Overview#
After a DeFi protocol exploit drained $12M from a lending pool, investigators needed to know where the funds went. Within an hour, fund flow analysis had traced the path through five intermediate wallets, across two cross-chain bridges, through a mixing service, and into deposit accounts at three exchanges. Two of those exchanges froze funds the same day. Without automated multi-hop tracing, that result would have taken days, and the window for asset recovery would have closed.
The Blockchain Fund Flow Analysis system delivers sophisticated multi-directional transaction tracing across blockchain networks. It tracks value flows from origin to destination while identifying intermediary nodes, mixing services, and value preservation patterns that indicate money laundering or fund structuring. Investigators can run forward tracing (where did funds go?), backward tracing (where did funds come from?), and bidirectional analysis that maps complete fund flow networks. Financial crime units, law enforcement cryptocurrency teams, AML compliance analysts, and asset recovery specialists all depend on this capability for case development.
Key Features#
- Multi-Hop Depth Tracing: Follow fund flows across numerous intermediary addresses with configurable depth limits, enabling deep investigation into complex laundering chains
- Bidirectional Analysis: Trace both forward and backward from any address to understand the complete picture of fund origins and destinations
- Pattern Detection: Identifies mixing services, layering schemes, and value splitting with high precision through advanced algorithmic analysis
- Intermediary Detection: Automatically identifies hop addresses used solely for fund transit, distinguishing pass-through addresses from meaningful endpoints
- Value Conservation Tracking: Detects when funds maintain consistent value through transaction chains, indicating deliberate layering rather than genuine economic activity
- Flow Aggregation: Aggregates value flows across multiple paths, identifying convergence and divergence points that reveal structured money movement
- Cross-Chain Tracing: Follows fund flows across blockchain networks through bridge protocols, cross-chain swaps, and wrapped asset conversions
- Temporal Analysis: Tracks timing patterns in fund movements to identify automated behaviour, coordinated transfers, and time-delayed reconsolidation
Supported Networks#
- Major Blockchains: Bitcoin, Ethereum, Tron, BNB Chain, Solana, Cardano, Polkadot, Avalanche
- Layer 2 Solutions: Polygon, Arbitrum, Optimism, Base, zkSync Era, Starknet, Linea
- EVM-Compatible Chains: Cronos, Moonbeam, Fantom, Gnosis Chain, Aurora, Celo, and more
- UTXO Chains: Bitcoin, Bitcoin Cash, Litecoin, Dogecoin, Zcash, Dash
- Additional Networks: Ripple, Stellar, Algorand, Cosmos, Near, Tezos
Investigation Use Cases#
Money Laundering Detection#
- Trace funds through layering schemes involving dozens or hundreds of intermediary addresses
- Identify value splitting and reconsolidation patterns characteristic of structured laundering
- Detect rapid dispersion followed by time-delayed reconsolidation at alternative cash-out points
Ransomware Fund Tracing#
- Follow ransom payments from victim wallets through mixing services to eventual cash-out points
- Map the complete financial infrastructure of ransomware operations including operator, affiliate, and service provider wallets
- Identify exchange deposit addresses for asset freeze requests with supporting evidence
Fraud Investigation#
- Trace stolen funds from initial theft through complex distribution networks
- Identify the ultimate beneficiaries of fraud proceeds across multiple blockchain networks
- Quantify total fund losses and recovery opportunities for victim restitution
Terrorist Financing Analysis#
- Map funding routes from donors through intermediary wallets to operational accounts
- Identify financial facilitation networks supporting designated organisations
- Track cross-border fund movements through cryptocurrency channels
Asset Recovery#
- Locate stolen or diverted assets across multiple blockchain networks
- Generate evidence packages documenting fund flows for court-ordered asset freezes
- Identify exchange and custodial endpoints where recoverable funds reside
Sanctions Evasion Detection#
- Trace fund flows to identify indirect connections to sanctioned entities
- Detect chain-hopping and cross-chain bridge usage designed to evade surveillance
- Map shell address networks used to obscure sanctioned entity involvement
Open Standards#
- FATF Recommendation 16 (Travel Rule): Fund flow tracing and VASP-to-VASP transaction monitoring aligns with FATF's Travel Rule requirements for virtual asset transfers, supporting originator and beneficiary identification across hops.
- FATF Guidance on Virtual Assets and Virtual Asset Service Providers: Risk assessment methodology, layering detection, and transaction monitoring procedures follow FATF's risk-based approach to virtual asset oversight, as referenced in the compliance documentation.
- Bank Secrecy Act (BSA) / FinCEN SAR Regulations (31 CFR Chapter X): The capability produces Suspicious Activity Reports (SARs) with structured findings and transaction narratives that conform to FinCEN's reporting requirements for financial institutions and money services businesses.
- OFAC SDN List / UN Security Council Consolidated List / EU Financial Sanctions List: Sanctions screening at each traced address checks the official OFAC Specially Designated Nationals, UN Security Council, EU, and UK HM Treasury sanctions lists, enabling compliance with international asset freeze obligations.
- GraphQL (June 2018 Specification): All fund flow queries, pattern detection mutations, and forensic report retrieval are exposed via a GraphQL API, enabling flexible client-driven traversal of transaction graphs.
- JSON (RFC 8259): Transaction records, flow graph structures, evidence packages, and forensic report payloads are serialised as JSON throughout the data pipeline and export formats.
- SHA-256 (FIPS 180-4): Cryptographic integrity verification of court-ready forensic evidence packages uses SHA-256 hashing, producing a tamper-evident fingerprint that supports chain-of-custody documentation.
Compliance#
- Fund flow tracing methodology documented for court admissibility and expert testimony
- Evidence packages include cryptographic verification linking to source blockchain transactions
- Supports Bank Secrecy Act, AML/CTF, and FATF Travel Rule compliance requirements
- Supports Suspicious Activity Report (SAR) preparation with detailed transaction narratives
- Audit trail documentation for all tracing activities and analytical decisions
- Aligns with FATF guidance on virtual asset transaction monitoring and risk assessment
- SOC 2 Type II certified infrastructure with GDPR-compliant data handling
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14