Blockchain Address Clustering

Overview#

A financial intelligence unit investigating a darknet fentanyl marketplace started with one known vendor wallet. Within forty seconds, the clustering engine had identified 312 additional addresses under the same operator's control, including three exchange deposit accounts and a consolidation wallet holding the equivalent of $1.8M. That kind of entity expansion, from a single seed to a complete financial picture, is what address clustering is for.

The Blockchain Address Clustering module uses advanced heuristic algorithms and machine learning to group cryptocurrency addresses into entities, revealing the real-world identities and relationships behind blockchain transactions. Processing hundreds of millions of addresses across multiple networks, it delivers real-time entity resolution in seconds rather than the weeks of manual analysis that preceded modern automated approaches.

Mermaid diagram
flowchart TD
    A[Seed Address] --> B{Clustering Heuristics}
    B --> C[Common Input Ownership]
    B --> D[Change Address Detection]
    B --> E[Co-spending Analysis]
    B --> F[Behavioral Correlation]
    C --> G[Entity Cluster]
    D --> G
    E --> G
    F --> G
    G --> H[Confidence Scoring]
    H --> I{Attribution}
    I -->|Exchange| J[Exchange Entity]
    I -->|Illicit| K[Threat Actor Entity]
    I -->|Service| L[Service Entity]
    style A fill:#4a90d9
    style K fill:#ff6b6b
    style J fill:#50c878

Key Features#

Multi-Heuristic Clustering: Implements seven proven clustering heuristics including common input ownership, change address detection, and co-spending analysis for high-accuracy entity resolution
Real-Time Entity Resolution: Delivers instant clustering results, maintaining current entity profiles as new transactions are confirmed on-chain
Cross-Chain Entity Detection: Identifies entities operating across multiple blockchain networks through behavioral correlation and address linking
Advanced Graph Algorithms: Processes wallet networks with millions of connected addresses, identifying entity boundaries through community detection and structural analysis
Change Address Detection: Proprietary algorithms identify change outputs with high precision, critical for UTXO-based blockchain analysis
Confidence-Scored Results: Every cluster relationship includes a confidence score enabling risk-based decision-making
Cluster Evolution Tracking: Monitors how entity clusters grow, merge, and split over time, maintaining historical context for investigations

Supported Networks#

UTXO Chains: Bitcoin, Bitcoin Cash, Litecoin, Dogecoin, Zcash, Dash
EVM-Compatible Chains: Ethereum, Polygon, BNB Chain, Arbitrum, Optimism, Base, Avalanche, Fantom, Cronos, Moonbeam, and more
Alternative Networks: Solana, Cardano, Tron, Ripple, Polkadot, Cosmos, Near, Algorand, Tezos
Layer 2 Solutions: Arbitrum, Optimism, Base, zkSync Era, Polygon zkEVM, Starknet, Linea

Investigation Use Cases#

Law Enforcement Investigations#

Rapidly expand from a single known address to the full set of addresses controlled by a suspect entity
Map criminal organization financial infrastructure by clustering payment, operational, and cash-out wallets
Generate court-admissible evidence packages showing entity-level fund flows rather than individual transactions

Ransomware Attribution#

Cluster ransomware payment wallets to identify operator infrastructure
Connect apparently unrelated ransom payments to the same criminal organization
Track proceeds from multiple victims through consolidation and cash-out patterns

Exchange Compliance#

Identify when multiple customer accounts are controlled by the same entity
Detect structuring attempts using multiple addresses to circumvent reporting thresholds
Enhance Know Your Customer (KYC) processes through entity-level risk assessment

Darknet Market Analysis#

Group vendor wallets to estimate total illicit revenue per marketplace seller
Map marketplace operational wallets including escrow, hot wallets, and administrator funds
Track entity activity across marketplace shutdowns and migrations

Sanctions Enforcement#

Expand sanctioned address lists by identifying additional wallets controlled by designated entities
Detect sanctions evasion through address rotation and entity restructuring
Quantify total asset exposure to sanctioned entities across clustered wallet networks

Compliance#

Clustering intelligence supports AML/CTF program requirements for virtual asset service providers
Entity-level risk assessment aligns with FATF Recommendation 16 (Travel Rule) obligations
OpenSanctions integration ensures sanctioned entity clusters stay current with the latest designations
Audit trail documentation for all clustering decisions and confidence scores
Results suitable for regulatory reporting and Suspicious Activity Report (SAR) preparation
Supports Bank Secrecy Act and FATF Travel Rule compliance workflows
Data handling compliant with GDPR requirements for public blockchain data analysis

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14

Module metadata