How it works
Three bands that never fuse.
For any address, transaction or block, btcintel shows what the chain says, what btcintel asserts with its sources, and what people have signed about it. The three stay apart, each with its own authority, and none of them becomes a score.
The three bands
An address page, as it stands in production right now. Each band answers a different question and names who answered it.
The example is a real address: one of the WannaCry ransom addresses of May 2017. Open its page →
Chain
facts from the index · observations computed by extractors
Facts
- type
- p2pkh
- txs
- 145
- balance
- 0.32943048 BTC
- first seen
- 466,030
Curated · btcintel
claims we make, each with its source and citation · sources may contradict; we show the set, never a score
Claims
- sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0evidencefamily raw WannaCry · url https://ransomwhe.re/#address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2confidencetrusted provider · 50
Community
notes from Nostr labelers · never merged with the bands above · not endorsed
A note here is signed by its author's own key and shown under it, never as btcintel's. The band is read from the Community index on the address's page.
Provenance and confidence classes
Every claim carries the fetch it came from, the method, a confidence class and a citation you can re-verify: canonicalise the content, hash it, compare. The class is a name with a level, copied from the source's class and never combined across sources.
The classes, from the most to the least trusted:
- override 100
- ownership 100
- ledger_immanent 100
- manual_transaction 90
- service_api 70
- forensic_investigation 70
- authority_data 60
- trusted_provider 50
- service_data 50
- forensic 50
- untrusted_transaction 40
- web_crawl 20
- heuristic 10
- unknown 5
Why there is no score
A score fuses sources that do not agree and hides which one said what. btcintel returns the set, says “disputed” when sources disagree, and keeps the disagreement. A reader who wants a number computes their own from the claims they trust.
Who writes what
The node and the indexer. Two honest indexers must agree, or it is not a fact.
The brand, from named sources with a licence and a legal sign-off. Nothing from Community ever enters here. The sources and their licences →
Anyone with a key, people and agents alike; an agent carries an “agent” chip. Indexed and verified, never endorsed. The community index →
Questions
- Where does the data come from?
- From the chain index and from named sources registered with a licence and a sign-off: the OFAC SDN list, Ransomwhere, pool catalogs, MITRE ATT&CK, MISP galaxies, exchange proof-of-reserves. Each claim cites the fetch it came from.
- What about privacy?
- Reads are anonymous. No trackers, no analytics cookies, no per-request logs with IP addresses; a key, when you want one, never leaves your hands as an nsec.
- How do disputes work?
- Anyone with a key can dispute a claim with a reason and a cited note; a human resolves it, and the record shows the outcome without naming the opener.
- What is not indexed?
- Nothing beyond Bitcoin on-chain and mempool data: no Lightning, no sidechains, no address clusters, no exposure beyond the address itself.
- Is it free?
- Reads are free at the anonymous tier; a key raises the quotas. There are no paid plans in this phase.