Blockchain Analytics

Public ledgers show every transfer between wallet addresses, but not who owns them. Analytics firms map the ledger. Wallet clustering groups addresses likely controlled by the same party, for example because they are spent together. Known addresses of exchanges, mixers, darknet markets and sanctioned parties are labelled from investigations and public sources. Tools then trace funds hop by hop and give each wallet or transaction a risk score. Compliance teams at exchanges use them to screen deposits and withdrawals. Investigators use crypto forensics to follow stolen or criminal funds to a service that can be asked for identity records. Limits include privacy coins, mixing, cross-chain hops and wrong attribution. Results are leads, not proof of identity. Exchanges use the output as a lead to decide whether to accept, hold or report a transfer.

A crypto exchange receives a deposit of 500 units from a new customer. Its analytics tool shows that the coins passed, two hops earlier, through wallets that cluster to a known ransomware group. The platform holds the funds, freezes the account, files a suspicious activity report and passes the trace to law enforcement.