Overview#
When a new ransomware variant first appeared in the wild, the threat actor tracking database already held seventeen wallet addresses associated with its operators, sourced from an earlier campaign under a different name. The moment the first victim payment arrived at one of those addresses, every exchange and compliance platform connected to the feed had that information in under a second. Two exchanges froze withdrawal requests from linked accounts before a single satoshi was cashed out.
The Blockchain Threat Actor Tracking module delivers identification, monitoring, and attribution of malicious actors operating across blockchain networks. A continuously updated database of wallet addresses links to known threat actors, integrated with intelligence from law enforcement, cybersecurity firms, and open-source sources. The system identifies criminal activity with confidence-scored attribution while tracking transactions across 15+ blockchain networks in real time, including mempool-level detection before transactions confirm. Exchange compliance officers, law enforcement cryptocurrency teams, AML compliance units, and cybersecurity threat intelligence teams all use this capability operationally.
Key Features#
- Known Threat Actor Wallet Database: Continuously updated database covering APT groups, ransomware families, exploit campaigns, darknet markets, money laundering operations, sanctioned entities, and scam operations with confidence-scored attribution
- Real-Time Transaction Monitoring: Observes mempool activity and confirmed transactions across all supported networks, instantly flagging any transaction involving tracked threat actor wallets with pattern recognition for suspicious behaviours
- Attribution Confidence Analysis: Machine learning models assess confidence levels by combining on-chain behaviour, transaction patterns, temporal analysis, and intelligence source credibility for probabilistic attribution scoring at five tiers from speculative to definitive
- APT Group Tracking: Monitors nation-state and sophisticated criminal organisations conducting long-term blockchain operations with wallet portfolios, operational tempo analysis, and targeting pattern identification
- Ransomware Tracking: Specialized monitoring of ransomware operator wallets covering hundreds of ransomware families with payment pattern analysis, victim intelligence, and Ransomware-as-a-Service affiliate tracking
- Exploit Wallet Monitoring: Tracks addresses associated with DeFi exploits, exchange hacks, bridge compromises, and other technical cryptocurrency theft with post-exploit behaviour analysis and fund recovery intelligence
- Darknet Market Intelligence: Vendor wallet identification, marketplace escrow tracking, payment processor monitoring, and scam operation detection including phishing, Ponzi schemes, and investment fraud
- Behavioural Pattern Recognition: Identifies money laundering indicators including rapid dispersion, mixer sequences, cross-chain hopping, exchange deposit patterns, time-delayed fund movement, peel chains, and dusting attacks
Supported Networks#
- Major Blockchains: Bitcoin, Ethereum, Tron, BNB Chain, Solana, Cardano, Polkadot, Avalanche
- Layer 2 Solutions: Polygon, Arbitrum, Optimism, Base, zkSync Era, Starknet, Linea
- EVM-Compatible Chains: Cronos, Moonbeam, Fantom, Gnosis Chain, Aurora, Celo, and more
- Additional Networks: Ripple, Stellar, Algorand, Cosmos, Near, Tezos, Aptos, Sui
Use Cases#
- Screening incoming cryptocurrency deposits at exchanges against known threat actor wallets in real time, flagging high-risk deposits for compliance review, and generating audit-ready documentation for regulatory examination
- Supporting law enforcement investigations with transaction tracing, attribution confidence scoring, evidence package generation, historical network analysis, and asset seizure intelligence for criminal prosecutions
- Enriching cybersecurity threat intelligence with blockchain attribution data to connect incidents across organisations through shared cryptocurrency wallets and detect emerging campaigns through wallet activity patterns
- Monitoring DeFi protocols for exploit wallet interactions in real time with rapid response alerts when known attackers target smart contracts, informing security auditing and vulnerability response
- Enforcing sanctions compliance by screening counterparties against sanctioned entity wallet lists from OFAC, UN, and international sources via OpenSanctions integration, with complete audit documentation
Integration#
The module connects with exchange compliance systems, law enforcement investigation platforms, cybersecurity threat intelligence feeds via STIX/TAXII, DeFi protocol security tools, and sanctions screening services. It supports role-based access control with comprehensive audit logging and meets SOC 2 Type II and ISO 27001 standards.
Open Standards#
- STIX 2.1 / TAXII 2.1 (OASIS): Threat actor wallet indicators are modelled as STIX 2.1 Indicator SDOs and exported in STIX bundles; the platform ingests and publishes intelligence feeds via TAXII 2.1 collection endpoints.
- MITRE ATT&CK: Threat actor profiles store TTPs as MITRE ATT&CK technique identifiers, and the attribution confidence engine weights direct technique overlap at 40% of its scoring model.
- TLP (Traffic Light Protocol, FIRST): All shared indicators carry TLP marking-definition references (WHITE / GREEN / AMBER / RED / CLEAR) mapped to canonical STIX marking-definition UUIDs to govern downstream redistribution of threat intelligence.
- FATF Recommendations and EU AML Directives (4th/5th): Sanctions screening and AML pattern detection are aligned with FATF red-flag indicators and the 25% beneficial-ownership threshold mandated by EU AMLD4/AMLD5, forming the regulatory baseline for the compliance workflows.
- OpenSanctions FollowTheMoney (FtM) data format: Bulk sanctions entity data is ingested in the FollowTheMoney newline-delimited JSON format published by OpenSanctions, covering OFAC, UN, EU, and other national lists across 2.5 million-plus entities.
- OFAC SDN and UN Security Council Consolidated List: Wallet and counterparty screening is performed directly against the OFAC Specially Designated Nationals list and the UN Security Council Consolidated List, with full audit documentation generated for each screening event.
- OAuth 2.0 and JWT Bearer Token: Token-based authentication protects typed, auditable read and write workflows across the platform.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14