Last updated: March 2026

Chainalysis Reactor is a blockchain investigation platform used by law enforcement agencies, financial intelligence units, and specialist forensic firms to trace cryptocurrency transactions, attribute wallet addresses to known entities, and produce court-ready evidence packages. Reactor combines automated graph analysis with manual investigation tools to map fund flows across Bitcoin, Ethereum, and over 100 additional blockchain networks. According to Chainalysis (2025), over 800 government agencies in 70 countries use Chainalysis Reactor as a primary blockchain investigation tool.

Crypto Trace Labs uses Chainalysis Reactor as part of its multi-platform investigation methodology, combined with Elliptic Forensics, TRM Labs, and Crystal Intelligence for complex cross-chain and DeFi cases. This guide explains how Reactor works, how investigators use it in practice, and where its capabilities and limitations lie.

Key Takeaways

• Chainalysis Reactor provides visualised transaction graphs, entity attribution, and case management tools for law enforcement-grade blockchain investigations
• Entity clustering automatically groups addresses believed to belong to the same wallet holder, using co-spend analysis and common input ownership heuristics
• The Chainalysis attribution database contains over 2,000 named entities including exchanges, darknet markets, and ransomware groups, updated in near real time
• Reactor’s court report export produces PDF evidence packages that have been accepted in UK, US, and EU criminal and civil proceedings
• Reactor is a tool, not a complete solution – forensic methodology, analyst credentials, and expert witness capability must come from the instructing firm, not the platform

Why This Matters

Chainalysis Reactor is the most widely adopted blockchain investigation platform in law enforcement, and understanding how it works is essential for anyone involved in cryptocurrency-related prosecutions or asset recovery. Defence solicitors challenging blockchain evidence need to understand what Reactor can and cannot prove. Prosecutors presenting Reactor evidence need to understand its methodological basis. Law enforcement agencies selecting forensic firms should know whether a firm uses Reactor, under what licence, and how they supplement its findings. The FCA (2024) guidance on digital asset investigations explicitly addresses the need to document which platform and version was used for each forensic conclusion.

The Reactor Investigation Interface

Chainalysis Reactor presents blockchain data as an interactive graph where wallets are represented as nodes and transactions as directed edges. Investigators begin an investigation by entering a known wallet address or transaction hash. Reactor automatically populates the graph with connected transactions, attributes known entities to wallet clusters using its internal database, and assigns risk scores to addresses based on their transaction history and counterparty exposure. The interface allows investigators to expand specific transaction paths, apply date filters, and annotate nodes with case-specific notes that feed into the final evidence report.

The graph is built on Chainalysis’s attribution database, which draws on exchange collaboration agreements, darknet market monitoring, open-source intelligence, and proprietary cluster analysis. According to Chainalysis (2025), the database contains attribution for over 5 billion address clusters across supported blockchains, with new entity identifications added continuously as new information is confirmed.

Entity Attribution and Cluster Analysis

Entity attribution is the process of linking blockchain addresses to real-world entities – exchanges, services, criminal groups, or individuals. Chainalysis Reactor uses several attribution methods in combination. Common input ownership heuristics group Bitcoin addresses that have been used as inputs in the same transaction, inferring they are controlled by the same wallet. This is the same technique described in the original Bitcoin whitepaper and forms the basis of most commercial attribution databases. Exchange deposit address identification uses known exchange cluster patterns to identify deposit addresses even when not directly labelled. Direct exchange cooperation provides confirmed KYC-linked address data that Chainalysis incorporates into its database under formal data sharing agreements.

The reliability of entity attribution varies significantly by entity type. Exchange attributions for major centralised exchanges like Binance, Coinbase, and Kraken are highly reliable. Attributions for darknet markets, ransomware wallets, and peer-to-peer exchanges carry higher uncertainty and should be treated as investigative leads rather than definitive identifications. For more on how address clustering works in practice, see our guide on address clustering techniques.

Case Management and Evidence Export

Chainalysis Reactor includes a case management system allowing multiple analysts to collaborate on the same investigation, share graph annotations, and maintain an investigation log. The case management system records each analyst action with timestamps, providing an audit trail of investigative steps. For court proceedings, Reactor generates PDF evidence packages that include the transaction graph, entity attributions, risk scores, and a methodology section. These PDFs have been submitted as documentary evidence in UK Crown Court proceedings, US federal criminal cases, and EU civil asset recovery proceedings.

The quality of the evidence package depends on the analyst’s annotation quality, the accuracy of the underlying entity attribution, and the methodology documentation accompanying the report. Reactor’s output is raw material for a forensic report – it is not a forensic report in itself. A credible court submission requires an ACAMS-accredited analyst to document their methodology, state the basis for each attribution, and be available as an expert witness to defend findings under cross-examination.

Reactor’s Supported Chains and Coverage Gaps

Chainalysis Reactor supports Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Ripple, Tron, BNB Chain, Solana, Polygon, and over 100 additional networks. Coverage depth varies significantly by chain. Bitcoin and Ethereum receive the deepest entity attribution, the most frequent database updates, and the most reliable cluster analysis. Less commonly investigated chains may have entity attribution gaps, particularly for peer-to-peer exchange activity and DeFi protocols. For DeFi-heavy investigations, Elliptic Forensics and TRM Labs provide deeper protocol-level coverage than Reactor, which is why specialist firms compare all four platforms before selecting a primary investigation tool.

Reactor Pricing and Licensing

Chainalysis does not publish public pricing. Law enforcement licences for Reactor start at approximately USD 40,000 per year for a single-seat licence, with multi-seat and enterprise pricing negotiated separately. UK law enforcement agencies can access Reactor through framework agreements coordinated by the National Crime Agency. Private sector forensic firms hold commercial licences at different pricing tiers. Chainalysis also offers a KYT (Know Your Transaction) module for real-time AML screening, which is a separate product from Reactor and priced separately.

Frequently Asked Questions

What is Chainalysis Reactor used for?

Chainalysis Reactor is used by law enforcement agencies, financial intelligence units, and specialist forensic firms to trace cryptocurrency transactions, attribute wallet addresses to known entities, and produce evidence packages for criminal and civil proceedings. It combines automated graph analysis with manual investigation tools across Bitcoin, Ethereum, and over 100 blockchain networks. Reactor is the most widely adopted blockchain investigation platform in law enforcement globally, used by over 800 government agencies in approximately 70 countries according to Chainalysis (2025).

How does Chainalysis entity attribution work?

Chainalysis entity attribution uses several methods: common input ownership heuristics group Bitcoin addresses co-spent in the same transaction; exchange deposit address identification uses known cluster patterns; direct exchange cooperation agreements provide KYC-confirmed address data; and open-source intelligence monitoring attributes addresses to darknet markets, ransomware groups, and other criminal entities. Attribution reliability varies by entity type – major exchange attributions are highly reliable while darknet market attributions should be treated as investigative leads requiring corroboration.

Is Chainalysis Reactor evidence admissible in court?

Chainalysis Reactor outputs have been submitted as documentary evidence in UK Crown Court, US federal criminal proceedings, and EU civil asset recovery cases. Admissibility depends on how the evidence is presented – the methodology must be documented, the analyst must hold appropriate expert witness qualifications, and entity attributions must be stated with appropriate confidence levels rather than presented as definitive. Reactor is a tool that produces data. Admissibility depends on the forensic analyst who interprets and documents that data, not on the platform itself.

What chains does Chainalysis Reactor support?

Chainalysis Reactor supports Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Ripple, Tron, BNB Chain, Solana, Polygon, Avalanche, and over 100 additional blockchain networks. Coverage depth varies by chain, with Bitcoin and Ethereum receiving the deepest entity attribution and most frequent database updates. Privacy coins including Monero receive limited heuristic analysis only. Cross-chain bridge coverage is partial. For DeFi-heavy investigations, Reactor should be supplemented with Elliptic Forensics or TRM Labs, which provide deeper DeFi protocol coverage.

What is the difference between Chainalysis Reactor and KYT?

Chainalysis Reactor is a forensic investigation tool used to trace historical transaction flows and build evidentiary cases. Chainalysis KYT (Know Your Transaction) is a real-time AML compliance screening tool used by crypto exchanges and financial institutions to monitor transactions as they occur. Reactor is used by investigators after a crime to build evidence. KYT is used by compliance teams before or during transactions to identify risk. Both draw on the same Chainalysis entity attribution database but serve entirely different use cases.

How long does a Chainalysis Reactor investigation take?

Investigation duration depends heavily on case complexity. A straightforward single-chain Bitcoin investigation with clear transaction flows may be completable in hours. A complex multi-chain investigation involving DeFi protocols, cross-chain bridges, and dozens of wallets requires days to weeks of analyst work. Court-ready documentation, peer review, and methodology writing add further time. A complete forensic report with expert witness documentation typically requires 5-15 business days from instruction, consistent with court-ready standards across all blockchain investigation tools.

Can defence solicitors access Chainalysis to challenge evidence?

Defence solicitors can request disclosure of the Chainalysis Reactor case file and underlying data as part of criminal proceedings disclosure obligations. The prosecution is required to disclose the methodology, entity attribution basis, and the specific database version used for any forensic conclusions. Defence experts with access to Reactor or comparable tools can independently verify or challenge entity attributions. Chainalysis does not licence Reactor to defence counsel directly, but independent forensic firms can be instructed to review and challenge prosecution blockchain evidence.

What is the Chainalysis attribution database?

The Chainalysis attribution database is a proprietary dataset containing attributed addresses and cluster assignments for over 5 billion address clusters across supported blockchains, updated continuously. It includes confirmed exchange deposit addresses from formal data sharing agreements, darknet market addresses identified through monitoring and law enforcement cooperation, ransomware wallet attributions from known incident data, and cluster assignments derived from common input ownership analysis. The database is the core asset underlying all Chainalysis investigation outputs and its accuracy and update frequency are key differentiators versus competitors.

Does Chainalysis Reactor support multi-user investigations?

Yes. Chainalysis Reactor includes case management functionality that allows multiple analysts to collaborate on the same investigation simultaneously. Users can share graph annotations, add case notes, assign investigation tasks, and maintain a timestamped audit trail of all analyst actions. This multi-analyst capability is particularly useful for complex investigations involving large transaction networks where work needs to be divided between team members. The audit trail produced by the case management system also supports the chain of custody documentation requirements for court proceedings.

What credentials should a Chainalysis Reactor analyst hold?

A Chainalysis Reactor analyst producing court-admissible forensic reports should hold ACAMS accreditation as the minimum professional standard, MLRO qualifications in the relevant jurisdiction, and prior experience providing expert witness testimony in legal proceedings. Chainalysis offers its own Certification in Blockchain Tracing (CBT), which is useful but does not substitute for ACAMS accreditation or legal expert witness qualification. The analyst’s credentials, not the platform licence, determine whether findings will survive cross-examination in court proceedings.

Executive Summary

Chainalysis Reactor is the most widely adopted blockchain forensic platform in law enforcement globally, used by over 800 government agencies across 70 countries. It provides visualised transaction graphs, entity attribution from a database of over 5 billion clusters, and case management tools with court-format PDF export. Reactor is most reliable on Bitcoin and Ethereum, with partial coverage for DeFi protocols and limited heuristics for privacy coins. Platform capability is only part of the equation – admissible forensic evidence requires ACAMS-accredited analysts with documented methodology and expert witness qualifications, not just access to the tool.

What Should You Do Next?

Chainalysis Reactor is a powerful investigation tool that requires qualified analysts to produce court-admissible findings. Platform access without forensic expertise produces data, not evidence. If your investigation requires Reactor-based analysis combined with documented methodology and expert witness capability, specialist forensic firms are the appropriate instructing choice.

Crypto Trace Labs holds a law-enforcement-grade Chainalysis Reactor licence and uses it alongside Elliptic Forensics and TRM Labs for complex investigations. Our ACAMS-accredited, MLRO-qualified analysts have produced Reactor-based forensic reports accepted in UK Crown Court and civil asset recovery proceedings. Contact Crypto Trace Labs to discuss your investigation requirements.

People Also Read

• Chainalysis vs Elliptic vs TRM Labs vs Crystal Intelligence: Platform Comparison
• How Do Investigators Use Address Clustering to Link Crypto Wallets?
• How to Evaluate Blockchain Forensic Firms: 12 Questions Law Enforcement Should Ask
• How Does Blockchain Forensics Work? Expert Methods Explained

About the Author

Crypto Trace Labs is a specialist crypto asset recovery and blockchain forensics firm founded by VP and Director-level executives formerly of Blockchain.com, Kraken, and Coinbase. Our team holds ACAMS accreditations, MLRO qualifications across the UK, US, and EU, and Chartered Fellow Grade status at the CMI. With over 10 years of experience in financial crime investigation and court-recognized blockchain forensics expertise, we have recovered 101 Bitcoin for clients in the last 12 months and delivered record fraud reduction for a $14bn crypto exchange. We work with law enforcement agencies, regulated financial institutions, and private clients on crypto asset recovery, blockchain forensics, AML compliance, and expert witness testimony – globally. We offer no upfront charge for non-custodial wallet recoveries. Contact us

This content is for informational purposes only and does not constitute legal, financial, or compliance advice. Crypto asset recovery outcomes depend on specific circumstances, regulatory cooperation, and technical factors. Consult qualified professionals regarding your specific situation.