AI Investigation Technology · 15 April 2026 · 8 min read
Understanding Transaction Graph Analysis
By Digital Asset Claims Research Desk·Investigation Team
- Transaction Graph
- Blockchain Analysis
- Wallet Clustering
Transaction graphs are one of the most widely used tools in blockchain investigation, converting raw ledger data into a visual structure that reveals fund flow patterns. Understanding how they are built and what their elements represent is essential to reading them correctly.
A node in a transaction graph is an address, not a person. Reading the graph correctly starts with keeping that distinction in view at every step.
How Nodes and Edges Are Constructed
Each node represents a blockchain address, and each directed edge represents a specific transaction moving value from one address to another, sourced directly from the public ledger.
Edge weight is typically scaled to transaction value, allowing an analyst to visually distinguish significant fund movements from minor or dust transactions at a glance.
Every edge is traceable to a specific transaction hash, which means any element of the constructed graph can be independently verified by checking the underlying blockchain record.
Wallet Clustering and Its Heuristics
Clustering heuristics group addresses believed to share a common controller, most commonly using the pattern of multiple addresses being spent together as inputs to a single transaction.
These heuristics are well-established in blockchain analysis but produce probabilistic groupings, not certainties, and are stated with an explicit confidence level in any resulting documentation.
Exchange and custodial wallet clusters require particular care, since a single clustered entity may represent an enormous number of unrelated underlying customers rather than one individual.
Convergence Points and Their Significance
A convergence point, where multiple distinct fund sources combine at one address, often marks a meaningful point in an investigation, such as a consolidation wallet or an exchange deposit address.
These points are checked against known address databases and, where relevant, against exchange deposit address patterns to determine whether they represent a regulated custodial service.
Correctly identifying a convergence point can materially narrow the scope of further enquiry, directing subsequent legal or investigative requests toward the specific service involved.
Handling Mixers, Bridges and Broken Traceability
Mixing services and cross-chain bridges are designed to obscure the direct link between funds entering and leaving them, which breaks the graph's normal edge-based traceability at that point.
Where a trail passes through such a service, the graph explicitly marks the segment as an assumed rather than directly observed continuation, distinguishing it from verified transaction edges.
Additional techniques, such as timing and volume correlation, may support a probabilistic inference across a mixer, but this inference is always stated at a lower confidence level than direct on-chain tracing.
Elements of a transaction graph and their evidential status
| Element | Represents | Certainty level |
|---|---|---|
| Node | A blockchain address | Directly observed |
| Edge | A specific verified transaction | Directly observed |
| Cluster | Heuristic grouping of addresses | Probabilistic, stated confidence |
| Mixer/bridge segment | Assumed fund continuation | Inferred, lower confidence |
Frequently asked questions
Does a transaction graph identify who owns an address?
No. It shows fund movement between addresses. Ownership attribution requires additional corroborating evidence, such as OSINT findings or exchange records obtained through legal process.
How reliable is wallet clustering?
The underlying heuristics are well-established and widely used, but results remain probabilistic. Clusters are documented with a stated confidence level rather than presented as confirmed ownership groups.
What happens when funds pass through a mixing service?
Direct traceability is broken at that point. Any continuation of the trail beyond the mixer is documented as an inference with a stated lower confidence, not as a directly observed fact.
Can a transaction graph be independently checked by a third party?
Yes, provided the underlying transaction hashes are documented. A third party can verify each edge against the public ledger independently of the original analysis.
Transaction graphs turn complex blockchain activity into an interpretable structure, but every element carries its own evidential status. Distinguishing directly observed transactions from probabilistic clustering and inferred continuity is what makes a graph analysis genuinely useful rather than merely persuasive in appearance.
