Published on Sat Aug 22 2026 00:00:00 GMT+0000 (Coordinated Universal Time) by Jacob Cavazos

Every transaction on a public blockchain is visible to anyone. The addresses are pseudonymous, not anonymous. But pseudonymity is not the same as knowing who is behind an address. The gap between seeing a transaction and understanding the entity that made it is what wallet intelligence fills.

Wallet intelligence is not a single tool or a single database lookup. It is a stack of techniques that, together, turn raw on-chain data into actionable knowledge about the entities operating on a blockchain. This article breaks down that stack into its component layers, explains how each works, and identifies the public tools that operate at each layer.

The focus is on concepts and publicly available tools. The compliance layer is where most tools stop and where the hardest problems remain.

Layer 1: Address Discovery

The first layer is address discovery: finding addresses that matter. A blockchain has millions or billions of addresses, but most are dormant, empty, or irrelevant. Address discovery is the process of identifying the subset that is active, funded, and significant.

Discovery starts with on-chain data. Every transaction reveals a sender and a recipient. Every smart contract interaction reveals a caller. By indexing transactions across blocks, you can build a graph of all addresses that have ever been active on a chain.

But raw activity is not enough. Discovery also involves identifying addresses of interest: exchange hot wallets, treasury addresses, known protocol deployers, whale wallets, and institutional addresses. This is typically done through a combination of automated heuristics and manual research.

One common heuristic is funding pattern analysis. If an address receives its first transaction from a known exchange withdrawal, that address is likely controlled by a user of that exchange. If an address is funded by a mining pool payout, it is likely a miner. These heuristics are probabilistic, not deterministic, but they narrow the search space significantly.

Another discovery method is entity propagation. Once an exchange’s deposit address is identified, all addresses that send to it are candidate users of that exchange. This creates a network effect: each identified entity reveals new addresses through its transaction patterns.

Layer 2: Attribution

Attribution is the process of linking an address to a real-world entity — for a practical guide on building this pipeline, see Building a Wallet Attribution Pipeline: a person, a company, an exchange, a fund, or a government. This is the core of what most people think of as wallet intelligence.

Attribution is fundamentally probabilistic. As Arkham’s own API documentation states, attribution is probabilistic, not binary. No tool can guarantee that an address belongs to a specific person with 100 percent certainty, unless the person has publicly claimed the address.

Clustering

The primary technique for attribution is clustering. Clustering groups addresses that are likely controlled by the same entity. The most common clustering heuristic is the common-input-ownership heuristic: if two addresses are used as inputs in the same transaction, they are likely controlled by the same wallet. This is because most wallets use a single private key to sign multi-input transactions, and combining inputs from different keys would require coordination that is rare in practice.

Other clustering heuristics include change address detection, peeling chain analysis, and temporal pattern matching. Each heuristic adds evidence, and the combined evidence produces a cluster of addresses that are likely controlled by the same entity.

Labeling

Once a cluster is identified, it can be labeled. Labels are tags that describe what the cluster is: an exchange, a mining pool, a DeFi protocol, a known individual, a sanctioned entity, or a category like smart money.

Nansen, one of the leading wallet intelligence platforms, maintains a database of over 500 million labeled addresses, according to their public API documentation. These labels include Smart Money tags, which identify wallets that have historically made profitable trades, and entity labels, which identify addresses associated with known organizations.

Arkham takes a different approach. According to public comparisons, Arkham focuses on deanonymization through its proprietary Ultra intelligence engine and a data marketplace where users can buy and sell wallet labels. Arkham’s model prioritizes depth and specific entity attribution, while Nansen prioritizes breadth and signal discovery.

The Probabilistic Nature of Attribution

Attribution is never final. An address that is labeled as belonging to an exchange might be a hot wallet today and a cold wallet tomorrow. A cluster that is attributed to a specific fund might include addresses that have been transferred to a different entity. Attribution systems must be continuously updated, and users of attribution data must understand that labels carry uncertainty.

This is why tools like Arkham explicitly state that attribution is probabilistic. Treating a label as ground truth without understanding the methodology behind it can lead to false conclusions, which in compliance contexts can mean falsely flagging a legitimate user or missing a sanctioned one.

Layer 3: Behavioral Profiling

Once an address is discovered and attributed, the next layer is behavioral profiling: understanding what the entity does, how it trades, and what patterns it follows.

Behavioral profiling goes beyond identity. It answers questions like: Is this address a market maker or a taker? Does it trade on DEXs or CEXs? Does it hold long-term or flip quickly? Does it follow Smart Money patterns? What is its profit and loss history?

Nansen’s Profiler tool, documented in their public API materials, provides deep dives into wallet activities, trading patterns, and PnL analysis. It can map relationships between wallets and identify connected addresses across chains. This is useful for investment research: understanding which Smart Money wallets are accumulating a token, or tracking how a fund’s portfolio allocation changes over time.

Behavioral profiling also includes pattern detection. Common patterns include peeling chains, where funds are split through a series of transactions to obscure their origin, and layering, where funds are moved through multiple intermediaries to break the trail. These patterns are relevant for both investment analysis and compliance investigation.

Cross-Chain Profiling

Modern wallet intelligence must work across chains. An entity that trades on Ethereum may also operate on Solana, Base, Arbitrum, and Polygon. Tracking an entity across chains requires linking addresses on different networks to the same real-world actor.

This is technically challenging because addresses on different chains use different formats and different cryptographic primitives. An Ethereum address and a Solana address share no common derivation. Cross-chain attribution relies on behavioral signals: if an address on Ethereum sends funds to a bridge, and an address on Solana receives funds from that bridge shortly after, the two addresses may be controlled by the same entity.

Nansen’s API documentation states that they support 25 or more major blockchains, including Ethereum, Solana, Bitcoin, Arbitrum, Base, and Polygon. This multi-chain coverage is essential for accurate profiling, as entities increasingly operate across multiple networks.

Layer 4: Compliance Screening

The fourth layer is compliance screening, and it is where most wallet intelligence tools are incomplete. Compliance screening means checking addresses against sanctions lists, identifying suspicious activity, and ensuring that transactions comply with regulatory requirements.

OFAC Sanctions Screening

The Office of Foreign Assets Control, or OFAC, maintains the Specially Designated Nationals and Blocked Persons List, commonly called the SDN List. Financial institutions are prohibited from transacting with entities on this list. In the crypto context, this means that addresses associated with sanctioned entities must be flagged and, in many cases, frozen.

OFAC has been actively adding crypto addresses to the SDN List. In 2022, OFAC sanctioned Tornado Cash, a mixing service, by adding associated Ethereum addresses to the SDN List. This was a landmark action because it sanctioned smart contract code, not just individuals or entities.

According to a public SAM.gov solicitation, OFAC itself uses Chainalysis for blockchain tracing and attribution — which is part of why becoming defense-eligible matters for blockchain companies targeting government contracts. The solicitation describes OFAC’s need for a tool to equip investigators in its Office of Global Targeting to analyze and track virtual currency transactions in order to gather attribution information on parties that OFAC may put on the SDN List. This confirms that sanctions screening and wallet intelligence are deeply interconnected.

The Travel Rule

The FATF Travel Rule is the other major compliance requirement for crypto. The Financial Action Task Force extended its anti-money laundering standards to virtual assets and virtual asset service providers in 2018. The Travel Rule requires VASPs to share originator and beneficiary information alongside virtual asset transactions, similar to the requirements for traditional wire transfers.

According to FATF’s June 2023 targeted update, implementation remains poor. Of 98 FATF mutual evaluation and follow-up reports, three quarters of jurisdictions assessed are only partially or non-compliant. More than half of survey respondents have taken no steps toward Travel Rule implementation.

The Travel Rule creates a direct need for wallet intelligence. VASPs must be able to identify whether a counterparty address belongs to another VASP, and they must exchange customer information for transactions above a threshold. This requires attribution: knowing which addresses belong to which VASPs, and being able to verify the identity of the customer behind an address.

The Gap in Most Tools

Most wallet intelligence tools focus on layers 1 through 3: discovery, attribution, and profiling. These are the layers that serve investment research, market analysis, and general curiosity. They are also the layers that are easiest to monetize, because they produce insights that traders and researchers will pay for.

Compliance screening is different. It requires not just attribution but verified attribution. It requires integration with sanctions lists that are updated in real time. It requires audit trails that can be presented to regulators. And it requires handling edge cases: what happens when an address is partially controlled by a sanctioned entity, or when funds transit through a sanctioned address but the sender was unaware?

Chainalysis and TRM Labs are the two tools most commonly used for compliance screening — see our blockchain compliance tools comparison for a detailed breakdown. Both have extensive government contracts. According to public procurement records, TRM Labs holds a 5-year indefinite delivery contract with Immigration and Customs Enforcement for blockchain analytics, with a total ceiling of $12.7 million. Chainalysis has contracts with OFAC, the FBI, the IRS, the DEA, and the State Department, among others.

The gap between investment intelligence and compliance intelligence is significant. A tool that can tell you which Smart Money wallets are accumulating a token is not the same as a tool that can tell you whether a specific address is sanctioned. The former is useful for alpha. The latter is necessary for legal operation.

Public Tools in the Wallet Intelligence Stack

The wallet intelligence market has several well-known public tools, each operating at different layers of the stack.

Nansen

Nansen operates primarily at the attribution and profiling layers. Its strength is breadth: over 500 million labeled addresses, Smart Money tracking, and multi-chain coverage across 25 or more chains. Nansen’s API provides programmatic access to wallet analysis, token analytics, and Smart Money insights. The platform is designed for investment research, alpha generation, and market sentiment analysis.

Arkham

Arkham operates at the attribution layer with a focus on deanonymization. Its proprietary Ultra intelligence engine maps addresses to real-world entities including VCs, exchanges, and whales. Arkham also features a data marketplace where users can buy and sell wallet labels, creating an economic layer for attribution data. Arkham is designed for forensic analysis, due diligence, and security investigations.

Chainalysis

Chainalysis operates across all four layers but is strongest at the compliance layer. The company provides blockchain analytics tools used by government agencies, exchanges, and financial institutions for sanctions screening, transaction tracing, and investigation. Chainalysis is the tool that OFAC uses to identify addresses for the SDN List, according to public procurement records. The company’s capabilities include address clustering, transaction flow mapping, wallet exploration, and behavioral analysis.

TRM Labs

TRM Labs focuses on compliance and forensics. The company provides tools for tracing crypto between entities and addresses, detecting suspicious patterns like peeling chains and layering, and visualizing chain of custody for legal proceedings. TRM Labs holds contracts with ICE, the Treasury Department, the FBI, and other federal agencies. According to public contract records, TRM’s ICE contract includes tracing and analysis of NFTs across multiple blockchains.

Why Compliance Is the Hardest Layer

Compliance is the hardest layer for three reasons.

First, compliance requires verified data, not probabilistic estimates. If an attribution tool says an address is 80 percent likely to belong to a sanctioned entity, that is useful for investigation but not sufficient for action. Compliance requires a higher standard of evidence, because the consequences of false positives, frozen legitimate funds, and false negatives, allowing sanctioned transactions, are both severe.

Second, compliance requirements vary by jurisdiction. OFAC sanctions apply to US persons and entities. The EU has its own sanctions list. The UK FCA implemented Travel Rule requirements in September 2023. Each jurisdiction has different rules, different thresholds, and different enforcement mechanisms. A compliance tool must handle all of them.

Third, compliance is adversarial. Bad actors actively try to evade detection. They use mixers, peel chains, cross-chain bridges, and privacy coins. A compliance tool that works today may not work tomorrow if evasion techniques evolve. This is why compliance tools must be continuously updated and why government agencies sole-source contracts to specific providers: the proprietary heuristics and data access of each tool are not easily replicated.

The Takeaway

Wallet intelligence is a four-layer stack: discovery, attribution, profiling, and compliance. Each layer builds on the one below it, and each requires different techniques and different tools.

For investment research, layers 1 through 3 are sufficient, and they feed directly into a web3 go-to-market strategy. Nansen and Arkham provide the attribution and profiling data that traders and researchers need. For compliance, all four layers are necessary, and the compliance layer requires specialized tools like Chainalysis and TRM Labs that integrate with sanctions lists and produce audit-ready evidence.

The gap between investment intelligence and compliance intelligence is the gap that matters most. As regulatory pressure on crypto increases, the tools that can bridge that gap, providing both attribution and compliance screening in a single workflow, will become increasingly valuable. But for now, the stack remains fragmented, and users must understand which layer they are operating in and which tool serves that layer.

Frequently Asked Questions

What is on-chain wallet intelligence?

On-chain wallet intelligence is the practice of analyzing public blockchain transaction data to understand wallet behavior, identify entities, and extract insights. It involves discovering addresses, attributing them to known entities, profiling their activity, and screening for compliance risks. It is used by traders, researchers, and compliance teams.

How does wallet attribution work?

Wallet attribution connects anonymous blockchain addresses to known entities such as exchanges, protocols, or individuals. This is done by analyzing transaction patterns, timing, linked addresses, and publicly disclosed wallet addresses. Heuristics like common input ownership and peeling chains help investigators cluster related addresses together.

What is wallet clustering?

Wallet clustering is the process of grouping multiple blockchain addresses that are likely controlled by the same entity. Clustering uses heuristics such as addresses that appear as inputs in the same transaction, or addresses that interact with the same smart contracts in similar patterns. The resulting clusters provide a fuller picture of an entity’s on-chain activity.

Is on-chain analysis legal?

Yes, on-chain analysis is legal because blockchain transaction data is public. Analyzing public ledger data does not violate privacy laws in most jurisdictions. However, how the resulting intelligence is used, particularly for compliance and law enforcement, is subject to regulations such as data protection laws and due process requirements.

Written by Jacob Cavazos