Wallet Intelligence Investigation

Executive Summary

Addresses recurring across several unconnected incident reports raised the question of whether a single operator was responsible. The engagement assessed common control on the evidence available, without overstating what clustering can establish.

The result was a graded assessment rather than a binary conclusion.

Investigation Scope

The mandate was assessment of common control and characterisation of operational behaviour.

• ›Clustering analysis across the supplied address set
• ›Behavioural profiling of timing, value structuring and service preference
• ›Explicit statement of attribution limits
• ›A reusable indicator set for future incident matching

Technical Challenges

Common-input clustering applies cleanly to UTXO chains but not to account-based chains, where shared control must be inferred from funding patterns and operational behaviour instead.

Service-controlled addresses can produce false clustering signals, so custodial infrastructure had to be identified and excluded before any conclusion was drawn.

Investigation Methodology

Exclusion of custodial and contract addresses preceded all clustering work.

• ›Classification of every address as user-controlled, contract or service-controlled
• ›Common-input analysis where the chain model supports it
• ›Funding-pattern and gas-payer analysis on account-based chains
• ›Temporal profiling to identify consistent operational windows

Blockchain Analysis

Two distinct clusters emerged. Within each, funding originated from a shared source and activity followed a consistent daily window. Between the clusters, the only connection was a shared preference for the same intermediate services, which is a weak signal and was recorded as such.

The assessment concluded common control within each cluster at high confidence, and connection between clusters at low confidence.

Evidence Collection

Each classification decision was documented with the observation that produced it, so the cluster boundaries could be audited.

• ›Address classification register with supporting observations
• ›Clustering output with the method applied to each chain
• ›An indicator set formatted for reuse in future matching

Findings

The reports involved at least two separate operational clusters rather than one actor. Behavioural signatures were sufficiently distinctive to support future matching against new incidents.

No individual identity was asserted; on-chain data supports control assessment, not identification.

Outcome

The graded assessment and indicator set were delivered for use in institutional reporting and for correlation against future incidents.

No outcome is promised in any engagement. The deliverable is a documented, verifiable evidentiary record.

Lessons Learned

Clustering answers a narrow question — whether addresses are commonly controlled — and it answers nothing about who exercises that control.

• ›Exclude custodial infrastructure before clustering anything
• ›State the chain model, because it determines which methods are valid
• ›Grade weak signals as weak rather than aggregating them into false certainty