Operator-level Ethereum validator attribution from a single withdrawal address. Two beacon-forensics reference cases: a Safe-linked operator cluster reaching 788 validators at 0.91 confidence, and a pooled-protocol pattern with 550 validators at 0.40 confidence. The key point is abstention when the evidence does not support a single-operator claim.