Business of Blockchain Analytics: Selling Certainty

To the unknowing participant, the crypto world presents itself as an inaccessible tangle. Wallets of one transaction send funds to wallets of the next, which send them to a bridge, which swaps them for an unrelated chain, which splinters them among dozens of new addresses, which passes them through a mixer, which sheds all traces of them in a dark exchange deposit. New wallets bloom constantly; old ones turn to dust. Some addresses serve only once. Mixers and peel chains turn the stream of funds into droplets, and bridges turn investigator’s interest sideways. Decentralized exchanges turn it to mist.

That is why the ordinary crypto user talks about anonymity. The tangle’s mystery wraps everything in perceived privacy, its complexity massaging a sense of security. But that is precisely the difference between hard to read and unreadable, between an insoluble riddle and an open book.

Public blockchains are not opaque. They are permanently illuminated in broad daylight, where all transactions’ details are etched in stone for everyone to see. The network forgets nothing and no one, regardless of what its owners do. It does not care if a wallet owner deletes the chat application or a social media or a blog where they posted their achievements and crypto addresses or renamed their usernames or changed countries or their appearance. The blockchain remembers their addresses, their transfer data, their gas fees, their time stamps, their bridges, their hours.

The crook may change his clothes a hundred times, but he will still have to pass through the turnstiles. Even on the perceived edge of the system, the investigator finds his clues. He may track them through wallets, exchanges, over-the-counter desks, stablecoin issuers, bridges, fiat on-ramps, marketplaces, gambling websites, dark net markets, hacked services, and careless acquaintances.

Business of the blockchain analytics is built on this asymmetry - and the value of this knowledge is in demand. Some see chaos, some see order. Some see the scammer’s trail, which the scammer foolishly laid for them. They see the exits to the maze and its keepers who can be contacted. They see that a particular bridge is a weak point, vulnerable to pressure, and the law enforcer who can apply this pressure, even though the chain itself does little to stop the transfer. Crypto introduced a new level of uncertainty, and uncertainty is expensive: exchange’s deposits of frozen crypto assets, the bank’s losses due to regulatory costs, the fund’s counterparty risk, the victim’s anguish of the ongoing theft, the state’s reputation damage from sanctioned crypto - all of this is what blockchain analytics firms turn into profit.

If companies hate regulation, they hate the loss of property even more. This is why the demand arose for such services in the first place - it was not necessary to persuade the market of the importance of investigating crypto transactions’ trails. It was enough to wait for the next bridge heist, social engineering of a centralized exchange, a ransomware attack, stablecoin freezing by an issuer whose movements were double-checked by analytics firms right before. When the time comes to determine responsibility, it turns out that a wallet has predictable vulnerabilities and weak points, and its owner can be found.

Vigilante With a Block Explorer

Before the advent of the current industry giants, the crypto investigation field was dominated by independent volunteers who did their best to follow the trails with the limited toolset available. One of the most famous figures of this sector is ZachXBT - the pseudonymous investigator whose work became the prototype for many a professional researcher. His contributions to the field are invaluable, as he was one of the first to demonstrate to the world that the on-chain space was not impenetrable. He used block explorers and his knowledge of the crypto space to piece together the transaction trails and identify the malicious addresses. His investigations followed the known clues - wallets, bridges, mixers, social media accounts, Telegram chats - and combined them with his experience, intuition, and a certain ruthlessness to name the culprits publicly.

In addition to the obvious (wallets on centralized exchanges that have been flagged as suspicious or have connections with known scam addresses), investigators use a variety of methods to identify the perpetrator. These include analyzing the Discord calls, where the attacker often communicates with their victims, using screen-sharing software to get an idea of the victim’s screen, looking for videos or posts on social media where the scammer shows off their ill-gotten gains, analyzing the ENS names or usernames associated with the wallet, and investigating the exchange accounts. In many cases, the attacker’s carelessness is what ultimately gives them away: while they may be experts at tricking people into sending them crypto, they cannot resist the urge to flaunt their wealth online. Investigators analyze all of these factors, linking them to the known scam wallet to build a comprehensive view of the scammer’s activities that can later be used to freeze the account or trace funds to their real-world counterpart.

This approach is essential to understanding the current state of the blockchain analytics industry. The investigator still plays a critical role in the process: while the wallet clustering and association tools are incredibly useful, they cannot simply be used to name the perpetrator. It takes a skilled professional to analyze all of the factors and come to a reasonable conclusion. More importantly, however, is the ability to read the clues and follow them - and for that, analysts still rely on their intuition, insight, and experience.

ZachXBT was one such investigator who became famous for his successes in the field. However, as demand grew, companies began to appear that offered to perform similar services for those who could not afford the time or resources to do it themselves. While the independent vigilantes still provide high-quality results, the companies had an advantage in terms of legitimacy, as they could offer their clients more protection: many large organizations prefer to deal with an established business rather than an unknown individual, no matter how talented they may be. The market has responded to this need, creating an entire industry that focuses on analyzing the mysterious crypto tangle. The companies provide their clients with all the tools needed for detection and investigation, from wallets’ tracking to the identification of the perpetrators’ real-world counterparts.

Companies Selling Certainty

This industry comprises several major players that provide a variety of services to a large customer base. From detecting illicit activity to analyzing wallets to providing full-scale investigation, companies such as Chainalysis, TRM Labs, Elliptic, Crystal Intelligence, Merkle Science, Arkham, and several others serve different niches and have a different approach to the blockchain analytics space. Some provide tools for investigators and analysts, others target the compliance space, and yet others offer their services directly to law enforcement or ordinary crypto owners who wish to protect their assets.

The oldest company to appear in this space (and arguably the most established one) is Chainalysis.

The company has built an impeccable reputation for itself, providing security and detection services to major companies as well as government agencies. It has an entire suite of different tools, ranging from wallet tracing to more specialized solutions such as Reactor for investigation use cases. Due to its early entry into the space and superior reputation, Chainalysis enjoys a status of a default option for many government agencies and businesses that need to secure their assets. It is often the preferred option for crypto compliance, and its products are trusted to hold up in court, which gives the company an invaluable edge over its competitors.

At the same time, the demand for alternatives is also growing, fueled by dissatisfactions with the status quo. TRM Labs was one of the companies that managed to gain significant traction by directly competing with Chainalysis, offering its own take on wallet analytics and investigation tools. Its primary value proposition is its versatility, as the company positions itself as a crypto-native entity that can provide end-to-end compliance solutions. TRM’s tools are convenient and intuitive, designed to be easily incorporated into an existing analyst’s infrastructure while also providing additional features that many traditional companies lack. It offers its clients extensive investigation tools, including VASP discovery, confidence scoring, risk assessments, and other helpful mechanisms for detecting illicit activity. The company has even managed to position itself as a serious competitor to Chainalysis. With the introduction of more innovative features and a rapidly growing customer base, TRM is quickly establishing itself as a major player in the blockchain analytics space.

Meanwhile, Elliptic takes a different approach, focusing on a risk assessment and investigation approach to the crypto compliance space. Positioning itself as a company that takes a cross-chain view of the industry, Elliptic highlights its extensive range of institutional-grade tools. Due to its strong reputation, Elliptic has secured its position as a preferred provider of compliance services for financial institutions, especially outside the US. This helps the company to dominate the European market, where many traditional crypto-friendly banks conduct their operations. It is yet another analytics firm that boasts deep institutional knowledge and is able to provide excellent solutions in terms of investigation and tracking.

Compared to the established names, Crystal Intelligence is a relative newcomer, but the company has been steadily gaining ground on its competitors through a combination of wide-ranging tools, convenient on-premise options, and excellent customer support. One of its primary advantages is its flexible approach to the market: unlike many of its competitors, Crystal offers various options to its clients, ranging from cloud-based solutions to fully on-premise infrastructure. Due to its convenient interface and extensive investigative tools, it has carved a niche for itself as an excellent option for investigators dealing with multiple blockchains. This is especially useful in the current environment, where bridges and other multi-chain services play an increasingly important role. Being able to analyze activity across chains helps to conduct more efficient investigations, and Crystal’s broad coverage enables it to serve as a reliable compliance partner.

In many ways, Merkle Science is similar to Elliptic, as it has been focusing on the institutional space to provide risk assessment and investigation services. Merkle Science highlights its unique approach to behavioral analytics, which helps to identify suspicious activity based on patterns. Its tools can be used by investigators to assess the risk associated with particular on-chain activity, helping to uncover threats before they can cause serious damage.

Speaking of investigators, Arkham is one of the youngest but most promising companies in the space. It takes an innovative approach to the blockchain analytics market, offering a variety of tools that prioritize accessibility and convenience. Its public intelligence tools and marketplace enable investigators and everyday users alike to obtain valuable information regarding particular wallets or addresses. By doing so, Arkham creates an environment where everyone can participate: while private investigators and law enforcement can use its tools to detect criminals, ordinary users and investors can benefit from analyzing the suspicious activity patterns.

While each of these companies has its own unique strengths, they all serve the same general purpose: investigating suspicious crypto activity and providing investigators with the tools they need to follow the trail. Many of them compete directly with one another, offering similar services, but they are unable to eliminate one another due to the sheer demand for their products and services. In addition, the companies also employ a variety of different sales strategies, ranging from the direct-to-consumer approach to partnerships with law enforcement and compliance departments. As such, it is quite difficult to distinguish between them on any objective basis: they all rely on the same fundamental principles but apply them in slightly different ways.

Detectives, Machines, and Private Clients

The rise of large language models has not made analysts any less necessary - but it has made them happier, as the tools allow them to accomplish more in less time. The on-chain investigation field is highly reliant on visual analysis: investigators follow the trail, connecting wallets to each other. It is not uncommon to see investigators manually expanding the graphs, analyzing the on-chain data, going through entity labels, and exporting CSVs for further processing. But with the emergence of AI agents, many of these mundane tasks can now be automated. Analysts can utilize the power of natural language processing tools to generate graph views, gain insight into the suspicious patterns, and make educated guesses as to what the next steps should be. It is much easier to ask an LLM to trace the bridge activity than it is to do it manually. Chainalysis ais one of the companies that provide such opportunities, as its investigators can now rely on the power of extensive training data, which allows them to accomplish more than ever before. Criminals have also taken advantage of the opportunities presented by AI, using it to scale their operations. Phishing, fraud kits, and money laundering scripts now generate far more volume than they ever did before. The investigators have to keep up, using automation to stay ahead of the game.

Old-school detectives and investigators still hold a special place in the industry. The new on-chain sleuths often combine elements of traditional detective work and digital investigation to get better results. A private investigator can follow the familiar breadcrumbs while also taking advantage of the crypto wallet trail. The tools have been developed, making it much easier to investigate the blockchain’s activities, but the basics have not changed: it is still necessary to follow the clues and gather evidence. The investigator who lacks these skills will be much less successful than the one who utilizes the fundamentals in addition to the tools. They enable the investigator to achieve synergy: while traditional techniques will narrow the search window, the digital tools will help to accelerate the process.

The phrase “find a guy” may seem crude, but it effectively summarizes the purpose of the investigator’s work. A crypto investigator often receives vague instructions: get me the guys behind this wallet address. Sometimes, the investigator has to determine who is responsible for the attack. This may involve looking through numerous compromised smart contracts, determining the initial point of contact, and ultimately narrowing the search window. An investigator may have to determine whether a particular scam wallet has been used to launder money and locate the person behind it. A company might need to identify a particular developer in order to bring them to justice, prevent further incidents, or reclaim assets. An exchange may suffer from a sanctions-related transaction freeze and need to quickly determine the underlying cause. A start-up may be concerned about receiving funds from a suspicious wallet and need to verify the information before proceeding. An insurance company may need to investigate a claim in order to determine whether the funds have actually been stolen. The government may need to conduct an investigation into a ransomware attack in order to bring the perpetrators to justice. There are many variations, but the common theme is that the investigator has to utilize all of the available knowledge and tools to locate the target wallet’s counterparty.

The same logic of professional tools applies to day-to-day TRON operations as well. Netts Workspace consolidates Energy API programming, TRON automation, AML checks with Elliptic, transaction history, smart delegation mode, reporting, and USDT fees management into one dashboard for serious TRON users who need more than a casual wallet button. It does not replace blockchain analytics companies that are on the trail of every stolen asset on a global scale 24/7/365, but it helps TRON users and companies to operate in a more organized manner and preempt minor issues that could arise from ignoring Energy, Bandwidth, AML checks, or TRON costs.