Blockchain Analytics Platform

Blockchain Analytics Platform

# Blockchain Analytics Platform

On-chain data is transparent but impenetrable at scale. Every block explorer shows raw transactions, but connecting the dots between wallets, identifying entity clusters, tracing fund flows across chains, and assessing risk requires stitching together multiple paid tools. Teams waste hours switching between Etherscan, Dune dashboards, Glassnode, and compliance platforms just to answer basic questions like "where did this money come from?" or "is this wallet risky?" Existing tools are either siloed (one chain only), expensive (Chainalysis-tier pricing), or require deep engineering to operationalise. There is no unified CLI tool that ingests on-chain data, performs address clustering, runs flow analysis, scores risk, and generates compliance-ready reports in one pass.

What It Does

• Ingests blockchain data via public RPC endpoints and APIs across 10+ chains
• Performs address clustering using common-input heuristics and behavioural patterns
• Traces fund flows with multi-hop transaction graph building
• Computes entity-level risk scores based on exposure to mixers, sanctions, darknet markets, and exchange flows
• Generates AML compliance reports with actionable risk indicators
• Tracks DeFi protocol metrics (TVL, volume, user counts, token flows) across major chains

Frameworks and Standards Covered

| Framework / Standard | Application | |---|---| | FATF Travel Rule | VASP-to-VASP transaction attribution and reporting | | FinCEN Guidance 2019-05 | CVC transaction monitoring for MSB compliance | | EU MiCA Regulation | Crypto-asset service provider transaction monitoring | | OFAC Sanctions Screening | Address screening against SDN list | | ISO 20022 | Structured report format for crypto payments | | TRM / Chainalysis Risk Models | Heuristic-based risk scoring methodology | | GraphSense TagPack Format | Entity attribution and tag management | | Dune Analytics Query Model | SQL-based on-chain data extraction patterns | | ROCA (Risk of Crypto Assets) | Entity-level exposure analysis framework |

Feature Breakdown

### Address Clustering Engine Groups addresses likely controlled by the same entity using: - Common-input heuristics - addresses used as inputs in the same transaction belong to the same entity - Change address detection - identifies likely change outputs in UTXO chains by amount and position heuristics - Behavioural clustering - groups addresses with matching transaction timing patterns, gas price behaviour, and interaction sets - DEX interaction overlap - clusters addresses that interact with the same set of DeFi protocol addresses during overlapping time windows ### Transaction Flow Tracer Builds directed transaction graphs across configurable search depth: - Forward tracing (from source address outbound) - Backward tracing (to source address inbound) - Peel-chain detection (identifies structured money movement patterns) - Cross-chain bridge flow mapping - Mempool-level pending transaction analysis (where supported) - Timestamp-constrained search windows ### Risk Scoring Framework Multi-dimensional risk assessment per address: - Sanctions risk - direct or indirect exposure to OFAC/SDN-listed addresses - Mixer risk - interaction with CoinJoin, Tornado Cash, or similar privacy tools - Darknet risk - transaction paths touching known darknet market wallets - Exchange risk - categorised by regulated vs. unregulated exchange interaction - Age risk - newly created wallets scoring higher for certain patterns - Volume risk - anomalous transaction sizing vs. typical behaviour - Flash loan risk - exposure to flash loan attack patterns in DeFi - Bridge risk - interaction with bridge contracts (higher risk for certain thresholds) ### DeFi Metrics Collector - Pulls TVL, volume, and fee data from DeFiLlama-compatible endpoints - Tracks token price and liquidity changes over configurable windows - Monitors protocol-level user counts and transaction volumes - Identifies large withdrawals/deposits at protocol level - Detects anomalous contract interactions (potential exploit patterns) ### Compliance Report Generator Generates structured reports suitable for: - AML compliance filings - Internal investigation documentation - Law enforcement referral packages - Due diligence onboarding reports - Periodic portfolio risk review

Quick Start

```bash
# Install dependencies
pip install requests web3 python-dotenv pyyaml

# Analyze a wallet address
python3 scripts/cli.py analyze --address 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18 --chain ethereum

# Trace fund flow
python3 scripts/cli.py trace --address 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18 --depth 3 --direction both

# Run risk assessment
python3 scripts/cli.py risk --address 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18 --output report.json

# Batch analyze a portfolio
python3 scripts/cli.py batch --file wallets.csv --format json

# Generate compliance report
python3 scripts/cli.py report --address 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18 --type aml --output aml_report.pdf
```

Configuration

Create `config/settings.yaml`: ```yaml chains: ethereum: rpc_url: "https://eth-mainnet.g.alchemy.com/v2/YOUR-KEY" explorer_url: "https://api.etherscan.io/api" api_key: "YOUR_ETHERSCAN_KEY" polygon: rpc_url: "https://polygon-mainnet.g.alchemy.com/v2/YOUR-KEY" explorer_url: "https://api.polygonscan.com/api" api_key: "YOUR_POLYGONSCAN_KEY" bsc: rpc_url: "https://bsc-dataseed.binance.org/" explorer_url: "https://api.bscscan.com/api" api_key: "YOUR_BSC_KEY" analysis: max_trace_depth: 5 default_depth: 3 risk_threshold_high: 70 risk_threshold_medium: 40 cluster_similarity_threshold: 0.85 include_mempool: false enable_cross_chain: true reporting: output_format: "json" include_graph_dot: true max_transactions_in_report: 500 include_timeline: true ```

Output Format

Reports include: - Address Profile - first seen, last active, total tx count, total volume - Cluster Info - all addresses in the same cluster, cluster risk score - Risk Breakdown - per-category risk scores (0-100) with explanations - Transaction Flow - forward/backward connections with hop counts and value - Sanctions Matches - any matches against known blocked addresses - Counterparty Summary - top counterparties by volume and risk tier - Timeline - chronological activity summary - Recommendations - actionable risk mitigation suggestions ### Sample Report (abbreviated) ```json { "address": "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18", "chain": "ethereum", "profile": { "first_seen_block": 12000000, "total_transactions": 342, "total_volume_eth": 1250.45, "active_days": 187 }, "cluster_id": "clust_8f3a2b", "cluster_size": 12, "risk_scores": { "overall": 42, "sanctions": 0, "mixer": 35, "darknet": 0, "flash_loan": 68, "exchange_unregulated": 45, "age": 12 }, "flags": ["flash_loan_active", "mixer_exposure_indirect"], "counterparties": [ {"address": "0x...", "volume": 450.2, "risk": "medium"}, {"address": "0x...", "volume": 320.0, "risk": "low"} ], "recommendations": [ "Indirect mixer exposure detected via second-hop transaction. Review counterparty cluster.", "Active flash loan pattern detected. Verify if user is performing legitimate arbitrage." ] } ```

Why This Beats Prompting It Yourself

Capability This Skill Raw Prompting --- --- --- Multi-chain address clustering Built-in heuristics for 10+ chains Must know and implement each chain's quirks manually Transaction flow tracing at configurable depth 1 command, auto-graph building Must construct and follow links manually every time Risk scoring across 8 dimensions Pre-computed with explanations Must research each risk vector individually Compliance-ready report generation Structured JSON/markdown output Must format manually from scattered tools Batch portfolio analysis CSV import, batch risk scores Must repeat single-address workflow N times Cross-chain bridge flow mapping Automated bridge detection and tracing Must track across separate explorers manually Sanctions screening integration Built-in OFAC SDN matching Must maintain own list and check tool by tool Graph visualisation export Auto-generates DOT format for Graphviz No visual output from raw prompting

Use Cases

• Compliance Officer at a Crypto Exchange - Screen incoming deposits against sanctions lists, run risk scores on withdrawal addresses, and generate AML reports for regulatory filings.
• DeFi Protocol Security Team - Monitor protocol wallets for unusual activity, trace stolen funds after an exploit, and assess bridge transaction patterns for attack signatures.
• On-Chain Investigator - Trace ransom payment flows, identify wallet clusters behind phishing campaigns, and build evidence packages for law enforcement referral.
• Portfolio Risk Manager at a Crypto Hedge Fund - Run batch risk assessments on all counterparty addresses, flag mixer-exposed wallets, and monitor for sanctions exposure across the fund's OTC desk.
• Web3 Auditor - Verify that smart contract deployers have clean on-chain histories, check team vesting wallets for cluster associations, and flag any connection to known bad actors.