Blockchain analytics firm Chainalysis has released a new methodology proposal aimed at establishing a unified on-chain fund tracing standard framework for law enforcement agencies and investigators. The proposal centers on systematically decomposing the industry's inconsistently defined concept of "address clustering" through an ontology-based structure. Address clustering is fundamental to on-chain investigations, but disparate clustering rules across platforms have hindered evidence interoperability across cases and jurisdictions.
Chainalysis's ontology framework breaks address clustering into two layers: wallet segmentation and functional roles. Wallet segmentation groups addresses controlled by the same entity based on transaction behavior patterns, while functional roles further describe the specific purpose of these addresses in fund flows—such as receiving, change, storage, or mixing. This decomposition enables investigators to better understand control relationships between addresses while providing interpretable grounds for legal proceedings.
Two-Layer Structure: Transaction Graph and Confidence Assessment
The proposal describes on-chain relationships through two layers. The first layer defines the transaction graph structure, constructing a fund flow network between addresses based on transaction records to identify possible controlling entities. The second layer assesses inference confidence, quantifying the probability of the control relationships derived from the first layer, thus allowing investigators to gauge the reliability of conclusions. This layered design balances analytical completeness with legal applicability: the transaction graph provides objective on-chain facts, while confidence assessment offers a quantitative reference for evidence admissibility.
Chainalysis Chief Scientist Jacob Illum noted that the proposal's starting point is to answer "on what basis of evidence can we conclude these addresses belong to the same entity." He emphasized that on-chain analysis alone cannot directly identify the real-world identity of end users; address clustering only reveals control relationships. To bind addresses to real identities, investigators must still combine legal investigative methods with centralized entities, such as exchanges' KYC records or IP address forensics.
Practical Validation and Industry Impact
The framework was designed and validated based on Chainalysis's practical experience in cases handled by the U.S. Department of Justice, including its analysis in the Bitcoin Fog case. Bitcoin Fog was one of the longest-running Bitcoin mixing services, and its founder was convicted of money laundering. Chainalysis's on-chain tracing methodology was admitted as evidence in that case, demonstrating the credibility of its analytical tools. The current proposal abstracts those practices into a standard framework to improve the interpretability and legal applicability of on-chain forensics.
Chainalysis stated that the standard proposal is now open for industry discussion, aiming to promote more unified technical norms for on-chain analysis in law enforcement and compliance. If widely adopted, clustering results from different analytics firms could become more cross-verifiable, reducing evidence barriers in cross-border enforcement cooperation. For blockchain compliance professionals, this framework provides clearer audit guidance—such as how to define suspicious address clusters and how to assess link strength. Industry feedback is still being collected to determine whether to adjust layers or add new functional role classifications.