Wallet Screening · Cross-Chain Tracing · L4

Elliptic Lens & Navigator

Address screening for sanctions, darknet, and mixer exposure, plus cross-chain transaction tracing across 100+ blockchains. Elliptic's unique strength: seeing the full fund flow when stablecoins bridge across chains.

What Elliptic Provides

Screening + Cross-Chain Analytics

Elliptic's KYT approach spans three capabilities:

  • Lens (L4) — Wallet and address screening API: submit an address and receive a risk assessment with exposure categories (SANCTION, DARKNET_MARKET, MIXER, RANSOMWARE, etc.). Built for one-time and continuous screening workflows.
  • Navigator (L4) — Cross-chain transaction tracing: track fund flows across 100+ blockchains simultaneously. When USDC bridges from Ethereum via CCTP to Base, Navigator traces the connection. Most monitoring tools see two disconnected events; Navigator sees the single logical transfer.
  • Enterprise API (L4) — Integration layer for PPSIs: batch screening, real-time alerts, exposure webhooks, and compliance-ready data formats. Designed for production KYT infrastructure.

Wallet Screening Workflow

From Address Query to Risk Assessment

How it works: Lens is Elliptic's API for screening addresses. Submit a wallet address, receive detailed exposure information in real-time.

  • Submit address — POST to /api/v2/screening/addresses with a single wallet or batch of addresses and blockchains (ethereum, polygon, solana, tron, etc.)
  • Receive exposures — Response includes risk categories: SANCTION (OFAC match), DARKNET_MARKET (known market address), MIXER (privacy service), RANSOMWARE (confirmed ransom payment recipient), STOLEN_FUNDS, and more
  • Map risk score — Exposures are not always binary (sanctioned or not). Some addresses have historical exposure but are now compliant. Elliptic surfaces confidence levels and temporal data.
  • Continuous monitoring — Can be called at onboarding (one-time screening) or at every transaction (continuous). Webhook-driven alerts for address status changes.
POST /api/v2/screening/addresses
{
  "addresses": [
    {
      "address": "0x8ba1f109551bD432803012645Ac136ddd8...",
      "blockchains": [
        "ethereum",
        "polygon",
        "base"
      ]
    }
  ]
}
Response
{
  "address": "0x8ba1f109...",
  "exposures": [
    {
      "category": "DARKNET_MARKET",
      "risk": "HIGH",
      "confidence": 0.95,
      "lastSeen": "2024-02-15T10:23:00Z",
      "source": "Silk Road Historical"
    }
  ],
  "riskLevel": "HIGH",
  "blockchains": ["ethereum", "polygon"]
}

Cross-Chain Intelligence

When Stablecoins Bridge: Navigator's Unique Strength

Navigator traces funds across chains and bridges. This is the only way to satisfy §104(d)(4): cross-chain transfer tracking.

The problem Navigator solves:

A USDC transfer via CCTP (Canonical Interoperability Protocol) from Ethereum to Base creates two separate on-chain events: (1) USDC burn on Ethereum, and (2) USDC mint on Base. Most KYT tools treat these independently, creating two separate monitoring entries. If the sender address is risky but only flagged on Ethereum, the Base recipient receives USDC without triggering an alert. Navigator connects the two events into a single logical transfer.

How Navigator works:

  • Bridge event mapping — Identifies bridge deposits (Stargate, Lido Bridge, CCTP, Atomic Swaps) and matches them to their corresponding withdrawal events on the destination chain
  • Cross-chain identity — Links the same funds across chains even when addresses change (e.g., bridge relayer address on Base vs. original sender on Ethereum)
  • 100+ chain support — Works across EVM chains, Solana, TRON, Bitcoin, Polkadot, and emerging L2s. Coverage grows as new chains launch.
  • Fund flow graph — Builds a directed graph of fund movement, showing the complete path from source to destination across all hops

Why this matters for §104(d)(4):

The GENIUS Act explicitly requires PPSIs to track cross-chain transfers. Chainalysis' Reactor only works within a single chain. TRM Labs has multi-chain coverage but focuses on entity attribution. Elliptic Navigator is purpose-built for tracing the same dollars across chains — the literal requirement of §104(d)(4).

GENIUS Act §104(d)/(e) Mapping

Elliptic Coverage Across Compliance Requirements

Requirement Elliptic Product Coverage Status
Real-time transaction monitoring for all customer transfers Lens API + Webhooks Full Coverage
Update customer risk profile when transaction triggers risk threshold Lens Risk Data + Alert Webhooks Full Coverage
Behavioral pattern detection (structuring, layering, smurfing) Manual Rule Engine Required Gap (No Built-In)
Cross-chain transfer tracking across bridge and protocol hops Navigator (Cross-Chain Tracing) Full Coverage
SAR identification: transactions >$5K with suspicious indicators Lens Exposures + Navigator Graph Full Coverage
On-chain sanctions screening (code-enforced) None (API Only) Gap (L3 Missing)

Key insight: Elliptic's superpower is cross-chain tracing (§104(d)(4)). Where Chainalysis can track single-chain transfers but lacks cross-chain capability, Elliptic sees the full picture. However, Elliptic doesn't offer code-enforced screening like Chainalysis' on-chain oracle. For complete coverage, PPSIs often combine Elliptic (cross-chain) + Chainalysis Sanctions Oracle (L3 gating).

Related Resources

Complete Your KYT Stack

Chainalysis KYT Integration
Real-time risk scoring via KYT API, graph analysis via Reactor, and the on-chain sanctions oracle. Chainalysis excels at single-chain monitoring.
Read Chainalysis guide →
TRM Labs (Coming Soon)
Multi-protocol entity attribution and cross-chain forensics. TRM Labs' emerging strength is high-fidelity entity mapping across diverse blockchains.
Available Soon
Patterns & Behavioral Analysis
Structuring, layering, and rapid movement detection. How to build heuristic engines for behavioral pattern monitoring (§104(d)(3)).
Explore patterns →
StableVASP & FATF
FATF Travel Rule messaging and VASP compliance. How inter-PPSI transfers and cross-chain flows integrate with KYT obligations.
Learn about VASP →