Blockchain Persistent Clusters

Overview#

The Blockchain Persistent Clusters system transforms transient blockchain activity patterns into durable, evolving entity intelligence that significantly improves detection accuracy over single-transaction analysis. The system maintains historical cluster relationships across millions of addresses while tracking confidence decay, entity attribution, and cluster evolution over multi-year timeframes. Designed for compliance teams, financial intelligence units, and blockchain forensics investigators, persistent clusters provide long-term context that is unavailable through snapshot-based analysis.

Key Features#

• Long-Term Cluster Storage - Maintains multi-year cluster histories with full member tracking, confidence evolution, and relationship metadata, accumulating intelligence over time
• Confidence Scoring System - Probabilistic scores (0.0-1.0) representing cluster validity and member relationship strength, enabling risk-based decision-making with configurable thresholds
• Temporal Decay Model - Confidence naturally declines without confirming activity, ensuring stale intelligence does not dominate current risk assessments while maintaining historical context
• Cluster Evolution Tracking - Records every structural change including formation, growth, splits, merges, dormancy, and reactivation with complete audit trails
• Entity Attribution Persistence - When a cluster is attributed to a real-world entity, that intelligence becomes permanent cluster metadata, propagating across all members and persisting through structural changes
• Cluster Merge and Split Detection - Identifies when clusters should combine (same underlying entity) or divide (distinct sub-entities), maintaining integrity as blockchain intelligence evolves
• Dynamic Member Management - Tracks core, probable, and peripheral members with rich contextual data including first seen, last activity, transaction count, and confidence trajectory

Supported Networks#

• Major Blockchains: Bitcoin, Ethereum, Tron, BNB Chain, Solana, Cardano, Polkadot, Avalanche
• Layer 2 Solutions: Polygon, Arbitrum, Optimism, Base, zkSync Era, Starknet, Linea
• EVM-Compatible Chains: Cronos, Moonbeam, Fantom, Gnosis Chain, Aurora, Celo, and more
• Cross-Chain: Multi-blockchain cluster relationships with chain-specific metadata

Cluster Lifecycle#

Clusters progress through five lifecycle states:

• Emerging - New patterns requiring validation with developing confidence
• Active - Established clusters with ongoing transactional activity
• Confirmed - High-certainty clusters with verified entity attribution
• Dormant - Inactive clusters undergoing confidence decay
• Archived - Historical records maintained for reference but excluded from active queries

Each state transition generates audit events enabling compliance teams to understand why classifications changed over time, critical for regulatory inquiries and legal proceedings.

Confidence Thresholds#

Different operational contexts require different confidence levels:

• High-Risk Screening (0.85+) - Sanctions checks, law enforcement referrals
• Compliance Monitoring (0.70+) - Transaction monitoring, enhanced due diligence
• Intelligence Development (0.50+) - Investigative leads, pattern detection
• Research and Exploration (0.30+) - Early warning, emerging threat identification

Investigation Use Cases#

Sanctions Screening#

• Screen against attributed sanctioned clusters for broader coverage than individual address lists
• Catch indirect sanctioned fund flows through cluster propagation that address-only screening would miss
• Automated blocking with audit trail documentation and complete evidence chains

Investigation Case Development#

• Instant access to pre-computed cluster relationships eliminates manual graph traversal
• Historical evolution reveals entity operational patterns and changes over time
• Attributed exchange deposits identify potential cash-out venues for rapid response

Customer Due Diligence#

• Historical analysis shows customer counterparty exposure across attributed entities
• Confidence-scored risk assessment based on cluster attributions for consistent evaluation
• Automated enhanced due diligence triggering for mixer, darknet, or sanctioned entity exposure

Forensic Analysis#

• Reconstruct entity development timelines through complete cluster evolution history
• Build evidence chains showing how entity identification occurred and evolved
• Support algorithm validation by comparing current clustering against historical ground truth

Entity Attribution#

Attribution types cover the full spectrum of blockchain entities:

• Exchange Attribution - Centralized exchange wallets identified through multiple intelligence sources
• Service Attribution - DeFi protocols, payment processors, custody services
• Illicit Attribution - Darknet markets, ransomware operations, scam campaigns
• Sanctions Attribution - OFAC, UN, EU sanctioned entities with regulatory cross-reference
• Mixer Attribution - Tumblers, privacy services, and obfuscation tools

Attributions include entity name, type, confidence level, evidence source, attribution date, and jurisdictional context. When any cluster member receives attribution, it propagates to all cluster members with historical backfill of past transactions.

Compliance#

• Complete audit trail documenting all cluster changes, attribution decisions, and confidence score evolution
• Configurable data retention policies meeting jurisdictional requirements
• Role-based access control with elevated privileges required for attribution modifications
• GDPR considerations addressed through pseudonymous data handling without PII storage
• Encryption at rest (enterprise-grade encryption) and in transit (TLS 1.3) for all cluster data
• Regular penetration testing and security assessments
• SOC 2 Type II certified infrastructure

Last Reviewed: 2026-02-05