Blockchain analytics

As of September 2026: Illicit-volume figures are the vendors' own published 2025 estimates as of September 2026, and both firms say such numbers are minimums that are revised upward later. Travel rule adoption figures are from FATF's seventh targeted update (July 16, 2026), which covers surveyed jurisdictions, not the whole world.

What is blockchain analytics?

Cash leaves few records. A public blockchain does the opposite: every transfer, its size and its timing are recorded permanently and open to anyone. Most major networks are pseudonymous, not anonymous. Transfers are tied to addresses, and an address has no name attached until someone links it to one.

Blockchain analytics is the work of making that link. Private firms such as Chainalysis, Elliptic and TRM Labs build software that maps the ledger, and government agencies, banks and exchanges buy it. Investigators use it to follow stolen or criminal funds. Compliance teams use it to screen customers’ deposits for links to sanctioned or criminal wallets.

How does tracing work?

The work has two steps.

Clustering. Software groups addresses that are probably controlled by the same party. Chainalysis describes the methods as common-input-ownership analysis (addresses that are spent together in one transaction are likely one owner), change address detection, and behavioral patterns. Elliptic describes the same goal: working out whether transactions from different wallets are coming from the same place.

Attribution. A cluster becomes useful when it is labeled. Chainalysis says analysts link clusters to real-world entities using exchange data, law enforcement intelligence and open-source research. Elliptic describes tagging a wallet with a “typology” that ties it to a kind of illicit activity, so future transactions can be flagged. Once a label is attached, any funds that later touch that cluster can be flagged automatically.

Why are exchanges the chokepoint?

Criminal proceeds have to be spent, and spending usually means converting crypto into ordinary money. That step tends to happen at a regulated business such as an exchange, which holds the customer’s identity documents. It is the point where a pseudonymous trail meets a named person.

This is why enforcement pushes at exchanges. After the February 2025 Bybit theft, the FBI attributed the loss to North Korean “TraderTraitor” actors and published the Ethereum addresses, asking exchanges, bridges, analytics firms and other providers to block transactions linked to them. In the Bitfinex case, the Justice Department described a laundering effort that ran through fictitious identities, darknet markets, exchanges, mixing services and gold coins, and that continued from 2016 until arrests in February 2022. Every one of those on-chain steps was recorded on a public ledger. See the case files for both.

Why do stablecoins change the picture?

Stablecoins are crypto tokens designed to hold a steady value. Chainalysis says they made up 84 percent of illicit transaction volume in 2025, and FATF’s July 2026 update says most identified on-chain illicit activity now involves stablecoins. Freezing and seizure are the responses that regulators and investigators rely on once analytics has found an address, and FATF warns that illicit actors adapt: it cites a proprietary stablecoin, backed by a financial group linked to criminal networks, designed to resist freezing and seizure.

What does a compliance team look for?

Exchanges and banks use analytics for screening, not just after-the-fact tracing. A deposit is scored for its exposure: does it come directly or through a few hops from an address labeled as sanctioned, as a scam operation, or as a mixing service? Rapid movement through many addresses and across chains also draws attention. A high score does not prove wrongdoing, and Chainalysis says risk scores should be inputs to human judgment, not verdicts.

What is the travel rule?

Banks have long had to pass sender and recipient details along with wire transfers. The travel rule extends that to crypto. When one virtual asset service provider (VASP) sends value to another, it must share identifying information about the parties. The point is to prevent a transfer from stripping identity as it moves between businesses.

In the US, FinCEN guidance from May 2019 explained that convertible virtual currency transmitters are money transmitters, so the funds travel rule can apply to transfers of $3,000 or more. Globally, FATF reported in July 2026 that 83% of surveyed jurisdictions (91 of 109) now have travel rule legislation, up from 73% in 2025, and that a further 11 say implementation is under way. FATF also warned that many jurisdictions have not yet turned the law into supervision and enforcement. See the FATF page for how the standards are set and monitored.

Where the tools fall short

Honest analytics vendors say so themselves.

• Results are probabilistic. Chainalysis says its heuristics produce probabilistic results, not certainties, with confidence that varies by data quality and by the sophistication of obfuscation. Clusters can be wrong and labels can go stale.
• Estimates are floors. Chainalysis counted at least US$154 billion of illicit receipts in 2025 and TRM US$158 billion, and each calls its figure a minimum. Chainalysis revised its 2024 estimate from US$40.9 billion to US$57.2 billion. Numbers that keep rising mean early counts missed a lot.
• The rules are uneven. FATF says jurisdictions struggle to identify VASPs, to deal with offshore providers and to assess risk in decentralized finance. It also notes a financial group linked to criminal networks building a stablecoin meant to resist freezing and seizure.
• Courts want proof. Chainalysis notes that tools without documented methods and known error rates may not survive legal challenge, so analytics results usually need corroboration from account records and other evidence.

Related techniques, and how investigators view them, are covered in the techniques hub, including mixers and chain-hopping. For the reports that exchanges themselves file, see reporting and the FIU page.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026