Risk analysis

This page covers the patterns Wavy Node detects and how to interpret the risk analysis results you receive from endpoints like Quick risk analysis and Async risk analysis. For an overview of how risk scores work, see Risk scores.

Detected patterns

The analysis engine identifies the following risk patterns in the transaction graph:

Pattern	Typical severity	Description
`malicious_actor`	Critical	Interaction with known malicious actors, sanctioned addresses, or blacklisted entities
`mixing`	Critical	Use of mixing services to hide fund origins
`peel_chain`	High	Transaction chains to fragment and obscure funds
`structuring`	High	Splitting amounts to avoid reporting thresholds
`wash_trading`	High	Artificial transactions to simulate volume
`round_tripping`	High	Funds returning to origin after multiple hops
`mass_wallet_creation`	High	Coordinated creation of multiple wallets
`exchange_hopping`	Medium	Rapid movement between exchanges to break traceability

Severity varies with the strength of the evidence. For example, mixing is critical when the address itself is a labeled mixer, high when it interacted with Tornado Cash, and medium when only small-value counterparty interactions with mixers were found. malicious_actor is critical when the address appears on the OFAC sanctions list, high for other blacklists, and scales up with the volume and count of malicious counterparties.

How scores are calculated

Each detected pattern contributes points to the score. Two things determine how many points:

Weight — how dangerous the pattern is by itself. For example, interacting with a known malicious actor (60) weighs far more than moving funds between exchanges (20).
Severity — how strong the evidence is. critical means the evidence is conclusive (e.g. the address is on the OFAC sanctions list or is a labeled mixer), high means strong evidence (e.g. a Tornado Cash interaction), and medium/low mean indirect evidence (e.g. small-value interactions with a flagged counterparty).

The score is the sum of every pattern’s points, capped at 100:

score = min(Σ pattern_weight × severity_multiplier, 100)

Pattern	Weight
`malicious_actor`	60
`mixing`	60
`peel_chain`	50
`round_tripping`	40
`wash_trading`	35
`mass_wallet_creation`	30
`structuring`	25
`exchange_hopping`	20

Severity	Multiplier
`critical`	1.2
`high`	1.0
`medium`	0.7
`low`	0.4

Worked examples

Scenario	Detected patterns	Calculation	Score	Level	Action
No suspicious activity found	—	no patterns to score	0	Minimal	No action needed
Small interaction with a flagged wallet (under $100)	`mixing` `medium`	60 × 0.7 = 42	42	Medium	Investigation recommended
Address interacted with Tornado Cash	`mixing` `high`	60 × 1.0 = 60	60	High	Priority investigation
Address is a labeled mixer	`mixing` `critical`	60 × 1.2 = 72	72	High	Priority investigation
Labeled mixer that also splits deposits to avoid thresholds	`mixing` `critical` + `structuring` `high`	72 + 25 = 97	97	Critical	Immediate action / regulatory report
Multiple laundering techniques at once	`mixing` `critical` + `peel_chain` `critical` + `wash_trading` `high` + `round_tripping` `high`	72 + 60 + 35 + 40 = 207 → capped	100	Critical	Immediate action / regulatory report

The score never exceeds 100. Once several severe patterns stack up, the result is 100 — the exact value stops being informative and the response’s patterns list becomes the main source of evidence for the report.

Response examples

Clean wallet

{
  "success": true,
  "data": {
    "risk": 0,
    "reason": null,
    "patterns": []
  }
}

No detected patterns. Score 0 (minimal range). Standard monitoring applies.

Registered exchange

{
  "success": true,
  "data": {
    "risk": 0,
    "reason": null,
    "patterns": []
  }
}

A recognized exchange wallet typically has no suspicious patterns, so it returns a score of 0. Labels do not discount the score — clean behavior is what keeps the score at 0.

Suspicious address

{
  "success": true,
  "data": {
    "risk": 74,
    "reason": null,
    "patterns": [
      {
        "name": "mixing",
        "severity": "high",
        "involvedWallets": ["0xabc...", "0xdef..."],
        "involvedTxs": ["0x123..."],
        "message": "Address has interacted with Tornado Cash"
      },
      {
        "name": "exchange_hopping",
        "severity": "medium",
        "involvedWallets": ["0xabc...", "0x789..."],
        "involvedTxs": ["0x789..."],
        "usdAmount": 12000,
        "message": "12000 of token 0xtoken moved from 0xabc... → 0x789... within 4.2h (92% value match)"
      }
    ]
  }
}

Mixing interaction plus exchange hopping. Score 74 (60 + 14, high range). Requires immediate investigation.

Critical risk

{
  "success": true,
  "data": {
    "risk": 97,
    "reason": null,
    "patterns": [
      {
        "name": "mixing",
        "severity": "critical",
        "involvedWallets": ["0xmixer...", "0xwallet1..."],
        "involvedTxs": [],
        "usdAmount": 150000,
        "message": "Address identified as \"Tornado Cash\" — classified as mixer"
      },
      {
        "name": "structuring",
        "severity": "high",
        "involvedWallets": ["0xmixer...", "0xwallet3..."],
        "involvedTxs": ["0xe5f6..."],
        "usdAmount": 80000,
        "message": "8 deposits to 4 counterparties within 48h window, averaging $2500 each (CV: 0.12, total $20000)"
      }
    ]
  }
}

Mixer label combined with structuring. Score 97 (72 + 25, critical range). Urgent escalation and regulatory report required.

Async job result

{
  "success": true,
  "data": {
    "address": "0x28c6c06298d514db089934071355e5743bf21d60",
    "status": "completed",
    "result": {
      "risk": 0,
      "reason": null,
      "patterns": []
    },
    "error": null,
    "createdAt": 1754400000000,
    "updatedAt": 1754400032000
  }
}

Polling GET /risk/{jobId} returns the job envelope. result is present and populated only when status is completed; error is set when the job fails.

Getting started

Concepts

Chains and tokens

Detected patterns

How scores are calculated

Worked examples

Response examples

​Detected patterns

​How scores are calculated

​Worked examples

​Response examples

Detected patterns

How scores are calculated

Worked examples

Response examples