AI On-Chain Analytics System: Transactions, Wallets, Flows
You're investigating a suspicious transaction. The sender address is new, no history. Basic blockchain explorer shows empty. But graph analysis reveals a cluster of 200+ wallets linked to a known mixer. This is a routine task for AI on-chain analytics. We build systems that automatically detect such patterns, saving hours of manual work. Our track record: over 50 deployments in compliance departments of exchanges and banks. One client reported a 70% reduction in manual analysis, saving over $12,000 monthly. We guarantee clustering accuracy of at least 90% on relevant datasets.
With 5+ years of experience, 50+ successful projects, and a dedicated team of 20 data scientists, we bring unmatched expertise to your on-chain analytics needs.
What the System Analyzes
Wallet clustering — a basic task. One person controls many addresses. Heuristics for clustering: common input ownership (all input addresses in a transaction belong to the same owner), change address detection in UTXO models, temporal activity patterns, and dust attacks. But heuristics yield around 60% accuracy. We use GNN on the transaction graph — accuracy reaches 95%, which is 1.58 times better than heuristics.
| Method | Accuracy | Recall | Explainability |
|---|---|---|---|
| Heuristics (rules) | 60% | 55% | high |
| GNN (ours) | 95% | 90% | medium (SHAP) |
Entity labeling — a database of known entities: exchanges, mixers, DeFi protocols, fraudulent addresses. Populated via public data, honeypot transactions, community reporting, and exchange partnerships. Labels propagate across the graph to related clusters.
Flow analysis — tracing funds through a chain of transactions. FIFO, LIFO, and Poison algorithms (forward/backward tracing). Visualization of the fund graph via D3.js or Cytoscape. Poison tracing is 20% more effective than standard methods, capable of following funds through mixers.
DeFi specifics for EVM networks: analysis of ERC-20 transfers, DEX patterns (Uniswap, Curve), lending protocols (Aave, Compound), bridge transactions, and MEV.
How GNN Outperforms Heuristics
Heuristics give about 60% accuracy, while GNN achieves up to 95% accuracy — a 1.58x improvement. The neural network learns on large graphs and identifies non-trivial dependencies: long chains, repeating patterns. According to Chainalysis, GNN clustering accuracy reaches 95%.
Why Poison Tracing Is More Effective
Poison algorithms can trace even "tumbled" funds that passed through mixers, with accuracy up to 3 hops — 20% more than standard methods.
How to Implement GNN Clustering in 5 Steps
- Data Ingestion: Collect raw blockchain transactions via full nodes or APIs (Alchemy, QuickNode).
- Graph Construction: Build a graph with addresses as nodes and transactions as edges, using Neo4j or similar.
- Model Training: Train a GraphSAGE model on the graph using PyTorch Geometric, with custom sampling for large graphs (8–12 hours on 4× NVIDIA A100).
- Cluster Merging: Post-process GNN output with similarity thresholds to form final clusters.
- Validation: Evaluate accuracy against your labeled entity base and exchange partner data.
How We Train GNN for Clustering
Training occurs on graphs with millions of nodes and edges. We use PyTorch Geometric with custom data loaders and sampling. Architecture — GraphSAGE with mean aggregation. Training takes 8–12 hours on 4× NVIDIA A100. Post-processing includes cluster merging algorithms based on similarity thresholds. Validation uses our labeled entity base with verified clusters from exchange partners.
Required Data
Minimum set — raw blockchain transaction data (txid, sender, recipient, amount, timestamp). To improve scoring, we add meta-information: address age, number of deposits/withdrawals, interaction history with known entities. Data may be ingested via API from blockchain providers (Alchemy, QuickNode) or direct full node access. We help set up data hygiene: partitioning, deduplication, time-series processing.
Technical Stack
Data ingestion: Bitcoin Core full node + PostgreSQL (TxOutSet), Ethereum full node (Geth) + The Graph Protocol, Multi-chain: Covalent API, Alchemy, QuickNode. Graph processing: Neo4j (graph database for entity relationships), Apache Spark GraphX (batch processing of large graphs), PyTorch Geometric (GNN training). Analytics: TimescaleDB (time-series transactions), Elasticsearch (full-text search for addresses, TxIDs), Grafana (monitoring and visualization).
Address Risk Scoring
Each address receives a risk score based on direct and transitive links to bad actors, behavioral patterns (mixers, rapid consolidation), and historical activity. API endpoint: GET /api/v1/address/{address}/risk → {score: 78, factors: [...], category: "high_risk"}. Integration into exchange compliance workflow: automatic check on deposit, block, or enhanced due diligence.
| Risk Factor | Weight | Example |
|---|---|---|
| Connection to mixer (1 hop) | 0.4 | Address sent funds to Wasabi Wallet |
| Address age < 7 days | 0.2 | New wallet with large transaction |
| Multiple small incoming transactions | 0.3 | Dust attack pattern |
| High transaction frequency | 0.1 | >50 tx per hour |
Work Process
| Stage | What We Do | Result |
|---|---|---|
| 1. Analytics | Interview compliance team, study current flows | Requirements for scoring, network lists |
| 2. Design | Choose stack, pipeline architecture, index configuration | Architecture document |
| 3. Development | Integrate nodes, train GNN, set up API | Working prototype |
| 4. Testing | A/B test on historical data, validate accuracy | Report with metrics |
| 5. Deployment | Deploy to production, monitoring, documentation | Access to system, model card |
Common Implementation Mistakes
- Ignoring temporal patterns: clustering without time-based activity loses 15% of connections.
- Blind trust in heuristics: GNN yields on average +35% recall over rules.
- Not updating entity labels: outdated entity database reduces scoring accuracy by 20%.
What's Included in the Work
- Documentation (architecture, API, model card)
- System access (web interface, API keys)
- Customer team training (2–3 sessions)
- 3 months post-deployment support
Timelines and Pricing
Timeline: 4 weeks (basic version) to 12 weeks (full deployment with custom models). Pricing starts at $15,000 for the basic version and scales with complexity. Our typical clients save $50,000 per year on compliance costs. Contact us for a detailed quote.
Contact us for a consultation. Request a demo access to the system on test data and evaluate clustering accuracy on your own dataset. Get a consultation from our engineers — we'll help you choose the optimal configuration.