Arkham Intelligence: who does this wallet address really belong to?

Arkham Intelligence is an analytics platform that assigns names to blockchain addresses. Enter an address there and you see not only balances and transactions but often a label as well: an exchange, a fund, a project, sometimes an individual. That is exactly what sets the platform apart from an ordinary block explorer, and exactly what makes it useful and uncomfortable for investors at the same time.

Useful, because before a transfer you can look up where an address belongs, and because after a theft the route of the loot can be followed. Uncomfortable, because the same technique points at your own wallet. An assignment is always a claim by the platform and never proof of ownership. This article sets out what the analysis achieves, where its limits lie, and which habits keep your own trail shorter.

Arkham Intelligence explained: the blockchain analysis behind the entity pages

Arkham Intelligence was founded in January 2020 in San Francisco by Miguel Morel. Its early backers include the venture capitalist Tim Draper, the Palantir co-founder Joe Lonsdale and the OpenAI chief Sam Altman. The company describes its product as a tool for analysing blockchain and crypto activity, and says it uses machine learning to determine and catalogue the owners of blockchain addresses.

The core term is entity. An entity is an actor to which the platform attributes several addresses, for instance an exchange with hundreds of deposit addresses. Individual addresses thereby turn into a profile with balances, inflows and outflows. The platform advertises that it translates raw transactions into clear network maps and provides a searchable database of crypto users whose transactions can be filtered.

The large networks are covered. The provider's product page lists Polygon, Arbitrum, Avalanche, Base and BNB Chain among others, alongside Ethereum and Bitcoin. To get started, the address you already have in hand is enough.

From the address to the entity: how the assignment comes about technically

The assignment arises from two ingredients. The first is behaviour on the chain itself, the second is knowledge from outside.

Traces on the chain

Addresses appearing together as senders in one transaction belong with high probability to the same actor; this procedure is called clustering. Added to it are recurring patterns: always the same counterparty, always the same amount, always the same time of day. Each of these points says little on its own. Together they make a profile.

Knowledge from outside

The second ingredient comes from public sources: annual reports, mandatory disclosures, posts on social networks in which someone names an address, and tips from users. Only this linking turns a string of characters into a name.

From that follows a rule of thumb that counts for your own wallet: the blockchain itself never gives away your name. It is given away at the crossings where the chain meets the real world, so at exchanges, with payments to known recipients, and with every public mention of an address of your own. How little a bare list of addresses says about the real spread of a holding is something we showed using the example of correlation in a crypto portfolio.

Intel Exchange since July 2023: bounties in ARKM for unmasking wallets

In July 2023 Arkham launched the Intel Exchange, a marketplace for tips. There users post bounties for someone to disclose the identity behind a particular address, or they offer such information themselves. Payment is in ARKM, the platform's token, which was issued in the same month through Binance's launchpad at an issue price of $0.05.

The model was contested from the outset. The business magazine Forbes ran a headline in July 2023 saying the company wanted to de-anonymise the blockchain and that privacy advocates were outraged. The critics' objection can be summed up in one sentence: a market that pays for the unmasking of pseudonyms turns a basic promise of open networks on its head.

The other side points to investigative work. The platform's data played a role in criminal proceedings, among them the case against the FTX founder Sam Bankman-Fried, and helped in describing money laundering patterns. Both readings describe the same capability. Which of them one weights is a judgement and not a question of fact.

Network map, entity search and alerts: the platform's tools

Four building blocks make up everyday work on the platform, and for each there is an occasion on which it pays off for you.

The network map

This view draws which addresses are connected with which others, as a mesh of nodes and links. Anyone wanting to know whether a project wallet and a supposed partner address in truth serve the same counterparty sees it here faster than in a transaction list.

The entity search

Instead of an address you enter a name and get the addresses attributed to the entity together with their holdings. For investors that is interesting above all when looking at exchange and project treasuries.

The alerts

You store an address and a condition and get a notification when something moves. The provider describes this function as customisable notifications about activity on the chain, whose history can be displayed alongside price charts.

The explorer

Added to that is an explorer spanning several chains, including checks on individual transaction identifiers. It does not replace the classic block explorer; it supplements it with the layer of names. How to read the raw transaction view, place fees in context and check approvals is set out in our guide to Ethereum gas and Etherscan. Anyone needing several such tools side by side is best off comparing them before the first piece of research.

Tracing stolen coins: the route of the loot across bridges and exchanges

After a theft, analysis is the only tool a victim has left at all. The sequence is the same in almost every case, and it can be read along.

1. The first move. The stolen funds leave the victim's wallet for a fresh address that has never appeared before.
2. The splitting. The amount is broken into many small parts and spread across numerous addresses, to make clustering harder.
3. The chain switch. Via a bridge the funds move to another network, because every switch makes tracing more laborious.
4. The exit. At the end there is almost always an exchange or a swap service, because somewhere the loot has to become money. That is exactly where anonymity ends, because this service holds customer data.

For you as a victim that means: the transaction identifier of the first outflow is the most important piece of evidence. With it the route can be drawn, and it belongs in every police report and in every notification to the exchange where the funds land. How such a theft comes about technically, usually through a signed approval rather than through a cracked key, is something we took apart in our piece on wallet drainers and their signatures.

An assignment is a claim, not an extract from the land register: the limits of the analysis

Here lies the most important reservation of the whole subject. A label on an address is the result of an inference, and inferences can be wrong.

Three sources of error are common. First the pooled address: an exchange keeps the holdings of many customers on a few addresses, so the label names the custodian and not the beneficial owner. Second the change of owner: an address may have been passed on, and the label stays attached to the old name. Third the misassignment through clustering, when two actors sign a transaction together.

From that follow two rules for handling such data. First: a label is an indication that bears a second, independent confirmation before anyone turns it into a statement about a person. Second: anyone passing an assignment on publicly, where it is wrong, carries the consequences. In Germany personality rights and defamation are not theoretical quantities, and a screenshot of an analytics platform is not evidence.

Travel Rule since December 30, 2024: what exchanges record about sender and recipient

Blockchain analysis would be considerably weaker if nobody had to collect data at the crossings. That is precisely what has changed in the EU. Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, the Travel Rule for short, has applied directly in all member states since December 30, 2024, at the same time as the provider regime of the MiCA regulation.

The core in one sentence: providers of crypto-asset services have to collect, store, pass on and make accessible to the authorities on request the details of the originator and the beneficiary on every transfer. Unlike with classic bank transfers there is no de minimis threshold for this; the complete data set is transmitted regardless of the amount. The accompanying guidelines of the European Banking Authority describe how providers are to spot missing details and what then has to happen. The earlier German crypto-asset transfer ordinance lapsed when the EU rule took effect.

In practice that means for you: every withdrawal from an exchange authorised in the EU to an address of your own links that address with your name in the provider's records. That is the law in force and no failing on the exchange's part. Which providers are under this supervision is shown by our comparison of crypto exchanges.

Separating addresses and not linking names: what to watch with your own trail

Nothing can be done about the analysis itself, but a great deal can be done about your own findability. The following habits cost nothing and take effect immediately.

• One address per purpose. One address for withdrawals from the exchange, one for the long-term holding, one for dealing with applications on the chain. If everything flows over a single address, clustering produces a seamless picture.
• No consolidation. Anyone merging balances from several addresses in one transaction thereby declares publicly that all of them belong to the same actor. That is the most frequent self-inflicted mistake.
• Never name your own address publicly. Not in a profile, not under a post, not in an appeal for donations. A single public mention links the name permanently with everything that has ever happened at that address.
• Do not make amounts recognisable. Always the same round amount at always the same time of day is a pattern a machine spots more easily than a person.
• Know your own situation. Enter your main address into an analytics platform yourself once and see what a stranger could assemble about you. That is the only honest test.

One limit belongs with this: these habits make assignment harder, they do not abolish it. As soon as an amount comes from a supervised exchange or goes to one, the link exists anyway, only in the provider's records instead of on the chain. Anyone not wanting even that cannot avoid self-custody, and that begins with the choice of software wallet.

Arkham as an exchange: what the provider's dual role tells you

One point is rarely stressed in product descriptions: Arkham by now runs a trading platform for crypto-assets of its own alongside the analytics platform. The same company thereby sits at two levers that are normally separate, namely the analysis of market movements and trading in the same assets.

No accusation follows from that. What does follow is a sober appraisal for you as a reader: anyone reading an analysis should know which business model stands behind it. That applies to this platform as to every provider that publishes data and earns from trading at the same time. In case of doubt, check whether a second, independent source reaches the same conclusion before you adopt a statement about the market.

For investors in Germany there is the additional point that a trading platform without authorisation under the MiCA regulation may not offer services here. Before you open an account anywhere, a look at the supervisor's register is part of the duty and not of the extras.

Arkham Intelligence: the key points for your decision

The platform makes visible what is public on open networks anyway, and sets names at the places where the chain and the real world touch. For you it is a tool and a warning at once. Three steps draw the consequence from it.

1. Look it up before your next transfer. Enter the destination address into an analytics platform and check whether the label matches what someone has told you. Which tools do that and what they cost is set out in our overview of crypto analytics platforms.
2. Shorten your own trail. Separate addresses by purpose, do not merge balances and never name an address of your own publicly. Where your holding sits and which exchange it came through decides more about your visibility than any technical setting; the exchange comparison shows who is supervised in the EU.
3. Move the long-term holding out of reach. Anyone holding their own keys has no account whose customer data someone can request. The devices for that are in the hardware wallet comparison.

(As of October 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)