Blockchain Analytics

Blockchain analytics is the discipline, and the category of software, that follows the movement of value across a public blockchain and attributes the addresses involved to real-world entities and risk categories such as exchanges, payment processors, mixing services, darknet markets, ransomware operators and sanctioned parties. Because every transaction on a public blockchain is visible to anyone, the raw data is open; the value of an analytics tool lies in the labels and heuristics it adds on top of that data.

Crypto businesses use blockchain analytics to screen the wallets their customers send to and receive from, to monitor flows for suspicious patterns, and to investigate alerts. Law enforcement agencies, regulators, auditors and banks that serve crypto firms use the same tools to trace stolen or illicit funds.

An analytics provider runs its own nodes or indexers to read the full history of each supported chain. It then groups addresses into clusters believed to belong to the same owner. On Bitcoin-style ledgers the best-known technique is the common-input-ownership heuristic: when several addresses are spent together as inputs to one transaction, they are usually controlled by one wallet. Other heuristics identify change addresses, deposit addresses at exchanges and the behavior of smart contracts on account-based chains such as Ethereum.

Clusters are then labeled. Labels come from test transactions made by the provider, public disclosures, court records, seized data, open-source research and government designations, including the digital currency addresses that OFAC has added to the SDN List since 2018. Each label carries a risk category, so a transaction can be scored by how much of its value came, directly or through intermediate hops, from high-risk sources.

For a virtual asset service provider, blockchain analytics sits inside the wider AML program and serves several functions:

• Deposit and withdrawal screening — checking the counterparty address before crediting incoming funds or releasing a withdrawal, especially to an unhosted wallet.
• Ongoing transaction monitoring — generating alerts when exposure to mixers, gambling sites, fraud shops or sanctioned clusters exceeds a set threshold.
• Investigations — following funds across many hops to support a suspicious activity report or a law enforcement request.
• Travel Rule support — identifying whether a counterparty address belongs to another hosted wallet provider, which determines how Travel Rule data should be exchanged.

Regulators generally expect firms to calibrate these alerts under a risk-based approach rather than block every address with indirect exposure. Guidance from the FATF on virtual assets treats on-chain monitoring as one tool among several, alongside customer due diligence.

A customer of a centralized exchange deposits 2 BTC. The analytics tool reports that 0.3 BTC of the deposit can be traced, within three hops, to an address cluster labeled as a crypto mixer, and the remaining 1.7 BTC to a regulated exchange. Indirect mixer exposure of 15% may breach the exchange's internal threshold, so the deposit is held while an analyst reviews the customer's history, asks about the source of funds and decides whether to release the funds, exit the relationship or file a report.

Attribution is probabilistic. Heuristics can merge unrelated users into one cluster or miss links, and labels may be out of date, so analytics output is intelligence rather than proof. Privacy techniques reduce visibility: CoinJoin transactions break the common-input heuristic, privacy coins such as Monero hide amounts and parties by design, and chain hopping across bridges and swap services fragments the trail. Coverage of newer chains and tokens often lags behind coverage of Bitcoin and Ethereum.

Critics also raise privacy concerns, since the same tools that trace ransomware proceeds can profile ordinary users, and point out that heavy reliance on a few commercial vendors concentrates judgment about what counts as tainted funds. Overly strict thresholds can lead exchanges to freeze funds of customers several steps removed from any wrongdoing.

The market is led by specialist firms, among them Chainalysis, Elliptic and TRM Labs, which sell screening APIs, investigation software and data to exchanges, stablecoin issuers, banks and government agencies. Issuers of stablecoins such as Tether (USDT) also rely on on-chain intelligence when deciding to freeze addresses linked to crime. Larger exchanges increasingly combine vendor data with their own in-house clustering.