Trace the funds. State the uncertainty.
XS1 Intelligence builds models for transaction tracing across public ledgers: clustering addresses into likely entities, attributing them to services, following value across chains, and scoring exposure and risk. Every cluster and attribution is probabilistic, and every report says so.
Peel-chain trace
Follow the funds, and say how sure you are.
A fictional trace from a reported payment to a custodial endpoint. Each step applies a named heuristic, each cluster is an estimate, and the final exposure is scored with its uncertainty in view.
A reported payment, traced forward from the addresses that received it.
Source cluster
Heuristics applied
Endpoint exposure
Risk score · estimate
Not yet scored
Clustering heuristics are probabilistic, and CoinJoin-style transactions are built to break them. Where one is detected, common-input ownership is not applied.
What it covers
Blockchain intelligence, stated as estimates.
Public ledgers record every transaction, but not who is behind them. These are the parts XS1 Intelligence builds models for, from the first hop to the report.
Transaction tracing
Following value from a source through successive transactions to its destinations, with every hop and every assumption recorded.
- Fund flows
- Hops
Address clustering
Grouping addresses probably controlled by one entity, with heuristics chosen for the chain's model and a stated confidence for every cluster.
- Probabilistic
Entity attribution
Linking clusters to real-world services and categories (exchanges, bridges, scams, listed parties) from labeled data, open sources and published disclosures.
- Services
- Categories
Cross-chain tracing
Following value through bridges, swaps and swap services by matching a deposit on one chain to its release on another.
- Bridges
- Swaps
Exposure and risk scoring
Direct and indirect exposure to high-risk categories, measured separately for sending and receiving, for wallet screening and transaction monitoring.
- Screening
- Monitoring
Typologies and sanctions screening
Patterns such as peel chains, chain hopping and mixer use, checked against published red-flag indicators, and screening against addresses on sanctions lists, which are not exhaustive.
- Red flags
- Listed addresses
Reproducible trace reports
Methods documented step by step and data preserved, so another analyst can reproduce the trace and a court or regulator can examine it.
- Preservation
Methods
The right heuristic for the chain, and a stated rule for taint.
Heuristics that work on one kind of chain mislead on another, and how mixed funds are allocated is a choice with consequences. Every trace report says which were used.
UTXO model
Bitcoin-style chains spend discrete outputs.
- Common-input ownership (co-spend)
- Change-address detection
- Wallet fingerprinting
Account model
Ethereum-style chains update balances.
- Deposit-address reuse
- Airdrop multi-participation
- Token-approval links
Taint methods
Illustrative10 units in, 3 from the traced source, out as A, B and CPoison
Every output is treated as fully tainted.
A · 4
100% tainted
B · 3
100% tainted
C · 3
100% tainted
Haircut
Taint is shared in proportion: 30% of each output.
A · 4
30% tainted
B · 3
30% tainted
C · 3
30% tainted
FIFO
First in, first out: the tainted units leave in the first output.
A · 4
75% tainted
B · 3
0% tainted
C · 3
0% tainted
Blockchain intelligence
Funds you need to trace, or exposure to assess?
Tell us what you need to establish and how the result will be used. Every request is reviewed before work is scoped.