Crypto Address Attribution Process
workflow
Core idea
Attribution links a pseudonymous blockchain address to a real-world entity. It is probabilistic, not definitive, but convergent evidence from multiple sources can build a compelling case. A five-step process moves from a seed address to an off-chain identity, with a KYC-verified exchange link as the gold standard.
Components
- Find the seed address, from a scam report, exchange record, or off-chain intelligence (from: victim, exchange, leak).
- Map transaction graph, trace all inbound and outbound transactions via a block explorer (tool: Etherscan, Blockchain.com).
- Apply clustering heuristics, group addresses likely controlled by the same entity (tool: Arkham, Chainalysis).
- Identify labelled addresses, look for known exchange deposit addresses at graph edges (tool: Arkham labels, Etherscan tags).
- Cross-reference off-chain, match wallets to social media, forums, GitHub commits (tool: Google dorks, Maltego).
When to use
When you must connect a wallet to a real-world entity in an investigation and have at least one seed address to start from.
Example
Starting from a victim-reported scam address, tracing its graph in Etherscan, clustering with Arkham, spotting a Binance deposit address at the edge, then confirming identity via KYC records. This is the gold standard: a transaction to or from a KYC-verified exchange linked to your cluster is the strongest attribution evidence.
Related
Attribution Confidence Levels, Chain-Specific Attribution Signals: Bitcoin vs Ethereum, Advanced Attribution Techniques, Court-Tested Attribution Evidence Types