Attribution Database
Definition
A commercial or law-enforcement dataset that maps known addresses or address clusters to real-world entities: exchanges, darknet markets, ransomware operators, sanctioned individuals, and mixing services. The database is what transforms a raw address into an investigative lead.
- Type
- Commercial or law-enforcement dataset
- Maps addresses to
- Exchanges, darknet markets, ransomware operators, sanctioned entities, mixers
- Function
- Converts a raw blockchain address into an investigative lead
- Field
- Cryptocurrency tracing
Common questions
Why is an attribution database necessary when blockchain transactions are already public?+
A public ledger shows addresses and transfers but not who controls an address. An attribution database supplies the real-world identity or category behind clusters of addresses, which is what turns a visible transaction trail into a lead an investigator can act on.
What is a limitation of relying on attribution databases in an investigation?+
Coverage is incomplete and provider-dependent, new addresses are unlabelled until enough activity or intelligence links them to an entity, and mixing services or address reuse across services can produce false or stale associations, so results are typically corroborated with other evidence.
Related terms
- Change-Address Heuristic
- The inference that one output from a Bitcoin transaction (usually the smaller one, to a fresh address) is change returning to the...
- Co-Spend Heuristic
- The inference that when multiple Bitcoin inputs appear in one transaction, all those input addresses are controlled by the same entity, because...
- De-Anonymisation
- The process of linking a pseudonymous address or cluster to a real-world identity. Most commonly achieved through exchange KYC records, but also...
- Mixing (Tumbling)
- A service or protocol that accepts cryptocurrency inputs from multiple users and returns equivalent outputs in a way designed to break the...
- Peel Chain
- A transaction pattern where one large input is repeatedly split, sending most of the value one hop forward and a small remainder...