// project ยท bitcoin forensics

ChainSight

Every Bitcoin transaction is public. Spotting the shady ones is the hard part. ChainSight follows the money, scores every wallet from 0 to 100, and explains why in plain English.

// the 10-second version

Bitcoin is a giant notebook anyone can read, where people sign with secret nicknames. ChainSight is a detective that reads the whole notebook, works out which nicknames belong to the same person, and points out who's moving money in sneaky ways.

// why it's cool

A score you can actually check

Launderers split, shuffle and hop money through many wallets until the trail goes cold. Investigators can see every step, but there are far too many to read by hand.

Plenty of tools say "this wallet looks risky". ChainSight also says why, runs fully offline, and traces every number back to the data. You can't take "the AI said so" to court.

// how it works

Raw data in, explained risk out

  1. Read the dataLoad transaction and network logs (CSV, JSON or XML) and add rough locations.
  2. Connect the dotsUse timing to link computers to the transactions they sent, then group wallets that likely share an owner.
  3. Measure behaviour19 features per wallet: how fast money moves, how many hops, who it deals with.
  4. ScoreFour detectors each give an opinion, blended into one 0–100 risk score.
  5. Explain and showTurn the maths into plain sentences and display it all on an interactive money-flow dashboard.

// under the hood

Four detectives

  • XGBoost: "Does this look like laundering I've seen before?"
  • Isolation Forest: "Is this wallet just weird compared to everyone else?" This catches new tricks.
  • Personalised PageRank: Google's page-ranking idea, aimed at money. "How close is this wallet to known bad money?"
  • Pattern rules for classic laundering shapes: peeling chains (shaving a little off at each hop), fan-out and fan-in (splitting money up, then gathering it back), and mixing.

Grouping wallets: wallets spent together in one transaction usually share an owner, so they're merged with a fast Union-Find structure. CoinJoin transactions, where strangers deliberately pool coins, are filtered out first so unrelated people aren't merged.

Explaining: TreeSHAP measures what pushed each score up or down, which becomes sentences like "90/100 HIGH: 2 hops from a flagged wallet; part of a 9-hop peeling chain; funds moved on within minutes."

// results

On a held-out test set

30 / 30
laundering cases caught
100%
of the top 50 alerts were truly illicit
0.5%
false-alarm rate
~7 s
for a full run on a laptop

PR-AUC of 0.98 (1.0 is perfect). Evaluated on synthetic data the models never trained on; real labelled data is the next test.

// the tricky part

Catching what nobody has labelled

A model trained on known laundering misses new tricks; a "weirdness" detector flags innocent oddballs. Blending four different approaches lets each cover the others' blind spots, and linking every score back to real transactions makes it trustworthy.

  • python
  • xgboost
  • scikit-learn
  • networkx
  • duckdb
  • fastapi
  • cytoscape.js