Skip to content
Quantix Security Labs

Address Intelligence

Chain data reads an address from the selected network: balances, transfers, counterparties, contract calls and provider signals, with observed facts, provider claims and Quantix inferences kept apart. Case file addresses open the risk profiles of the 69 addresses in the forensic case files and the 53 contracts under recorded monitoring.
Illustration: a wallet at the centre of hop rings with clustered counterparties, one flagged

Loading address analysis…

Connected data

Three layers, kept apart.

A connected result never mixes what the chain shows with what a provider claims or what Quantix infers. Attribution stays Unknown unless the address is registered in the Quantix contract registry.

  1. 01

    Observed on-chain

    Native balance, code, nonce and token balances, plus transfers from Alchemy, Etherscan or, with RPC only, ERC-20 Transfer logs over a recent block window. Each result states which source answered and what it cannot see.

  2. 02

    Provider signals

    GoPlus address_security flags, shown as the provider’s claim with the time it was fetched. A missing or failed check is reported as unknown, never as clean.

  3. 03

    Quantix inferences

    Heuristics such as fan-out, quick pass-through or concentration on one counterparty, each with its evidence, a confidence level and the benign explanations. A few transfers never make an address criminal.

Case file addresses

How the address risk score is built.

Wallets (38 in the case files) are scored on behaviour; contracts, pools, bridges, exchange clusters and mixing services are scored by category, because they handle value for many unrelated users.
  1. 1

    Category floor

    Each classification sets a minimum score: an address that executed an exploit cannot score below its floor however its funds moved.

  2. 2

    Exposure

    Value is followed forward and backward in time, split across each intermediary’s outflows in proportion to their size, for up to six hops. The exposure score weights the share of value reaching each category.

  3. 3

    Base

    The higher of the category floor and the exposure score.

  4. 4

    Indicators

    Behavioural indicators (structured splits, peel chains, shared gas funders, rapid pass-through) each carry a weight. Together they add that percentage of the remaining headroom to 100.

Inputs used by the score (lib/transaction-graph.ts)
CategoryFloorExposure weight
Exploit951.00
Mixing service900.85
Laundering600.60
Affected protocol150.10
Exchange150.05
Bridge100.10
DeFi protocol50.00
Counterparty50.00
Unlabelled00.30

Input formats

Validated before anything is looked up.

The format check is local. Chain data covers EVM networks and Solana; among case file addresses, an address that is not in a case file returns no result rather than an estimated one.
FormatShapeChains
EVM0x followed by 40 hex characters (20 bytes)Ethereum, Arbitrum, Optimism, Base, BNB Chain, Polygon, Avalanche
Solanabase58, 32 to 44 characters (32-byte public key)Solana
Move0x followed by 64 hex characters (32 bytes)Aptos, Sui
Cosmosbech32 with a human-readable prefixCosmos SDK chains

Screening and investigations on real chain data.

Address classification, exposure scoring and fund-flow investigation, designed around your onboarding and reporting obligations.

AML & transaction risk analyticsTransaction intelligence