Methodology
How ChainHint follows funds, what its scores and labels mean, where they are typically wrong, and what it cannot do. It is written for investigators and lawyers who need to know what a figure rests on before they rely on it. Every number on this page is the one the engine runs with today.
What ChainHint does not establish
ChainHint does not identify people.
A trace connects addresses to addresses. A label names a service (an exchange, a protocol, a mixer) or repeats a published attribution with its source; it never names the person who controls an address. Names people give their own wallets (ENS, Farcaster, Lens, TON DNS) are shown only as "Personal wallet", and an exchange deposit address is attributed to the exchange, not to its customer. Who is behind an address is for law enforcement and the exchange that holds the customer records.
A risk score is not a probability.
It is a sum of fixed weights for the findings on an address, with some findings setting a minimum, capped at 100. The weights were set by hand and are published; they have not been fitted to, or measured against, outcomes. A score of 70 does not mean a 70% chance of anything. An automated estimate from on-chain data and published labels — not a finding that anyone did anything wrong.
A label is an attribution, not proof.
Every label carries its source and the date it was read. Only a sanctions designation that names the address makes it "Sanctioned". An address with no label is reported as not identified, which is not the same as clean.
ChainHint freezes nothing and recovers nothing.
Only the exchange or the token issuer holding the funds can freeze them, usually at law enforcement's request. ChainHint shows where funds went and who can be asked. It is an investigative tool, not a certified forensic examiner: a figure meant for a court should be reviewed by an expert who can testify to it.
How a trace works
A trace starts from an address on one of 12 chains and reads only the public ledger, through blockchain data providers. Nothing in it comes from a private feed, an informant or an off-chain claim. It takes minutes; how many depends on how deep it goes and how widely the funds spread.
Hop by hop, to a fixed depth.
The engine follows outgoing transfers breadth-first: the addresses that received funds, then the addresses they sent to, and so on — 3 hops on the free plan, 4 on the Case and Investigator plans, 6 hops on Agency.
A bounded number of addresses per hop.
At each hop the receiving addresses are ranked by how much they received and only the top ones are opened. The rest are recorded as reached but not read further. Such an address marks a limit of this trace, not a place where the funds stopped; the graph and the report say so for each one ("Where the trace stopped"). Transfers below a dust threshold per chain are ignored.
Services end a branch.
Exchanges, DeFi protocols, bridges and mixers are recorded as endpoints and not walked through: their own traffic belongs to thousands of unrelated users, and following it would fill the trace with strangers.
Bridges are recorded, not crossed.
When funds reach a known bridge, the trace records the bridge and, where known, the destination chain, and stops. It does not continue on the other chain by itself; an investigator starts a new trace there.
Every transfer is priced on its own day.
Each transfer is valued in USD at the historical price of the day it moved, not at one price for the whole trace. A token with no price is shown with no dollar value rather than an invented one.
How a downstream share is calculated
Where an address's funds went is expressed as a share of what left it — an indirect exposure, never a claim that the receiver holds the victim's money. The model is a proportional haircut: where funds from several sources mix in one address, the onward flow is split in proportion to net receipts. Hop 1 is a direct transfer and is exact; every further hop is discounted by 35%, because a dollar several hops away is weaker evidence than one handed over directly. A flow is not followed once it falls below 1% of what was traced, but a flow that reaches an identified bad actor is recorded from $1,000 whatever its share, and a sanctioned counterparty at any amount. If more than 50% of the transfers could not be priced, no percentage is printed at all.
What the risk score means
Every address gets a score from 0 to 100, built from the findings on that address: a sanctions designation, a law-enforcement attribution, a seizure order, an issuer freeze, a mixer interaction, a scam-list entry and a few weaker signals. Some findings set a minimum on their own — a sanctions designation sets 100. The bands are Low (0–20), Moderate (21–40), Elevated (41–60), High (61–80) and Critical (81–100). Every weight and minimum is listed on Risk Scoring.
A score can also rise because of whom an address dealt with, but only under stated conditions: the counterparty's label must be verified (a designation, a law-enforcement attribution, a seizure order, an issuer freeze or an analyst's verification on that address), and the address must have sent it at least 10% of its priced outgoing value and at least $1,000. Funds received never raise a score — anyone can send anything to any address. Sending to a sanctioned address counts at any amount.
We check the engine against a fixed set of cases whose answers we are certain of, after every backend deploy. That shows the engine still gives the answers it gave; it does not measure how often a score is right.
Where labels come from
Sanctions designations.
Addresses named in the lists we screen addresses against: OFAC SDN, EU (via FR DG Trésor), France DG Trésor, UK Sanctions List.
Official records.
Stablecoin issuers' freeze lists, law-enforcement attributions and court or ministerial seizure orders, each shown as what the document establishes — its authority, reference and date — and marked "Not a sanctions designation". Court filings that mention an address are shown as citations and score nothing: a filing names the victim's and the exchange's addresses next to the defendant's.
Clustering, incident reports and public label registries.
Shown as "attributed, unverified" with their source. They count toward what a trace reports, but never set a minimum score on another address and never make an address a freeze target.
Industry blocklists and heuristic detectors.
Shown with their source. A heuristic detector's flag scores nothing.
Our own deposit-address inference.
An address that received from at least 10 different senders and swept at least 50% of it onward to at most 3 destinations looks like an exchange deposit address. It is shown as "possibly" that service, with a confidence never above 0.9 — a behavioural guess, not an identification.
The full list of sources and their licences is on Entity Database.
Typical false matches
Exchange wallets.
A hot wallet or a shared deposit address moves funds for thousands of customers. A transfer to an exchange is not a transfer to a person, and a transfer from one does not make the receiver a suspect.
Dust and address poisoning.
Anyone can send tokens to any address — including small amounts from a hacker's wallet or from look-alike addresses meant to be copied by mistake. This is why funds received never raise a score, and why a restricted asset worth under $10 is shown and not scored.
Mixers and privacy tools.
Using a mixer raises a score; it is not evidence of wrongdoing, and many people use privacy tools for ordinary reasons.
Issuer freezes.
A frozen address means the issuer stopped its token there, not that the owner is a criminal. On an exchange's own wallet a freeze carries a lower minimum, and on the issuer's own token contract it carries no weight.
Busy personal wallets read as deposit addresses.
The deposit-address inference can mistake a payment processor or a very active personal wallet for an exchange deposit address. That is why it says "possibly" and never acts as an identification.
Old labels.
A label is true as of the date it was read. Sanctions are lifted, services change hands, and a registry can be wrong. Check the date and the source before relying on one.
What ChainHint cannot do
See inside an exchange or any custodial service.
Funds deposited at an exchange move on its internal books; only the exchange can say where they went.
Follow funds through a mixer or a privacy coin.
Past a mixer or into a privacy coin such as Monero, the trace reports a boundary, not a destination. ChainHint does not demix by amount or timing.
Cross chains automatically.
A trace stops at a bridge. Swap and bridge services that are not on our list appear as ordinary addresses.
Read every branch.
Depth and the per-hop limit mean small branches can go unread. A wider or deeper trace is what would answer; this page does not assume the answer.
Watch continuously.
Address monitoring checks watched addresses on a schedule, not as each block arrives.
Treat every chain equally.
Tron tracing is in beta, and on Solana each hop reads a limited window of recent transactions. The chain list on Fund Tracing states each chain's limits.