Analyze Blockchain Transactions and Addresses

Blockchain Analytics Expert is a skill for on-chain data analysis, transaction tracing, address clustering, and forensic investigation across different blockchain networks. It covers the data structures and analytical methodologies used to extract meaningful insight from distributed ledgers.

It starts from the data layer: primary sources (full nodes, block explorers, specialized analytics APIs like Etherscan, Blockchair, and Chainalysis), graph databases for relationship mapping (Neo4j, Amazon Neptune), data warehouses (BigQuery public datasets, Dune Analytics, Flipside Crypto), and real-time mempool monitoring over WebSocket connections. Its transaction-analysis framework distinguishes Bitcoin's UTXO model from Ethereum's account-based model, and uses input/output flow tracking, gas analysis (transaction cost as a signal of user behavior), and temporal clustering of activity.

For address clustering and attribution it covers heuristics such as multi-input clustering (addresses appearing together as inputs in one transaction are likely controlled by the same entity) and change-address detection in two-output transactions, plus SQL-based attribution against contract-interaction patterns (grouping by counterparty and gas usage to surface high-frequency interactions with ERC-20 contracts). For transaction-flow analysis it traces funds forward with a breadth-first search across a configurable hop limit and minimum amount, and detects mixing-service patterns from rapid-succession transfers, round-number amounts, and timing analysis.

Its DeFi analytics cover Uniswap V3 liquidity-position analysis (mint events aggregated into total positions, unique providers, and average liquidity) and MEV detection, using window functions to spot sandwich attacks where the same trader appears immediately before and after a victim's swap. For compliance and risk it defines an OFAC sanctions-screening risk score that walks a counterparty graph to a configurable depth, weighting direct sanctions matches, hop-decayed sanctions exposure, mixing-service and darknet-market association, and ransomware links, while reducing risk for exchange-deposit and DeFi-interaction counterparties. For performance it uses connection pooling and a concurrency semaphore to batch-analyze many addresses asynchronously against a rate-limited API.

Use it for investigative or compliance work that needs to trace fund flows, cluster addresses, screen counterparties against sanctions lists, or analyze DeFi liquidity and MEV activity across Bitcoin, Ethereum, or similar chains. It is not a substitute for legal or regulatory judgment - the skill's own ComplianceAnalyzer returns immediately on a direct sanctions match rather than always walking the full counterparty graph, its best practices insist attribution results carry confidence levels, and addresses are never linked to real identities without a legal basis.

Input is addresses, transactions, or a block/pool range to analyze, plus the data source(s) available (node RPC, block explorer API, or a warehouse like BigQuery/Dune). Output is clustering results, fund-flow paths, DeFi position and MEV metrics, or a numeric risk score with named risk factors on a 0-100 scale: a direct sanctions match scores 100, ransomware association 90, a darknet-market link 80, one-hop sanctions exposure 75 decayed by hop count, mixing-service use 50, DeFi interaction only 5, and an exchange-deposit counterparty actually reduces the score by 10. These are produced by patterns such as this address-clustering heuristic:

### Multi-input clustering heuristic for Bitcoin
def cluster_multi_input_addresses(transaction):
    """
    Addresses that appear as inputs in the same transaction
    are likely controlled by the same entity
    """
    if len(transaction['inputs']) > 1:
        input_addresses = [inp['address'] for inp in transaction['inputs']]
        return input_addresses  # These belong to same cluster
    return None

### Change address detection
def detect_change_address(transaction):
    """
    In Bitcoin, change addresses often have specific patterns:
    - Smaller amounts
    - Different address formats
    - Single output transactions following this one
    """
    outputs = transaction['outputs']
    if len(outputs) == 2:
        amounts = [out['value'] for out in outputs]
        # Typically, change is the smaller amount
        change_idx = amounts.index(min(amounts))
        return outputs[change_idx]['address']

Data sources and platforms named include Etherscan, Blockchair, Chainalysis, Neo4j, Amazon Neptune, BigQuery, Dune Analytics, and Flipside Crypto; the async implementation runs on aiohttp and asyncio with a Semaphore for concurrency control, and Redis is recommended for caching frequently-queried blockchain data.

Blockchain forensic investigators, compliance and risk teams, and DeFi analysts who want a risk score built on a transparent, weighted counterparty walk (a 3-hop default depth) rather than a black-box number - with attention to jurisdictional compliance (GDPR, CCPA), pseudonymization, and auditable investigation trails.