Begin with a precise question
“What happened to the account?” needs to become checkable facts: who initiated a transaction, which contract was called, the spender and allowance, and whether account permissions changed. This is an evidence-organizing method, not a verdict on a particular transaction.
Build a timeline of distinct actions
Record approvals, token transfers and account-permission updates separately. Note transaction IDs, block times, callers and public lookup sources. Different networks represent different facts; do not assume one network’s display applies to another.
Leave unknown relationships unresolved
An unfamiliar address, an ordinary permission change or a large allowance is not sufficient evidence of malicious intent. Compare the intended action with the actual transaction and record gaps. Do not turn relationships unsupported by public records into definite claims.
Sources and reading notes
This article is an editorial explanation of risks and ways to verify information. It does not make a factual finding about a particular wallet or person. Product behavior and rules may change; check the original documentation.