Overview#
Seventy-two hours after a cryptocurrency exchange was notified that a customer's account had been compromised, the stolen funds were still sitting in a holding wallet. The moment those funds moved, an automated alert reached the exchange's compliance desk within four seconds. That alert triggered an asset freeze request that recovered over $400K. Real-time address monitoring is what made the difference between recovery and loss.
The Blockchain Address Monitoring system provides continuous, real-time surveillance of cryptocurrency addresses across 15+ blockchain networks. Financial institutions, law enforcement cryptocurrency teams, AML compliance units, and sanctions enforcement agencies use this capability to track illicit funds, enforce compliance requirements, and respond to emerging threats as they unfold. The platform automatically detects suspicious activity patterns and escalates alerts based on customisable risk thresholds, with real-time mempool monitoring to catch movements before on-chain confirmation.
Key Features#
- Multi-Chain Surveillance: Monitor unlimited addresses simultaneously across Bitcoin, Ethereum, Tron, and 12+ additional networks through a single platform
- Threshold-Based Alerting: Configure precise detection rules based on transaction value, frequency, velocity, and contextual risk factors to generate high-fidelity notifications
- Real-Time Mempool Monitoring: Detect transactions before blockchain confirmation, enabling response before funds are irreversibly settled
- Activity Pattern Detection: AI-powered behavioural analytics identify distinct suspicious patterns including mixing service usage, chain-hopping, rapid dispersion, layering schemes, and other evasion tactics
- Multi-Channel Notifications: Receive alerts through webhooks, email, Slack, PagerDuty, SMS, and in-app notifications with configurable routing rules
- Alert Escalation Framework: Automatic severity adjustment, time-based escalation, and notification routing ensure critical threats reach investigators promptly
- Continuous Infrastructure: High-availability architecture with redundant connectivity ensures uninterrupted monitoring with automatic failover
- Rich Address Management: Organise monitored addresses into watchlists, cases, or investigations with custom tagging, risk classification, and metadata
Supported Networks#
- Layer 1 Blockchains: Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Tron, Ripple, Cardano, Polkadot, Solana, Avalanche, Algorand, Cosmos, Stellar, Dogecoin, Zcash, Dash, Near, Fantom, Harmony, Celo, Tezos, and more
- Layer 2 Solutions: Polygon, Arbitrum, Optimism, Base, zkSync Era, Starknet, Immutable X, Loopring, Boba Network, Metis, Mantle, Linea
- EVM-Compatible Chains: BNB Chain, Cronos, Moonbeam, Moonriver, Gnosis Chain, Fuse, Kava, Aurora, Evmos, Oasis Emerald, Ronin, Palm
Investigation Use Cases#
Sanctions Enforcement#
- Monitor addresses associated with sanctioned entities for any transaction activity
- Receive immediate alerts when funds move to or from watchlist addresses
- Track attempts to circumvent sanctions through address rotation or chain-hopping
Ransomware Response#
- Configure monitoring on known ransom payment addresses to detect fund movements in real-time
- Alert when tracked funds reach identifiable exchange deposit addresses
- Detect mixing service interaction to trigger rapid response before funds become untraceable
Fraud Investigation#
- Monitor suspect addresses for rapid dispersion patterns indicating layering activity
- Track exchange deposit patterns to identify potential cash-out attempts
- Detect dormancy awakening when previously inactive addresses resume activity
Compliance Monitoring#
- Set cumulative daily thresholds aligned with regulatory reporting requirements
- Monitor customer addresses for interactions with high-risk entities
- Generate audit-ready documentation of all monitoring activity and alert dispositions
Asset Recovery#
- Track stolen funds in real-time across multiple blockchain networks
- Alert when monitored funds reach addresses associated with known exchanges
- Support asset freeze requests with immediate notification to exchange compliance teams
Alert Configuration#
The platform provides pre-configured templates for common monitoring scenarios:
- Ransomware Tracking: Large value movements combined with mixing service interaction
- Sanctions Enforcement: Any transaction to or from watchlist addresses
- Fraud Investigation: Rapid dispersion combined with exchange deposit patterns
- Compliance Monitoring: Cumulative daily thresholds aligned with reporting requirements
Alerts are prioritized by severity (P1 through P5) based on sanctions list interaction, transaction value, detected patterns, and historical behaviour context.
Open Standards#
- STIX 2.1 / TAXII 2.1 (OASIS): Threat indicators derived from monitored addresses and detected patterns can be exported as STIX 2.1 bundles and shared with partner organisations via TAXII 2.1 feeds, enabling interoperable intelligence exchange across security platforms.
- FATF Recommendation 16 (Travel Rule): The monitoring platform supports FATF Travel Rule compliance workflows, helping virtual asset service providers track and report the originator and beneficiary information required for cross-border cryptocurrency transfers above threshold values.
- ERC-20 / ERC-721 / ERC-1155 (Ethereum Improvement Proposals): Token transfer events on Ethereum and all EVM-compatible chains are decoded and monitored using these three Ethereum token standards, enabling precise tracking of fungible tokens, NFTs, and multi-token contracts across watchlisted addresses.
- OpenSanctions FollowTheMoney (FtM) data format: The platform ingests bulk sanctions data from OpenSanctions in the open FollowTheMoney newline-delimited JSON format, enabling real-time cross-referencing of blockchain addresses against 2.5 million-plus global designations including OFAC SDN, UN, and EU lists.
- Bank Secrecy Act (BSA) / AML-CTF regulatory frameworks: Monitoring thresholds, audit trail requirements, and alert disposition records are structured to satisfy BSA and broader anti-money laundering and counter-terrorist financing obligations, supporting examination-ready compliance documentation.
- RFC 3339 / ISO 8601 datetime format: All transaction timestamps, alert events, and forensic report metadata are serialised in ISO 8601 / RFC 3339 format, ensuring consistent interoperability across export formats and downstream analytical systems.
- TLS 1.3 (RFC 8446): All data in transit between monitoring nodes, API consumers, and notification delivery channels is protected using TLS 1.3, meeting current cryptographic transport security requirements.
Compliance#
- Supports Bank Secrecy Act (BSA) and AML/CTF compliance requirements
- OpenSanctions integration keeps watchlist data current with the latest global designations
- Supports FATF Travel Rule compliance workflows for cross-border cryptocurrency transfers
- Monitoring activity fully documented with audit trails for regulatory examination
- Alert dispositions and investigation outcomes tracked for compliance reporting
- STIX/TAXII export support for sharing threat indicators with partner organisations
- Data encryption at rest and in transit (TLS 1.3)
- Role-based access control with multi-factor authentication
- SOC 2 Type II certified infrastructure
- GDPR-compliant data handling
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14