Blockchain Monitoring

Blockchain Monitoring is a specialized technology-based control that financial institutions integrate into their AML/CFT frameworks to detect, investigate, and disrupt illicit activities in cryptocurrencies and digital wallets. By applying advanced analytics and chain analysis, it traces fund flows, identifies abnormal or suspicious transaction patterns, and illuminates connections among blockchain entities. This increased transparency enables the filing of suspicious transaction reports, targeted asset freezing, and focused investigations against threats such as layering, ransomware-related flows, and cross-border transfers exploiting the pseudonymous nature of digital assets. Integrated into existing compliance workflows, Blockchain Monitoring significantly strengthens an institution’s capability to safeguard against the misuse of cryptocurrency services and enhance overall AML/CFT controls.

[
Code
M0011
]
[
Name
Blockchain Monitoring
]
[
Version
1.0
]
[
Application Level
Tactical
]
[
Functional Category
Transaction & Activity Monitoring, Escalation
]
[
Client Lifecycle Stages
Ongoing Relationship, Onboarding, Post Alert
]
[
Created
2025-01-23
]
[
Modified
2025-04-02
]

Client Lifecycle Stages

CL0004
|
Ongoing Relationship
|

Continuously track wallet addresses.

CL0003
|
Onboarding
|

If a customer uses crypto from the start, monitoring might begin at or shortly after onboarding.

CL0005
|
Post Alert
|

Investigate suspicious blockchain flows.

Mitigated Techniques

  • Use blockchain analytics tools to identify transactions involving mixers and privacy wallets.
  • Identify patterns of transactions associated with mixers, such as the use of CoinJoin or other mixing protocols.
  • Identify transactions originating from "tainted" sources, such as blacklisted addresses.
  • Analyze transaction graph data structures.
  • Analyze transaction patterns for laundering activities.
T0003.001
|
|

Use advanced blockchain analytics to identify addresses flagged as custodial mixers, track fund flows through aggregator wallets, and detect short deposit-to-withdrawal intervals. This enables visibility into repeated mixing cycles, revealing layering patterns that obscure the original fund provenance.

Use specialized blockchain analytics solutions to track transactions to or from known decentralized mixer addresses, analyze cross-chain bridging or aggregator usage that might indicate layering, and promptly escalate suspicious patterns for further investigation. This measure provides advanced insight into the flow of funds, enabling institutions to identify hidden connections and reduce the anonymity provided by decentralized mixing protocols.

T0005
|
|

Use advanced cross-chain analytics to trace assets as they move between blockchains, identify bridging patterns indicative of layering, and detect the involvement of newly issued tokens or stablecoins employed to break transactional links. Integrate known aggregator and bridging service data to pinpoint suspicious chain-hopping practices more efficiently.

Implement specialized on-chain analytics to identify addresses definitively used for burn events (i.e., lacking private keys) and correlate burned token amounts with newly minted tokens on other chains. Monitor short intervals between burns and re-mints to detect cross-chain layering attempts. By pinpointing these burn-to-mint sequences, institutions can better address the technique’s core vulnerability of obscuring asset provenance through chain transitions.

Use specialized blockchain analytics tools to detect and trace cross-chain bridging transactions. Specifically, monitor patterns such as rapid bridging sequences, lock-and-mint mechanisms, or transfers to anonymity-focused networks, which are commonly exploited for layering and concealing fund flows across different blockchains.

Apply specialized on-chain analytics and wallet clustering to trace fund flows linked to suspected money mule accounts. Use IP and device fingerprinting to correlate multiple digital wallets controlled by the same individual, revealing coordinated funnels of criminal proceeds through crypto channels.

T0011.002
|
|

Leverage blockchain analytics to track on-chain flows from crypto ATM addresses. Identify repeated use of the same wallet by multiple individuals at different terminals, detect potentially linked addresses across jurisdictions, and escalate evidence of pattern-based layering or funneling consistent with money mule networks.

Use advanced blockchain analytics to identify short-term wallet balances, repeated interactions with high-risk addresses, and unexplained cross-jurisdiction transfers. Cross-check on-chain data with off-chain transactions to reveal NEP's unregulated intermediaries or suspicious aggregator addresses.

Leverage specialized blockchain analytics to detect recurring small-value transfers sent to newly generated or ephemeral addresses. Aggregate these sub-threshold transactions over time or across wallet clusters to reveal structuring attempts otherwise concealed by blockchain pseudonymity.

T0016.005
|
|

Apply blockchain analytics to identify coordinated smurfing across multiple wallets moving small amounts of cryptocurrency in repetitive patterns. Investigate clusters of transactions that originate from or converge on the same addresses, ensuring sub-threshold transfers aimed at concealing illicit proceeds are flagged for further review.

If in-game currencies or items are linked to public blockchains, use specialized ledger analytics to trace wallet addresses associated with gaming transactions. Pinpoint potential layering steps by identifying short holding periods, large cross-border transfers, or mixing strategies designed to disguise the path of funds. Investigate repeat patterns involving wallets previously flagged for illicit activities.

Utilize blockchain analytics to trace and analyze inbound crypto donations to charitable organizations. Flag addresses associated with mixers, newly established wallets lacking transaction history, or large inbound transfers from uncertain sources. This specifically addresses infiltration tactics leveraging the anonymity of digital assets to evade detection.

Leverage specialized analytics to track the source of newly generated cryptocurrency, identify high-risk or pseudo-anonymous mining pools, and detect abrupt transfers of fresh coins into exchange or customer wallets. Cross-reference on-chain activity with known minimal-KYC pools or hosting services to flag possible obfuscation of illicit funds via remote mining.

T0020.001
|
|

Leverage specialized blockchain analytics to trace newly mined coins originating from remote mining pools. Identify large deposits moving to multiple wallets across different jurisdictions or patterns inconsistent with normal mining outputs. By exposing these flows, institutions can identify layering attempts that rely on creating distance between illicit funds and their criminal origin.

Deploy chain-analytics to follow rapid “peel-chain” or mixer hops when automated scripts pivot value into crypto, linking on-chain patterns back to originating bank activity.

Analyze on-chain data for NFT or cryptocurrency payments linked to e-commerce transactions by tracing fund flows, identifying unusual wallet cluster activity, and correlating off-chain sales data with on-chain movements.

Leverage specialized chain analytics to trace rapidly executed cross-chain conversions linked to non-custodial swap services. Flag multi-hop transactions that intentionally obfuscate the originating wallets or final beneficiaries.

Use specialized analytics tools to trace cryptocurrency flows into and out of self-hosted and privacy-focused wallets. Specifically, track CoinJoin or stealth transactions, identifying chain-hopping or intermittent layering patterns. By mapping wallet histories, institutions can detect illicit funds moving through unregulated addresses that bypass conventional oversight.

T0034.001
|
|

Continuously monitor on-chain transactions using specialized blockchain analysis software. Identify patterns indicative of layering, chain-hopping across multiple cryptocurrencies, and the use of coinjoin or zk-based protocols to obscure ownership. By tracking wallet histories and linking addresses, institutions can detect high-risk clusters and disrupt attempts to launder proceeds via privacy-focused wallets.

Deploy specialized blockchain analytics to detect repeated trades among related addresses at distorted prices for NFTs or digital tokens. Flags include wash trading and collusive 'whale' activities that artificially inflate or deflate digital asset valuations to conceal illicit gains under a veneer of legitimate trades.

Use advanced blockchain analytics to trace funds across multiple addresses and blockchains, identifying mixers, anonymity-enhanced cryptocurrencies, or bridging services commonly used by ransomware groups for obfuscation. By tracking the flow of extorted funds, institutions can detect and intervene in ransomware-related layering activities.

Use blockchain analytics to trace abnormal cryptocurrency deposits or withdrawals tied to adult webcam or content hosting platforms. Identify suspicious address clusters with sudden spikes in micropayments, potentially indicating revenue from forced pornography or sexual exploitation, and escalate for immediate investigation or account restrictions.

Use specialized analytics to track wallets and blockchain transactions tied to platforms popular among minors. Focus on repeated small-value inflows or high-velocity transfers that could mask child exploitation proceeds. Identify wallet addresses flagged for underage content sales, monitor mixing/tumbling services often used to conceal these illicit funds, and promptly escalate anomalies for potential law enforcement engagement.

Use advanced blockchain analytics to detect addresses and transactions linked to high-risk or sanctioned jurisdictions, tracing the flow of digital assets across borders. Identify layering attempts involving multiple accounts or unregulated exchanges domiciled in secrecy-friendly locales. Investigate unusual volume or velocity of funds moving to or from these jurisdictions to expose efforts to obscure illicit proceeds.

Track cryptocurrency addresses interacting with crypto ATMs to detect red flags such as rapid layering, repeated address usage at multiple kiosk locations, or known illicit wallet histories. Use chain analytics to identify patterns indicating structured transactions or geographical displacement designed to obscure activity.

Deploy specialized analytics to track NFT movement across wallets and blockchains, identifying correlations in repeated transfers, usage of mixing services, and patterns consistent with self-dealing or wash trading. By monitoring wallet clusters and multi-chain hops, this measure uncovers structured NFT layering schemes that blur the origin of funds.

Apply chain-tracing tools to trace internal tokens or NFTs leveraged within metaverse or virtual world ecosystems, promptly identifying wash trades, rapid asset flipping, and code exploit transactions. By mapping on-chain flows across gaming platforms, institutions can spot cross-chain layering tactics that obscure illicit origins.

Leverage specialized blockchain analytics to trace funds from suspicious or stolen token sources into metaverse-based transactions. Identify unusual wallet linkages, repeated NFT transfers at inflated prices, or code-exploit manipulations. Maintain updated external intelligence on addresses associated with wash trading or known exploits to flag high-risk transactions for review.

Use specialized chain analytics to track digital tokens, NFTs, or in-game currencies migrated across different blockchain-integrated gaming platforms. This reveals complex cross-chain bridging or token swaps designed to layer funds, flagging high-risk flows for deeper investigation.

Track crypto wallets funding in-game currency accounts and monitor transactions from unregulated or grey-market crypto exchanges that convert in-game assets to cryptocurrency. Analyze blockchain movements to identify repeated patterns of address usage, large or frequent deposits aligning with in-game purchases, and liquidation events with no legitimate gaming justification.

Employ dedicated blockchain analytics to track token movements across different networks, detecting repeated bridging, layering patterns, and high-volume or rapid-fire swaps. By correlating wallet activity across multiple chains, institutions can pinpoint addresses coordinating pseudonymous transactions for illicit fund flows.

T0067.001
|
|

Use specialized blockchain analysis tools to trace payment token flows across multiple wallets, identifying short holding periods, round-number transfers, or circular transactions that indicate layering or concealment. Link wallet addresses to known illicit activities by correlating on-chain data with external risk information.

Implement specialized cross-chain analytics tools to identify token-locking, bridging events, and wrapped token transactions across multiple blockchains. This directly addresses the complexities introduced by cross-chain wrapping by detecting abnormal bridging flows, repeated wrapping/unwrapping, or short holding periods indicative of layering attempts.

Deploy advanced on-chain analytics to trace the flow of governance tokens across multiple blockchain networks. Focus on detecting short holding periods, repeated bridging, and multi-hop wallet transfers that deviate from typical governance participation, as these patterns commonly reflect deliberate layering and obfuscation.

Leverage blockchain analytics tools to trace cross-chain movements, aggregator bridging, and yield-farming transactions. Identify patterns such as newly created self-custodial wallets used in quick succession, suspicious chain-hops, or abnormally complex flows across multiple DeFi protocols indicating potential layering attempts.

T0067.005
|
|

Implement specialized analytics tools to trace cross-chain bridging, repeated token swaps, and high-velocity utility token movements across multiple blockchains. Investigate wallet addresses frequently involved in short-interval transfers or connected to known illicit activities. By leveraging on-chain data from multiple networks, institutions can detect layering attempts aimed at obscuring fund origins.

Deploy dedicated chain analytics to trace cross-asset bridging, chain hopping, and the use of off-chain or Layer 2 solutions (e.g., the Lightning Network). By identifying high-volume micro-transactions, sudden shifts across multiple blockchains, and attempts to move funds off-chain, institutions can detect efforts to obscure fund origins and escalate promptly for enhanced scrutiny.

T0070.002
|
|

Blockchain analytics tools can track and identify typical chain peeling indicators, such as when a user repeatedly creates new addresses for each transfer instead of reusing them, and multiple hops in the transaction chain.

Use specialized analytics to trace on-chain fund transfers and identify repeated transactions between related wallets, sudden token price surges, or NFT wash trading. Correlate suspicious on-chain activities, such as large synchronous trades and the use of multiple closely linked wallets, with apparent price manipulation attempts. This measure is essential for detecting illicit trading behaviors in digital asset markets.

T0094.002
|
|

Use specialized analytics to trace repeated self-dealing on blockchain-based platforms by correlating on-chain transactions and identifying common control of multiple wallets. This enables the rapid detection of cyclical transfers that are characteristic of wash trading in digital asset markets.

Leverage specialized analytics to trace cryptocurrency flows across multiple blockchains, identifying the use of tumbling/mixing services, cross-chain bridges, and addresses tied to darknet platforms. Real-time analysis of wallet usage and transaction pathways allows institutions to isolate suspicious activity and disrupt illicit layering tactics.

For platforms allowing digital asset trading, employ specialized blockchain analytics to trace short-interval, back-to-back transactions that create no net position change. Investigate instances where on-chain addresses are repeatedly engaged in self-directed wash trades that serve no genuine market function.

Use blockchain analytics to trace and analyze cryptocurrency flows originating from or passing through OTC trades. Specifically, examine addresses or transaction patterns known to be associated with mixers or dark web marketplaces. Identify rapid layering between multiple wallets or cross-border hops that suggest an attempt to mask origins, ensuring suspicious OTC-related transactions are escalated for investigation.

Use specialized analytics tools to trace cross-currency crypto conversions, such as movements between different cryptocurrencies or shifts from fiat to crypto and back. Identify repeated layering attempts by monitoring wallet clusters, transaction chains, and potential mixing or bridging services to detect the rapid cycling of illicit funds across digital assets.

Leverage advanced blockchain analytics tools capable of detecting suspicious wallet clusters and transaction flows commonly associated with privacy coin laundering. Although privacy coins obscure transaction details, these solutions can identify repeat deposit and withdrawal addresses, frequent wallet changes, and other usage patterns that indicate the hidden large-scale movement of illicit funds.

Leverage on-chain analytics to trace digital asset flows, identify suspicious wallet clusters, and pinpoint mixing protocols or chain-peeling. Institutions can track funds across addresses in near real-time, flagging unusual patterns such as repetitive partial transfers or cyclical trading indicative of layered crypto investments.

Use analytics tools and tracing software to examine on-chain activity for cryptocurrency transactions. Identify address clusters, repeated mixing or chain-hopping, and links to sanctioned or high-risk wallets. Escalate detected anomalies for deeper investigation to prevent hidden cross-border transfers.

Use dedicated blockchain analytics to trace digital asset flows passing through pseudonymous or ‘unhosted’ wallets and identify cross-chain transfers associated with P2P transactions. Pinpoint overlapping wallet clusters, rapid mixing, or bridging activity to disrupt attempts at obscuring the origin of illicit funds.

Deploy chain-analysis tools to trace incoming and outgoing cryptocurrency flows, focusing on flagged wallet addresses tied to sanctioned entities. Identify the use of mixers, layering across multiple unregulated exchanges, or abrupt shifts in digital asset transaction patterns that obscure sanctioned involvement, triggering rapid compliance intervention.

T0142
|
|

Deploy specialized analytics to track digital wallet flows suspected to originate from illicit marketplaces. Identify rapid multi-hop transactions or mixing activities commonly used to launder narcotics proceeds. Investigate wallets flagged for connections to known drug trafficking addresses and freeze or restrict relevant accounts if strong narcotics links are established.

Monitor cryptocurrency transactions for addresses associated with dark web marketplaces or mixers. Identify rapid conversions from virtual assets to fiat that are subsequently used to purchase or settle invoices for precursor chemicals, especially when suppliers operate in regions known for chemical export and the activity lacks a clear business rationale.

T0144.003
|
|

Deploy advanced blockchain analytics to continuously track on-chain token liquidity and wallet activity associated with newly released tokens. Rapid detection of significant, unexplained outflows from project wallets (e.g., post-ICO) triggers timely intervention or deeper investigation into a potential rug pull.

T0144.009
|
|

Leverage specialized analytics to trace digital asset flows from victim deposits through multiple wallet hops to identify suspected Pig Butchering rings. Scrutinize unusual wallet clusters, rapid layering, and transfers that lack economic rationale. By mapping the on-chain flow, institutions can better detect large-scale crypto fraud, freeze illicit proceeds, and support law enforcement investigations.

Employ specialized blockchain analytics to trace fund flows from token sales, flagging unusual transaction sequences, such as rapid multi-wallet hops or immediate large outflows, that indicate potential layering or imminent exit scams. This involves monitoring known scam addresses, clustering suspicious wallet activity, and alerting compliance teams for further action.

T0144.017
|
|

Apply advanced analytics to track on-chain transactions, identifying abrupt liquidity withdrawals, newly created tokens with rapid inflows, and cross-chain hops that mask the origin of funds. This is crucial for detecting 'Rug Pull' scams and false crypto investment schemes where proceeds are quickly diverted to obscure wallets.

Leverage blockchain analytics and threat intelligence to trace wallet flows linked to cryptojacking malware, identify micro-payout patterns from mining pools, and disrupt laundering before assets reach mainstream exchanges.

References

  1. FATF (Financial Action Task Force). (2023, March). Countering ransomware financing. FATF. https://www.fatf-gafi.org/content/fatf-gafi/en/publications/Methodsandtrends/countering-ransomware-financing.html

  2. Lam, K. Y., Chan, B.H., Hartel, P., van Staalduinen, M. (2020, June). Combatting cyber-enabled financial crimes in the era of virtual asset and darknet service providers. INTERPOL. http://www.interpol.int