> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wavynode.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Transactions

> How Wavy Node monitors and analyzes on-chain transactions in real time

Wavy Node analyzes blockchain transactions in real time to detect suspicious patterns, fraud, and money laundering. Each analyzed address receives a risk score and a set of detected patterns.

## How it works

<Steps>
  <Step title="Register addresses">
    Add the relevant on-chain addresses for your project using the [Addresses API](/api-reference/endpoint/list-addresses). These are the wallets you want to monitor for compliance.
  </Step>

  <Step title="Scan for risk">
    Submit addresses for analysis using the [Risk analysis](/api-reference/endpoint/get-risk-quick) endpoints. The system traverses the transaction graph to detect suspicious patterns.
  </Step>

  <Step title="Review results">
    Each address receives a risk score (0-100), a risk level, and a list of detected patterns with their severity.
  </Step>

  <Step title="Take action">
    Based on the results, you can approve, investigate, or escalate. Wavy Node sends real-time alerts to your [integration webhook](/integrations/endpoints) when suspicious activity is detected.
  </Step>
</Steps>

## Detected patterns

When analyzing the transaction graph, Wavy Node can identify the following suspicious patterns:

| Pattern                | Typical severity | Description                                                                            |
| ---------------------- | ---------------- | -------------------------------------------------------------------------------------- |
| `malicious_actor`      | Critical         | Interaction with known malicious actors, sanctioned addresses, or blacklisted entities |
| `mixing`               | Critical         | Use of mixing services to hide fund origins                                            |
| `peel_chain`           | High             | Transaction chains to fragment and obscure funds                                       |
| `structuring`          | High             | Splitting amounts to avoid reporting thresholds                                        |
| `wash_trading`         | High             | Artificial transactions to simulate volume                                             |
| `round_tripping`       | High             | Funds returning to origin after multiple hops                                          |
| `mass_wallet_creation` | High             | Coordinated creation of multiple wallets                                               |
| `exchange_hopping`     | Medium           | Rapid movement between exchanges to break traceability                                 |

<Note>
  Severity varies with the strength of the evidence. See [Risk analysis](/concepts/risk-analysis) for the full detection rules and scoring formula.
</Note>

## Risk levels

| Level    | Score  | Recommended action                   |
| -------- | ------ | ------------------------------------ |
| Minimal  | 0-19   | No action needed                     |
| Low      | 20-39  | Passive monitoring                   |
| Medium   | 40-59  | Investigation recommended            |
| High     | 60-79  | Priority investigation               |
| Critical | 80-100 | Immediate action / regulatory report |

## Response example

```json theme={null}
{
  "success": true,
  "data": {
    "risk": 56,
    "reason": null,
    "patterns": [
      {
        "name": "malicious_actor",
        "severity": "medium",
        "involvedWallets": ["0xabc...", "0xdef..."],
        "involvedTxs": ["0x123..."],
        "usdAmount": 80,
        "message": "Interacted with 1 known malicious actors ($80.00 USD)"
      },
      {
        "name": "exchange_hopping",
        "severity": "medium",
        "involvedWallets": ["0xabc...", "0xdef..."],
        "involvedTxs": ["0x456..."],
        "usdAmount": 12000,
        "message": "12000 of token 0xtoken moved from 0xabc... → 0xdef... within 3.1h (88% value match)"
      }
    ]
  }
}
```

Here the score is the weighted sum: `malicious_actor` (60 × 0.7 = 42) plus `exchange_hopping` (20 × 0.7 = 14), for a total of 56 (medium range).

<Warning>
  Addresses with a `risk` score of 80-100 (critical range) should be reported to the regulator per applicable regulations. See [Regulations](/concepts/regulations) for details.
</Warning>