Fund Trace

Fund Trace is BlockchainAnalysis.io's origin-of-funds investigation tool. It traces the flow of cryptocurrency backwards from any address, mapping the path funds have taken through the blockchain using a 3-hop BFS (Breadth-First Search) graph traversal. The result is an interactive visualization showing where funds originated, which intermediary addresses they passed through, and whether any high-risk entities are present in the chain of custody.

Why Fund Tracing Matters

Knowing an address's current risk score is important, but regulators and compliance officers increasingly need to answer a deeper question: Where did this money come from?

Fund tracing addresses critical compliance scenarios:

• Source of funds verification — When onboarding a high-value customer, verifying that their crypto holdings originate from legitimate sources (mining, verified exchange withdrawals, salary payments) rather than illicit activity.
• STR/SAR evidence — When filing a Suspicious Transaction Report or Suspicious Activity Report, regulators expect detailed documentation of the funds flow. A fund trace provides the evidence chain.
• Post-incident investigation — After a hack, scam, or theft, tracing the stolen funds forward (destination analysis) and backward (origin analysis) to identify the perpetrators and recovery paths.
• Enhanced Due Diligence (EDD) — For customers flagged as medium or high risk, fund tracing provides the additional context needed to make an informed onboarding or continued-service decision.

How Fund Tracing Works

BFS Graph Traversal

Fund Trace uses a Breadth-First Search algorithm to systematically explore the transaction graph surrounding a target address. The traversal works as follows:

Hop 0 (Target Address) The starting point. The platform identifies all incoming transactions to the target address, along with amounts, timestamps, and counterparty addresses.

Hop 1 (Direct Sources) For each address that sent funds to the target, the platform identifies that address's entity classification (if known) and its own incoming transactions. Known entities (exchanges, protocols, mixers) are labeled and categorized.

Hop 2 (Indirect Sources) The process repeats for each Hop 1 address, expanding the graph one level further. At this depth, the platform typically identifies the original deposit source — the exchange or service where the funds entered the blockchain ecosystem.

Hop 3 (Extended Sources) A third hop provides additional context for complex flows, such as funds that passed through multiple intermediary wallets, DeFi protocols, or bridge contracts before reaching the target address.

Entity Resolution at Each Hop

At every hop in the traversal, each address is checked against the BlockchainAnalysis.io entity database. When a known entity is identified, the traversal branch is typically terminated at that point — once you know funds came from Binance or Coinbase, tracing further back into the exchange's internal wallet infrastructure provides no additional compliance value.

Flow Aggregation

Raw blockchain transactions are aggregated into meaningful flows:

• Multiple small transactions between the same pair of addresses are consolidated into a single flow with total volume
• Internal wallet transfers within a single entity (e.g., exchange hot wallet rotations) are collapsed
• DeFi protocol interactions (swaps, deposits, withdrawals) are interpreted and labeled with the protocol name and action type

Initiating a Fund Trace

Via Dashboard

Via API

POST /api/v1/fund-trace

Request Body

{
  "address": "0x1234567890abcdef1234567890abcdef12345678",
  "chain": "ethereum",
  "direction": "inbound",
  "depth": 3,
  "from_date": "2025-01-01",
  "to_date": "2026-03-31",
  "reference_id": "investigation_case_42"
}

Request Parameters

| Parameter | Type | Required | Description | |---|---|---|---| | address | string | Yes | The blockchain address to trace | | chain | string | Yes | Blockchain identifier | | direction | string | No | inbound, outbound, or both (default: inbound) | | depth | integer | No | Hop depth: 1, 2, or 3 (default: 3) | | from_date | string | No | Start date filter (ISO 8601) | | to_date | string | No | End date filter (ISO 8601) | | reference_id | string | No | Your internal reference ID |

Response

{
  "id": "ft_9a2b3c4d5e6f7g8h",
  "status": "COMPLETED",
  "address": "0x1234567890abcdef1234567890abcdef12345678",
  "chain": "ethereum",
  "direction": "inbound",
  "depth": 3,
  "summary": {
    "total_volume_usd": 485230.50,
    "unique_sources": 14,
    "identified_entities": 8,
    "high_risk_sources": 2,
    "sanctioned_exposure": false,
    "mixer_exposure": true,
    "mixer_percentage": 12.4
  },
  "source_breakdown": [
    {
      "category": "EXCHANGE",
      "entities": ["Binance", "Kraken"],
      "volume_usd": 312500.00,
      "percentage": 64.4
    },
    {
      "category": "DEFI_PROTOCOL",
      "entities": ["Uniswap V3", "Aave V3"],
      "volume_usd": 85000.00,
      "percentage": 17.5
    },
    {
      "category": "MIXER",
      "entities": ["Tornado Cash"],
      "volume_usd": 60200.50,
      "percentage": 12.4
    },
    {
      "category": "UNKNOWN",
      "entities": [],
      "volume_usd": 27530.00,
      "percentage": 5.7
    }
  ],
  "graph": {
    "nodes": 47,
    "edges": 62,
    "visualization_url": "https://app.blockchainanalysis.io/fund-trace/ft_9a2b3c4d5e6f7g8h"
  },
  "risk_flags": [
    {
      "flag": "MIXER_EXPOSURE",
      "severity": "HIGH",
      "detail": "12.4% of inbound funds originated from Tornado Cash (via 2 hops)"
    }
  ]
}

Interactive Visualization

The fund trace results are presented as an interactive graph visualization in the dashboard. This is one of the most powerful features of the Fund Trace tool, allowing compliance officers to visually explore complex fund flows.

Graph Elements

• Nodes — Each node represents a blockchain address. Nodes are color-coded by entity category:

  • Blue — Known exchanges
  • Green — DeFi protocols
  • Red — High-risk entities (mixers, darknet, sanctioned)
  • Orange — Medium-risk entities (gambling, unregulated services)
  • Gray — Unknown/unidentified addresses
  • Purple — The target address (center of the graph)

• Edges — Each edge represents a flow of funds between two addresses. Edge thickness indicates relative volume. Edge labels show the amount and token transferred.

• Hop Rings — The graph is laid out in concentric rings around the target address. Hop 1 addresses form the inner ring, Hop 2 the middle ring, and Hop 3 the outer ring.

Interaction Controls

| Control | Action | |---|---| | Click node | Show address details, entity information, and transaction list | | Hover edge | Display transaction amount, timestamp, and token | | Scroll wheel | Zoom in/out | | Drag canvas | Pan the view | | Drag node | Reposition individual nodes | | Double-click node | Expand that node to show additional hops (if available) | | Right-click node | Context menu: Copy address, open in wallet screening, add to watchlist |

Filtering

The visualization supports filtering to focus on specific aspects of the fund flow:

• Filter by entity category — Show only flows involving exchanges, mixers, DeFi protocols, etc.
• Filter by risk level — Hide low-risk flows to focus on suspicious activity
• Filter by time range — Narrow the visualization to a specific period
• Filter by amount — Show only flows above a minimum threshold
• Filter by token — Focus on specific assets (ETH, USDT, USDC, etc.)

PDF Evidence Reports

Every fund trace can be exported as a PDF evidence report suitable for regulatory submissions, SAR/STR filings, and internal compliance records.

Report Contents

The PDF report includes:

1. Cover Page — Report ID, target address, trace parameters, generation date, and analyst name
2. Executive Summary — Key findings in narrative form, suitable for non-technical readers
3. Source of Funds Breakdown — Pie chart and table showing the percentage and volume of funds from each source category
4. Risk Flags — All detected risk indicators with severity and explanation
5. Graph Visualization — A static snapshot of the interactive graph, with legend and annotations
6. Transaction Table — Complete list of all transactions included in the trace, with timestamps, amounts, and counterparty addresses
7. Entity List — All identified entities in the trace, with their categories and risk classifications
8. Methodology Statement — Description of the BFS traversal methodology, data sources, and confidence levels
9. Audit Trail — Report generation metadata including cryptographic hash for integrity verification

Generating a PDF Report

From the fund trace results page, click Export > PDF Report. The report is generated server-side and available for download within 30-60 seconds. Reports are also stored in your account under Reports > Fund Trace Reports for future access.

Fund Trace vs Wallet Screening

Both tools analyze blockchain addresses, but they serve different purposes:

| Aspect | Fund Trace | Wallet Screening | |---|---|---| | Primary question | Where did these funds come from? | What is the risk profile of this address? | | Analysis type | Historical transaction path tracing | Current-state risk assessment | | Output | Graph visualization + flow breakdown | 12-section risk report | | Depth | 3-hop BFS traversal of transaction history | Full entity resolution + risk scoring | | Time | 15-60 seconds | 5-15 seconds | | Best for | Investigations, SAR evidence, EDD | Routine screening, compliance checks | | Pricing | $11.98-$14.90 per trace | Included in screening plans |

When to Use Each

Use Wallet Screening when:

• Performing routine compliance checks on customer addresses
• You need a quick risk score for a counterparty
• Onboarding a new customer (initial screen)
• Re-screening monitored addresses on a schedule

Use Fund Trace when:

• A wallet screening returned a HIGH or CRITICAL risk score and you need to understand why
• Preparing evidence for a SAR/STR filing
• Conducting enhanced due diligence on a high-value customer
• Investigating a reported fraud, hack, or theft
• A regulator or law enforcement has requested fund flow documentation

Integration with KYT

Fund Trace integrates seamlessly with KYT (Know Your Transaction). When a KYT check returns a BLOCK or REVIEW verdict, the platform can automatically initiate a fund trace on the flagged address, providing your compliance team with a ready-made investigation package.

Automatic Escalation Flow

1. KYT check returns BLOCK or REVIEW verdict
2. Platform automatically initiates an inbound fund trace (3 hops) on the flagged address
3. Compliance team receives an alert with the KYT verdict and the fund trace results
4. The compliance officer reviews the visualization, identifies the risk source, and makes a disposition decision
5. If a SAR is required, the fund trace PDF report is generated and attached to the filing

Pricing

Fund Trace is priced per individual trace:

| Volume (Monthly) | Price per Trace | |---|---| | 1 - 100 | $14.90 | | 101 - 500 | $13.50 | | 501 - 1,000 | $11.98 | | 1,001+ | Contact sales |

Supported Blockchains

Fund Trace is available on all 38 supported blockchains. However, trace depth and entity resolution coverage varies by chain:

| Chain Category | Trace Depth | Entity Coverage | Notes | |---|---|---|---| | Ethereum | 3 hops | Full | Most comprehensive coverage including all DeFi protocols | | Bitcoin | 3 hops | Full | UTXO-based tracing with clustering heuristics | | EVM L2s (Arbitrum, Optimism, Base, etc.) | 3 hops | High | Cross-chain bridge flows traced to L1 | | Solana | 3 hops | High | SPL token flows fully supported | | Tron | 3 hops | High | TRC-20 token flows (USDT focus) | | Other chains | 2-3 hops | Moderate | Coverage expanding continuously |

See Supported Blockchains for the full list.

Best Practices

1. Start with inbound traces — In most compliance scenarios, the question is "where did the money come from?" Start with an inbound trace. Only run outbound traces when investigating where stolen or suspicious funds were sent.

2. Use time range filters — For addresses with long transaction histories, limiting the trace to a relevant time window significantly improves processing speed and result clarity.

3. Combine with wallet screening — Run a wallet screening first to get the overall risk profile, then use fund trace on addresses that warrant deeper investigation.

4. Save PDF reports proactively — Generate and archive PDF reports for any investigation, even if you do not file a SAR. Regulators may request historical documentation during examinations.

5. Annotate the visualization — Use the annotation tools in the interactive visualization to add notes, highlight key paths, and mark suspicious flows before sharing with colleagues or regulators.

6. Check the mixer percentage — The mixer_percentage field in the API response is a critical metric. Funds with even a small percentage of mixer exposure warrant additional scrutiny.