labTXINT
TXINT method
TXINT builds a graph of transfers around an address, a transaction identifier or an ENS name and reads it with detectors. A detector describes the shape of a movement of funds: splitting, consolidation, a return to the origin, a pass through intermediaries. The analyst decides what stands behind the shape, from the transactions the finding cites.
The graph
A node of the graph is an address on one chain. The same EVM key on six chains gives six nodes, joined to each other. An edge of the graph is one transfer: chain, transaction, asset, amount, time, type and status.
Amounts are kept as integers of base units all the way from the chain to the screen. Failed transactions are shown in the transfer lists, and they are left out of the graph's edges and of every detector's calculations.
Every cap on a build records a named reason, and the answer says which cap was hit and where.
| Cap | Default | What happens when it is reached |
|---|---|---|
| Hub address | 5 000 transfers | the last 200 transfers are sampled, the address is flagged and is never expanded on its own |
| Transfers per address | 2 000 | collection stops, the expansion is marked as truncated |
| Nodes in the graph | 1 500 | the build stops |
| Edges in the graph | 20 000 | the build stops |
| Counterparties per address | 25 | the busiest are kept, and the number dropped is recorded |
| Window | 90 days | for a transaction, 30 days either side |
The detectors
Fifteen detectors read the stored graph and ask the network for nothing. Inflow, outflow and residual are computed from transfers inside the investigation, so a truncated graph cannot silently change a conclusion. The same graph with the same thresholds gives the same findings.
| Detector | What it looks for |
|---|---|
| Pass-through address | an address with at most 10 transactions in its known lifetime, where at least 0.9 of every inflow leaves within 24 hours |
| Long chain of intermediary addresses | three or more pass-through addresses in a row, the outflow of each becoming the inflow of the next |
| Peel chain | at every hop at least 0.8 of what arrived goes to one fresh address and the rest goes aside, within 72 hours, over three hops or more |
| Funds split across many new addresses | five or more fresh recipients within 24 hours, with near-equal amounts or a sum matching a recent inflow |
| Funds consolidated from many addresses | five or more senders into one address within 24 hours, with the sum forwarded within 48 hours |
| Funds split and then reunited | the recipients of a split (at least 0.6 by count or by amount) send funds to one address within 7 days |
| Funds returned to their origin | a closed path of 2-6 transfers along which at least half of what left returns within 7 days |
| Funds forwarded within minutes | an inflow and an outflow of at least 0.9 of it within 10 minutes |
| Identical amounts repeated | three or more transfers of one amount within 24 hours between one pair of addresses or from one sender |
| Mostly round amounts | round amounts make up at least half of an address's outgoing transfers, over five transfers or more |
| Interaction with a known entity | a transfer with an address on a label list: sanctioned, mixer, scam, bridge, exchange or DEX |
| Addresses spent together | on UTXO chains, addresses whose funds were spent by one transaction |
| Dormant address reactivated | a gap of 180 days or more between two transfers, when the investigation window covers it |
| Cross-chain transfer | a confirmed crossing of funds to another chain, and above all several crossings in sequence |
| Trail leaves the chain | funds entered a bridge, and the way out of it was not found |
A round amount is a whole number of units of the asset, or a multiple of 1 000 for stablecoins. Address labels come from open datasets, and the entity detector looks nothing up itself.
The confidence of a finding
Every detector computes a confidence between 0 and 1, based on how cleanly the pattern matched, and each finding carries its own. The interface shows it as a percentage.
If the region of a finding passes through a hub address or a truncated expansion, the confidence is multiplied by 0.7, and the explanation of the finding says so. A finding about a sanctioned address, a mixer or a scam address one intermediary away gets half the confidence of a direct one.
Every finding records the thresholds it was found with, and the nodes, links and transactions it stands on. The explanation names the amounts and times that triggered it.
Severity
Severity says how much attention a shape usually deserves. There are four levels: high, medium, low and info.
| Kind of listed address | Severity of the interaction |
|---|---|
| Sanctioned address | high |
| Mixer | high |
| Scam address | medium |
| Bridge | low |
| Exchange, DEX | info |
The analyst's decision
On every finding the analyst sets one of three decisions: confirmed, likely or rejected, with a note on why. “Likely” is there for the usual working state, while the checking goes on.
The decision is kept apart from the finding and is bound to the detector, its version and its set of nodes. A rerun over the same graph keeps the decision. If the detector has changed or the graph has grown, the decision becomes detached, and the analyst makes it again.
The risk reading
The risk level is given as a word and a list of reasons: none, low, elevated, high. Only listed addresses set it: sanctioned addresses and mixers give the high level, scam addresses elevated, bridges low.
Every hop from the subject past the first lowers the level by one step, and the most serious listed address decides. Shapes of movement are listed beside the level and do not move it: exchanges, contracts and services show such shapes every day.
The level “none” refers to the collected graph. Beside the level stand the depth, the window and the sampling on hub addresses that bound this graph.
Crossings between chains
A crossing between chains is drawn only when two conditions hold together: the deposit transaction itself named the destination chain and the recipient, and the arrival was then found at that recipient within 24 hours.
TXINT reads the declarations of four bridge families: the OP Stack standard bridge (Optimism, Base), the Arbitrum One gateways, the Polygon PoS predicates and Across. A match by amount and time without a declaration does not count as a crossing.
| How the arrival matched | Confidence of the crossing |
|---|---|
| exact amount and the same token | 0.95 |
| exact amount | 0.9 |
| amount less the bridge fee | 0.75 |
| several transfers fit | 0.6 |
An arrival larger than the deposit is rejected: a bridge charges a fee and pays out no more than it received.
| Status | What it means |
|---|---|
| Confirmed | the deposit declared a destination, and the arrival was found there |
| Unconfirmed | the deposit declared a destination, and no arrival was found there |
| Unsupported destination | a chain TXINT does not cover was declared, and its number is kept |
| Undeclared | funds entered a bridge, and no destination was declared in readable form |
| Not checked | a cap was hit or a data provider did not answer |
Every status is written on the deposit's edge, and the export carries every crossing, including the ones that led nowhere. When a destination was declared, the “Trail leaves the chain” finding names the recipient as the next place to look.