Blockchain Forensics Tools Compared: Chainalysis vs Elliptic vs TRM

Blockchain Forensics Tools Overview

Blockchain forensics tools trace cryptocurrency transactions, label entities, and flag illicit activity. They are the backbone of AML/KYC compliance for exchanges, custodians, and financial institutions operating in crypto. The blockchain analytics market reached roughly $1.76 billion in 2026, with over 78% of financial institutions now using some form of on-chain tracking for compliance.

Five platforms dominate the space: Chainalysis, Elliptic, TRM Labs, Crystal Intelligence, and Arkham Intelligence. They differ significantly in chain coverage, entity labeling depth, compliance tooling, pricing, and target audience. The following comparison covers each platform across the dimensions that matter most for compliance teams, investigators, and developers building on Bitcoin and stablecoin infrastructure.

Product Capabilities and Features

Each platform bundles several products covering different parts of the compliance and investigation workflow: transaction monitoring, wallet screening, investigation/tracing, and risk scoring.

Chainalysis

The market leader by revenue and government adoption. Reactor is its core investigation tool, tracing funds across 27+ blockchains and following value through 325 million+ swaps, 300+ bridges, and DEXs. KYT (Know Your Transaction) provides real-time monitoring. In 2025, Chainalysis acquired Hexagate (web3 security) and Alterya (AI fraud detection), signaling a shift from post-incident investigation toward real-time threat prevention. In 2026 it launched "Blockchain Intelligence Agents" powered by AI to automate investigator workflows.

Elliptic

The longest-running analytics firm (founded 2013). Its Navigator tool handles investigation and tracing, while Discovery provides VASP risk profiling. Elliptic screens over 1 billion transactions per week for 700+ customers across 30 countries. In June 2025, it launched Data Fabric for direct data access, and followed with an agentic AI product that automates compliance analyst workflows. Its $120 million Series D in May 2026 brought in institutional investors including Nasdaq Ventures, Deutsche Bank, and JP Morgan.

TRM Labs

The fastest-growing competitor, reaching unicorn status ($1 billion valuation) with its February 2026 Series C. TRM differentiates on breadth: risk screening covers 190+ blockchains and 1.9 billion+ assets. Its "Behavioral Intelligence" engine analyzes on-chain messages, smart contract creation patterns, and wallet behavior rather than relying solely on address clustering. TRM holds FedRAMP High authorization and DoD IL4/IL5 compliance (via Palantir partnership), enabling classified government deployments that no competitor currently matches.

Crystal Intelligence

Originally spun out of Bitfury in 2018, Crystal covers 330+ blockchains and 10,000+ digital assets. It offers cloud, API, and on-premise deployments, making it the most flexible for institutions with data residency requirements. In July 2025, Tether made a strategic investment. Crystal launched Foresight for stablecoin-specific monitoring and secured the first blockchain intelligence platform approved for court proceedings in Dubai's DIFC Courts.

Arkham Intelligence

Arkham takes a fundamentally different approach. It is a consumer-facing analytics platform with a free tier, an Intel Exchange where users buy and sell on-chain intelligence using the ARKM token, and a built-in DEX. It excels at entity attribution for public figures, institutions, and whale wallets. In late 2025, Arkham demonstrated it could de-anonymize over 53% of all Zcash transactions by tracing activity through transparent addresses. It does not offer enterprise compliance tools, Travel Rule support, or SAR filing workflows.

Compliance and Regulatory Features

Regulatory pressure is the primary driver of blockchain analytics adoption. The EU's MiCA transitional period closed on July 1, 2026, requiring full AML/CFT obligations for any crypto-asset service provider serving EU clients. In the US, the GENIUS Act (signed July 2025) establishes stablecoin regulation with implementing rules due July 18, 2026. FinCEN has proposed treating stablecoin issuers as BSA financial institutions requiring full AML programs.

For compliance teams building infrastructure to meet these requirements, see our crypto compliance framework comparison and AML tool comparison.

Government and Law Enforcement Adoption

Government contracts have historically driven the majority of revenue for Chainalysis and TRM Labs. Chainalysis counts the FBI, DEA, IRS-CI, SEC, CFTC, ICE, and Secret Service among its clients, with over 70% of revenue coming from the public sector. TRM Labs serves 600+ government agencies across 75+ countries, and its FedRAMP High plus DoD IL4/IL5 certifications enable classified deployments. Elliptic works primarily with UK agencies: the NCA, HMRC, FCA, and Metropolitan Police.

Notable cases where chain analysis proved decisive include the 2025 Bybit hack ($1.5 billion in ETH), where investigators linked the theft to North Korea's Lazarus Group within 48 hours. Chainalysis's 2026 Crime Report found that illicit addresses received at least $154 billion in 2025, with sanctioned-entity activity growing 694% year-over-year driven by DPRK and Russia-linked flows.

Pricing and Accessibility

All four enterprise platforms use quote-based pricing with annual contracts. Exact costs vary by chain coverage, API volume, and number of seats.

Chainalysis and TRM Labs command premium pricing, reflecting their government certifications and deep investigative capabilities. Elliptic sits in the mid-to-high range with strong institutional backing. Crystal is often positioned as a more accessible option for mid-market firms. Arkham is the only platform with free access, but it lacks the compliance infrastructure that regulated entities require.

Privacy Technologies and Chain Analysis Limitations

Not all Bitcoin transactions are equally traceable. Privacy-preserving technologies create real challenges for forensics tools, and understanding these limitations is critical for both compliance teams and users concerned about fungibility.

CoinJoin

CoinJoin combines multiple users' inputs into a single transaction, breaking the common-input-ownership heuristic that analytics tools rely on. All major platforms can detect CoinJoin transactions and flag them as high risk, but tracing individual fund flows through well-executed CoinJoins remains difficult. Law enforcement has increasingly targeted CoinJoin infrastructure directly: Samourai Wallet developers were arrested in 2024, and zkSNACKs (Wasabi Wallet's coordinator) shut down in May 2024 under regulatory pressure. For a deeper look at these tools, see our Bitcoin privacy tools comparison.

Lightning Network

Lightning Network payments are routed through private channels using onion routing, making them significantly harder to trace than on-chain transactions. Channel funding and closing transactions are visible on-chain, but the payments routed between channels are not publicly broadcast. Chainalysis has announced Lightning tracking capabilities for its KYT product, marking the first major analytics firm to address Layer 2 surveillance. As stablecoins arrive on Lightning via Taproot Assets, regulatory scrutiny of Lightning analytics will intensify. For more on Lightning privacy, see our Lightning Network privacy analysis.

Privacy Coins

Monero's FCMP++ upgrade in early 2026 requires analyzing the entire unspent output set (1.8 million+ outputs), making reliable tracing computationally infeasible. No analytics firm has publicly demonstrated scalable Monero tracing since the upgrade. Zcash presents a different picture: because privacy is optional, Arkham was able to de-anonymize over 53% of all ZEC transactions in late 2025 simply by tracing activity through transparent addresses. The lesson is clear: optional privacy is weak privacy.

How Bitcoin Privacy Interacts with Compliance

The tension between on-chain privacy and regulatory compliance is one of the defining issues for self-custodial Bitcoin users. Analytics firms apply taint analysis and address clustering to build risk profiles. A UTXO that has passed through a flagged mixer or a CoinJoin transaction may be scored as high risk even if the current holder has no connection to illicit activity. This creates practical problems for fungibility: not all bitcoins are treated equally by exchanges and compliance-gated services.

Layer 2 solutions like Spark offer a different model. By moving transactions off-chain, they reduce the surface area available to on-chain analytics while still supporting compliance at the application layer where regulated services operate. This preserves user privacy for routine payments without undermining the ability of regulated entities to meet their BSA and AML obligations. For more on this topic, see our research on the Bitcoin privacy landscape in 2026.

How to Choose a Forensics Platform

The right tool depends on your regulatory environment, budget, and use case:

• Government or law enforcement agencies: Chainalysis (broadest agency adoption) or TRM Labs (FedRAMP High, classified deployments).
• Regulated exchanges and VASPs in the EU: Elliptic or TRM Labs, both of which have strong MiCA-aligned compliance features and Travel Rule support.
• Mid-market firms or those with data residency requirements: Crystal Intelligence, which offers on-premise deployment and broader chain coverage.
• Researchers, analysts, and retail users: Arkham Intelligence, the only platform with free access and public entity labeling.
• Startups building compliance from scratch: start with the AML tool comparison to understand the full stack before selecting an analytics provider.

Frequently Asked Questions

What is the best blockchain forensics tool for compliance?

For most regulated entities, Chainalysis and TRM Labs lead in compliance tooling. Chainalysis has the broadest government adoption and entity labeling (5 billion+ address clusters). TRM Labs differentiates with FedRAMP High certification and behavioral analytics across 190+ chains. The best choice depends on your regulatory jurisdiction: US government agencies often standardize on one of these two, while EU-focused institutions may prefer Elliptic given its strong UK and European regulatory relationships.

Can blockchain analytics tools trace CoinJoin transactions?

Analytics tools can detect and flag CoinJoin transactions, but tracing individual fund flows through a well-executed CoinJoin remains challenging. Fixed-denomination protocols like Whirlpool (5 inputs, 5 outputs) produce recognizable on-chain patterns. Wasabi 2.0's WabiSabi protocol uses dynamic denominations that are harder to fingerprint. Rather than breaking the cryptography, law enforcement has targeted CoinJoin coordinators directly, as demonstrated by the Samourai Wallet arrests in 2024.

Can Lightning Network payments be traced by chain analysis firms?

Lightning payments are routed off-chain through encrypted channels using onion routing and are not broadcast to a public ledger. Channel open and close transactions are visible on the Bitcoin base layer, but intermediate payment routing is not. Chainalysis has announced Lightning tracking for its KYT product, primarily focused on linking channel funding UTXOs to known entities rather than intercepting individual routed payments.

How much do blockchain analytics tools cost?

Enterprise platforms use annual contract pricing. Chainalysis ranges from roughly $25,000 to over $300,000 per year depending on seat count and product mix. TRM Labs ranges from approximately $33,000 to $500,000+. Elliptic typically falls between $40,000 and $100,000. Crystal Intelligence positions itself as mid-range but does not publish pricing. Arkham is the only platform with a free tier, though it lacks enterprise compliance features.

How do forensics tools support Travel Rule compliance?

Chainalysis, Elliptic, TRM Labs, and Crystal Intelligence all provide Travel Rule support by identifying counterparty VASPs and risk-scoring wallet addresses. They complement dedicated Travel Rule messaging platforms like Notabene and TRISA. With the EU's Transfer of Funds Regulation dropping the Travel Rule threshold to zero and enforcement now active in 70+ jurisdictions, analytics-driven counterparty identification has become essential for any money services business handling crypto.

What role did blockchain analytics play in the Bybit hack?

The February 2025 Bybit hack resulted in the theft of approximately $1.5 billion in ETH (around 401,000 ETH). Blockchain investigators linked the attack to North Korea's Lazarus Group within 48 hours by tracing fund flows across multiple chains and flagging receiving addresses at exchanges worldwide. The Lazarus Group stole over $2 billion in crypto during 2025 alone, accounting for roughly 76% of all service-related crypto theft that year.

Can Monero transactions be traced by analytics tools?

Since Monero's FCMP++ upgrade in early 2026, reliable tracing at scale has not been publicly demonstrated by any analytics firm. The upgrade requires analyzing the full unspent output set of 1.8 million+ outputs, making computational tracing infeasible with current methods. This stands in contrast to Zcash, where optional privacy allowed Arkham to trace over 53% of transactions through transparent addresses.

This tool is for informational purposes only and does not constitute financial, legal, or compliance advice. Data is approximate and based on publicly available information as of mid-2026. Pricing, features, and chain coverage change frequently. Always verify current capabilities directly with vendors before making procurement decisions.