Investigation¶

Key Takeaways
- Full forensic investigation of any EVM wallet address — identity, activity, counterparty network, AML exposure, and SAR recommendation in one structured report
- FATF-aligned AML exposure across 14 categories: Sanctions, Mixers, Rug Pull, Honeypot, Cybercrime, Phishing, High Risk, and more
- Circular flow detection identifies controlled address clusters — addresses that appear in both inbound and outbound graphs likely share an owner
- Two-hop network analysis: fraud scores for every direct counterparty, plus their upstream senders
- Supports ETH, BSC, Base, and Polygon; EOA addresses only

Investigation is ChainAware's deep forensic product for blockchain intelligence professionals. Submit any EVM wallet address and receive a complete, structured investigation report — covering who the address is, what it has done, who it has transacted with, and what AML risk that counterparty network represents.

The report is produced by ChainAware's investigation engine, which combines on-chain database profiling, live ML fraud scoring, two-hop counterparty analysis, OFAC sanctions checking, AML forensic signals, domain identity resolution, and an AI-generated narrative — assembled automatically, typically in 30–90 seconds.

What Investigation Covers¶

Every investigation produces a report across seven sections:

Section	What you learn
Identity & Roles	ENS / Unstoppable / SPACE ID domain registrations, ChainAware known-entity labels (e.g. "Binance 4"), wallet type, and whether this is a known protocol, exchange, or labelled actor
Activity Summary	Tokens and pairs created, liquidity positions, inflow and outflow patterns — a plain-language summary of what this address has actually done on-chain
Top Counterparties	Top 5 inbound and top 5 outbound addresses by USD volume, with labels, transaction counts, and risk scores — the key trading relationships at a glance
Risk Assessment	ML fraud probability, confirmed rug pull and honeypot history from ChainAware's database, trust tier
Circular Flows & Clusters	Addresses that appear in both the inbound and outbound transaction graphs — strong evidence of a controlled cluster sharing a common operator
AML Exposure	FATF-aligned breakdown of inbound and outbound exposure: how much of the USD flow passes through sanctions-listed, fraud-linked, mixer, or high-risk addresses — with a combined risk tier and SAR recommendation when warranted
Conclusion	One-sentence verdict; an explicit SAR recommendation when the combined AML risk tier reaches CRITICAL or any sanctions exposure is present

How Investigation Works¶

Step 1 — On-chain profile¶

The engine pulls ChainAware's local database profile for the address: tokens created, pairs created and rugged, agents registered, liquidity events, fraud scores, and any known-entity label. This gives the factual baseline — confirmed on-chain history, not probabilistic.

Step 2 — Live ML profile¶

ChainAware's fraud prediction model scores the address in real time across three dimensions: fraud probability, DeFi segmentation (what kind of actor this is), and risk profile (portfolio composition by token rank bucket). This layer adds forward-looking behavioral intelligence on top of the confirmed history.

Step 3 — Counterparty network¶

The engine fetches the full inbound (senders) and outbound (recipients) transaction graphs, then scores each direct counterparty — 50 inbound and 50 outbound — against ChainAware's fraud model. A pre-check against the fraud database short-circuits most lookups using a cache, keeping latency low even on active wallets.

For each direct counterparty (Distance 1), their own inbound senders (Distance 2) are also fetched and flagged for non-zero confirmed fraud history, mixer interactions, and sanctions hits. This two-hop view surfaces indirect contamination that a single-depth check would miss.

CEX hot wallets (Binance, Coinbase, Kraken, and others) are identified and separated from the fraud scoring pool — they contribute to the exposure picture as legitimate exchange flows, not fraud signals.

Step 4 — Sanctions and AML forensics¶

Every address in the network is checked against OFAC sanctions lists and GoPlus AML forensic signals (cybercrime, money laundering, phishing, darkweb transactions, mixing activity, and more). Confirmed hits are hard evidence — not probabilistic scores — and are surfaced prominently in the report.

Step 5 — Circular flow detection¶

Addresses that appear in both the inbound and outbound graphs — directly or through one intermediary — are flagged as a circular flow cluster. This pattern is strong evidence that a set of addresses shares a common owner or operator: funds flow out to them and back from them, indicating coordinated control rather than independent counterparties.

Step 6 — AML exposure calculation¶

The engine aggregates the scored counterparty network into a FATF-aligned exposure breakdown per direction (inbound and outbound). Each USD flow is assigned to one of 14 AML categories. DeFi infrastructure (Solvers, Resolvers, Relayers) is excluded from the base denominator — these are protocol mechanics, not counterparties. The result is a risk percentage by category and a combined risk tier.

Step 7 — AI narrative¶

Claude produces the final structured Markdown report from all collected data — connecting the dots across identity, history, counterparty network, and AML exposure into a coherent, investigator-ready document.

AML Exposure Categories¶

Exposure is calculated across 14 FATF-aligned categories. The combined risk tier is the highest of the inbound and outbound tiers.

Category	Description
Sanctions	Confirmed OFAC sanctions list hit — always the highest severity
Obfuscation	Mixer-adjacent addresses with confirmed obfuscation signals
Mixers	Direct interaction with privacy mixers such as Tornado Cash
Central Exchange	CEX hot wallets (Binance, Coinbase, Kraken, and others) — treated as legitimate, not risk
Fraud — Rug Pull	Address has confirmed rug pull history in ChainAware's pairs database
Fraud — Honeypot	Address has deployed confirmed honeypot tokens
Fraud — Cybercrime	Confirmed cybercrime, money laundering, darkweb, or financial crime flags
Fraud — Phishing	Confirmed phishing activity or honeypot-related address flags
Fraud — Unspecified	ML fraud classification without a specific forensic sub-signal
High Risk	Fraud probability ≥ 80%
DeFi — Protocol	On-chain protocol contracts (AMMs, lending, bridges) — treated as infrastructure
Medium Risk	Fraud probability 50–80%
Low Risk	Fraud probability < 50%, no confirmed signals
Unclassified	No score available for this counterparty

Combined Risk Tiers¶

Tier	Meaning
LOW	Negligible exposure to high-risk counterparties
MEDIUM	Some elevated-risk counterparty exposure; enhanced monitoring recommended
HIGH	Significant fraud, mixer, or obfuscation exposure
CRITICAL	Sanctions hit, very high fraud exposure, or SAR-level indicators; the report explicitly recommends filing a Suspicious Activity Report

Circular Flows and Cluster Detection¶

A circular flow occurs when the same address appears in both the inbound and outbound transaction graphs of the subject — either directly (Distance 1) or through one intermediary (Distance 2 via another address).

Circular flows are strong evidence of a controlled cluster: a group of addresses that likely shares a common owner or is coordinated by the same operator. The investigation report lists each overlapping address with its inbound path, outbound path, and risk score. The cluster_size field reports the total number of overlapping addresses found.

This is particularly relevant for:

Wash trading detection — addresses that both sell to and buy from the same wallet
Self-funding loops — operators cycling funds through intermediaries back to their own wallet to obscure origins
Sybil clusters — multiple apparently-independent wallets that turn out to be co-managed

Identity Resolution¶

Investigation automatically resolves on-chain domain registrations for the subject address and all direct counterparties:

ENS (.eth) — cryptographic proof; the address signed the on-chain registration transaction
Unstoppable Domains — .crypto, .nft, .x, and other Web3 TLDs
SPACE ID — .bnb and other chain-specific namespaces

A registered domain is not a claim — it is on-chain fact. Where a domain is present, the report uses the domain name (e.g. vitalik.eth) as the address's identity throughout. Where an ENS profile has a linked Twitter handle, that is also surfaced as public persona context.

ChainAware's known-entity label registry also covers major exchange hot wallets, protocol contracts, and infrastructure addresses. When a counterparty has a registered label (e.g. "Binance 4"), it is identified as exchange infrastructure rather than scored as an independent wallet.

What Investigation Does Not Cover¶

Contracts — investigation is for EOA (externally owned account) wallets only. Submitting a contract address returns an error. For smart contract risk analysis, use Token Audit.
Historical re-investigation — each investigation job is a snapshot at the time it runs. On-chain state evolves; re-investigate periodically for wallets under ongoing monitoring.
Unsupported chains — ETH, BSC, Base, and Polygon are supported. Solana, TON, and Tron are not available in Investigation (they are available in the Fraud Detection API).

Common Use Cases¶

AML and KYT due diligence
Before onboarding a new whale or processing a large withdrawal, run an investigation to establish whether the wallet has known fraud history and what percentage of its inbound funds originate from sanctioned or high-risk sources. The structured report is audit-ready.

Incident response
After a suspected exploit, rug pull, or phishing attack, investigate the suspect address immediately. The two-hop counterparty map and circular flow analysis frequently identifies the broader operator cluster within the first investigation.

Pre-transaction screening
For large DeFi transactions or institutional OTC trades, run an investigation on the counterparty wallet to identify CEX relationships, mixer exposure, and any direct fraud links before funds move.

Regulatory compliance and SAR filing
When the combined AML risk tier reaches CRITICAL, the investigation report explicitly recommends filing a Suspicious Activity Report. The exposure section — with per-category USD values and percentages — provides the structured data needed to support the SAR narrative.

Counterparty due diligence in agentic pipelines
Combine Investigation with the Agent Trust Score for AI agent operators: use Agent Trust Score to screen the agent's ownership chain, and Investigation to do a deep forensic check on the agent's payment wallet before committing to a high-value autonomous transaction.

Supported Chains¶

Chain	Investigation
Ethereum	✓
BNB Smart Chain	✓
Base	✓
Polygon	✓

Frequently Asked Questions¶

What addresses can be investigated?
EOA (externally owned account) wallets only. Contract addresses are rejected — use Token Audit for smart contract analysis.

How long does an investigation take?
Most investigations complete in 30–90 seconds. Wallets with very high transaction volumes (thousands of counterparties) may take longer due to the volume of network scoring required.

What is a circular flow?
A circular flow is an address that appears in both the subject's inbound transaction graph and outbound transaction graph — directly or via one intermediary. It means funds flowed both from that address to the subject and from the subject to that address. This pattern strongly suggests co-ownership or coordinated control.

What does a SAR recommendation mean?
When the combined AML risk tier is CRITICAL — or when any counterparty carries a non-zero sanctions exposure percentage — the investigation report explicitly states that a Suspicious Activity Report should be considered. This is an informational recommendation; ChainAware does not file SARs on your behalf.

Why are CEX addresses not treated as risk?
CEX hot wallets (Binance, Coinbase, Kraken, and others) are identified from ChainAware's known-entity label registry and filtered from the fraud scoring pool. An inflow from Binance 14 is a standard exchange withdrawal — it does not contaminate the counterparty risk score. CEX flows are listed separately in the AML exposure breakdown under the "Central Exchange" category.

Why are DeFi protocol interactions excluded from the exposure base?
Interactions with on-chain infrastructure — AMM router contracts, lending protocol addresses, bridge relayers — are protocol mechanics, not counterparty relationships. Including them would inflate the "clean" percentage artificially. Investigation excludes DeFi infrastructure from the exposure denominator and reports the excluded USD amount separately so you can see exactly what was filtered.

Can I re-run an investigation on the same address?
Yes. Each investigation is a point-in-time snapshot. For wallets under ongoing monitoring, re-running periodically captures new counterparty relationships and updated ML scores.