Clustering Path for Court-Admissible Data
What is court-admissible data?
Court-admissible data is information a court allows to be used as evidence. In a case involving cryptocurrency, investigators must establish the foundation required by that court for the transaction records and the analysis they present.
Address clustering adds a specific question: why are these addresses grouped together? A cluster identifier gives the result. To examine it, an investigator needs the links between addresses, the reason for each link, and the records supporting it.
How does Prism explain a clustering link?
Caudena’s investigation platform, Prism, features Clustering Path, which shows the links connecting two addresses in a cluster, the reason for each step, and transaction references for co-spend and change links.
Bitcoin paths can also include public-key reuse and identity-based connections. A label identifies the basis of a link. It is not a substitute for the transaction, classification rationale, or attribution source needed to examine that link.
A Clustering Path from Prism
For each co-spend link, an examiner can retrieve the complete transaction hash from the supporting record and confirm that both addresses supplied inputs. Common control is the inference drawn from that fact, subject to the heuristic’s limitations.
Link 3 requires a different check: the records supporting the Stake attribution. Repeating the label in the path does not independently confirm it. This identifies the point where review must turn from transaction data to attribution evidence.
An illustrative change link
T1 lets the examiner check the co-spend. T2 allows the examiner to inspect the outputs, but the transaction alone does not establish which output is changed. The analyst must explain the features and assumptions behind selecting C.
The distinction matters when reviewing a path with several links. If one change classification is uncertain, the examiner can assess its effect on the connection between the endpoints. Other co-spend links may remain valid even when that particular connection needs further support.
A clustering path explains why addresses are connected. It does not need to represent a chronological movement of funds between them. Prism’s investigation tools let investigators examine the addresses and transactions behind the explanation and retain complete identifiers in their case records.
When can blockchain analysis be used as evidence?
Presenting blockchain analysis may require authenticating transaction records, explaining an expert’s method, and showing how that method was applied to the transactions at issue.
In U.S. federal proceedings, Rule 901 addresses whether an item is what its proponent claims it is. Rule 702 governs testimony by a qualified expert. The party offering that testimony must show that the rule’s requirements are more likely than not satisfied. The testimony must help the fact-finder, rest on sufficient facts or data, use reliable principles and methods, and reflect a reliable application to the case. Hearsay and other rules may also apply. Federal Rules of Evidence, Rules 702, 801–807 and 901.
For an investigator, this means keeping three statements distinct:
- Observation: addresses A and B supplied inputs to a particular Bitcoin transaction.
- Inference: their participation supports a common-control assessment under the common-input heuristic, subject to its limitations.
- Attribution: separate evidence connects that activity to a named person or organization.
Each statement needs its own support. The transaction establishes the joint spend. The heuristic supports a control inference. Exchange records, seized devices, or additional evidence may establish an identity. Our guide to defensible blockchain investigation evidence covers how to document those steps.
Admissibility determines whether evidence may be considered. Its weight concerns how persuasive it is. Admissibility does not make every inference conclusive.
What did United States v. Sterlingov establish?
In United States v. Sterlingov, the district court admitted Reactor-based expert evidence after a Daubert challenge. The D.C. Circuit upheld that decision on appeal.
On 29 February 2024, the U.S. District Court for the District of Columbia rejected the challenge to the government experts’ reliance on Chainalysis Reactor. It considered corroboration through manual analysis, other software, undercover transactions, and records obtained through legal process. Its reliability finding concerned the software as used and corroborated in that case. The defense remained able to challenge the analysis before the jury. District court memorandum opinion.
On 25 September 2026, the D.C. Circuit affirmed and held that the district court had not abused its discretion in admitting Luke Scholl’s and Elizabeth Bisbee’s testimony. The opinion discusses explanations of Reactor’s methods, comparisons with records obtained through legal process, and checks against addresses used in undercover transactions. The absence of a known software error rate or peer review at the relevant hearings did not, by itself, require exclusion. D.C. Circuit opinion, pages 19–23.
The Sterlingov Daubert ruling supports the use of analysis whose methods and results can be explained and corroborated. It does not approve every analytics provider or establish that every cluster assignment is correct.
What are European courts examining?
Dutch courts have recently accepted clustering evidence and asked for further examination of an analyst’s methods. These decisions apply Dutch procedure, not a Europe-wide admissibility standard.
On 25 February 2026, the Rotterdam District Court rejected a reliability objection to Chainalysis analysis in a HeinekenExpress-related prosecution. The court referred to acceptance of the clustering heuristic in money-laundering cases and found that the defense had supplied no concrete basis for a different conclusion in that case. ECLI:NL:RBROT:2026:2050, section 3.3.2.
In separate proceedings at The Hague, the investigating appellate judge asked which tools and heuristics had been used, how custom clusters were assembled, and why particular outputs were classified as changes. A case from 10 February 2026 also asked the analyst to explain the basis for his probability assessments. ECLI:NL:GHDHA:2026:321.
On 29 April 2026, the judge ordered expert examination. The decision records that the analyst had applied the change heuristics himself. Reactor had not made those classifications. The judge deferred a decision on the defense’s request for all underlying data used by the investigators. In ordering expert examination, the judge considered the potentially incriminating findings, the defense’s ability to examine them, and the lack of a sufficiently prescribed method and fixed procedure for this analysis. The order did not exclude the analysis. ECLI:NL:GHDHA:2026:1922.
The Hague proceedings concerned the application of change heuristics to particular transactions. Explaining the general idea of change detection would not answer why an analyst selected a specific output.
The decisions at a glance
| Court and date | Procedural stage | Decision | Limit |
|---|---|---|---|
| U.S. District Court, D.D.C. · 29 February 2024 | Expert-evidence challenge | Accepted the Reactor-based analysis | Specific use and corroborating record |
| D.C. Circuit · 25 September 2026 | Appeal | Upheld admission of expert testimony | Review for abuse of discretion |
| Rotterdam District Court · 25 February 2026 | Criminal judgment | Rejected the reliability objection | Grounds advanced in that case |
| The Hague Court of Appeal · 10 February and 29 April 2026 | Investigative appellate proceedings | Sought explanations; ordered expert examination | No final exclusion ruling in these decisions |
Caudena’s experience supporting the Brooklyn DA
Caudena supported the Brooklyn District Attorney’s investigation of Ronald Spektor.
The DA’s 23 September 2026 announcement reports that Spektor pleaded guilty to a 31-count indictment on 2 September and received a sentence of four to 12 years. The phishing and social-engineering scheme caused approximately $15.944 million in losses to about 100 Coinbase users. The announcement describes transaction records, blockchain analysis, digital forensics, IP evidence, and material recovered through search warrants. Brooklyn DA’s case announcement.
What should investigators document?
A clustering record should let another examiner reconstruct the links used to reach the same conclusion.
- The underlying records. Chain, complete addresses and transaction hashes, relevant inputs and outputs, block references, and collection details.
- The clustering explanation. Each material link, its reason, the supporting transaction where applicable, and the specific basis for a change classification.
- The analytical context. Tool and version, examination date, relevant settings or exclusions, and analyst-created links. Record changes that affect the conclusion.
- The attribution foundation. Identify which assertions depend on exchange records, seized devices, witness evidence, or other sources, and preserve those sources separately.
- The alternatives considered. Address collaborative transactions, shared custody, ambiguous change, or other explanations relevant to the observed pattern. Explain why an alternative was retained or rejected.
- The corroboration and limits. State what independently supports the inference and what remains unresolved. Keep records of corrections and their effect on the case theory.
Frequently asked questions
Is blockchain data automatically admissible in court?
No. A public transaction record must still meet the proceeding’s evidentiary requirements. Its authenticity, relevance, and interpretation are separate questions.
Does address clustering prove ownership?
No. Clustering supports an assessment of common control. Evidence connecting the addresses to a named person is a separate part of the attribution case.
Did Sterlingov approve every blockchain analytics tool?
No. The decisions assessed Reactor-based evidence and expert testimony on the record before those courts. Other methods and applications require their own foundation.
What does a clustering path demonstrate?
A clustering path shows the links used to connect addresses and the reason for each link. It directs an examiner to the transactions, classifications, and attribution records that need checking.
To examine how this works in practice, request a Prism demonstration focused on Clustering Path and its supporting transactions.
Methodology
Sources reviewed on 18 October 2026: the linked court decisions and rules, the Brooklyn DA’s announcement.
