Category: Virtual Assets and Technology

Blockchain Analytics

Also known as: Blockchain Analysis, On-Chain Analytics

Simply put

Blockchain analytics is the practice of examining data recorded on public distributed ledgers (blockchains) to trace transactions and understand the activity behind them. It is commonly used to investigate potential crime, support compliance efforts, and produce evidence about how digital assets have moved. Because most public blockchains record transactions transparently, this data can be examined, grouped, and mapped to reveal patterns.

Formal definition

Blockchain analytics refers to the process of examining, clustering, attributing, modeling, and visually mapping on-chain data from public distributed ledgers to trace activity across wallet addresses and transactions. In a compliance and investigative context, practitioners typically use heuristics and attribution techniques to cluster addresses likely controlled by a common entity, link on-chain flows to identified services (such as exchanges, mixers, or illicit actors), and reconstruct transaction paths. These techniques may support AML monitoring, sanctions and risk screening of crypto counterparties, investigations, and evidentiary work. It should be noted that attribution and clustering rely on probabilistic heuristics and third-party data, so results indicate risk or likely associations rather than conclusive proof of identity or wrongdoing, and the specific outputs and their evidentiary weight may vary by tool, methodology, and jurisdiction.

Why it matters

Public blockchains typically record transactions in a transparent and durable manner, which means the movement of virtual assets can be examined long after it occurs. Blockchain analytics turns this raw ledger data into something usable for compliance and investigative purposes, allowing obliged entities and authorities to trace on-chain activity, understand the services and counterparties involved, and assess the risk associated with a given address or flow. For virtual asset service providers and financial institutions with crypto exposure, these techniques can support AML transaction monitoring, sanctions and risk screening of crypto counterparties, and the reconstruction of transaction paths in an investigation.

At the same time, the outputs of blockchain analytics should be understood as indicators of risk or likely association rather than conclusive proof. Attribution and clustering rely on probabilistic heuristics and third-party data, so a link between an address and a named service or actor is an assessment, not an established fact of identity or wrongdoing. A cluster attribution or a flagged flow may inform a risk decision or an investigation, but on its own it does not establish that a crime has been committed, and its evidentiary weight may vary by tool, methodology, and jurisdiction.

Because specific outputs differ across providers and analytical approaches, practitioners generally treat blockchain analytics as one input among several within a risk-based program rather than a standalone control. Used carefully, it can help detect, deter, and investigate suspicious activity involving virtual assets; used uncritically, it risks overstating certainty. Firms should confirm how a particular tool's methodology and confidence levels map to their own risk appetite and to the requirements of the applicable regime.

Who it's relevant to

Crypto businesses and virtual asset service providers

Exchanges and other crypto businesses may use blockchain analytics to screen and risk-assess counterparties, monitor on-chain activity for suspicious patterns, and support their AML obligations. Given that attribution relies on probabilistic methods, results are generally treated as risk indicators feeding into broader compliance decisions rather than definitive determinations.

Financial institutions with crypto exposure

Banks and other financial institutions engaging with virtual assets may draw on blockchain analytics to understand the risk associated with crypto counterparties and flows. This can inform monitoring and risk decisions, though the outputs should be considered alongside other information within a risk-based framework.

Government agencies and investigators

Government agencies and investigators may use blockchain analytics to trace on-chain activity, investigate potential crime, and produce evidence about how digital assets have moved. The evidentiary weight of such analysis can vary by methodology and jurisdiction, and a clustering or attribution result does not by itself establish wrongdoing.

Compliance and financial intelligence analysts

Analysts responsible for transaction monitoring and investigations may rely on blockchain analytics to reconstruct transaction paths and identify likely associations between addresses and services. They should interpret heuristic outputs as indicators of risk to be corroborated, not as conclusive proof of identity or criminal conduct.

Inside Blockchain Analytics

Address Clustering

The analytical technique of grouping multiple blockchain addresses believed to be controlled by the same entity, typically using heuristics such as common-input-ownership. Results are probabilistic attributions rather than definitive proof of control, and confidence levels vary by chain and methodology.

Entity Attribution and Tagging

The process of associating clustered addresses with real-world entities such as exchanges, mixers, darknet markets, or sanctioned parties. Attribution generally relies on a combination of open-source intelligence, exchange data, and proprietary datasets, and its accuracy depends on the quality and currency of underlying labels.

Transaction Tracing

Following the movement of funds across the ledger to establish flow of value between addresses or entities. On transparent ledgers this is generally feasible, but tracing may be substantially degraded by mixers, privacy coins, cross-chain bridges, and coinjoin techniques.

Risk Scoring

The assignment of risk indicators to addresses or transactions based on exposure to categories such as illicit-associated services or high-risk jurisdictions. Scores are risk-management signals intended to inform review, not determinations of criminal conduct.

Source and Destination of Funds Analysis

Assessment of where value originated and where it is directed, supporting customer due diligence and investigation. This can help detect and mitigate exposure to illicit activity but does not by itself establish the lawful or unlawful nature of funds.

Sanctions and Watchlist Exposure Checks

Screening of blockchain addresses against lists of designated addresses or entities, for example those published by authorities such as OFAC in the US. This is distinct from customer sanctions screening of names and identifiers, and a match should be investigated rather than treated as conclusive.

Common questions

Answers to the questions practitioners most commonly ask about Blockchain Analytics.

Does a blockchain analytics match or high-risk score prove that a customer is engaged in money laundering?

No. A match, attribution, or elevated risk score generated by blockchain analytics is an investigative and risk-management signal, not proof of wrongdoing. These tools rely on heuristics, clustering assumptions, and third-party attribution data that carry uncertainty and can produce false positives. In a compliance context, such outputs typically inform whether further review, enhanced due diligence, or a suspicious activity or transaction report may be warranted; they do not establish criminal liability, which is a separate matter for legal authorities to determine under the applicable criminal-law standard.

Is blockchain always anonymous and therefore beyond the reach of analytics tools?

Not in the way the term 'anonymous' is often used. Many widely used blockchains are pseudonymous rather than anonymous, meaning transactions are recorded on a public ledger against addresses rather than named identities. Blockchain analytics seeks to link addresses to clusters and, where possible, to real-world entities using attribution data. However, this is not absolute: privacy-enhancing technologies, mixers, certain privacy-focused assets, and off-chain activity can limit or defeat attribution. Analytics should therefore be treated as a tool to detect and manage risk, not as a guarantee of full transparency.

How does blockchain analytics fit into an obliged entity's broader AML program?

It generally functions as one component supporting customer due diligence, transaction monitoring, and investigation of virtual asset activity, rather than as a standalone control. Where a firm qualifies as an obliged entity dealing in virtual assets, blockchain analytics outputs may feed into risk scoring, alert generation, and the assessment of whether to escalate or file a suspicious activity or transaction report. Its scope is typically limited to on-chain data and available attribution; it does not replace identity verification, sanctions screening, or documentary due diligence, and its role and reliance should be documented within the program's risk-based framework.

What are the practical limitations that should be documented when relying on blockchain analytics outputs?

Firms generally document that attribution and clustering rely on heuristics and third-party data that may be incomplete, outdated, or incorrect, and that different vendors can produce different results for the same address or transaction. It is also common to note coverage gaps across blockchains and assets, the impact of privacy-enhancing technologies, and the distinction between direct and indirect exposure to a flagged entity. Recording these limitations supports a defensible risk-based approach and helps analysts avoid over-relying on a single tool or treating its output as conclusive.

How should analysts handle differences in results between multiple blockchain analytics vendors?

Because vendors use differing heuristics and attribution datasets, discrepancies are common and do not by themselves indicate an error. Analysts typically treat divergent results as prompts for further review rather than as a definitive answer, considering factors such as the basis for each attribution, the directness of exposure, and corroborating information from other program elements. Firms may set internal procedures for reconciling or escalating conflicting outputs, and generally document the rationale for the conclusion reached to support a consistent, risk-based methodology.

Can blockchain analytics support sanctions screening of virtual asset activity?

It can contribute to identifying exposure to addresses or entities associated with sanctions concerns, but it should be understood as distinct from, and complementary to, name-based sanctions screening of customers. Attribution of an address to a sanctioned entity depends on available data and may lag real-world designations, so a non-match does not confirm the absence of exposure and a match should be validated before action. Firms subject to sanctions obligations should confirm how such tools are used against the requirements of the relevant sanctions authority, as scope and expectations vary by jurisdiction.

Common misconceptions

Blockchain analytics can definitively identify the individual behind any given address.

Attribution is generally probabilistic and depends on clustering heuristics and third-party labels. Analytics may link an address to a service or entity with varying confidence, but establishing the identity of a natural person typically requires additional off-chain evidence, such as information obtained from a regulated exchange.

A high risk score or an analytics alert proves that a transaction involves money laundering or other criminal activity.

Risk scores and alerts are risk-management signals designed to detect, deter, and prioritize review. They do not establish wrongdoing. As with a SAR or STR filing, an alert or match reflects suspicion or exposure warranting investigation, not a legal finding of criminality.

All blockchain transactions are fully traceable, so analytics gives complete visibility.

Tracing effectiveness varies by ledger and technique. Privacy coins, mixing services, coinjoin, and cross-chain bridges can significantly obscure flows, meaning analytics may provide partial visibility and should be treated as one input among several rather than a guarantee of coverage.

Best practices

Treat clustering and attribution outputs as probabilistic inputs, recording the confidence level and methodology relied upon, and corroborate with off-chain evidence before drawing conclusions about identity or control.

Use risk scores and alerts to prioritize and inform investigation and, where warranted, suspicious activity or transaction reporting, rather than as standalone determinations of criminal conduct.

Keep entity labels, sanctioned-address data, and watchlists current, and confirm sanctions exposure findings against the applicable authority's published designations before acting.

Document tracing limitations for each case, noting the presence of mixers, privacy coins, or cross-chain bridges that may reduce visibility, so that analytical conclusions reflect the actual degree of certainty.

Integrate blockchain analytics into a broader risk-based AML program alongside customer due diligence and other controls, recognizing that no single tool eliminates financial crime risk.

Verify that thresholds, sanctions obligations, and reporting requirements are applied consistently with the specific regime governing the obliged entity, since requirements diverge across jurisdictions.