A blockchain shows movement. It rarely prints intent.
Why it matters
Large-transfer alerts become useful only when evidence grade and alternative explanations travel with the number.
KNOWN
Use KNOWN only when an entity has publicly verified an address, a court or regulator has established control, or a transaction is tied to a documented event. Keep the date and scope attached.
PROBABLE
Use PROBABLE for multiple independent signals such as repeated deposit patterns, clustering and confirmed counterparties. Explain the inference and recognize that service wallets aggregate many users.
POSSIBLE
A familiar transaction size, timing coincidence or one analyst label is POSSIBLE at best. Labels propagate between databases and can create false certainty.
UNKNOWN—and honest
Unknown is a result, not a failure. Report asset, amount, time, confirmed endpoints and plausible non-exclusive explanations; then wait for stronger evidence before assigning motive.