Wallet clustering
Heuristic + ML
Groups wallets that share operational patterns or ownership.
Ethereum Mainnet • Global
Wallet Investigator for protocol security teams
Map wallet relationships, clustering, and transaction flows to uncover counterparties and hidden networks. Focus on smart contract security, counterparty risk, and operational safeguards for treasuries and protocols. Detect anomalies, suspicious approvals, and governance changes before funds are at risk. Teams operating in 24/7 markets with globally distributed contributors.
- Graph visualizations connecting wallets via token transfers, LP shares, and governance activity.
- Entity tagging with metadata (team, treasury, exchange, MEV, mixers).
- Flow timelines to trace funds across chains and protocols.
- Proactively identifying malicious approvals and upgrade patterns is tedious.
Key metrics
Case exports
GraphML, JSON, PDF
Share investigation results with stakeholders or regulators.
Ethereum Mainnet profile
Deepest liquidity and broadest institutional adoption.
Base fees typically 15–40 gwei outside of NFT drops; priority fees ~1–2 gwei.
Unique insights
- Ethereum Mainnet: Base fees typically 15–40 gwei outside of NFT drops; priority fees ~1–2 gwei. Pair this with wallet investigator to live monitoring of contract upgrades, proxy changes, and admin key usage..
- Global: Balance FATF Travel Rule guidance with country-specific VASP licensing expectations. Align risk & security analysts workflows with fewer false positives in alerting systems..
- For protocol security teams, emphasize Combines automated clustering with analyst-friendly manual tagging. and track Mean time to detect high-risk contract events. weekly.
Why teams rely on this tool
Core capabilities
Graph visualizations connecting wallets via token transfers, LP shares, and governance activity. Entity tagging with metadata (team, treasury, exchange, MEV, mixers). Flow timelines to trace funds across chains and protocols.
Audience fit
Proactively identifying malicious approvals and upgrade patterns is tedious. Fewer false positives in alerting systems.
Ethereum Mainnet focus
Uniswap, Lido, EigenLayer, and Aave drive high-value flow and require precise gas timing. Live monitoring of contract upgrades, proxy changes, and admin key usage.
Operational playbook
- 1Seed the graph with addresses or transactions of interest.
- 2Expand relationships, apply entity tags, and flag suspicious flows.
- 3Export investigation packs or synchronize with compliance tickets.
Use cases
Live monitoring of contract upgrades, proxy changes, and admin key usage. Requires tooling that supports asynchronous collaboration, multi-timezone monitoring, and localized communications.
Token scanner sweeps of newly listed assets interacting with your treasury. Requires tooling that supports asynchronous collaboration, multi-timezone monitoring, and localized communications.
Mapping transacting wallets to known entities for counterparty risk scoring. Requires tooling that supports asynchronous collaboration, multi-timezone monitoring, and localized communications.
Proof points
- Security teams use the tool to triage exploits and track stolen funds.
- Compliance analysts gather intelligence before onboarding institutional clients.
- DAO contributors investigate grant usage and treasury distributions.
ChainUnified tools that pair well
Related pages
Frequently asked questions
Can I import existing clustering data?
Yes. Upload CSV or JSON cluster definitions to align with internal intelligence.
Do you integrate with chain analytics providers?
We overlay public attribution datasets and allow custom enrichment via API.
How are large graphs handled?
Graph rendering dynamically loads segments to keep performance stable even with thousands of nodes.