Overview#
When a national financial intelligence unit began tracing cryptocurrency used to fund a sanctions-evasion network, they needed a platform that could work simultaneously across Bitcoin, Ethereum, and Tron, correlate transactions through cross-chain bridges, attribute wallets to known entities, and produce court-ready evidence without weeks of manual work. That is the scope of what the Blockchain & Crypto Intelligence module addresses.
The module provides comprehensive cryptocurrency investigation and financial crime detection capabilities for law enforcement, financial institutions, regulatory agencies, and corporate compliance teams. It covers tracing, analysing, and investigating cryptocurrency transactions across 15+ blockchain networks, with purpose-built tools for sanctions screening, money laundering detection, entity attribution, and forensic reporting. AML compliance officers, exchange compliance teams, tax authorities, and sanctions enforcement agencies use it as their primary blockchain investigation platform.
Key Features#
- Multi-Chain Coverage: Supports 15+ blockchain networks including Ethereum, Bitcoin, BNB Chain, Polygon, Solana, Tron, and Layer 2 networks, plus 64 EVM-compatible chains
- Transaction Graph Analysis: Visualises and traces fund flows with interactive graph visualisations that reveal hidden relationships through multi-hop traversal, value filtering, and risk-based colouring for immediate pattern recognition
- Entity Clustering and Attribution: Advanced heuristic algorithms attribute addresses to real-world entities using common input ownership, change address detection, behavioural similarity analysis, and an attribution database linking addresses to known exchanges, protocols, and threat actors
- Sanctions Screening: Real-time screening against OFAC, UN, EU sanctions lists and custom watchlists, with both direct match and multi-hop indirect exposure detection. OpenSanctions integration keeps data current
- Money Laundering Detection: Automated detection of layering, mixing service usage, DeFi obfuscation, structuring patterns, and other laundering techniques through pre-configured playbooks that generate confidence scores and recommended actions
- Court-Ready Evidence: Forensic reports with cryptographic verification, chain-of-custody documentation, and formatting that meets evidentiary standards for legal proceedings
- Real-Time Address Monitoring: Continuous surveillance of addresses with configurable alerts and multi-channel notifications when monitored wallets transact, including mempool-level detection
- DeFi Protocol Intelligence: Specialized analysis for decentralized exchange activity, liquidity pools, lending protocols, flash loan detection, wash trading identification, and cross-protocol interactions
- Darknet Market Intelligence: Vendor wallet identification, marketplace escrow tracking, ransomware payment monitoring, stolen funds tracing, and cash-out pattern analysis
Supported Networks#
- EVM Networks (64 Chains): Ethereum, Polygon, BSC, Arbitrum, Optimism, Base, Avalanche, Fantom, Gnosis, zkSync Era, Polygon zkEVM, Scroll, Linea, Mantle, Blast, and dozens more including emerging and specialized chains
- Non-EVM Networks: Bitcoin, Solana, Tron, Sui, Aptos, Near, TON, Cardano
Use Cases#
- Pre-transaction sanctions screening for cryptocurrency deposits and withdrawals, customer wallet risk assessment during onboarding and ongoing monitoring, and automated compliance reporting with SAR filing support
- Ransomware payment tracing, darknet market enforcement, fraud investigation, asset seizure support with fund location and exchange identification, and criminal network mapping for law enforcement
- Counterterrorism finance tracking, state-sponsored cryptocurrency monitoring, sanctions evasion detection, and weapons proliferation financing analysis for intelligence agencies
- Cryptocurrency market manipulation detection, insider trading investigation, VASP compliance verification, and consumer protection enforcement for regulatory bodies
Integration#
The module connects with compliance platforms, law enforcement investigation tools, regulatory reporting systems, and threat intelligence feeds via STIX/TAXII. It supports forensic standards including ISO/IEC 27037, SWGDE, and NIST SP 800-86, and meets Bank Secrecy Act, AML/CTF, FATF Travel Rule, and EU Anti-Money Laundering Directive requirements.
Open Standards#
- FATF Recommendations 15 & 16 (Virtual Assets): The travel rule tracing and suspicious-activity identification workflows align with the Financial Action Task Force recommendations for virtual asset service providers and law enforcement cooperation, including the Travel Rule (R.16) requirements for threshold-based transaction reporting.
- NIST SP 800-53 Rev 5 (AU, IR, AC controls): Access control, audit-log retention, and incident-response controls governing investigator queries, evidence exports, and role-based access to wallet attribution data follow NIST 800-53 Rev 5 control families for audit and accountability (AU) and access control (AC).
- CJIS Security Policy v5.9: All blockchain query data, attribution records, and exported evidence packages are handled in accordance with the FBI Criminal Justice Information Services Security Policy, including encryption-in-transit (TLS 1.3) and access-log requirements for criminal-justice information.
- ISO/IEC 27001:2022 (A.8 Asset Management, A.5.33 Evidence Protection): Chain-of-custody maintenance, cryptographic hashing (SHA-256) of exported evidence, and immutable audit-log retention map to ISO/IEC 27001:2022 Annex A controls for evidence protection and information asset management.
- GDPR / UK GDPR (Article 6 Lawful Basis, Article 22 Automated Decisions): Wallet-to-person attribution involves processing of pseudonymous personal data; attribution confidence scores and human-review gating satisfy Article 22 requirements for automated individual decision-making in law-enforcement contexts.
- FinCEN SAR Electronic Filing Standard (BSA/AML): The SAR-export capability produces structured Suspicious Activity Report data aligned with FinCEN's Bank Secrecy Act electronic filing requirements, enabling direct submission to the FinCEN SAR system.
- Egmont Group Secure Web (ESW) Exchange Format: Intelligence-sharing exports designed for Foreign Financial Intelligence Unit disclosure follow the Egmont Group's secure information-exchange format for cross-border AML/CFT cooperation.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14