Transactions

Wavy Node analyzes blockchain transactions in real time to detect suspicious patterns, fraud, and money laundering. Each analyzed address receives a risk score and a set of detected patterns.

How it works

Add the relevant on-chain addresses for your project using the Addresses API. These are the wallets you want to monitor for compliance.

Scan for risk

Submit addresses for analysis using the Risk analysis endpoints. The system traverses the transaction graph to detect suspicious patterns.

Review results

Each address receives a risk score (0-100), a risk level, and a list of detected patterns with their severity.

Take action

Based on the results, you can approve, investigate, or escalate. Wavy Node sends real-time alerts to your integration webhook when suspicious activity is detected.

Detected patterns

When analyzing the transaction graph, Wavy Node can identify the following suspicious patterns:

Pattern	Typical severity	Description
`malicious_actor`	Critical	Interaction with known malicious actors, sanctioned addresses, or blacklisted entities
`mixing`	Critical	Use of mixing services to hide fund origins
`peel_chain`	High	Transaction chains to fragment and obscure funds
`structuring`	High	Splitting amounts to avoid reporting thresholds
`wash_trading`	High	Artificial transactions to simulate volume
`round_tripping`	High	Funds returning to origin after multiple hops
`mass_wallet_creation`	High	Coordinated creation of multiple wallets
`exchange_hopping`	Medium	Rapid movement between exchanges to break traceability

Severity varies with the strength of the evidence. See Risk analysis for the full detection rules and scoring formula.

Risk levels

Level	Score	Recommended action
Minimal	0-19	No action needed
Low	20-39	Passive monitoring
Medium	40-59	Investigation recommended
High	60-79	Priority investigation
Critical	80-100	Immediate action / regulatory report

Response example

{
  "success": true,
  "data": {
    "risk": 56,
    "reason": null,
    "patterns": [
      {
        "name": "malicious_actor",
        "severity": "medium",
        "involvedWallets": ["0xabc...", "0xdef..."],
        "involvedTxs": ["0x123..."],
        "usdAmount": 80,
        "message": "Interacted with 1 known malicious actors ($80.00 USD)"
      },
      {
        "name": "exchange_hopping",
        "severity": "medium",
        "involvedWallets": ["0xabc...", "0xdef..."],
        "involvedTxs": ["0x456..."],
        "usdAmount": 12000,
        "message": "12000 of token 0xtoken moved from 0xabc... → 0xdef... within 3.1h (88% value match)"
      }
    ]
  }
}

Here the score is the weighted sum: malicious_actor (60 × 0.7 = 42) plus exchange_hopping (20 × 0.7 = 14), for a total of 56 (medium range).

Addresses with a risk score of 80-100 (critical range) should be reported to the regulator per applicable regulations. See Regulations for details.

Getting started

Concepts

Chains and tokens

How it works

Detected patterns

Risk levels

Response example

​How it works

​Detected patterns

​Risk levels

​Response example

How it works

Detected patterns

Risk levels

Response example