Every time you send Bitcoin, Ethereum, or any other cryptocurrency, three companies are watching. Chainalysis, TRM Labs, and Elliptic are the three major blockchain analytics firms that provide transaction monitoring tools to cryptocurrency exchanges, law enforcement agencies, and governments. Their tools analyze every transaction on every major blockchain, build profiles of wallet addresses, and flag suspicious activity. When an exchange freezes your account for "suspicious activity," it is because one of these three tools flagged your transaction. When law enforcement traces stolen cryptocurrency, they are using one of these tools. Understanding how these tools work is essential for anyone involved in crypto — whether you are a fraud victim trying to recover funds or a legitimate user whose account has been flagged.

In this article, I explain how Chainalysis, TRM Labs, and Elliptic work, what data they collect and analyze, how exchanges use their tools to screen transactions, and what this means for fraud recovery and privacy. As a former FIU investigator and current crypto compliance counsel, I have used all three tools and understand them from both the investigator's and the advocate's perspective.

What blockchain analytics tools do

Blockchain analytics tools serve three primary functions:

1. Address clustering

The most fundamental function of blockchain analytics is address clustering — grouping wallet addresses that are likely controlled by the same entity. This is done through heuristics (rules of thumb) that identify patterns in transaction data. The most important heuristic is the "common input ownership heuristic": when multiple addresses are used as inputs in the same transaction, they are likely controlled by the same wallet. If address A and address B are both inputs to a single Bitcoin transaction, they probably belong to the same person.

Analytics tools apply this heuristic across millions of transactions, building clusters of addresses that appear to be controlled by the same entity. A cluster might contain thousands of addresses, all linked through their transaction patterns. Once a cluster is built, the tool can identify the entity that controls it — if any address in the cluster has been linked to a known exchange, service, or individual, the entire cluster is attributed to that entity.

For example, if address A (in a cluster of 500 addresses) has been identified as a Binance deposit address, the tool attributes the entire cluster to Binance. This allows the tool to identify all transactions going to or from Binance, even if the specific deposit address has not been previously identified.

2. Risk scoring

Once addresses are clustered and attributed, the analytics tool assigns a risk score to each address. The risk score reflects the likelihood that the address is associated with illicit activity. The score is based on the address's transaction history — specifically, whether it has transacted with known illicit addresses, such as:

The risk score is not a simple yes/no — it is a gradient. An address that has directly transacted with a sanctioned address receives a high risk score. An address that has transacted with an address that transacted with a sanctioned address receives a lower (but still elevated) risk score. The further removed the connection, the lower the score. But some tools (particularly Chainalysis) use a wide transaction radius — up to 5 hops — which means that addresses several transactions removed from a sanctioned address can still receive an elevated risk score.

Exchanges use these risk scores to screen incoming deposits. If a deposit comes from an address with a high risk score, the exchange may freeze the account, request additional information, or reject the deposit. This is why legitimate users sometimes have their accounts frozen after receiving funds from a tainted source — the analytics tool flagged the source address, and the exchange acted on the flag.

3. Transaction tracing

The third function is transaction tracing — following the flow of funds from a source address to a destination address. This is the function used in fraud recovery cases. The tool takes a starting address (the scammer's wallet) and traces all outgoing transactions, building a graph of where the funds went. The graph includes every address that received funds from the source, every address that received funds from those addresses, and so on, out to several degrees of separation.

The tracing graph is visualized as a flow diagram, showing the amount of funds at each hop, the timing of each transaction, and the attribution of each address (if known). The analyst can follow the flow of funds from the scammer's wallet to the final destination — typically an exchange where the funds are cashed out.

Tracing is complicated by mixers, cross-chain bridges, and decentralized exchanges — each of which can break the direct link between source and destination. See our articles on chainhopping and mixer tracing for the specific challenges and methods.

Chainalysis: the market leader

Chainalysis is the largest and most well-known blockchain analytics firm. Founded in 2014 and based in New York, Chainalysis serves over 1,000 clients, including major exchanges (Coinbase, Binance, Bitstamp), law enforcement agencies (FBI, DEA, Europol), and government regulators. Chainalysis is valued at over $8 billion and is the dominant player in the blockchain analytics market.

Chainalysis's flagship product is Chainalysis Reactor, an investigation tool that allows analysts to trace cryptocurrency transactions across multiple blockchains. Reactor provides:

Chainalysis also offers KYT (Know Your Transaction), a real-time transaction monitoring tool used by exchanges. KYT screens every incoming and outgoing transaction in real time, flagging transactions that involve high-risk addresses. When a KYT alert is triggered, the exchange's compliance team reviews the transaction and decides whether to freeze the account, request additional information, or allow the transaction to proceed.

Chainalysis's main competitive advantage is its data. The company has been building its address attribution database since 2014, and it has partnerships with major exchanges, payment processors, and law enforcement agencies. These partnerships give Chainalysis access to off-chain data (KYC records, deposit/withdrawal patterns) that smaller analytics firms do not have. This makes Chainalysis's attribution database the most comprehensive in the industry.

TRM Labs: the fast-growing challenger

TRM Labs is the second-largest blockchain analytics firm, founded in 2017 and based in San Francisco. TRM has grown rapidly in recent years, securing contracts with major exchanges (Binance, Kraken) and law enforcement agencies (IRS Criminal Investigation, UK NCA, Swiss FedPol). TRM's valuation is approaching $1 billion.

TRM's flagship product is TRM Transaction Monitoring, a real-time screening tool similar to Chainalysis KYT. TRM also offers TRM Forensics, an investigation tool similar to Chainalysis Reactor. TRM's products provide:

TRM's main competitive advantage is its user interface and workflow. TRM's tools are designed for compliance teams (not just investigators), with workflows that integrate with KYC processes, case management systems, and regulatory reporting. Many exchanges prefer TRM for day-to-day compliance operations because it fits more naturally into their existing workflows.

TRM also has strong coverage of newer blockchains (Solana, Tron, Polygon, Arbitrum) and DeFi protocols. As crypto activity has shifted to these newer chains, TRM's coverage has become a significant advantage. In my practice, I often use TRM for cases involving Solana or Tron, where Chainalysis's coverage is less complete.

Elliptic: the research-focused veteran

Elliptic is the third major blockchain analytics firm, founded in 2013 and based in London. Elliptic was the first blockchain analytics company to market, predating both Chainalysis and TRM. Elliptic serves exchanges (Binance, Huobi), banks (Barclays, Santander), and law enforcement agencies (NCA, Europol).

Elliptic's flagship product is Elliptic Navigator, an investigation tool, and Elliptic Lens, a transaction screening tool. Elliptic's products provide:

Elliptic's main competitive advantage is its research. The company publishes detailed reports on crypto crime trends, typologies, and emerging threats. Elliptic's research team has identified numerous illicit crypto operations, including terrorist financing networks, North Korean hacking groups, and darknet marketplaces. This research feeds back into Elliptic's tools, improving their risk scoring and attribution.

Elliptic is particularly strong in Bitcoin analytics, where it has the longest history of address attribution. For Bitcoin-only cases, Elliptic's coverage is sometimes more comprehensive than Chainalysis or TRM.

How exchanges use these tools

Exchanges use blockchain analytics tools primarily for two purposes: transaction monitoring and customer due diligence.

Transaction monitoring

When a user deposits cryptocurrency on an exchange, the exchange screens the deposit using a real-time monitoring tool (Chainalysis KYT, TRM Transaction Monitoring, or Elliptic Lens). The tool checks the deposit address against its database of known addresses and assigns a risk score. If the risk score is below the exchange's threshold, the deposit is processed automatically. If the risk score is above the threshold, the deposit is flagged for manual review.

The manual review is conducted by the exchange's compliance team, who examine the flagged transaction in more detail. The compliance team may:

The thresholds and review processes vary by exchange. Major regulated exchanges (Coinbase, Kraken) tend to have lower thresholds (they flag more transactions) and more thorough review processes. Smaller or less regulated exchanges (MEXC, Gate.io) may have higher thresholds and less thorough reviews. This is why scammers prefer smaller exchanges — the chances of the funds being flagged are lower.

Customer due diligence

Exchanges also use analytics tools for ongoing customer due diligence. The tool continuously monitors the user's transaction history, looking for patterns that suggest involvement in illicit activity. If a user's transaction history changes significantly (e.g., they start receiving large deposits from previously unknown addresses), the tool may flag the account for review.

This ongoing monitoring is why accounts are sometimes frozen long after a deposit. A deposit that was not flagged when it was received may be flagged weeks or months later, when the analytics tool updates its database and identifies the source address as risky. This is frustrating for users, but it is a standard part of AML compliance.

What this means for fraud recovery

For fraud recovery, blockchain analytics tools are both a help and a hindrance. They help because they enable tracing — without these tools, following the flow of stolen cryptocurrency through multiple wallets and across blockchains would be practically impossible. They hinder because they can cause false positives — legitimate users' accounts get frozen because the analytics tool flagged a transaction that was actually innocent.

The key to effective recovery is understanding how the tools work and using them to your advantage:

The privacy implications

Blockchain analytics tools are powerful, and their use raises significant privacy concerns. These tools can deanonymize cryptocurrency users — linking pseudonymous wallet addresses to real-world identities through patterns in transaction data. The tools are used by exchanges, law enforcement, and governments, often without the user's knowledge or consent.

For law enforcement purposes, this is generally accepted — law enforcement needs tools to investigate crime, and blockchain analytics is a legitimate investigative technique. But for commercial purposes (exchange compliance, risk scoring), the privacy implications are more concerning. An exchange can know not just that you deposited Bitcoin, but where that Bitcoin came from, who previously held it, and whether any of the previous holders were involved in anything suspicious. This is far more information than a bank has about a cash deposit.

For users who value privacy, the existence of these tools means that cryptocurrency is not truly anonymous. Every transaction is recorded on the blockchain forever, and analytics tools can reconstruct the history of any address. Privacy-enhancing technologies (CoinJoin, mixers, privacy coins like Monero) can obscure the trail, but they come with their own risks — exchanges flag transactions involving mixers, and some privacy coins are delisted from major exchanges.

Limitations of blockchain analytics

Despite their power, blockchain analytics tools have important limitations:

The competition between analytics firms: what it means for users

The competition between Chainalysis, TRM Labs, and Elliptic is not just a business rivalry — it has practical implications for crypto users. Because each firm has different data partnerships, different clustering heuristics, and different risk scoring models, the same address can receive different risk scores from different tools. An address that Chainalysis flags as high-risk might not be flagged by TRM Labs, and vice versa.

This means that the same cryptocurrency deposit can be accepted by one exchange (which uses TRM) and frozen by another (which uses Chainalysis). For legitimate users, this creates an unpredictable landscape — you do not know whether your deposit will be accepted until you try it. For scammers, it creates an opportunity: they can target exchanges that use the tool with the most lenient risk scoring for the specific transaction pattern they are using.

In practice, most major exchanges use either Chainalysis or TRM (Elliptic has a smaller market share). Binance uses both Chainalysis and TRM for different purposes. Coinbase uses Chainalysis. Kraken uses TRM. The choice of tool depends on the exchange's compliance priorities, budget, and existing technology stack. When we file a freeze request with an exchange, we tailor the forensic report to the tool the exchange uses — if the exchange uses Chainalysis, we provide a Chainalysis report; if TRM, a TRM report. This ensures that the exchange's compliance team can verify our findings using their own tools.

How law enforcement uses blockchain analytics

Law enforcement agencies are the largest users of blockchain analytics tools after exchanges. The FBI, DEA, IRS Criminal Investigation, Europol, and national police forces all use Chainalysis or TRM (and sometimes both) for criminal investigations. These tools allow law enforcement to:

Law enforcement agencies typically have access to more data than private firms. Through subpoenas, MLAT requests, and partnerships with international agencies, law enforcement can obtain KYC records, IP addresses, and transaction data from exchanges that private analytics firms cannot access directly. This makes law enforcement's tracing capabilities more powerful than those of private firms — though the speed of law enforcement investigations is typically much slower.

In my practice, I often coordinate with law enforcement on recovery cases. The optimal approach is to do the initial tracing privately (using our own analytics tools) and then share the results with law enforcement, who can use their broader powers (subpoenas, seizures, arrests) to take the case to its conclusion. Private tracing plus law enforcement enforcement is the most effective combination for crypto fraud recovery.

The bottom line

Chainalysis, TRM Labs, and Elliptic are the three tools that shape the landscape of crypto compliance and fraud recovery. They enable exchanges to screen transactions, law enforcement to trace stolen funds, and forensic analysts to build recovery cases. Understanding how they work is essential for anyone involved in crypto — whether you are trying to recover stolen funds or trying to avoid having your account frozen.

If you need blockchain forensic analysis for a fraud recovery case, contact us. We use professional-grade analytics tools (Chainalysis and TRM Labs) to trace stolen cryptocurrency and build the forensic evidence needed for freeze requests, court orders, and law enforcement coordination.

N. Silinevics
Nils Silinevics Crypto Compliance Counsel · Former FIU Investigator · Valken Legal AG