Machine learning is a valuable tool in blockchain analytics – so long as it is used responsibly. Automated tools can quickly trawl reams of on-chain data, finding patterns that analysts might miss, if they ever had time to look. Applied judiciously, machine learning plays an important supporting role in the work that Chainalysis does.

The question every provider should answer is: where do you draw the line? If ML outputs are automatically accepted as ground truth then they risk degrading the value of blockchain intelligence. A predictive model may erroneously assume multiple addresses are owned by a single entity and thus feed bad data into the system. Just one false cluster can trigger enormous downstream consequences for the investigators and compliance teams who misplace their trust in them.

Still, machine learning has strong potential to assist in the intelligence-gathering process. If ML-generated outputs are clearly labeled as probabilistic assessments requiring further validation, they can inform analysis without corrupting it.

Where machine learning fits into our work

At Chainalysis, we do not use ML in our work assessing wallet segments. But we do use it – selectively – in other important and impactful areas of our work.

As we explain in the Ontology paper, what’s commonly known as a “cluster” actually covers three separate analytical claims: Structural (which addresses are controlled by the same key); Attribution (linking a specific address to a specific entity); and Operator (what relationship that entity has to an address).

Wallet segments fall into the structural category. They’re Tier 1 intelligence claims that must be deterministic, reproducible, auditable, and with understood failure models. We call this the structural soundness standard.

We don’t use predictive models in identifying wallet segments because machine learning cannot fulfil the structural soundness standard. This is not a question of their accuracy. A perfectly accurate predictive model still would not pass the structural soundness standard. Their decision logic is learned from data, rather than derived from specific, auditable rules. If the training data changes, a predictive model’s rules, and thus its conclusions might also change.

Instead, we use machine learning as one of the many tools that help generate  “Tier 2” intelligence claims, analytic ones. This covers lead generation, evidence-based category assessments, anomaly detection and pattern recognition. These signals can be useful in informing an investigation.

We also use AI and machine learning to strengthen our scam-detection and disruption tool, Alterya. Alterya’s models continuously learn from web data, chat messages, and blockchain activity to identify emerging scams.

Why this matters in court

U.S. courts use the Daubert standard to evaluate whether expert evidence is reliable enough to present to a jury. The test asks whether a methodology is testable, whether it has been peer reviewed, whether it has a known error rate, and whether it is generally accepted in its field.

Chainalysis is the first and only blockchain analytics provider to successfully meet the Daubert standard, in the 2024 case United States v. Sterlingov. The defense challenged Chainalysis’ work as insufficient and flawed. But the judge in the case found that Chainalysis’ approach to building clusters was sound. Core to that finding was the judge’s review of our clustering methodology: its reasoning was transparent enough to be independently verifiable.

That ruling validated a specific methodology built on deterministic, reproducible heuristics with documented safeguards. It did not validate blockchain analytics as a category.

An ML-heavy approach faces an uphill battle under Daubert. If a provider cannot explain how a cluster was constructed, what evidence supports a label, or why a model reached a particular conclusion, that methodology may not survive a Rule 702 hearing. The implications for investigations, prosecutions, and compliance programs are serious.

Real-world implications

Bad wallet segments shape decisions that affect real people and real investigations.

For law enforcement, a flawed segment can send an investigation in the wrong direction. For instance, agents could spend months pursuing a suspect based on wallet connections that do not actually exist, or issue subpoenas to the wrong exchanges. They could even execute faulty search warrants on insufficient evidence. In complex cases involving multiple jurisdictions, a single bad lead can sink an investigation’s progress.

For compliance teams, the consequences are equally serious. A false positive linking a customer wallet to a sanctioned entity can trigger account termination, fund freezes, and suspicious activity reports filed with regulators. The customer loses access to financial services based on a connection that was never real.

For prosecutors, a wallet segment that cannot withstand scrutiny can unravel a case. Defense attorneys will probe the methodology behind every claimed wallet connection. If the answer to “how do you know these addresses are linked?” is “the model said so,” that attribution becomes a liability rather than an asset. Cases built on unexplainable ML outputs risk dismissal, or create precedent that undermines future prosecutions relying on blockchain evidence.

Methodology as the foundation

Machine Learning offers an appealing proposition: feed a model enough data, and it will find patterns humans miss. In blockchain analytics, that proposition has led some providers to lean heavily on machine learning for address clustering and entity attribution.

The recent Daubert ruling and our published ontology for defining the cluster reflect the same underlying commitment: that the claims behind our data should be transparent, testable, and defensible. Structural soundness standard is a safeguard designed to survive exactly the kind of scrutiny that ML-driven approaches struggle to meet.

Daubert showed that you can cluster addresses based on standards that are admissible in court. The Ghost Clusters paper showed those same methods can have exceptionally high coverage of services at the same time. ML is a compromise; Chainalysis’ approach ensures you don’t have to.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein. 

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.