Wallet Clustering Intelligence
Advanced blockchain analysis identifying connected wallet clusters used by nation-state actors for cryptocurrency theft and laundering operations.
15
Tracked Clusters
3,847
Linked Wallets
$13.10B
Total Volume
0
Active (30d)
Clustering Methodology
Common Spend Analysis
Identifies wallets that are inputs to the same transaction, indicating shared ownership.
Timing Correlation
Links wallets based on synchronized transaction timing patterns across chains.
Change Address Heuristic
Traces change outputs to identify wallets controlled by the same entity.
Mixer Output Correlation
Links wallets through statistical analysis of mixer withdrawal patterns.
Entity Attribution
Government designations and known entity tags from OFAC, EU, and research.
ML Pattern Detection
Machine learning models identifying behavioral patterns unique to threat actors.
Interactive Cluster Network
Click on nodes to explore connections. Drag to pan, scroll to zoom. Filter by nation or click a cluster to highlight its network.
Legend
Identified Clusters
Garantex Operations Cluster
high confidence RUS-GARANTEX-OPS • Entity Attribution
$6.00B
Total Volume
Iranian State Mining Cluster
high confidence IRAN-MINING-OPS • Entity Attribution
$2.50B
Total Volume
Bybit Cold Wallet Cluster
high confidence DPRK-BYBIT-2025 • Entity Attribution
$1.46B
Total Volume
February 2025 Bybit exchange cold wallet attack - largest crypto theft in history. Lazarus exploited multisig UI vulnerability to drain 401,346 ETH.
Linked Wallets
95
Threat Actor
lazarus
First Seen
2025-02-21
Last Activity
2025-02-22
Related Incidents
Iranian OTC Trading Cluster
high confidence IRAN-OTC-NETWORK • Common Spend Analysis
$1.20B
Total Volume
Ronin Bridge Cluster
high confidence DPRK-RONIN-2022 • Common Spend Analysis
$620.00M
Total Volume
Cluster of wallets used to receive, layer, and launder funds from the March 2022 Ronin Bridge exploit. Initial funds were quickly split across multiple addresses.
Linked Wallets
86
Threat Actor
lazarus
First Seen
2022-03-23
Last Activity
2023-09-15
Mixers Used
Bridges Used
Related Incidents
DMM Bitcoin Cluster
high confidence DPRK-DMMBIC-2024 • Entity Attribution
$308.00M
Total Volume
May 2024 DMM Bitcoin exchange attack - largest single theft of 2024. 4,502 BTC stolen through private key compromise.
Linked Wallets
67
Threat Actor
lazarus
First Seen
2024-05-31
Last Activity
2025-02-15
Mixers Used
Bridges Used
Related Incidents
WazirX Multisig Cluster
high confidence DPRK-WAZIRX-2024 • Common Spend Analysis
$230.00M
Total Volume
July 2024 WazirX Indian exchange multisig wallet compromise through UI manipulation.
Linked Wallets
43
Threat Actor
lazarus
First Seen
2024-07-18
Last Activity
2025-02-10
Mixers Used
Bridges Used
Related Incidents
Conti Ransomware Network
high confidence RUS-CONTI-NETWORK • Common Spend Analysis
$180.00M
Total Volume
Bitcoin wallets linked to Conti ransomware operations and associated money laundering.
Linked Wallets
450
Threat Actor
conti
First Seen
2020-08-01
Last Activity
2024-06-15
Mixers Used
Related Incidents
Poloniex Hot Wallet Cluster
high confidence DPRK-POLONIEX-2023 • Common Spend Analysis
$125.00M
Total Volume
Multi-chain cluster from November 2023 Poloniex exchange compromise.
Linked Wallets
52
Threat Actor
lazarus
First Seen
2023-11-10
Last Activity
2025-01-20
Mixers Used
Bridges Used
Related Incidents
Harmony Horizon Cluster
high confidence DPRK-HARMONY-2022 • Timing Correlation
$100.00M
Total Volume
Wallets associated with the June 2022 Harmony Horizon bridge exploit. Funds were laundered through multiple chain hops.
Linked Wallets
42
Threat Actor
lazarus
First Seen
2022-06-23
Last Activity
2023-12-01
Mixers Used
Bridges Used
Related Incidents
Atomic Wallet Cluster
high confidence DPRK-ATOMIC-2023 • Entity Attribution
$100.00M
Total Volume
Multi-chain cluster from the June 2023 Atomic Wallet compromise. Funds scattered across BTC, ETH, and TRX chains.
Linked Wallets
156
Threat Actor
lazarus
First Seen
2023-06-03
Last Activity
2024-06-15
Mixers Used
Bridges Used
Related Incidents
HTX/Heco Bridge Cluster
high confidence DPRK-HECO-2023 • Timing Correlation
$99.00M
Total Volume
Wallets from November 2023 HTX exchange and Heco bridge simultaneous attacks.
Linked Wallets
31
Threat Actor
apt38
First Seen
2023-11-22
Last Activity
2025-01-05
Mixers Used
Bridges Used
Related Incidents
Orbit Chain Cluster
high confidence DPRK-ORBIT-2024 • Common Spend Analysis
$82.00M
Total Volume
January 2024 Orbit Chain cross-chain bridge exploit cluster.
Linked Wallets
18
Threat Actor
lazarus
First Seen
2024-01-01
Last Activity
2025-02-01
Mixers Used
Bridges Used
Related Incidents
CoinEx Hot Wallet Cluster
high confidence DPRK-COINEX-2023 • Common Spend Analysis
$54.00M
Total Volume
Cluster from the September 2023 CoinEx exchange hot wallet compromise.
Linked Wallets
38
Threat Actor
lazarus
First Seen
2023-09-12
Last Activity
2024-08-20
Mixers Used
Bridges Used
Related Incidents
Stake.com Cluster
high confidence DPRK-STAKE-2023 • Timing Correlation
$41.00M
Total Volume
Wallets linked to the September 2023 Stake.com casino breach.
Linked Wallets
24
Threat Actor
lazarus
First Seen
2023-09-04
Last Activity
2024-07-10
Mixers Used
Bridges Used
Related Incidents
Cluster Intelligence API
Access wallet clustering data via our free API
GET /api/v1/clustersGET /api/v1/clusters/DPRK-BYBIT-2025GET /api/v1/address/0x47666fab.../cluster