On-chain analysis is the examination of blockchain transactions, wallet addresses, token flows, and smart-contract interactions to trace where digital assets moved and how they were handled. Because blockchains are often public and immutable, investigators can map transfers, cluster related addresses, and spot patterns that suggest theft, laundering, reward diversion, or misuse of privileged keys.
In cyber security, on-chain analysis helps confirm whether an incident involved real asset movement, estimate exposure, and identify follow-on destinations for stolen funds. Defenders use it to support incident response, compliance, and attribution efforts, while attackers try to defeat it by splitting transfers, using fresh wallets, bridges, or mixers. In staking and DeFi incidents, it can reveal unusual reward withdrawals, unauthorized validator activity, or other traces that point to a compromise even when the intrusion path is still unknown.