On-chain analytics that resolves addresses into actors.
Indexing the chain is the half that gets estimated, and it is the commodity half. What decides whether the output is usable is the layer above it — resolving hundreds of addresses into the one actor behind them, tracing where the value went across four hops, and attaching a confidence score so an inference is never read as a fact.
Why an explorer cannot answer the question you have.
Chain data being public is not the same as chain data being usable. A transfer tells you that an address moved value. A decision needs to know which actor that was, where the value ended up, and how much of the answer is inference — and every failure below sits in that distance.
A cluster is a probability and gets read as a certainty
Clustering heuristics infer, they do not observe. Every cluster carries a confidence score and the specific evidence that produced it — co-spending in one transaction, funding from a single source inside a short window, a matching nonce cadence — and members below the inclusion threshold are excluded and shown as excluded, rather than quietly folded in to make a number look better.
A four-hop trace does not fit a query anyone will wait for
Walking raw transactions across billions of events is not an OLTP workload, and following flows by hand stops at one hop. Flows are pre-aggregated into entity-level edges in a columnar store, so depth costs a read of summarised edges instead of a reconstruction from individual transfers.
A graph with forty thousand nodes is not a visualisation
A traversal that returns everything returns a smear. Value and confidence thresholds are applied before anything renders, and when a traversal hits its limit the interface names the limit and what to change — hop depth, minimum value — instead of truncating silently and presenting a partial graph as the whole one.
A wrong label is worse than no label
Labels decay. A deposit address is reassigned, an attribution was thin to begin with, and nobody downstream knows which are still trustworthy. Each label is versioned with its source and an attestation count, single-source labels are marked as such, and two sources that disagree surface as a conflict instead of resolving last-write-wins.
Improving a heuristic rewrites answers you already acted on
Better clustering moves every past conclusion the old clustering produced. Clustering runs are versioned and reproducible, and a saved conclusion references the run that produced it, so a heuristic change becomes a new run you can compare against rather than a silent edit of history.
By the time a pattern is noticed, the funds have moved
Pull-based analysis requires somebody to think to ask. Behavioural rules run continuously against the flow graph and push what they find — a new cluster member, exposure to a flagged counterparty, a shift from two-sided flow to net selling — so the finding arrives instead of waiting to be hunted.
How we build one.
Read in the order the data moves, because that is the order the cost sits in. The graph on the screen is the last layer and the least of the work; everything that decides whether it is true happened before it rendered.
- 01
Ingestion
Multi-chain event decoding and protocol normalisation, with labels ingested alongside their source rather than as bare strings.
- Rust
- Kafka
- ABI/IDL decoding
- 02
Entity resolution
Heuristic clustering that resolves many addresses to one actor, capturing the evidence and a score per member, run as a versioned job separate from serving so a past conclusion can be re-derived instead of overwritten.
- Spark
- Graph algorithms
- Confidence scoring
- 03
Analytics store
A columnar store for flows alongside a graph store for traversal, with entity-level edges pre-aggregated so hop depth is a read rather than a walk.
- ClickHouse
- Graph store
- Materialised views
- 04
Query API
Traversal, aggregation and saved queries under explicit budgets and result limits, with behavioural rules evaluated against the same edges so an alert and a query cannot disagree about what a flow is.
- Go
- GraphQL
- Behavioural alerts
- 05
Analyst workspace
Graph exploration, entity profiles and case management, where an inferred figure never renders without its score and the empty, loading and limit-exceeded states are designed rather than defaulted.
- Next.js
- React
- Canvas/SVG
- 06
Chains
Full-history indexing across EVM networks and Solana, because an actor that trades on one chain and settles on another is still one actor.
- EVM
- Solana
- Archive nodes
We have already built this.
MERIDIAN is our on-chain data intelligence workspace: address clustering into entities with the confidence score and the evidence trail beside them, multi-hop flow traversal over pre-aggregated edges, labels versioned with source and attestation count and conflicts surfaced as conflicts, behavioural rules that push alerts rather than waiting for a query, and clustering runs versioned so a past conclusion stays explainable. It is a MaatX demonstration rather than a client deployment, and every mechanism above is running in it.
Questions we get asked.
How is this different from a block explorer?
An explorer answers questions about addresses and transactions, because that is what the chain hands over. This answers questions about actors and behaviour, which the chain does not — and the clustering, labelling and flow aggregation that turn one into the other are the system. An explorer tells you an address sent value. What a decision needs is that the address is one of hundreds under one desk and that the value terminated at an exchange.
Can you show why two addresses were clustered together?
Yes, and we treat it as a requirement rather than a feature. Each member carries the heuristic that admitted it and a score — co-spending in the same transaction, funding from one source inside a few minutes, a matching nonce cadence and rounding convention — and anything below the inclusion threshold is left out and shown as left out. A conclusion nobody can explain is not usable in a case file, and it is worse than no conclusion because it will be believed.
Where do the labels come from?
Ingested, and never treated as ground truth because it arrived from somewhere. A label carries its source and a count of how many independent sources assert it, single-source labels are marked, and conflicting labels stay visible as a conflict. Whose feeds you ingest is a procurement decision rather than an engineering one, but it belongs in the architecture conversation, because it sets the limit on what the system can honestly claim.
What does an engagement look like?
Usually Mechanism and Architecture first — one to three weeks to settle which heuristics you are willing to stand behind, how confidence is scored and surfaced, and what the store has to pre-aggregate for the traversals you expect. Those are the expensive decisions to reverse: changing how entities are resolved re-runs every conclusion drawn from the old resolution. Build follows if you want us to do it.
What it costs, and what you are agreeing to.
The commercial answers in one place, so none of them has to wait for a call.
Typical route in
Full System Build
Typically $25,000–120,000
Scoped per system
The contract is one layer. Most of what decides whether an on-chain system survives production lives in the indexing, the risk model and the reconciliation.
A starting point for the scope described, not an estimate for your project. Ongoing engineering runs at $75 per hour blended.
Who owns what you build?
You do. On full payment of the fees for an engagement, the intellectual property in everything built specifically for you is assigned to you.
Our pre-existing tools, libraries and internal infrastructure stay ours — but where a deliverable uses them, you get a perpetual, worldwide licence to run, modify and extend it. Nothing we hand over needs us to keep operating it. Open-source and third-party components keep their own licences, and we tell you which ones and what they require.
We also will not name you as a client, describe your project, or publish a case study about it without your written agreement.
What happens if it does not work out?
Either of us can end an engagement with 30 days written notice, or immediately if the other commits a material breach and does not remedy it within 15 days. You pay for work properly performed up to that point, and we hand over completed work along with every deliverable you have paid for.
Two limits worth stating before you ask. We are engineers, not advisers: nothing we deliver is legal, regulatory, tax or financial advice, and a system built to your specification is not an opinion that it is lawful in your jurisdiction. And where our work includes reviewing or auditing code, the findings cover the scope and time agreed — an absence of findings is not a guarantee that nothing is there.
What do you need from me to start?
Not a specification. Discovery exists precisely because most people do not have one — an idea, or a technical problem you cannot yet size, is enough to begin.
What the work does assume: timely access to the people, systems, credentials and environments it touches; decisions and approvals at roughly the pace the timeline assumes, since delays on your side move both dates and cost; and that you have the right to give us whatever you give us, including data, code and third-party material.
Why you rather than the alternative?
Against hiring a senior engineer in-house: sourcing one takes months and commits you permanently. Discovery runs 1–3 weeks, and you keep the architecture whichever way you then go — including if the answer is to make that hire.
Against the cheapest contractor available: you will pay less per hour. Our argument is that the architecture decision is the one that is expensive to reverse, which is why we sell it first, separately, and at a price you can say yes to before committing to a build.
Against a larger firm: there is no account layer. The people who scope the work are the people who build it.
And when not to hire us: if a no-code or off-the-shelf tool still fits what you are doing, stay on it. We are worth paying once you have hit a ceiling you cannot engineer around from where you are.
These are summaries. The binding version of the ownership, exit and liability terms is in our Terms of Service. A person reads every enquiry. We usually reply within a few hours.
Start a technical assessment
Turning raw chain activity into entity-level intelligence someone can act on?
Send us the architecture or the problem. We will come back with the technical risks we can see and a sensible path forward, free, and tell you if we are not the right people for it.