# ChainAnalyzer - Multi-Chain AML & Security Intelligence Platform

> ChainAnalyzer is an enterprise-grade blockchain address risk analysis platform that automatically detects security risks, AML violations, and compliance issues across 12 chains, all live for self-serve scanning, with 76+ detection rules, ML anomaly scoring, and AI-powered analysis.

---

## Overview

ChainAnalyzer scans blockchain addresses across Bitcoin, Ethereum, Polygon, BNB Smart Chain, Base, Arbitrum, Optimism, Avalanche, Solana, Kaia, TRON, and XRP (12 chains live for self-serve) to detect:

- Sanctions violations (OFAC SDN list screening)
- Money laundering patterns (mixer usage, peel chains, fund splitting)
- Wallet drainers and phishing addresses
- Address poisoning and sybil attacks
- Rug pulls, honeypots, and fake tokens (Solana)
- LP vulnerabilities and whale concentration (Solana)
- Cross-chain bridge fund flows

The platform serves compliance teams, financial institutions, security researchers, and crypto traders who need to verify address safety before transacting.

---

## Supported Chains

### Bitcoin (9 detectors)
- Address formats: Legacy (1...), P2SH (3...), Bech32 (bc1...)
- OFAC SDN screening, dust attack detection, CoinJoin participation, peel chain analysis
- Data source: Blockstream Esplora (free, no API key)
- Price: CoinGecko (free)

### Ethereum (18+ detectors)
- Full EVM AML analysis with 25+ detection rules
- OFAC sanctions, mixer detection, address poisoning, peel chains
- Sybil aggregation, dangerous approvals, token relay chains, fake tokens
- Neo4j graph proximity analysis
- Data source: Etherscan V2 API
- External ML: GoPlus Security, Alterya, Chainalysis KYT (optional)

### Polygon (18+ detectors)
- Same EVM detection suite as Ethereum
- Native token: POL
- Data source: Etherscan V2 API (chainid=137)

### Avalanche (18+ detectors)
- Same EVM detection suite as Ethereum
- Data source: Routescan API (Etherscan-compatible)

### Solana (17 detectors)
- Address auto-detection: Token mint vs wallet address
- Token scanning: rug pull, honeypot, LP vulnerability, whale concentration, metadata risk
- Wallet scanning: known drainers, drainer patterns, exchange laundering, rapid activity
- Data sources: Solana RPC, RugCheck.xyz, Helius DAS, Birdeye, Jupiter Ultra API

### Base / Arbitrum / Optimism (18+ detectors each)
- Same EVM detection suite as Ethereum
- Data source: Etherscan V2 API (chainid 8453 / 42161 / 10)

### Kaia (18+ detectors)
- Formerly Klaytn, chainid 8217; same EVM detection suite as Ethereum
- Data source: Kaiascan (Etherscan-compatible) API with public-RPC eth_getLogs fallback

### BNB Smart Chain (18+ detectors)
- Same EVM detection suite as Ethereum (chainid 56)
- Data source: Etherscan V2 API, covered under ChainAnalyzer's Etherscan Lite plan (all-chains access)

### TRON (6 detectors)
- Non-EVM (TVM): base58check addresses, no Etherscan-compatible surface — independent scanner pipeline
- Native TRX transfers and TRC20 tokens (including USDT-TRC20)
- OFAC sanctions screening, dust attack detection, peel chain analysis, KYT risk rating, Alterya risk scoring, social/web mention detection
- Data source: TronGrid API (BYOK supported; free tier 15 QPS / 100k requests per day)

### XRP / XRP Ledger (6 detectors)
- Account-based ledger with a JSON-RPC surface, not Etherscan-compatible — independent scanner pipeline
- Native XRP payments and IOU (issued currency) tokens
- OFAC sanctions screening, sanctioned-counterparty detection, dust attack detection, peel chain and fund-splitting detection, KYT risk rating
- Partial Payment transactions are corrected against `delivered_amount` for the actual amount received
- Data source: Ripple's official full-history cluster s2.ripple.com (fallback: xrplcluster.com), no API key required (no BYOK path)

---

## Detection Rules (76+)

### Risk Scoring

Addresses are scored on a 0-100 scale where higher scores indicate higher risk:

- **CRITICAL** (Score 70-100): Immediate threats — sanctions violations, known scams, honeypots, active mint authority
- **HIGH** (Score 40-69): Significant risks — mixer contact, peel chains, fake tokens, drainer patterns, whale concentration
- **MEDIUM** (Score 10-39): Notable concerns — new tokens, low holders, address poisoning indicators
- **LOW** (Score 0-9): Minor observations — missing social links, moderate concentration

### Solana Token Detectors

| Severity | Detection | Description |
|----------|-----------|-------------|
| CRITICAL | Mint Authority Active | Token supply can be arbitrarily increased by the mint authority holder |
| CRITICAL | Known Scam Token | Token flagged as dangerous in RugCheck database |
| CRITICAL | Honeypot Detected | Token cannot be sold — swap simulation fails |
| HIGH | Freeze Authority Active | Token transfers can be frozen by the authority holder |
| HIGH | Top Holders Over 50% | Top 10 holders control more than 50% of supply |
| HIGH | LP Not Locked | Liquidity pool tokens are neither locked nor burned |
| HIGH | Single Whale Over 20% | A single address holds more than 20% of total supply |
| HIGH | Low Liquidity | Market cap to liquidity ratio exceeds 100x |
| MEDIUM | New Token | Token was created less than 7 days ago |
| MEDIUM | Low Holder Count | Fewer than 50 unique holders |
| MEDIUM | Suspicious Distribution | Top holders appear to belong to the same entity cluster |
| MEDIUM | Metadata Mismatch | Token metadata is incomplete or inconsistent |
| MEDIUM | Single LP Provider | Only one address provides all liquidity |
| LOW | Social Links Missing | No Twitter or website in token metadata |
| LOW | Moderate Concentration | Top 10 holders control 30-50% of supply |
| LOW | Low Trading Volume | 24-hour trading volume below $100 |
| LOW | Not Verified | Token not verified on Jupiter or major aggregators |

### Solana Wallet Detectors

| Severity | Detection | Description |
|----------|-----------|-------------|
| CRITICAL | Known Drainer | Address is registered in ChainAnalyzer ScamDB as a confirmed drainer |
| HIGH | Drainer Pattern | Multiple incoming transfers followed by immediate swaps — classic drain behavior |
| HIGH | Exchange Laundering | Funds routed to anonymous or KYC-free exchanges |
| MEDIUM | High Error Rate | Transaction failure rate exceeds 30%, indicating spam or automated attacks |
| MEDIUM | Rapid Activity | Abnormally high transaction count in a short time window |

### EVM Detectors (Ethereum, Polygon, Avalanche)

| Severity | Detection | Description |
|----------|-----------|-------------|
| CRITICAL | OFAC Sanctioned | Address appears on the U.S. OFAC SDN sanctions list |
| CRITICAL | Sanctioned Entity Contact | Direct transaction with a sanctioned address |
| HIGH | Mixer Contact | Interaction with known mixing services (Tornado Cash, etc.) |
| HIGH | Peel Chain | Small-amount sequential transfers designed to obfuscate fund origin |
| HIGH | Fake Token | Token name or symbol impersonates a well-known token |
| HIGH | Dangerous Approval | Unlimited token approval granted to an externally owned account |
| MEDIUM | Address Poisoning | Zero-value token transfers mimicking legitimate addresses |
| MEDIUM | Fund Splitting | Funds split across multiple addresses in a short time |
| MEDIUM | Sybil Aggregation | Multiple wallets sending identical amounts to a central address |
| MEDIUM | Token Relay Chain | ERC-20 tokens forwarded through intermediate addresses |
| LOW | Self Transfer | Address sending funds to itself |
| LOW | OSINT Flagged | Address mentioned in scam reports or community databases |

### Bitcoin Detectors

| Severity | Detection | Description |
|----------|-----------|-------------|
| CRITICAL | OFAC Sanctioned | Address on the OFAC SDN list |
| HIGH | Dust Attack | Tiny BTC amounts sent to track wallet activity |
| HIGH | CoinJoin Participation | Usage of CoinJoin mixing to obfuscate transaction history |
| HIGH | Peel Chain | Sequential small-output transactions designed to launder funds |
| LOW | OSINT Flagged | Address found in scam databases |

### TRON Detectors

| Severity | Detection | Description |
|----------|-----------|-------------|
| CRITICAL | OFAC Sanctioned | Address on the OFAC SDN list (TRX) |
| HIGH | Sanctioned Counterparty | Contact with an OFAC-sanctioned TRON address |
| HIGH | Peel Chain | Sequential decreasing sends to new addresses |
| MEDIUM | Dust Attack | Tiny TRX transfers used for wallet tracking / address poisoning setup |
| MEDIUM | Fund Splitting | Funds split across multiple addresses in a short time |

### XRP Detectors

| Severity | Detection | Description |
|----------|-----------|-------------|
| CRITICAL | OFAC Sanctioned | Address on the OFAC SDN list |
| HIGH | Sanctioned Counterparty | Contact with an OFAC-sanctioned XRP address |
| HIGH | Peel Chain | Sequential decreasing sends to new addresses |
| MEDIUM | Dust Attack | Tiny XRP transfers used for wallet tracking / address poisoning setup |
| MEDIUM | Fund Splitting | Funds split across multiple addresses in a short time |

### External Intelligence Detectors (All Chains)

| Source | Detections | Description |
|--------|------------|-------------|
| GoPlus Security (EVM) | Sanctioned, High Risk, Medium Risk, Low Risk | Free threat intelligence for EVM addresses |
| Reddit OSINT (All) | Scam Mention, General Mention | Public discussion monitoring for address references |
| Chainalysis KYT (EVM/BTC) | High/Medium/Low Risk | Enterprise transaction monitoring (API key required) |
| Alterya ML (All) | Severe/High/Medium Risk | Machine learning risk scoring (API key required) |

### ML Anomaly Detection

ChainAnalyzer employs an ensemble of three machine learning models to detect anomalous transaction patterns:

- **Isolation Forest**: Detects outliers in transaction graph features
- **AutoEncoder**: Identifies unusual patterns through reconstruction error
- **GraphSAGE**: Graph neural network analyzing neighborhood structure in Neo4j

Ensemble weights: Isolation Forest 40%, AutoEncoder 35%, GraphSAGE 25%. Models auto-adjust weights when a component is unavailable.

---

## Key Features

### Address Scanning
- Paste any blockchain address to get an instant risk assessment
- Automatic chain and address type detection (token vs wallet for Solana)
- Results include risk score, severity level, all triggered detections, and detailed explanations
- 30-minute result caching for faster repeat lookups

### AI Analysis (Pro+)
- GPT-powered executive summaries explaining risk findings in plain language
- Fund flow analysis with regulatory context
- Inquiry reports for compliance documentation
- Exchange regulatory context (JFSA status, enforcement history, travel rule compliance)

### Batch Scanning
- Scan multiple addresses at once (up to 100 per batch on Pro plan)
- CSV import/export with AI-annotated results
- Enterprise CSV pipeline for external ML system integration

### Portfolio Scan
- Connect a Phantom wallet to scan all held tokens at once
- Instant portfolio-wide risk assessment

### Follow Mode (Pro+)
- Automatic discovery of related suspicious addresses via graph exploration
- Neo4j-powered BFS traversal up to 3 hops (Enterprise)
- Email alerts when new risky connections are found

### Contract Monitor (Pro+)
- Monitor EVM token contracts for malicious transaction patterns
- Detects address poisoning, relay chains, rapid distribution, large transfers
- Automated alerts on suspicious activity

### Bridge Trace (Pro+)
- Track fund movements across chain bridges
- Identify cross-chain laundering patterns

### Watchlist Monitoring
- Add addresses to watchlist for periodic automated rescanning
- Email alerts when risk level changes
- Monitoring frequency: 24hr (Starter) to 1hr (Enterprise)

### ScamDB (OSINT)
- Community-driven database of confirmed scam addresses
- Verified through automated transaction analysis
- Real-time matching during address scans
- Public API for external integrations

### PDF & CSV Export
- Download detailed security reports in PDF format
- Export batch results as CSV with risk annotations
- Enterprise CSV with AI analysis annotations

### BYOK (Bring Your Own Key)
- Use your own API keys for deeper analysis
- Supported: Helius, Birdeye, Etherscan, Chainalysis KYT, Alterya

---

## Pricing

### Free Plan — $0/month
- 10 scans per month
- All 12 chains
- Basic rug pull and scam detection
- 7-day scan history

### Starter Plan — $4.99/month
- 200 scans per month
- 12 chains (Bitcoin, Ethereum, Polygon, BNB Smart Chain, Base, Arbitrum, Optimism, Avalanche, Solana, Kaia, TRON, XRP)
- Batch scan (up to 10 addresses)
- Holder analysis
- Watchlist monitoring (10 items, 24hr frequency)
- Email alerts
- 30-day scan history

### Pro Plan — $19.99/month
- 1,000 scans per month
- All 12 chains (same as Starter)
- Batch scan (up to 100 addresses)
- AI-powered analysis (executive summaries, fund flow reports)
- REST API access (60 requests/min)
- Webhooks (3 endpoints)
- Follow Mode (2-hop graph exploration)
- Contract Monitor
- Bridge Trace
- Watchlist monitoring (50 items, 6hr frequency)
- 180-day scan history

### Enterprise Plan — Custom Pricing
- Unlimited scans
- All 12 chains
- Batch scan (up to 500 addresses)
- Enterprise CSV pipeline for external ML integration
- REST API (300 requests/min)
- Webhooks (10 endpoints)
- Follow Mode (3-hop graph exploration)
- Audit logs
- External ML risk-feed integration
- Watchlist monitoring (unlimited, 1hr frequency)
- Unlimited scan history
- Dedicated support

### Topup Packs
- Small: 50 scans — $2.99 (Starter+)
- Medium: 200 scans — $9.99 (Starter+)
- Large: 500 scans — $19.99 (Pro+)

---

## API

### Scan API
```
POST /api/v1/public/scan
Authorization: Bearer tfk_...
Content-Type: application/json

{
  "address": "0x...",
  "chain": "ethereum"
}
```

Supported chain values: `solana`, `ethereum`, `polygon`, `avalanche`, `bitcoin`, `bsc`, `base`, `arbitrum`, `optimism`, `kaia`, `tron`, `xrp`

### Batch Scan API
```
POST /api/v1/public/batch
Authorization: Bearer tfk_...

{
  "addresses": [
    {"address": "0x...", "chain": "ethereum"},
    {"address": "bc1...", "chain": "bitcoin"}
  ]
}
```

### ScamDB API (Free, No Auth Required)
```
GET /api/v1/scamdb/lookup?address=...
```

Returns known scam entries with type, severity, method, and verification status.

---

## Exchange Regulatory Registry

ChainAnalyzer maintains a registry of 24+ cryptocurrency exchanges with regulatory compliance data:

- JFSA (Japan Financial Services Agency) registration status
- Enforcement action history and administrative orders
- Travel Rule compliance status by jurisdiction (FATF)
- KYC verification levels (None / Basic / Enhanced / Full)
- License event timelines

This data is integrated into AI analysis to provide regulatory context when exchange addresses are detected in transaction flows.

---

## Technology

- **Frontend**: SvelteKit (Svelte 5) with daisyUI
- **Backend**: FastAPI (Python)
- **Database**: Supabase (PostgreSQL)
- **Graph Database**: Neo4j for transaction flow analysis
- **ML Models**: Isolation Forest, AutoEncoder, GraphSAGE ensemble
- **AI**: Azure OpenAI GPT for natural language analysis
- **Hosting**: Azure Container Apps

---

## x402 Pay-Per-Request API

ChainAnalyzer supports the x402 protocol for pay-per-request access without account registration. AI agents, MCP clients, and browser wallets can pay with USDC on Base or Solana.

### Endpoints & Pricing

| Endpoint | Price | Description |
|----------|-------|-------------|
| `GET /x402/api/address/{addr}/risk-score` | $1.00 | AML risk score (all chains) |
| `GET /x402/api/address/{addr}/sanctions` | $0.50 | Sanctions screening |
| `GET /x402/api/tx/{hash}/trace` | $3.00 | Transaction flow tracing |
| `GET /x402/api/tx/{hash}/coinjoin` | $1.00 | CoinJoin detection |
| `GET /x402/api/wallet/{addr}/cluster` | $2.50 | Wallet clustering |
| `POST /x402/api/batch/screening` | $5.00 | Batch screening (up to 50) |

### How it works

1. Send a request to any x402 endpoint
2. Receive HTTP 402 with payment requirements (USDC amount, wallet address, supported networks)
3. Sign a USDC transfer with your wallet (Phantom, MetaMask, or programmatic)
4. Resend the request with `X-PAYMENT` header containing the signed payment
5. Receive the AML analysis result

### Service Discovery

- `/.well-known/x402.json` — static service metadata
- `/x402/api/discover` — dynamic endpoint listing with current pricing and network info

### Supported Payment Networks

- Base (EVM): USDC on `eip155:8453`
- Solana: USDC on `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`

---

## Links

- Website (English): https://chain-analyzer.com/en/
- Website (Japanese / 日本語): https://chain-analyzer.com/ja/
- Pricing: https://chain-analyzer.com/en/pricing
- Documentation: https://chain-analyzer.com/en/docs
- Detection Features: https://chain-analyzer.com/en/docs/detection
- API Reference: https://chain-analyzer.com/en/docs/api
- News: https://chain-analyzer.com/en/news

## Japanese Version / 日本語版

- Short Japanese summary: https://chain-analyzer.com/llms-ja.txt
- Full Japanese technical documentation: https://chain-analyzer.com/llms-full-ja.txt

ChainAnalyzer is deeply optimized for the Japanese market:
- Native Japanese UI and documentation
- FISC compliance (Japanese financial industry security standard)
- Azure Japan East hosting for data residency
- Full JPYC (Japanese yen-pegged stablecoin) AML coverage with FATF travel rule support

## Stablecoin AML Coverage

ChainAnalyzer supports AML analysis for major stablecoins:
- **JPYC** (Japanese yen-pegged, issued domestically by JPYC Inc., compliant with electronic payment instruments regulation)
- **USDT** (Tether, USD-pegged)
- **USDC** (Circle, USD-pegged)
- **PYUSD** (PayPal, USD-pegged)
- **FDUSD** (First Digital, USD-pegged)

Capabilities include:
- Transfer flow tracing across chains
- Cross-chain bridge analysis (Wormhole, LayerZero, Across, Stargate, Hop, Synapse)
- DeFi pool liquidity analysis (Curve 3pool, Uniswap V3, Aave, Compound)
- FATF Travel Rule screening: automatic detection of transfers exceeding $1,000 threshold with originator/beneficiary metadata generation
- Regulatory compliance reporting for Japanese Electronic Payment Instruments Act

## Issuer Intelligence (Stablecoin Issuer Dashboards)

Public, no-login dashboards for JPY stablecoin issuers at https://chain-analyzer.com/en/issuers :

- **Verified holder ledger**: full-history reconstruction of every holder balance per chain. Holder counts are published only when the ledger passes a supply-invariant check (sum of all holder balances == on-chain totalSupply) and are marked with a "Verified supply" badge with per-chain verification timestamps. Unverified numbers are never displayed.
- **Coverage**: JPYC across Ethereum, Polygon, Avalanche, and Kaia, plus JPYSC (trust-type JPY stablecoin). Kaia holder tracking is fully supported.
- **Issuance/redemption feed**: on-chain mint/burn events with explorer links, updated continuously.
- **Holder Graph**: top-holder structure with entity labels (exchanges, DeFi infrastructure, distribution hubs) and concentration metrics (top-10 share, Gini coefficient).
- **Methodology**: how verification works, and why these figures differ from explorer estimates — https://chain-analyzer.com/en/issuers/methodology

## Contact

For enterprise inquiries (English): https://chain-analyzer.com/en/contact_us
エンタープライズに関するお問い合わせ (日本語): https://chain-analyzer.com/ja/contact_us