KYT tracks where coins came from and where they go, and checks whether they are linked to criminal activity — hacks, fraud, sanctioned or darknet addresses. It is part of the AML (anti-money laundering) system and one of the key compliance tools for crypto exchanges.
Why KYT is needed in crypto
The blockchain is public: any transaction can be seen. But wallet addresses are pseudonymous — on their own they don't reveal who is behind them. Criminals exploit this: stolen and «dirty» funds are run through mixers, split across dozens of wallets and cashed out via sanctioned addresses. Tracking such chains manually is impossible — the volumes are enormous.
Regulators require crypto services not just to verify a customer at onboarding but to continuously monitor their operations. This is exactly what KYT solves — it turns public blockchain data into a clear risk assessment for each transaction.
For the platform itself it is also a matter of survival: if funds from a sanctioned or stolen address pass through it, it faces fines, the loss of partner banks and a reputational blow. Cutting off a risky operation in advance is easier than explaining it to the regulator after the fact.
How KYT works: the principle
A KYT system automatically analyzes transactions and assesses their risk. In simplified terms, this is four steps.
- 1. Collecting data from the blockchain.The system gathers addresses, amounts, transfer history and connections between wallets. The public nature of the network makes it possible to trace the path of coins many steps back — all the way to the source.
- 2. Assessing the risk of addresses and transactions.Each address and each operation is assigned a risk level — risk scoring. It depends on the «environment» of the address: if the coins recently passed through a mixer or a sanctioned wallet, the risk is high; if they come from a regulated exchange, it is low.
- 3. Real-time monitoring and alerts.KYT works continuously: on a deposit, withdrawal or transfer, the system checks the operation in real time and, if the risk exceeds a set threshold, sends an alert to compliance staff.
- 4. Response: block, freeze, report.Based on the alert, the service decides what to do: pause or block the operation, freeze the funds, request the source from the customer or file a report with the regulator (SAR — Suspicious Activity Report).
What KYT detects: risky operations
KYT highlights operations that are highly likely to be linked to criminal activity.
KYT and KYC: what's the difference
KYT is often placed next to KYC, but they are different things — they complement each other.
| Parameter | KYC | KYT |
|---|---|---|
| What it checks | The customer's identity | The customer's transactions |
| When | At registration, at onboarding | Continuously, in real time |
| Answers the question | «Who is the customer?» | «Where does the money come from and where does it go?» |
Together, KYC and KYT form an AML system: the first checks who the user is, the second monitors what they do.
Who uses KYT
KYT is a mandatory element of compliance for everyone who works with crypto flows: crypto exchanges, payment services, custodial wallets and other VASPs. For them, transaction monitoring is a direct requirement of regulators: in addition to verifying customers, FATF requires crypto services to continuously monitor operations and report suspicious transactions.
Most platforms don't build such monitoring from scratch but connect ready-made KYT solutions via API — specialized systems that maintain databases of labeled addresses and calculate risk scoring in real time. This makes it possible to get world-class monitoring without an in-house team of analysts.
What KYT means for the ordinary user
For an honest user, KYT is usually invisible. But sometimes it shows up: if crypto arrived from a high-risk address (for example, one previously linked to a hack or a mixer), the exchange may delay the withdrawal, request the source of funds or temporarily freeze the amount pending a check. This is not a punishment but the automation triggering — and a reason to be more careful about who you accept transfers from. For example, coins bought from a random seller on P2P may carry a «history» you had no idea about — and surface only at the withdrawal stage on the exchange.
How to check an address or transaction in advance
Risk can be assessed not only on the exchange's side — public verification services are also available. On KYTme, you just enter a wallet address or a transaction hash to see, even before the deal, whether the funds are linked to risky sources — mixers, sanctioned or stolen addresses. This is a simple way to secure a P2P deal, check an unfamiliar counterparty or make sure an incoming transfer is «clean» before accepting it.
It is the monitoring of crypto transactions: the service checks where coins came from and where they go, and whether they are linked to criminal activity. This is how exchanges detect «dirty» funds.
Conclusion
KYT is the «second line» of crypto compliance: if KYC checks the customer at onboarding, KYT continuously monitors the movement of funds and prevents «dirty» coins from dissolving into the system. For exchanges it is a mandatory tool, and for the user — a reason to use regulated platforms and not accept transfers from dubious sources. This is how transaction monitoring works for the security of the entire market.
