Analysis Methodology

Last updated: April 9, 2026

1. Methodology Overview

All analysis results produced by Trailbit are probabilistic, heuristic-based assessments derived from publicly available Bitcoin blockchain data. No finding should be treated as a deterministic fact.

Results require human verification before being used as the basis for regulatory filings, legal proceedings, or other consequential action. Compliance teams and analysts are expected to apply professional judgment when interpreting platform outputs.

Trailbit applies transparent, documented heuristics to on-chain data. Every risk score, pattern detection result, and entity attribution label is traceable to a specific documented methodology with known confidence characteristics. This transparency is intentional — it supports defensible compliance workflows and enables analysts to explain their reasoning in audits, court filings, and regulatory reviews.

All heuristics are probabilistic — false positives are inherent and documented per method
Findings reflect pattern presence, not confirmed intent or identity
The platform analyses publicly available blockchain data only
No private keys are accessed, stored, or processed at any point

2. Risk Scoring Framework

Each address and transaction receives an overall risk score on a 0–100 scale derived from multi-factor analysis. The score aggregates signals from pattern detection, risk screening, temporal analysis, and behavioral fingerprinting.

Risk Levels

Level	Score range	Interpretation
Low	0–25	Minimal risk indicators detected
Medium	26–50	Some concerning patterns present
High	51–75	Significant risk indicators detected
Critical	76–100	Multiple severe risk factors present

Score Composition

Pattern detection (peel chains, consolidations, mixing, N-1 distributions)
Risk screening against public watchlist data (direct and proximity matches)
Temporal analysis (activity clustering, night-time concentration)
Behavioral fingerprinting (address reuse, fee anomalies, self-churn)

Important: Risk scores reflect the presence of detectable patterns in on-chain data. They are indicators, not determinations of malicious intent. A high score does not confirm illicit activity; a low score does not exclude it. All scores require analyst review before being relied upon in any compliance or legal context.

3. Pattern Detection Heuristics

The following heuristics are applied to transaction data. Each entry documents what the heuristic detects, its confidence characteristics, and known false-positive scenarios.

Peel Chain Detection

Confidence: Medium

Detects sequential 1-input to 2-output transactions where one output retains 80–99% of the incoming value and the smaller output is spent. Requires a minimum chain length of 3 linked transactions to qualify as a confirmed peel chain.

Known false positives: Regular payment sequences where one party consistently receives smaller amounts; exchange withdrawal batches that produce structurally similar output ratios.

Consolidation Patterns

Confidence: Medium-High

Two sub-patterns are detected. Large consolidation: 10 or more inputs merged into one or more outputs. Perfect consolidation: 3 or more inputs combined into a single output.

Known false positives: Standard wallet UTXO cleanup operations; exchange cold-wallet consolidation after a high-volume period; mining pool payout aggregation.

CoinJoin / Mixing Detection

Confidence: Medium

Uses an equal-output sliding window algorithm to identify transactions where 5 or more inputs and 5 or more outputs share similar values within a 2% tolerance. This covers Wasabi Wallet, Whirlpool (Samourai), JoinMarket, and structurally similar protocols.

Known false positives: Batch payment transactions where multiple recipients receive similar amounts (e.g., payroll disbursements, recurring billing aggregation).

Change Output Identification

Confidence: Medium

Applies a multi-factor scoring system using 7 heuristics: address reuse, value analysis, script type matching, output position, round-number detection, dust threshold proximity, and script version consistency. An output is classified as change when it scores 45 or higher with at least 2 independent supporting indicators.

Known false positives: Multi-party transactions (e.g., CoinJoin); payment-splitting arrangements where both outputs are intentional payments.

Address Reuse Analysis

Confidence: High

Calculates a privacy grade based on the single-use address ratio across the analysed address set. Grades: Excellent (>80% unique addresses), Good (>60%), Fair (>40%), Poor (<40%).

Known false positives: Rare — address reuse is directly observable on-chain. The grade reflects a factual metric, not an inference. However, reuse is not inherently suspicious in all contexts (e.g., static donation addresses).

Wallet Fingerprinting

Confidence: Low-Medium

Identifies wallet software from transaction structure signatures. Covered wallet types include Bitcoin Core, Electrum, Wasabi Wallet, Samourai, hardware wallets (Ledger, Trezor), major exchanges, and common mobile wallets. Confidence thresholds range from 0.3 to 0.5 depending on how distinctive the wallet's on-chain signature is.

Known false positives: Custom wallet implementations that coincidentally match the structural signature of a known wallet type; updated wallet versions that change signing behavior; users who modify default wallet settings.

Exchange Fingerprinting

Confidence: Medium

Identifies exchange-like behaviour patterns including characteristic peeling, large consolidations, batch withdrawal structures, and consistent fee policies. A likelihood threshold of 0.7 is required before an address cluster is flagged as exchange-like.

Known false positives: Large payment processors with high transaction volume; high-volume merchants operating at exchange-like scale; OTC desks.

Self-Churn Detection

Confidence: Medium

Identifies round-trip transactions where value returns to an originating address after passing through one or more intermediate hops. Confidence is adjusted downward for longer hop chains (increasing likelihood of coincidence) and upward for fast round-trips occurring within 1 hour.

Known false positives: Coincidental address reuse at separate points in time; exchange deposit-withdrawal cycles where the same user controls both ends; wallet recovery operations.

Fee Analysis

Confidence: Medium-High

Compares transaction fee rates against yearly median benchmarks calibrated to network conditions. Extreme overpayment (more than 10× the median benchmark) carries a confidence score of 0.9. Significant overpayment (more than 3× the median) carries a confidence score of 0.75.

Known false positives: Emergency transactions submitted during fee spikes; users relying on default fee estimators during congestion; RBF fee-bumped transactions where only the replacement is analysed.

N-1 Pattern Detection

Confidence: Medium

Based on published academic research. Detects recursive splitting trees where a transaction produces N outputs and each is subsequently spent in a similar structure. Minimum requirements: 3 non-dust outputs per node, at least 2 validated generations, and 50% or more valid descendants. Tracing is capped at 7 generations to manage computational bounds.

Known false positives: Legitimate fund distribution networks (e.g., affiliate payouts, grant disbursements); merchant payment processors that use fan-out structures for operational reasons.

4. Temporal Analysis

Temporal pattern analysis examines when transactions occur to identify activity concentration patterns that may indicate geographic origin, operational schedules, or automated behaviour.

All timestamps are derived from the Bitcoin blockchain and expressed in UTC
Business hours: 08:00–18:00 UTC
Night activity: 22:00–06:00 UTC
Timezone estimation is probabilistic, inferred from activity concentration patterns — it is not a confirmed geographic location
A minimum of 10 transactions is required before temporal pattern detection is applied

Timezone inferences should be treated as investigative leads, not confirmed facts. Many actors use VPNs, automated scripts, or operate across multiple time zones, which reduces the reliability of timezone attribution.

5. Risk Screening

Risk screening compares addresses against publicly available watchlist data, including government-published flagged-address lists.

Data sources: Publicly available watchlist repositories, synced from open-source mirrors
Update mechanism: Automated periodic synchronisation; data may lag behind upstream list updates

This is not a licensed compliance tool. Trailbit's risk screening uses publicly available data for investigative and educational purposes. It must not be represented as an authoritative compliance service or used as a substitute for a licensed risk-screening provider in regulated contexts.

False positives are possible due to address reuse and data latency between upstream updates and the synced dataset
All matches require independent verification through the originating authority's official channels before any compliance action is taken

6. Entity Attribution

Entity attribution associates Bitcoin addresses with known entities (exchanges, services, mining pools, dark-market infrastructure) using community-sourced label data.

Data Sources

GraphSense TagPacks — Academic-grade label dataset maintained by researchers at Complexity Science Hub Vienna
Mining-pool repositories — Community-maintained lists of known mining pool addresses

Confidence Levels

Level	Meaning
Confirmed	Label verified by the entity or through on-chain proof
High	Strong corroborating evidence from multiple independent sources
Medium	Plausible attribution with limited corroboration

Attribution data is informational, not authoritative. Confidence levels are always preserved and displayed to users — they are never stripped or aggregated away in exports or reports.

Community-sourced labels vary in accuracy by source and entity type. Labels should be treated as investigative context, not verified identity.

7. AI-Assisted Analysis

Trailbit optionally integrates AI-assisted analysis via the Anthropic Claude API. This feature uses a bring-your-own-key (BYOK) architecture — users provide their own API key and are subject to Anthropic's usage policies directly.

BYOK architecture: The user's API key is used directly; Trailbit does not proxy or log the content of AI requests
Framing: All AI outputs are presented as investigation work product — advisory summaries to support analyst reasoning, not independent findings
Human judgment required: AI analysis does not replace professional investigative or compliance judgment
Audit trail: Model version and token usage are logged per report to support reproducibility and audit requirements

Limitation notice: Large language models are subject to hallucination — they may generate plausible-sounding but incorrect statements. All AI-generated analysis outputs require verification against primary on-chain data before being used in any compliance, legal, or regulatory context.

Questions & Methodology Review

For questions about specific heuristics, confidence assessments, or methodology suitability for a particular compliance or legal context, contact us at contact@trailbit.io.