How Rain approaches wallet monitoring: Q&A with Chainalysis

At Rain, fraud prevention and detection starts long before a user attempts a transaction. One of the earliest tools we use to mitigate risk is wallet monitoring, the practice of screening where onchain value has been before arriving in a smart contract connected to a Rain-powered product. Identifying source of funds is one of the primary ways we protect the platform, our partners, and our users. 

Screening at this level takes overlapping systems and specialized expertise, which is why we work with best-in-class vendors alongside our internal controls. One of these partners is blockchain analytics company Chainalysis. We sat down with Caitlin Barnett, Director of Regulation and Compliance at Chainalysis, to dig into how upstream wallets are identified and risk-scored, and why real-time monitoring is mission critical for stablecoin payment infrastructure providers like Rain. 

‍

Q: How does Chainalysis identify wallets onchain?

A: It starts with clustering, which is the process of grouping individual blockchain addresses that we can determine are controlled by the same entity. The scientific methods for grouping addresses together depend on the blockchain. On UTXO chains like Bitcoin, we use co-spend heuristics. If two addresses sign the same transaction as inputs, they share a private key and therefore belong to the same wallet. On account-based chains like Ethereum or Tron, different techniques apply, but the principle is the same and the end goal is to link addresses to their common owner. Importantly, we only leverage Machine Learning techniques for lead generation as those are probabilistic and less certain.

Once we have clusters, we layer on attribution. Our research team continuously maps clusters to real-world identities through Open-Source Intelligence (OSINT) research, law enforcement partnerships, proprietary data collection, and community submissions. That means a cluster isn't just "these 50 addresses move funds together," it's "these 50 addresses belong to VASP ABC," or "this cluster is operated by a sanctioned entity."

We also maintain address-level identifications for cases where a single address within a larger cluster has a distinct designation. For example, for a specific deposit address at a major exchange that's been listed on an OFAC sanctions designation, the parent cluster might be a legitimate exchange, but that particular address carries its own risk signal.

The result is a layered identification system: clustering tells you who controls what, attribution tells you who they are, and address-level identifications distinguish operators from users.

‍

Q: How does Chainalysis identify risky actors?

A: We assess risk through two complementary lenses: direct identification and exposure analysis.

Direct identification is the most straightforward. If we've attributed a cluster to a known ransomware group, a sanctioned entity, a darknet marketplace, or a scam operation, that identification carries an inherent risk category. Our research team tracks these entities continuously and maintains the most comprehensive high quality database of illicit actor attributions in the industry.

Exposure analysis is where things get more nuanced. Even if a wallet doesn't belong to a known bad actor, it may have significant transactional ties to one. We analyze both direct exposure (the wallet transacted directly with a risky counterparty) and indirect exposure (funds passed through intermediaries before reaching the wallet). We break this down by risk category (sanctioned entities, stolen funds, ransomware, darknet markets, fraud shops, child exploitation material, terrorist financing, and others) and quantify it in both percentage and dollar-value terms.

On top of that, our software lets clients set custom alert rules with configurable thresholds so that a transfer triggering, say, 5% indirect exposure to a sanctioned entity fires a high-severity alert, while 1% exposure to a mixing service might be a medium. Risk isn't binary, it's a spectrum, and we give our clients the tools to define where their lines are.

‍

Q: Why is wallet monitoring especially critical for a stablecoin payments provider like Rain?

A: Stablecoins have moved well past crypto-native use. They're now processing real payment volume: cross-border settlement, card transactions, treasury flows. That shift is exactly why regulators hold infrastructure providers to the same standard as any payments processor or money transmitter.

These regulators expect real-time monitoring, not after-the-fact reviews. A payments infrastructure provider sees the transaction as it happens, not weeks later in a batch report. If a sanctioned wallet moves funds through your platform in real time and you don't catch it, that's not a reporting gap you can close later. It's a live compliance failure, and potentially an enforcement action.

Reputation follows directly from that. A payments platform's value depends on partners, banks, and regulators trusting that every transaction moving through it has been screened, not sampled after the fact. Wallet monitoring is how stablecoin platforms demonstrate that trust is earned in real time, transaction by transaction, rather than assumed.

‍

Q: How does wallet monitoring evolve as new chains, wallets, or laundering techniques emerge?

A: This is one of the hardest problems in the space, and honestly, it's a never-ending arms race. A few things are critical to staying ahead.

As the blockchain ecosystem grows and activity expands across an increasing number of networks, Chainalysis coverage must continuously evolve to meet customers wherever onchain activity takes place. Today, Chainalysis supports more than 30 blockchains with deep attribution and clustering coverage, supporting 3-5 new chains each quarter. Supporting a new network goes beyond technical integration and tracking value transfers. We apply existing intelligence, develop new clustering heuristics, and discover new attributions to identify the entities and types of activity occurring onchain. This gives customers the context they need to understand not just how value moves, but who is involved and what that activity represents. This is to say we're constantly onboarding new networks and deepening our analytics on existing ones.

Laundering techniques evolve constantly. Cross-chain bridges, privacy protocols, chain-hopping through DEXs, nested services with the playbook changing every few months. Our response is multi-layered: we invest in cross-chain tracing capabilities so that moving funds from Ethereum to Tron to Solana doesn't break the trail; we deploy threat detection that can flag exploit patterns and anomalous behavior even before a cluster is formally attributed; and we maintain real-time monitoring infrastructure that watches for onchain events such as fund movements, approval changes, and contract interactions at the block level.

Every new attribution, every new cluster identification, and many law enforcement cases we support feed back into the system. The compounding effect of this intelligence network is what makes monitoring more effective over time even as adversaries adapt.

‍

Q: From your vantage point across many clients, what separates a company with a strong wallet monitoring program from one with a weak one?

A: Three things stand out consistently.

First, strong programs are proactive, not reactive. Weak programs screen a wallet when a compliance officer gets a tip or when a regulator asks a question. Strong programs screen in real time every counterparty at the point of transaction whether that's deposits or withdrawals. They also have automated alert pipelines that surface risk without waiting for a human to go looking. The difference between catching a sanctioned entity's funds before they clear versus three days later is the difference between a compliance success and an incident report.

‍
Second, strong programs invest in tuning. Out-of-the-box alert thresholds are a starting point, not a destination. The best teams iterate on their rules by adjusting exposure thresholds by category and building tiered escalation workflows. They understand that 2% indirect exposure to a mixing service means something very different from 2% direct exposure to a sanctioned entity, and their rules reflect that nuance. Weak programs leave default settings in place and drown in noise, which leads to alert fatigue and, eventually, missed real risk.

Third, strong programs treat monitoring as cross-functional, not siloed. The best clients connect their wallet monitoring data to their broader risk and investigation workflows, which allows them to tie blockchain analytics to KYC data, case management, and regulatory reporting. They use exposure data not just to block or allow a transaction, but to understand the full risk profile of a customer relationship over time. A single suspicious transfer is data; the pattern across six months of transfers is intelligence. The companies that build that connective tissue between monitoring and decision-making are the ones that consistently stay ahead of both illicit actors and regulators.

‍

‍Wallet monitoring is one piece of a larger system

Real-time screening catches what a transaction looks like the moment it happens. But a strong risk program has to hold that same standard at every other point in a payment program's lifecycle: who signs up, where they're signing up from, what changes as a relationship evolves. That's why Rain treats risk mitigation as a continuous discipline rather than a checkpoint, with clear ownership over transaction-level controls, AML and fraud risk assessment, and geographic and sanctions screening from onboarding through ongoing use.

Read more about how we structure that program in How Rain Reduces Risk: A Guide.