Overview#
When investigators traced $2.3M in ransomware proceeds through a suspected cash-out network, a single address query revealed 847 connected wallets, three exchange deposit clusters, and a behavioural fingerprint matching a previously identified threat actor. That kind of depth, delivered in seconds, is what the Blockchain Address Analytics module is built for.
The module provides deep financial intelligence through comprehensive profiling of cryptocurrency wallet addresses across 15+ blockchain networks including Ethereum, Bitcoin, BNB Chain, Polygon, Solana, and Tron. Compliance teams, law enforcement cryptocurrency units, AML analysts, and exchange compliance officers use it to accelerate case development from days of manual analysis to minutes of structured investigation.
Key Features#
- Deep Address Profiling: Comprehensive profiling across Bitcoin, Ethereum, Tron, BNB Chain, and additional networks covering billions of indexed addresses
- Behavioural Fingerprinting: AI-powered analysis identifies high-risk addresses through behavioural patterns, transaction timing, and counterparty associations
- Counterparty Mapping: Analyses thousands of connected addresses per target in a single query, revealing hidden financial relationships
- Entity Attribution: Automated clustering links addresses to known entities with high confidence rates
- Multi-Dimensional Risk Scoring: Evaluates address exposure across numerous risk dimensions including ransomware interaction, darknet marketplace involvement, mixer usage, sanctioned entity connections, and exchange fraud indicators
- Temporal Analysis: Identifies transaction patterns, activity windows, and dormancy periods that reveal operational behaviour
Supported Networks#
- Layer 1 Blockchains: Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Tron, Ripple, Cardano, Polkadot, Solana, Avalanche, Algorand, Cosmos, Stellar, Dogecoin, Zcash, Dash, Near, Fantom, Harmony, Celo, Tezos, and more
- Layer 2 Solutions: Polygon, Arbitrum, Optimism, Base, zkSync Era, Starknet, Immutable X, Loopring, Boba Network, Metis, Mantle, Linea
- EVM-Compatible Chains: BNB Chain, Cronos, Moonbeam, Moonriver, Gnosis Chain, Kava, Aurora, Evmos, Ronin, and more
- Non-EVM Networks: Solana, Tron, Sui, Aptos, Near, TON, Cardano
Investigation Use Cases#
Financial Crime Investigation#
- Profile suspect wallet addresses to understand transaction volume, counterparty networks, and behavioural patterns
- Identify connections to known illicit entities through counterparty relationship mapping
- Detect structuring, layering, and other money laundering indicators through temporal analysis
Ransomware and Cyber Threat Analysis#
- Analyse ransom payment addresses to identify cash-out patterns and intermediary wallets
- Track address reuse across multiple ransomware campaigns
- Map the financial infrastructure of threat actor organisations
Fraud and Scam Detection#
- Identify rug pull risk factors through address behaviour profiling
- Detect pump-and-dump coordination through counterparty analysis
- Flag addresses exhibiting Ponzi scheme distribution patterns
Exchange Due Diligence#
- Risk-score customer deposit and withdrawal addresses during onboarding
- Continuously monitor address risk profiles for changes in activity or counterparty exposure
- Generate address intelligence reports for compliance documentation
Asset Recovery#
- Trace stolen funds through address networks to identify recovery opportunities
- Map the full extent of illicit fund movements from initial theft to cash-out endpoints
- Identify exchange deposit addresses for asset freeze requests
Open Standards#
- OASIS STIX 2.1 / TAXII 2.1: Address intelligence, risk indicators, and threat actor attributions can be exported as STIX 2.1 bundles and shared or ingested via an async TAXII 2.1 polling and push client, enabling interoperability with threat intelligence platforms.
- FATF Recommendations (Virtual Assets / Travel Rule): Risk scoring and AML/CTF workflows are aligned with FATF guidance on virtual asset service providers, including Travel Rule considerations for counterparty identification and transaction-level due diligence.
- OFAC SDN List / OpenSanctions Open Data: Address sanctions screening is performed against the OFAC Specially Designated Nationals list and the OpenSanctions consolidated dataset, which aggregates UN, EU, and national designations in a standardised open format.
- Ethereum ERC-20, ERC-721, and ERC-1155: Token transfer analysis covers all three Ethereum token standards, allowing investigators to trace fungible tokens, NFTs, and multi-token contracts across counterparty networks.
- GraphQL (June 2018 specification): All address profiling queries, counterparty mapping, clustering, and forensic report mutations are exposed through a typed GraphQL API, enabling structured programmatic access for investigation tooling.
- ISO 8601: All transaction timestamps, activity windows, and report generation times are serialised in ISO 8601 date-time format, ensuring consistent temporal analysis across blockchain networks and jurisdictions.
- FIPS 180-4 (SHA-256): Forensic reports are sealed with a SHA-256 cryptographic integrity hash computed over the canonical JSON representation, providing verifiable chain-of-custody evidence suitable for court submission.
Compliance#
- Supports Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) investigations
- Risk scoring aligns with FATF guidance on virtual asset risk assessment
- Address intelligence suitable for Suspicious Activity Report (SAR) preparation
- Audit trail documentation for regulatory examination readiness
- STIX/TAXII support for sharing address intelligence across organisations
- Sanctions list screening integration with OpenSanctions and OFAC data
- Supports Bank Secrecy Act, AML/CTF, and FATF Travel Rule compliance
- GDPR-compliant analysis of public blockchain data
- SOC 2 Type II certified infrastructure
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14