Crypto firm outlines address clustering methodology after courtroom validation
Chainalysis published a proposed ontology on Monday outlining standards for how investigators can identify and link clusters of crypto addresses on blockchains, formalizing methodologies the firm has already deployed in law enforcement cases.
The ontology breaks down “clusters” of addresses into component parts: wallet segments that may function as deposit addresses, change addresses, or other functions. It presents a two-tier structure, with the first tier defining the structural graph and the second assessing confidence in that graph.
Jacob Illum, chief scientist at Chainalysis, framed the work as a response to investigative needs. “If I was the one who needed this information to actually either convict on or prosecute or investigate, what would I want a tool to do?” Illum said. The ontology aims to answer that question by establishing what investigators can reliably infer from onchain data alone.
The proposal comes after Chainalysis’ Reactor tool underwent scrutiny in a U.S. Department of Justice case against Roman Sterlingov, co-founder of Bitcoin Fog, who was convicted on money laundering charges in 2024. A Daubert hearing examined whether the tool met evidentiary standards for courtroom use. Judge Randolph Moss ruled the software highly reliable, writing that “substantial evidence supports the government’s submission that the software is highly reliable.”
Illum emphasized the distinction between onchain analysis and user identification. “Those two things really have nothing to do with each other, because the science of the wallet has to stand on its own, because it’s supported by the blockchain,” he said. Chainalysis cannot identify actual end users without additional information beyond onchain data. Investigators may need to issue subpoenas to identify customers behind wallets at exchanges or other entities managing wallets.
The ontology addresses a fundamental ambiguity in the industry. The term “cluster” does not have a universal meaning across the industry, according to the document. Illum clarified the underlying logic: “What does it mean that these addresses belong together, right? It’s clearly because somebody believes that they are under the control of the same entity, right?”
Illum warned against opacity in methodology. “When people start stepping away from independent scrutiny about their methodologies, like independent testing, that’s a clear danger sign,” he said. The published ontology appears designed to invite such scrutiny by making Chainalysis’ reasoning transparent to prosecutors, defense attorneys, and courts.
Illum described his role as one of constraint: “what’s supported by the data? That’s my job, to tell an investigator as much as possible what you can do with what the data tells us.” The ontology formalizes that boundary, establishing what conclusions blockchain analysis can and cannot support.
