Crypto entity attribution: how field verification tells you who is behind an address

A blockchain address is not an identity. It is a string of characters. A compliance analyst can trace it, group it with related addresses, and score it for risk, and still not know who controls the funds. That gap is where decisions stall, and crypto entity attribution is how it gets closed. A VASP cannot file a report against an address alone, an investigator cannot name a suspect from one, and an automated agent cannot clear a payment on one. Each of them needs the entity behind the address, with evidence they can produce if asked.

This is the data question underneath the category Crystal works in. Decision intelligence for digital assets is the discipline of putting verified evidence in front of every decision an organization makes about digital assets. Entity attribution is the part of that evidence that says who, and it is the part on-chain data alone cannot supply.

This article explains what a cluster tells you, why a risk score does not answer the identity question, how Crystal’s analysts verify an attribution in the field, what the resulting dataset contains, and which decisions it supports. It starts with the floor: what clustering does and does not establish.

Key takeaways

• Clustering groups addresses that behave as if one party controls them. It establishes that addresses belong together, not who holds the keys.

• A risk score measures proximity to known illicit activity. It is an input to the firm’s own risk policy, not an identification of the counterparty.

• Field-verified entity attribution ties a cluster to a named real-world operator through direct engagement, open-source verification, address testing, and intelligence gathered on the ground.

• Every attribution in Crystal’s dataset carries its source, so a compliance team or investigator can produce the evidence behind a label instead of asking for it.

• The same entity dataset supports three different calls: a pre-transaction screen, a court-ready investigation, and a per-decision Know Your Agent check in agentic payment flows.

What does a cluster actually tell you?

Clustering is the first thing any analytics tool does with an address. It groups addresses that behave as if one party controls them. The common heuristics are simple to state. If several addresses fund the same transaction, they are probably held in the same wallet. If a payment leaves change, the change address probably belongs to the sender. Machine-learning models layer on subtler patterns: timing, fee choices, and reuse habits that survive attempts to obscure them.

The output is a set of addresses that are likely under one owner. That is useful. It turns thousands of addresses into a manageable number of wallets and lets an analyst follow funds without losing the thread at every hop.

It is also an inference. These patterns hold most of the time, not every time. A transaction with several signers can look like one wallet when it is several parties. An exchange’s hot wallet can absorb addresses that belong to its customers. A model can extend a cluster past the point the evidence supports. Good tools quantify that uncertainty. None of them remove it.

Even a perfect cluster answers only one question: do these addresses belong together? It says nothing about who holds the keys. Naming the controller is a different claim, and it has to be built from different material than the chain provides.

Why isn’t a risk score enough to know who is behind an address?

A risk score expresses how close a wallet sits to known illicit activity in the transaction graph: how many hops from a sanctioned entity, how much of its volume touched a darknet market, how its behavior compares with wallets already labeled. It is computed from clustering output plus the labels the vendor already holds. For volume screening, that is exactly what a compliance team needs. It sorts thousands of transfers into the few that deserve a look.

The score is an input. Under the firm’s own risk policy, thresholds and rules turn it into a pass, a hold, or an alert. What the score does not do is identify anyone. A wallet scored at 80% is a wallet whose neighbors are worrying. Whether it belongs to a licensed exchange in Lithuania or an unregistered OTC desk is a separate fact, and the score does not carry it.

That matters because the obligations are written in terms of identity. FATF Recommendation 16 requires VASPs to obtain and hold originator and beneficiary information on virtual asset transfers, and a sanctions screen compares a counterparty against a list of named persons and entities. An examiner asking why a transfer was approved wants to know who the counterparty was and how the firm knew. A score answers neither of those two questions. In practice, an analyst who receives a high score goes looking for the identity by hand: a web search, a block explorer, a vendor label, a colleague who remembers the address. That work is legitimate. It is also slow, and it is repeated from scratch on the next alert.

Nested services show how far a score can miss. When a smaller operator runs its business through accounts at a larger exchange, its transfers appear on-chain as the host exchange’s own. The host is licensed, the score is low, and the risk sits one level down, where the score cannot see it. Crystal’s research on nested services shows the scale of what passes through these arrangements without being identified. Only attribution at the entity level separates the nested operator’s flows from the host’s.

A score narrows the field to the wallets worth a closer look, and attribution supplies the named counterparty that a compliance action, a sanctions decision, or a court filing requires.

How does field verification actually build an entity attribution?

Crypto entity attribution ties a cluster to a specific real-world operator: an exchange, an OTC desk, a mixer, a payment processor, a darknet market, a gambling service. The label has to be true, and it has to come with evidence the team can hand over when someone asks how they know. On-chain data alone cannot deliver that, so Crystal’s analysts go off-chain. The method has multiple layers, and the layers reinforce one another.

Direct engagement. Analysts interact with the candidate service as a user would: open an account, make a deposit, request a withdrawal, place a trade. Then they follow the funds to where they settle. If a deposit to a newly listed exchange lands in a known exchange’s hot wallet, the new exchange is a nested operator, and the relationship has been observed rather than assumed.

Open-source verification. The candidate is checked against what it says about itself and what others say about it: its website, its social media accounts, its Telegram channels, company registrations, license registers, and press coverage. Each match is kept with its original reference, so a later reader can open the source rather than take the label on faith.

Address testing. Deposit addresses issued by the service are tested to confirm they resolve into the cluster the label is attached to. This closes the loop between the entity and its addresses in both directions.

Field intelligence. In regions where public information is thin and cash-for-crypto services operate offline, analysts collect intelligence on the ground. Crystal’s investigation into cash-for-crypto services quotes an investigator who, at the time, had seen no other provider collect intelligence on the ground in the Middle East. This is what Crystal means when it says its entity data is verified: “Everything Crystal shows you is checked against the physical world, not guessed from the chain alone.”

An attribution enters the dataset when the evidence supports it, and the evidence enters with it. Analysts can produce that evidence on request, so anyone reviewing the label can inspect how it was reached and what it rests on. That is what field-verified means in practice: the claim was checked outside the chain, and the check is on file.

What does the entity dataset contain, and how does it stay current?

The result of that work is an entity profile, not a label on an address. Each profile carries the entity’s type (exchange, OTC desk, mixer, payment processor, darknet market, and so on), its risk score, registration and legal details, the authorities that supervise it, and the source behind each attribution link: a direct engagement result, a web mention with its original reference, a register entry. When an analyst asks why an address is labeled as it is, the answer is in the profile.

Attributions can change. A service rebrands, moves its hot wallets, obtains a license, or is added to a sanctions list. Crystal’s analysts update profiles as new evidence surfaces, and the new evidence is kept alongside the changed label. Check an entity twice, months apart, and any difference between the two answers traces to a documented update rather than to drift nobody can explain.

Profiles are not chain-specific. One entity resolves to one profile whether its funds move on Bitcoin, Ethereum, Tron, or any other of the 330+ blockchains Crystal covers, so an investigator following a counterparty across chains sees one operator rather than several unconnected clusters.

Scale is what makes this usable rather than anecdotal. Crystal’s dataset holds 130,000+ entities verified in the field, and in Crystal Expert it is applied across 210M+ verified transfers, with 30M+ risky transfers flagged. Those figures describe how much of the transaction graph has a named operator behind it rather than a heuristic guess.

Table 1: Clustering alone vs. field-verified entity attribution

Source: Crystal Intelligence, 2026. Download as CSV.

What decisions does verified attribution support?

Three kinds of decision-maker use the same dataset for different calls.

Compliance and AML teams screen counterparties before a transfer clears and file reports afterward. With an entity profile behind the address, the screen compares a named operator against the sanctions list, the firm’s licensing requirements, and its own risk policy, instead of comparing a score against a threshold. That is the difference between a hold that says “high score” and a hold that says “counterparty is an unregistered OTC desk operating from a sanctioned jurisdiction, source attached.” The second version is the one an auditor accepts. Clearing a transfer without identifying the counterparty is a Travel Rule gap and, where a sanctioned jurisdiction is involved, a sanctions exposure the firm carries from that moment on.

Financial crime investigators need the attribution to hold in court. Every link in a profile traces to a source, so the investigator can put the evidence, not just the label, in front of a prosecutor, and can follow the same counterparty across chains as one operator. That is what turns a lead into a case. The operational side, where a flag becomes an investigation, is covered in Crystal’s article on threat detection decisions.

Automated systems and their operators face the same question at a different tempo. In agentic payment flows an AI agent transacts on behalf of a principal, and the check on who it is dealing with has to happen per decision rather than once at onboarding. Know Your Agent (KYA), the counterpart to KYC for an AI agent acting on someone’s behalf, rests on the same entity dataset: the agent’s wallet, and the principal behind it, are resolved against verified profiles at decision time, with the source kept for the review afterward.

The rule across all three is the same: Crystal surfaces; humans decide. The dataset puts the named entity and its evidence in front of the analyst, or the rule the analyst configured, and the call stays with them.

Frequently asked questions

What is the difference between crypto clustering and entity attribution?

Clustering groups addresses that share on-chain behavior, such as funding the same transaction or receiving change from the same sender, into a set that one party probably controls. Entity attribution ties that set to a named real-world operator, with evidence gathered off-chain. Clustering establishes that addresses belong together; attribution establishes who controls them. Only the second supports a compliance action, an investigation, or a court filing.

Why doesn’t a high risk score tell me who is behind an address?

A risk score measures how close a wallet sits to known illicit activity in the transaction graph. It reflects what the wallet did and whom it transacted with, not who controls it. A compliance decision, a sanctions screen, and an investigation all require the identity and the evidence behind it. The score is one input to the firm’s risk policy; the attribution is the fact the decision rests on.

What does field-verified mean for a crypto entity?

Field-verified means the attribution was checked outside the chain. Crystal’s analysts interact directly with the service, verify it against its website, social media, and registrations, test the addresses it issues, and, where public information is thin, gather intelligence on the ground. An attribution is added to the dataset when that evidence supports it, and the source is kept with it so the claim can be examined later.

Can Crystal’s entity attribution be used as evidence in court or a regulatory proceeding?

Each attribution traces to a source, such as a direct engagement result, a web mention with its original reference, or a register entry, so a reviewer can retrace the steps and see what the label rests on. Law enforcement agencies and regulators rely on Crystal’s entity data in investigations and proceedings. Crystal surfaces the evidence; the investigator or compliance team decides how to apply it.

For informational purposes only. Not legal or compliance advice.

Get the evidence behind the address

Clustering is the foundation. It tells an analyst which addresses move together, and no serious tool skips it. Attribution is the claim a decision actually rests on: who controls those addresses, and how the firm knows. The distance between the two is where compliance exposure accumulates, where investigations stall at an unlabeled wallet, and where an agent clears a payment to a counterparty nobody has identified.

Closing that distance is off-chain work. Direct engagement, open-source verification, address testing, and intelligence gathered on the ground produce a dataset in which every label carries its evidence. As agentic payments shorten the time between a transfer request and a decision, the same dataset is what lets a per-decision identity check happen at all.