On-chain

What is on-chain?

On-chain means that a transaction or piece of data is processed directly on the blockchain and remains permanently visible there. Anyone can look up the transaction through a blockchain explorer using the address or the transaction hash. This contrasts with off-chain arrangements, which run outside the blockchain and are therefore harder to verify.

Why does on-chain matter in a crypto investigation?

Because on-chain data cannot be manipulated, it provides a reliable basis for reconstructing a money flow. An investigator can cluster addresses, reconstruct a chain and demonstrate where the assets came from or went to. Off-chain materials such as emails or screenshots are supporting evidence but carry less weight than the on-chain trail.

Is on-chain the same as public?

The transactions are public, the identities are not. You see addresses, amounts and moments, but no names. Linking an address to a person requires information from outside the chain.

What does off-chain mean?

A step that is not recorded in the ledger, for example an internal transfer within a platform. Such steps are known only to that platform and cannot be verified publicly.

Can an on-chain transaction be deleted?

No. A confirmed transaction remains in place. One consequence is that old payments can still be examined years later, which regularly makes the difference in an investigation.

Where the boundary of the public record sits

The distinction that matters is not technical but evidential. Whatever is recorded on the network can be verified by anyone, at any time, without permission: the amounts, the order, the addresses involved and the moment of confirmation. Everything else that happened around it sits outside that record. The conversation that led to a transfer, the agreement about what it was for, the deposit at a platform and the payout to a bank account are all real events with no trace on the network at all.

That boundary decides how a file has to be built. What is on the network can be stated flatly, with a reference, and left to be checked. What is off it has to come from somewhere else: a provider through a formal route, a bank statement, a message thread, or a statement from the person involved. A report that blurs the two reads as if everything is equally solid, and the first reader who tests a line will find out otherwise. We therefore mark each finding with where it comes from, and we treat the absence of a network trace as an ordinary fact rather than as something suspicious.

It also sets a limit on what anyone can promise you. A route can be described in full and still stop at an address that belongs to nobody in particular, because the step from address to person happens off the network, in records held by a provider. Anyone who claims otherwise is selling certainty that the public record does not contain.