How to Investigate Web3 Identities: ENS, Lens, and Farcaster

As the Web3 ecosystem matures, the traditional methods of investigating digital identities are evolving. Instead of relying solely on email addresses, phone numbers, or Web2 social media handles, investigators must now navigate a complex web of decentralized identifiers.

The Shift to Decentralized Identity

Decentralized identity systems provide users with sovereignty over their digital presence. While this enhances privacy, it also creates an interconnected, public graph of activity that can be analyzed. The key is understanding how these protocols interconnect.

Ethereum Name Service (ENS)

ENS is the foundation of many Web3 identities. By mapping complex Ethereum addresses to human-readable names (e.g., alice.eth), it becomes a primary pivot point in any investigation.

• •Text Records: ENS allows users to attach text records, including Twitter handles, GitHub accounts, and email addresses.
• •Reverse Resolution: Finding the primary ENS name set for an address can reveal the user's preferred identity.
• •Historical Ownership: Since ENS registrations are NFTs, tracing past ownership can uncover previous pseudonyms.

Lens Protocol and Farcaster

Decentralized social graphs like Lens and Farcaster are rich sources of intelligence. Unlike Twitter or Facebook, the entire social graph—follows, posts, and interactions—is verifiable on-chain or via decentralized storage.

Farcaster, in particular, associates Farcaster IDs (FIDs) with custody addresses and connected addresses, providing a direct link between social activity and financial history.

Connecting On-Chain to Off-Chain

The ultimate goal is often de-anonymization. This requires bridging the gap between the Web3 identifier and Web2 presence.

1. 1Extract all linked metadata from ENS and social profiles.
2. 2Cross-reference standard OSINT sources with extracted handles.
3. 3Analyze transaction timing to infer time zones and behavioral patterns.
4. 4Look for slip-ups: NFT purchases shipped to physical addresses or POAP claims at real-world events.

Tools for Web3 Investigations

Block explorers are essential, but specialized tools make the process efficient. Etherscan is a starting point, but exploring the social layer requires purpose-built indexers.

Graph visualization tools can help map interactions across these disparate protocols, highlighting clusters of activity that might otherwise go unnoticed.