Question 1

What is ARACHNE?

Accepted Answer

ARACHNE is a blockchain trace engine for Ethereum. It lets you input any Ethereum wallet address and recursively maps every connected address up to five layers deep, rendering the result as an interactive force-directed graph. It also automatically detects interactions with known mixer contracts and classifies each wallet by risk level.

Question 2

How does ARACHNE work?

Accepted Answer

You enter an Ethereum wallet address. ARACHNE queries the blockchain in real time to fetch the wallet's full transaction history, identifies every address it has interacted with, then repeats that process outward — layer by layer — up to the depth you select (1–5 layers). The resulting network is rendered as an interactive graph in your browser. Mixer detection runs automatically during the trace.

Question 3

What blockchain does ARACHNE support?

Accepted Answer

ARACHNE currently supports Ethereum mainnet. Ethereum is the world's largest programmable blockchain, and the vast majority of investigation-relevant on-chain activity occurs there. Support for additional EVM-compatible networks is planned for future releases.

Question 4

Is there a free trial?

Accepted Answer

Yes. The Spinner plan includes a 7-day free trial with no credit card required. You can trace wallets immediately after registering. At the end of the trial, you can subscribe to continue using ARACHNE or your account will revert to a limited free tier.

Question 5

How many layers deep can I trace?

Accepted Answer

You can trace between 1 and 5 layers deep from the origin wallet. Layer 1 returns the origin wallet's direct contacts; Layer 5 maps the full network five hops outward. Deeper traces take longer and return larger graphs — for most investigations, 2–3 layers provides the right balance of coverage and clarity.

Question 6

What is a mixer contract?

Accepted Answer

A mixer (or tumbler) is a smart contract designed to break the transaction trail on a public blockchain. Users deposit funds into the mixer pool; the contract pools those funds with other users' deposits and allows withdrawals to fresh addresses, severing the on-chain link between the original source and the final destination. Mixers are used to obscure the origin of funds.

Question 7

What is Tornado Cash and why does it matter?

Accepted Answer

Tornado Cash is the most widely used Ethereum mixer protocol. It uses zero-knowledge proofs to allow users to deposit ETH or ERC-20 tokens and withdraw them to a different address with no on-chain link. In August 2022, the US Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, citing its use to launder over $7 billion in crypto — including proceeds from state-sponsored hacks. ARACHNE checks every traced wallet against known Tornado Cash contract addresses and flags any interactions.

Question 8

Can I export my trace results?

Accepted Answer

Yes. ARACHNE supports two export formats: PNG (a high-resolution image of the full graph, suitable for reports and filings) and JSON (the raw network data, including all node addresses, edge connections, and risk classifications — suitable for import into external analysis tools).

Question 9

How is my data handled?

Accepted Answer

ARACHNE stores your trace history so you can review previous runs. Wallet addresses you trace are associated with your account for this purpose. ARACHNE does not sell your data to third parties, does not share individual trace results externally, and does not retain data after account deletion. Please see the Privacy Policy for full details.

Question 10

How accurate is the risk detection?

Accepted Answer

Risk detection is based on a maintained list of known Tornado Cash contract addresses and related mixer protocols. If a wallet in your trace graph has directly transacted with one of those contracts, it is flagged as High Risk. The list is comprehensive for Tornado Cash and major mixers, but no detection system is exhaustive — new mixer deployments may not be immediately included. ARACHNE surfaces risk signals; human judgement remains essential for any compliance or legal determination.

Question 11

Can ARACHNE be used for legal or compliance investigations?

Accepted Answer

ARACHNE is used by compliance professionals, investigators, and legal teams as a rapid pre-screening and visualisation tool. It is not a regulated compliance product and does not produce court-admissible reports. For formal AML/CFT compliance programmes, ARACHNE should be used alongside — not as a replacement for — regulated blockchain analytics platforms and qualified legal counsel.

Question 12

What is the difference between the subscription plans?

Accepted Answer

Plans differ primarily in the number of traces you can run per month and the depth available. The Spinner plan is the entry-level tier with a limited monthly trace allowance. Higher tiers unlock more traces, greater depth, and additional features. Full details are on the Pricing page.

Question 13

Do I need technical knowledge to use ARACHNE?

Accepted Answer

No. ARACHNE is designed to be used by anyone who can paste a wallet address into a text box. No coding, blockchain expertise, or command-line experience is required. The graph interface is intuitive — click, drag, zoom, and explore. If you are unsure what something means, the FAQ and documentation pages cover the key concepts.

Question 14

Is ARACHNE real-time?

Accepted Answer

Yes. Every trace queries the blockchain live at the moment you run it, returning the most current data available on the Ethereum chain. There is no caching of network graphs — each trace reflects the current state of the blockchain. Note that new blocks are indexed within seconds of confirmation, so very recent transactions may occasionally not yet appear.

Question 15

What counts as a trace for billing purposes?

Accepted Answer

A single trace is one submission of a wallet address at a specified depth. Running a trace on wallet A at depth 3, then re-running the same wallet at depth 4, counts as two traces. Viewing a previously saved trace from your history does not count as a new trace.

Question 16

Can I cancel my subscription at any time?

Accepted Answer

Yes. You can cancel your subscription at any time from your Profile page. Cancellation takes effect at the end of your current billing period — you retain full access until then. There are no cancellation fees or lock-in periods.

Question 17

What happens to my data if I cancel?

Accepted Answer

Your trace history and account data are retained for 30 days after cancellation, during which time you can reactivate your subscription and recover your data. After 30 days, your data is permanently deleted. If you choose to delete your account directly, deletion is processed within 24 hours and is irreversible.

Question 18

Who uses ARACHNE?

Accepted Answer

ARACHNE is used by a range of professionals and individuals: compliance analysts running counterparty wallet checks, investigators and journalists tracing fund flows, security researchers mapping post-exploit wallet clusters, academics studying on-chain behaviour, and individuals performing due diligence before sending or receiving funds.

Question 19

Does ARACHNE store the wallet addresses I search?

Accepted Answer

Yes — ARACHNE stores the addresses you search as part of your trace history, so you can review and re-export previous runs. This data is tied to your account and is not shared publicly or with third parties. You can delete individual trace records from your history at any time.

Question 20

How do I get started?

Accepted Answer

Register for a free account — no credit card required. Your account is active immediately, with a 7-day trial of the Spinner plan. From the dashboard, enter any Ethereum wallet address, choose your trace depth (1–5 layers), and hit Trace. Your network graph will render within seconds.

Question 21

Is cryptocurrency truly anonymous?

Accepted Answer

No — cryptocurrency is pseudonymous, not anonymous. Every transaction on a public blockchain like Ethereum is permanently recorded on an open ledger that anyone can read. Wallet addresses are not inherently linked to real-world identities, but they are not hidden either. If a wallet address is ever connected to a person — through an exchange's KYC records, an IP address, a social media post, or any other data point — every transaction that wallet has ever made becomes attributable to them.

Question 22

Why is blockchain transaction data traceable at all?

Accepted Answer

Public blockchains like Ethereum are designed to be transparent and immutable. Every transaction — sender address, recipient address, value, timestamp, and transaction hash — is recorded in a block and replicated across thousands of nodes worldwide. This openness is a core security property of the network, not an oversight. It means there is no central authority to petition for records; the data is simply public, permanent, and globally accessible.

Question 23

What is an 'anchor' in a blockchain investigation?

Accepted Answer

An anchor is the known starting point of a tracing investigation — a wallet address, transaction hash, or cluster that has already been linked to a specific event or entity. Common anchors include the deposit address used in a scam, the withdrawal address from a hacked exchange, or a wallet flagged on a sanctions list. Every subsequent hop in the trace radiates outward from the anchor, mapping the network of addresses the funds have touched.

Question 24

What does 'hops' mean in the context of crypto tracing?

Accepted Answer

A hop is a single transfer of funds from one wallet to another. If funds move from Wallet A → Wallet B → Wallet C, that is two hops. Investigators track how many hops separate a wallet from a known illicit source, because criminals often route funds through many intermediate addresses to create distance from the original crime. The greater the hop count, the more complex — but not impossible — the trace becomes.

Question 25

What is a peel chain?

Accepted Answer

A peel chain is a common money-laundering technique on public blockchains. A large balance is 'peeled' through a long sequence of wallets — each one receiving the bulk of the funds and passing the remainder to the next — with small amounts being cashed out at each step. The effect on a graph is a long, thin chain of single-connection nodes. It is a recognisable pattern that tracing tools are specifically designed to detect.

Question 26

What is layering in crypto money laundering?

Accepted Answer

Layering is the second stage of the classic three-stage money laundering model (placement → layering → integration). In crypto, layering involves moving funds through multiple wallets, exchanges, chains, or mixing services to obscure their origin. Common layering techniques include splitting one large transaction into many small ones (smurfing), routing through decentralised exchanges, and converting between multiple token types or blockchains. The goal is to make it prohibitively difficult to reconstruct the original trail.

Question 27

What is smurfing in cryptocurrency?

Accepted Answer

Smurfing — also called structuring — is the practice of breaking a large sum into many smaller transactions to avoid detection thresholds. In traditional finance, this means staying below reporting limits. In crypto, it typically means splitting a large balance across dozens or hundreds of wallets to fragment the trail and make the source harder to identify. Smurfing is a strong red flag in a transaction graph and is a pattern blockchain tracing is specifically built to surface.

Question 28

What is cluster analysis in blockchain tracing?

Accepted Answer

Cluster analysis is the process of grouping multiple wallet addresses that are likely controlled by the same entity. Analysts use heuristics such as common-input ownership (when multiple addresses are used as inputs in a single transaction, they are likely controlled by the same key holder) and address reuse patterns. Expanding from a single address to a full cluster dramatically increases the surface area of an investigation — a suspect may control hundreds of wallets, not just one.

Question 29

What does address reuse reveal about a wallet?

Accepted Answer

When the same wallet address is used repeatedly across many transactions, it creates a rich trail of historical activity. Each interaction adds another data point that can be cross-referenced with other wallets, exchange deposits, or known entities. Address reuse is poor operational security for someone trying to remain anonymous — it concentrates identifying information in a single, easily searchable identifier.

Question 30

What is gas fee analysis and why does it matter?

Accepted Answer

On Ethereum, every transaction requires a fee paid in ETH — called gas. The wallet paying the gas for a transaction almost certainly controls that transaction. If a suspect uses a 'fresh' wallet to receive funds but the gas fees for moving those funds are paid from a separate, identifiable wallet, that creates a direct link between the two. Gas fee analysis is a powerful heuristic for identifying controlling entities behind otherwise unattributed wallets.

Question 31

Can funds be traced through a decentralised exchange (DEX)?

Accepted Answer

Yes. Decentralised exchanges operate as smart contracts on the blockchain, so every swap — the input tokens, output tokens, wallet addresses, and timestamps — is publicly recorded. Although DEXs do not require KYC, the on-chain data is fully visible. Investigators can follow funds through a DEX swap by tracking the input and output addresses of the smart contract interaction, even when the token type has changed.

Question 32

How do cross-chain bridges complicate tracing?

Accepted Answer

Cross-chain bridges allow funds to move between different blockchains — for example, from Ethereum to Solana or Polygon. Each chain has its own explorer and data format, and a bridge transaction can look like a dead end on the source chain. Criminals exploit this to break simple single-chain traces. However, bridge protocols typically emit events on both chains that can be correlated, allowing investigators to follow funds across the chain boundary — it is more complex, but not untraceable.

Question 33

Can privacy coins like Monero evade tracing entirely?

Accepted Answer

Privacy coins like Monero (XMR) use cryptographic techniques — ring signatures, stealth addresses, and confidential transaction amounts — to conceal sender, recipient, and value by default. Zcash (ZEC) offers optional shielding via zero-knowledge proofs. When funds enter a privacy coin network in a fully shielded transaction, the on-chain trace typically stops there. However, the entry and exit points — converting ETH to XMR on an exchange, or converting XMR back to a public asset — remain visible and are often the focus of investigation.

Question 34

What role do centralised exchanges play in investigations?

Accepted Answer

Centralised exchanges (CEXs) are the most common point where on-chain activity connects to real-world identity. Most regulated exchanges operate Know Your Customer (KYC) programmes, collecting government-issued ID, name, and address. When a traced wallet interacts with a CEX deposit address, investigators can seek legal process (a court order or subpoena) to compel the exchange to reveal the account owner. This is often the final step in de-anonymising a suspect.

Question 35

What is Know Your Transaction (KYT)?

Accepted Answer

KYT — Know Your Transaction — is the on-chain equivalent of Know Your Customer. While KYC verifies who someone is, KYT analyses what their funds have done: where they came from, which addresses they passed through, whether they touched mixers or sanctioned addresses, and what their risk profile is. KYT is used by regulated crypto businesses to screen incoming and outgoing transactions in real time and flag suspicious activity before it is processed.

Question 36

What is a risk score in blockchain analytics?

Accepted Answer

A risk score is a numerical or categorical assessment of a wallet's likelihood of association with illicit activity. It is derived from analysing the wallet's transaction history, its direct and indirect connections to known high-risk entities (mixers, sanctioned addresses, darknet markets, scam wallets), and the proportion of its funds attributable to those sources. A high risk score does not prove wrongdoing — it indicates that a wallet warrants closer scrutiny.

Question 37

What is the FATF Travel Rule and how does it affect crypto?

Accepted Answer

The FATF Travel Rule is a global anti-money-laundering recommendation that requires Virtual Asset Service Providers (VASPs) — exchanges, custodians, and other crypto businesses — to collect and share information about the sender and recipient of any crypto transfer above a threshold (typically around $1,000 / €1,000). It mirrors the Travel Rule that applies to wire transfers in traditional banking. The rule makes it significantly harder to move large sums between regulated entities without leaving an identity trail.

Question 38

What is MiCA and what does it mean for crypto traceability?

Accepted Answer

MiCA — the EU's Markets in Crypto-Assets Regulation — establishes a comprehensive licensing and compliance framework for crypto businesses operating in or serving customers in the EU. Under MiCA, Crypto-Asset Service Providers must implement robust AML controls, including continuous transaction monitoring and suspicious activity reporting. In practical terms, it significantly expands the number of regulated access points where on-chain activity can be linked to verified identities.

Question 39

How much cryptocurrency is involved in illicit activity?

Accepted Answer

According to Chainalysis' 2025 Crypto Crime Report, an estimated $40.9 billion flowed into illicit crypto addresses in 2024 — with actual totals likely closer to $51 billion once all data is accounted for. This includes funds linked to sanctions violations, ransomware, scams, darknet markets, and stolen assets. While illicit activity represents a small percentage of overall crypto transaction volume, the absolute dollar figures are significant and growing.

Question 40

Can stolen cryptocurrency actually be recovered?

Accepted Answer

Yes, in some cases — though recovery is difficult and depends heavily on speed and jurisdiction. If stolen funds are traced to an exchange before they are withdrawn, law enforcement can seek a freeze order. Several major crypto heists have resulted in partial or full recovery: in 2022, the US Department of Justice recovered approximately $3.6 billion in Bitcoin linked to the 2016 Bitfinex hack. The key enabler in every successful recovery is blockchain tracing — establishing an unbroken chain from the theft wallet to an identifiable endpoint.

Question 41

What can a blockchain trace actually prove legally?

Accepted Answer

A blockchain trace can establish, with high confidence, the flow of funds between specific wallet addresses. It can demonstrate that funds originating from a theft, scam, or sanction-listed address ultimately arrived at a particular wallet or exchange account. However, a trace alone does not prove that a specific person committed a crime — it proves what the funds did on-chain. Identity attribution (connecting a wallet to a human) typically requires additional evidence: exchange KYC records, IP logs, or testimony. Tracing is essential evidence, but rarely sufficient on its own.

Question 42

What are the limitations of blockchain analytics tools?

Accepted Answer

Blockchain analytics tools rely on heuristics — probabilistic assumptions about which addresses belong to the same entity. These assumptions can be wrong. A cluster attributed to one exchange may include addresses that have since been sold or reassigned. Sanctions labels may be outdated. Risk scores are signals, not verdicts. Investigators must treat trace outputs as intelligence that directs further inquiry, not as proof that can stand alone in legal proceedings. Human judgement and corroborating evidence remain essential.

Question 43

Why do investigators look at indirect connections, not just direct ones?

Accepted Answer

Sophisticated actors rarely send funds directly from a crime to a cash-out point. They introduce multiple intermediary wallets — sometimes hundreds — to create distance. Examining only the immediate counterparties of a wallet misses the broader pattern. Multi-layer tracing maps the full network of addresses connected to a wallet at increasing depths, revealing relationships that would be invisible in a one-hop view and that are only detectable when the complete transaction graph is visualised.

Question 44

What is IP correlation in a crypto investigation?

Accepted Answer

When a user broadcasts a transaction directly to the network without routing it through privacy tools (like Tor or a VPN), their IP address may be visible to the nodes that first relay that transaction. In some cases, investigators or network monitoring services record these IP associations. IP correlation links an on-chain event to a network-level identity — a specific internet connection — which can then be tied to a physical location or ISP account through legal process.

Question 45

What is 'dusting' and can dusted wallets be traced?

Accepted Answer

Dusting is the practice of sending tiny amounts of cryptocurrency ('dust') to a large number of wallets. The sender then monitors whether those wallets consolidate the dust with their other funds in future transactions. If they do, the resulting transaction links multiple previously unconnected addresses together, breaking their pseudonymity. Dusting is used both as a de-anonymisation technique and, in some cases, as a form of harassment or surveillance. Yes — receiving dust does not itself compromise a wallet, but spending it alongside other funds can.

Question 46

What is sanctions screening in the context of crypto?

Accepted Answer

Sanctions screening checks wallet addresses against lists maintained by bodies such as OFAC (the US Office of Foreign Assets Control), the UN, and the EU. These lists designate individuals, entities, and addresses that are prohibited from participating in financial activity with regulated counterparties. If a wallet in your transaction graph appears on a sanctions list, any interaction with it may expose you to legal liability — even if the interaction was indirect. Automated screening flags these connections in real time.

Question 47

How does fund splintering work and why is it used?

Accepted Answer

Fund splintering is a form of layering in which a single large sum is rapidly divided across dozens or hundreds of wallets — sometimes programmatically, using scripts or smart contracts. Each fragment then takes a different route before being recombined at a later stage. The goal is to overwhelm manual analysis by producing a graph of enormous complexity. Automated tracing tools handle splintering by following all branches simultaneously and flagging convergence points where funds recombine.

Question 48

What happens after a blockchain trace identifies a suspect wallet?

Accepted Answer

Once a trace establishes that funds flowed to a specific exchange deposit address, the investigating party — law enforcement or legal counsel — typically issues a legal demand (subpoena, court order, or mutual legal assistance treaty request) to the exchange, seeking the identity and account data of the wallet's owner. Simultaneously, they may request an account freeze to prevent further withdrawals. The traced funds can then be the subject of civil asset forfeiture, criminal prosecution, or restitution proceedings, depending on jurisdiction.

Question 49

Is on-chain tracing useful for civil disputes, not just criminal cases?

Accepted Answer

Yes. Blockchain tracing is increasingly used in civil litigation — fraud recovery, partnership disputes, divorce proceedings, and insolvency cases. Where one party has moved assets into crypto to conceal them, a trace can map those assets and provide evidence for a freezing injunction. Several law firms and forensic accountancy practices now offer blockchain tracing as a standard tool in asset recovery and financial dispute work, independent of any criminal investigation.

Question 50

How quickly can funds be moved and how does that affect tracing?

Accepted Answer

On Ethereum, a transaction is confirmed in roughly 12 seconds and is immediately visible on the blockchain. Funds can be moved through dozens of wallets in a matter of minutes using scripts. This speed creates urgency for investigators — the sooner a trace is initiated after an incident, the more likely funds are to still be reachable at an exchange or identifiable endpoint before they are cashed out. Real-time tracing and rapid legal process are the two most important factors in successful fund recovery.

Question 51

Why does blockchain tracing matter for ordinary people, not just institutions?

Accepted Answer

Anyone who sends or receives cryptocurrency is exposed to counterparty risk. Receiving funds from a wallet with a high-risk history — even unknowingly — can result in a subsequent exchange flagging or freezing your account. Before accepting a large crypto payment, sellers and individuals have a legitimate interest in understanding where those funds have been. Tracing gives ordinary users the same visibility that was previously available only to compliance professionals at large institutions.

Got Questions?

Still have questions?