Skip to main content
Wavy Node analyzes blockchain transactions in real time to detect suspicious patterns, fraud, and money laundering. Each analyzed address receives a risk score and a set of detected patterns.

​
How it works

1

Register addresses

Add the relevant on-chain addresses for your project using the Addresses API. These are the wallets you want to monitor for compliance.
2

Scan for risk

Submit addresses for analysis using the Scan Risk endpoint. The system traverses the transaction graph to detect suspicious patterns.
3

Review results

Each address receives a risk score (0-100), a risk level, and a list of detected patterns with confidence scores.
4

Take action

Based on the results, you can approve, investigate, or escalate. Wavy Node sends real-time alerts to your integration webhook when suspicious activity is detected.

​
Detected patterns

When analyzing the transaction graph, Wavy Node can identify the following suspicious patterns:
PatternSeverityDescription
mixingCriticalUse of mixing services to hide fund origins
peel_chainHighTransaction chains to fragment and obscure funds
structuringHighSplitting amounts to avoid reporting thresholds
round_trippingMediumFunds returning to origin after multiple hops
mass_wallet_creationMediumCoordinated creation of multiple wallets
wash_tradingMediumArtificial transactions to simulate volume
exchange_hoppingLowRapid movement between exchanges to break traceability

​
Risk levels

LevelScoreRecommended action
Minimal0-19No action needed
Low20-39Passive monitoring
Medium40-59Investigation recommended
High60-79Priority investigation
Critical80-100Immediate action / regulatory report

​
Response example

{
  "address": "0xabcd...",
  "chainId": "1",
  "status": "completed",
  "riskScore": 45,
  "riskLevel": "medium",
  "riskReason": "Clustering pattern detected, requires investigation",
  "suspiciousActivity": false,
  "patterns": [
    {
      "type": "clustering",
      "confidence": 0.75,
      "severity": "medium"
    }
  ],
  "transactionGraph": {
    "rootAddress": "0xabcd...",
    "totalNodes": 1107,
    "totalEdges": 2000,
    "maxDepth": 3
  }
}
Addresses with riskLevel: "critical" should be reported to the regulator per applicable regulations. See Regulations for details.