Skip to content
Quantix Security Labs

AML & Transaction Risk Analytics

Transaction risk analytics combines address classification, exposure scoring and graph analysis of fund flows. It supports onboarding decisions, investigations and reporting obligations by showing how an address relates to known risk categories, through which paths, and with what confidence.

Wallet risk, exposure and fund-flow analysis.

Request an AssessmentAnalyse an address
Illustration of a transaction network resolved into wallet clusters, each ringed by its exposure tier, beside a bar chart of exposure by tier.

Service overview

Know where value came from, and where it went.

Screening answers a narrow question: is this address acceptable to deal with? Investigation answers a wider one: what happened to these funds? Both rest on the same work of classifying addresses and following value across transactions, swaps and chains.

Quantix builds that analysis from transaction data rather than from labels alone. Each address receives a category, a value-weighted exposure to the categories it transacted with, directly and through intermediaries, and a set of behavioural indicators such as structured splits, peel chains and shared gas funders.

The result is a score you can explain. Every number traces back to transfers, every link that rests on inference rather than observation is marked as such, and every report states what the analysis cannot see: off-chain transfers inside a service, private order flow, and mixing pools where only timing connects a deposit to a withdrawal.

We work with exchanges and on-ramps on screening policy, with custodians and payment providers on monitoring, and with protocol and treasury teams on investigations after an incident.

Address formats
EVM, Solana, Move, Cosmos
Exposure
Direct and indirect, up to six hops, value-weighted
Output
Explained score, exposure paths, indicators, chronology
Alignment
FATF Recommendations 15 and 16 (risk-based approach, travel rule)

Applies to

  • Exchanges and on/off-ramps
  • Custodians and payment providers
  • DeFi front ends with screening obligations
  • Treasury and investigations teams
Address classificationExposure scoringFund-flow graphsCase reporting

Address analysis · forensic case file

Open the full analysis

Ethereum · wallet

Withdrawal wallet W3

Laundering
0xb5c096d4c8da849dcd0efa2465cff27a35eee4dd

94/ 100

Severe risk

0 · no indication100 · highest risk
  • Direct mixing-service interaction1 transfer to or from a mixing service.
  • New address moving large valueFirst large outflow within 72 hours of first funding.
  • Shared gas funderGas paid by an address that also funds 7 other addresses.
  • Exchange depositValue sent to an exchange deposit cluster, a point where the holder may be identifiable.
Source of funds$235k traced, up to 6 hops
CategoryDirectIndirectShare
Mixing service$235k$67100%
Destination of funds$235k traced, up to 6 hops
CategoryDirectIndirectShare
Exchange$235k–100%
Quantix forensic case files (69 addresses, 106 transactions across 3 cases), Quantix Protocol Research.

Threats addressed

Patterns that move illicit value.

Laundering on public chains leaves records. These are the patterns screening and investigations are designed to recognise.
  • Dispersal

    Structured splitting

    Proceeds divided into near-equal parts within minutes to run parallel routes and stay under per-transfer thresholds.

  • Dispersal

    Peel chains

    One balance moved in steps: part sent to a service at each hop, the rest forwarded to a fresh address.

  • Obfuscation

    Mixing services

    Pooled contracts that break the observable link between deposit and withdrawal, leaving only timing and amounts.

  • Obfuscation

    Chain hopping

    Bridging and swapping across ecosystems within hours, so each chain shows only part of the route.

  • Obfuscation

    Swap recipient changes

    Swaps whose output is sent to a different address than the sender, breaking naive address-to-address tracing.

  • Source

    Exploit and phishing proceeds

    Funds taken through protocol exploits or signature phishing, typically moved within the first hours.

  • Source

    Fraudulent token launches

    Liquidity withdrawn and supply minted by a token owner, then converted to liquid assets.

  • Exit

    Exchange deposit clusters

    Deposit addresses reused across stages of a laundering route: the point where a holder can often be identified.

  • Exit

    Dormant balances

    Proceeds parked in wallets with no activity, waiting for attention to move elsewhere.

Technical capabilities

Classification, exposure, graphs and reports.

Four capabilities that work together, each available as part of an engagement or as standalone analysis.

  • Address classification

    Categories assigned from behaviour and known service patterns, with the basis for each classification recorded.

    • Wallet, contract, pool, bridge, exchange and mixer roles
    • Same-key detection across EVM chains
    • Format validation per chain family

  • Exposure scoring

    Value followed forward and backward in time, split proportionally across intermediaries, reported as direct and indirect exposure by category.

    • Up to six hops
    • Swap and bridge legs followed as one flow
    • Score broken down into its inputs

  • Fund-flow graphs

    Interactive graphs of an investigation: filter by transaction type and value, replay over time, trace time-ordered paths.

    • Observed and heuristic links separated
    • Time-respecting path search
    • Exportable transfer lists

  • Case reporting

    Investigation reports that counsel, exchanges and law enforcement can follow: chronology, leads, and the evidence behind each.

    • Exchange identification requests
    • Dormant-balance watch lists
    • CSV and Markdown evidence packs

Assessment methodology

From policy to evidence.

Screening engagements start with the decisions the analysis must support; investigations start with the transactions that matter. Both follow the same path.
The seven-stage Quantix workflow
  1. 01

    Define the decision

    Which decisions the analysis supports (onboarding, withdrawals, reporting) and the risk appetite behind each.

  2. 02

    Assemble the data

    Transactions, internal transfers, swap and bridge legs, decoded per chain, with the gaps in coverage written down.

  3. 03

    Classify

    Categories for every address in scope, each with its basis: observed behaviour, service pattern or prior investigation.

  4. 04

    Trace and score

    Exposure in both directions, behavioural indicators, and a score whose every input can be shown.

  5. 05

    Review

    An analyst reads the paths behind every elevated result; heuristic links never stand alone as evidence.

  6. 06

    Report and tune

    Results, leads and recommendations delivered; thresholds tuned against the decisions they produced.

Tools & techniques

How the analysis is done.

Techniques and data sources used in screening and investigations. Commercial label feeds can be integrated where a client already licenses them.
Tools and techniques used for AML & Transaction Risk Analytics
Tool or techniqueCategoryWhat it is used for
Quantix transaction graphGraph analysisInteractive fund-flow graphs, path search and case chronologies.
Value-weighted exposure modelScoringDirect and indirect exposure by category with proportional splitting across intermediaries.
Call and instruction tracingDataEVM call traces, Solana inner instructions and Cosmos authz and IBC packets decoded into transfers.
Swap and bridge leg matchingDataLegs of one swap or bridge transfer joined so value is followed through pools and across chains.
Heuristic libraryAttributionCommon gas funders, structured splits, peel chains, same-key detection, mixer timing (marked heuristic).
Address format validationInput checksEIP-55 checksums for EVM, the base58 alphabet for Solana, 32-byte Move ids and bech32 characters checked before any lookup.
Risk-based policy designGovernanceScore bands, decisions and owners aligned with the FATF risk-based approach for virtual asset service providers.
Evidence exportReportingTransfer lists and case summaries in CSV and Markdown with transaction identifiers.

Ecosystem coverage

Technical depth per execution environment.

Tracing depends on how each chain records value: account-based EVM transfers, Solana token accounts and inner instructions, Move objects, and Cosmos messages including authz and IBC.

Ethereum

Layer 1, proof of stake EVM

Programming languages
SolidityVyperYul
Monitoring capabilities
  • Proxy admin and implementation changes
  • Governance proposals and timelock queues
  • Large transfers and treasury outflows
  • Oracle deviation against reference feeds
Typical vulnerabilities
  • Reentrancy, including read-only reentrancy
  • Oracle and spot-price manipulation
  • Access control on privileged functions
  • Proxy storage collisions and initializer misuse
  • Signature replay across chains and contracts
  • Front-running and MEV exposure
Assessment methodologies
  • Line-by-line manual review
  • Invariant fuzzing (Foundry, Echidna)
  • Symbolic execution and formal verification
  • Economic attack modelling
Supported standards
ERC-20ERC-721ERC-1155ERC-4626EIP-2612EIP-712ERC-1967ERC-4337

Ecosystems indicate technical specialisation only, not partnerships or endorsements.

Deliverables

What you receive.

Deliverables depend on whether the work is screening, monitoring or an investigation.

  • Address and wallet risk reports

    Score, category, exposure in both directions, indicators, and the transactions behind each.

  • Fund-flow investigation reports

    Chronology, graph, exposure of the starting addresses, and open leads with the route that reached each.

  • Screening policy and thresholds

    Score bands mapped to decisions and owners, tuned against the decisions they would have produced.

  • Analyst workspace access

    The Quantix graph, address analysis and case files for the addresses in your engagement.

Screening policy, designed with you.

An example of the threshold design delivered with screening work: each score band maps to a decision and an owner. Bands and actions are set with your compliance team; the counts show how the wallets of the worked example above would fall.

BandScoreDecisionCase file wallets
Low0–19Proceed. Record the result with the screening date.9
Moderate20–39Proceed and add the address to periodic re-screening.0
Elevated40–59Enhanced review: analyst reads the exposure paths before approval.0
High60–79Hold. Analyst review with documented rationale; second approver required.0
Severe80–100Do not proceed. Escalate to the compliance officer for a reporting decision.29

Relevant research

Read the work behind the service.

Research and case studies behind the service. The Quantix forensic case files trace $52.78M of transfers.
Research hub

Publications

Case studies

All case studies

Research assessments

Security assessments library
Compare all services

FAQ

Questions teams ask before an engagement

They have two modes. Connected data reads balances, transfers and transactions for a real address through the configured providers and shows which ones answered; attribution stays "Unknown" unless it is confirmed. Case file addresses come from the Quantix forensic case files, which is where the worked example on this page comes from. Neither mode estimates a score for data it does not have.

A label says what an address is believed to be. The score combines that category with how value actually moved to and from the address and with behavioural indicators, and it can be broken down into those inputs for review.

Only probabilistically. Timing and amounts suggest links, and stronger signals such as a shared gas funder can corroborate them. Such links are always marked heuristic and are never presented as the only evidence for a conclusion.

In engagement reports, counterparties are named where attribution is established and its basis is stated. On this site, every service in the forensic case files is an anonymised cluster such as an exchange deposit cluster or a bridge route.

No analysis does that on its own. We help design screening and monitoring that fit your obligations and risk appetite, aligned with the FATF risk-based approach; compliance remains a matter for your compliance function and legal counsel.

EVM chains, Solana, Move-based chains and Cosmos SDK chains, including the bridge routes between them. Coverage for a specific deployment and its data sources is confirmed during scoping.

Screening you can explain. Investigations that hold up.

Tell us which decisions the analysis must support, or which transactions you need traced. We will reply with scoping questions.

Discuss AML analyticsOpen the forensics workspace