Blockchain analytics is what turns a stream of public transactions into a report with a risk score and source labels. The blockchain itself holds none of that: it has addresses, amounts, timestamps and the order of operations, but no names and no payment purpose. Everything else is built on top. Let us break down what that superstructure is made of and at which step human judgement enters it.
What blockchain analytics is
Exchanges and exchange services use it to decide whether to accept a deposit; banks, to understand where a client's money came from; law enforcement, to trace stolen funds; ordinary holders, to check an address before a deal.
It matters which question it actually answers. Not «who owns this address», but «what does the behaviour of these funds look like and what are they connected to». These are different things, and all the mechanics that follow come out of that difference.
Analytics is built as three layers stacked on top of one another. The higher the layer, the less verifiable fact and the more interpretation it contains.
Layer 1. What is actually visible in a blockchain
The ledger itself holds the sender and recipient addresses, the amount, the time, the fee, the block number and the inputs and outputs of a transaction. That is enough to reconstruct the movement of funds from address to address at any depth.
What the ledger does not hold: names, passports, company names, payment purposes, agreements between the parties. A record of a 500 USDT transfer looks exactly the same whether it is a freelance payment or a share of a fraud scheme.
This is the only fully objective layer. Everything above it is reconstruction.
Layer 2. Clustering: how addresses are grouped into one wallet
A person or a service rarely has just one address. The job of the second layer is to work out which addresses belong to the same owner. There is no direct proof: a blockchain does not store the link «this address and that one belong to the same person». So indirect signals — heuristics — are used instead.
How this looks in practice:
Several inputs in one transaction. Anna holds 0.3, 0.25 and 0.2 BTC on three addresses. She pays 0.7 BTC — the wallet collects the amount from all three addresses at once and signs them in a single transaction. Only someone holding all three private keys can sign all three. Analytics groups the addresses into one cluster.
The change address. Anna spends 0.7 BTC out of a 1 BTC input. The remaining 0.3 goes to a new address that has never appeared on the network before. That is change — it came back to the sender. The cluster grows by one more address.
A service's deposit addresses. An exchange gives every client a personal address for top-ups and, once a day, sweeps the balances into a common hot wallet. Thousands of different addresses regularly send funds to the same one — this is how analytics works out that they all belong to a single platform.
The techniques work differently depending on how the network is built:
| UTXO networks (BTC, LTC) | Account-based networks (ETH, TRON) | |
|---|---|---|
| How funds are held | as a set of «unspent outputs» | as a balance on one address |
| Main technique | common inputs and the change address | reuse of deposit addresses |
| Additional signals | wallet software fingerprints, output order | behaviour, timing, contract interactions |
| Accuracy of grouping | historically higher | lower: inputs are not combined, there is little to group |
Layer 3. Attribution: where labels physically come from
A cluster on its own is nameless — it is simply a group of addresses that probably share an owner. The name and the category are assigned at the third layer, and this is where a human enters the system.
There are four sources of attribution, and their reliability differs.
The provider's own check of a service. An analyst registers at an exchange service, deposits a small amount and records the address the service issued. That is now a confirmed entry point, and clustering pulls the rest of the platform's infrastructure towards it.
Official documents. An agency publishes a sanctions list with specific crypto addresses, or addresses appear in court materials and press releases. The label appears at providers immediately, on the authority of a government publication.
Victim reports and platform data. Several people report that they sent funds to the same address under a «guaranteed deal» scheme. The address gets a scam label — on the basis of statements, not a court ruling.
Open sources. The address is listed on a service's website, in an exchange service's advert, in a forum thread or in a researcher's report.
How the three layers become a risk score
The layers are then combined into a single number. Analytics looks at which labelled clusters your funds are connected to, what share of the balance is connected to them and how many transfers separate you from the source. A direct link to a sanctioned address and 0.5% of funds five transfers away produce fundamentally different results, even though the category in the report will be named the same.
Low, medium, high: how AML risk scoring of crypto wallets worksRead more
A worked case: how a label reaches someone who broke no rules
Now that the mechanics are clear, let us see how they play out in real life.
Maxim bought 500 USDT on a P2P platform: he sent the seller money and received the coins to his wallet. A week later he deposited them at an exchange — and the deposit was put on hold with a request for the source of funds. The report on his address carries a label: link to a P2P scam, 12% of funds, depth of two transfers. He had never met the seller before and knew nothing about their history.
What happened, layer by layer:
- 1. Someone cashed out funds from a fraud scheme — that address is already flagged on victim reports (third layer, source: people's statements).
- 2. The funds went through an intermediate wallet with no label and reached the P2P seller.
- 3. The seller's addresses were merged into one cluster through address reuse (second layer), and part of their balance turned out to be connected to the flagged address.
- 4. Maxim bought USDT from them and received a portion of those same funds.
- 5. The result: 12% of his balance has a link to a risky category at a depth of two transfers.
At no step did the system claim Maxim was guilty. The final label is a chain of probabilities, and the decision on the deposit is taken by a compliance officer who looks at the share and the depth of the link.
What the method delivers: two public cases
How well all this works is best seen in cases where the documents are public.
The Colonial Pipeline ransom. After a ransomware attack the company paid around 75 BTC. Law enforcement traced the movement of the funds and seized 63.7 BTC — roughly $2.3M at the time. The US Department of Justice statement says explicitly that the transfers were tracked by reviewing the public bitcoin ledger.
The 2016 Bitfinex hack. 119,754 BTC were taken from the exchange. The funds moved in parts for years, were run through mixers, hopped between networks and were converted into other assets — and the case still ended in a conviction: the organiser was sentenced to five years in November 2024.
What KYT is in crypto and how transaction monitoring worksRead more
What blockchain analytics cannot see
The limits of the method explain why a report cannot be read as a verdict.
A transfer inside an exchange. You sent USDT to another client of the same platform. Nothing appeared in the blockchain: the exchange changed two numbers in its own database. For analytics, that operation does not exist.
Cash. The seller handed you USDT and you handed them cash in person. All the network shows is a transfer — and it looks like a gift.
Moving between networks. Funds left one network and appeared in another. The link is reconstructed from indirect signals — the amount, the timing, the contract — and not always unambiguously.
The same goes for privacy coins and confidentiality protocols, where the chain is broken deliberately.
Crypto mixers: how they work and what their trace in a wallet history meansMar 9, 2026Read more
Hence the rule: no label does not mean «clean», and a label does not mean «criminal».
Attribution errors and what they cost
The practical conclusion: what you need to read is not the final number but the breakdown — the source category, the share of funds, the depth of the link and the date of the label. A score without a breakdown says almost nothing.
Why different providers give different results
The same address easily produces three different pictures. The first provider labels an exchange service as a platform without verification and assigns it a high weight. The second knows it as an ordinary exchange service and assigns a medium one. The third does not see the address at all, because its coverage of that network is thin.
The reason is that label databases, cluster-merging rules and category weights are different everywhere. This is exactly why we show the assessment from several providers at once — Crystal Intelligence, VALEGA Chain Analytics and BitOK — together with the discrepancies between them. A discrepancy is not a malfunction but information: it shows that a conclusion rests on the labelling of a single source.
What to do with this
Check an address
An address report shows not only the final assessment but the breakdown by source: which categories were found, what share of funds is connected to them and at what depth. Checking an address takes less than a minute.
Check an address for free
Visit siteNot on its own. Names do not exist in a blockchain. An identity is linked to an address where you revealed it yourself: during verification at an exchange, in a transfer to a bank account, in a public advert.
