MERIDIAN
On-Chain Data Intelligence
Turn blockchain activity into usable intelligence.
See who is actually moving value on-chain — entities and behaviour, not just addresses and hashes.
- Entity resolution
- Graph traversal
- Confidence scoring
- Columnar analytics
- Behavioural alerts
Entity resolution, transaction graphs and token-flow analysis that answer who is doing what — not just which address moved which token.
What the product is built around.
MERIDIAN works at the entity level. Addresses are clustered into entities using behavioural heuristics with confidence attached, flows are traversable to arbitrary depth, and patterns worth knowing about generate alerts instead of waiting to be discovered.
Entities, not addresses
Clustering resolves many addresses to one actor with an explicit confidence score and the evidence that produced it.
Confidence is always visible
Every label and cluster carries a score and a source. An inference is never presented as a fact.
Patterns push, not pull
Behavioural rules run continuously against the flow graph, so notable activity arrives as an alert rather than being found on a hunt.
What makes this hard.
Blockchain data is completely public and almost completely unusable. A raw transaction tells you an address moved value. It does not tell you that eleven addresses are one desk, that the flow terminated at an exchange, or that the pattern matches behaviour you flagged three weeks ago.
- 01
Addresses are not identities, and one actor controls hundreds
- 02
Analysis stops at one hop because following flows manually does not scale
- 03
Labels go stale and nobody knows which are still trustworthy
- 04
Protocol-level metrics require bespoke indexing for every protocol
- 05
By the time a pattern is noticed manually, the funds have moved
What the system does.
MERIDIAN works at the entity level. Behavioural heuristics cluster many addresses into one actor with an explicit confidence score and the evidence that produced it, flows are traversable to arbitrary depth over pre-aggregated edges, and behavioural rules run continuously so notable activity arrives as an alert instead of waiting to be found.
Address clustering into entities with confidence and evidence always visible
Multi-hop flow traversal over pre-aggregated edges, not raw transactions
Labels versioned with source and attestation count, conflicts surfaced as conflicts
Behavioural rules that push alerts rather than waiting for a query
Reproducible, versioned clustering runs so past conclusions stay explainable
MERIDIAN, as working interface.
Rendered UI, not a mockup — real tables, charts, filters and states. Try ⌘K for the command palette.
Entity balance
$24.18M
Addresses clustered
184
Counterparties
1,204
Risk score
34 / 100
Token flow graph — 4 hops from entity ENT-4128
value-weighted- Subject entity
- Exchange
- Protocol
- Flagged
- Unlabelled
Top counterparties
| Counterparty | Type | Inflow | Outflow | Net | Txs | Confidence | Risk |
|---|---|---|---|---|---|---|---|
| Exchange ACentralised venue | Exchange | $3.10M | $5.30M | −$2.20M | 1,284 | 0.99 | Low |
| DEX pool — ETH/USDC0x88e6… | Protocol | $2.80M | $3.40M | −$0.60M | 842 | 1.00 | Low |
| Lending market0x7d2b… | Protocol | $1.90M | $1.90M | $0.00 | 418 | 1.00 | Low |
| Exchange BCentralised venue | Exchange | $2.40M | $1.70M | +$0.70M | 612 | 0.96 | Medium |
| 0x8c41…9df2Unlabelled cluster | Unknown | $0.90M | $1.20M | −$0.30M | 96 | 0.62 | Elevated |
| Flagged mixerSanctions-adjacent | Flagged | $0.00 | $0.40M | −$0.40M | 14 | 0.94 | High |
Two-hop exposure · confidence reflects clustering certainty, not counterparty trustworthiness
Entity profile
- Entity
- ENT-4128
- Classification
- Market-making desk
- Cluster confidence
- 0.91
- First seen
- 2023-04-11
- Chains active
- 4
- Behaviour
- High-frequency · two-sided
- Flagged exposure
- 1.7% of outflow
- Label source
- Behavioural + attested
Net flow
90DOutflow destination
- Exchanges50.4%
- DEX & pools24.5%
- Lending13.7%
- Bridges8.6%
- Flagged2.9%
Alert feed
- Flagged-counterparty exposureENT-4128 → mixer · $412K over 14 txs2h
- New cluster member0x1de6… joined ENT-4128 · confidence 0.885h
- Behaviour shiftTwo-sided → net seller over 72h8h
- Large bridge transfer$2.4M ETH → Arbitrum in a single tx1d
- Dormant address active0xf82d… first activity in 412 days2d
- Label attestedExchange A confirmed by second source3d
Activity by hour / weekday
Clustering evidence
- Common-input heuristic0.94
112 addresses co-spent in the same transaction across 48 instances
- Gas-funding pattern0.91
41 addresses funded from one source within a 6-minute window
- Behavioural fingerprint0.87
Matching nonce cadence and rounding convention across 26 addresses
- Timing correlation0.71
Activity windows overlap beyond chance for 18 addresses
- Weak signal — excluded0.44
5 addresses share a counterparty only · below inclusion threshold
Interface states
UI statesNo entity selected
Search an address, transaction or label to begin a trace.
Start a traceEmpty stateGraph too large to render
This traversal returned 41,800 nodes. Reduce the hop depth or add a minimum value filter.
How it is put together.
Clustering is a separate, reproducible pipeline from serving. Heuristic changes re-run as a versioned job so historical conclusions stay explainable.
- 01
Analyst Workspace
Graph exploration, entity profiles, dashboards and case management.
- Next.js
- React
- Canvas/SVG
- 02
Query API
Graph traversal, aggregation and saved-query execution with result limits.
- Go
- GraphQL
- Cursor pagination
- 03
Entity Resolution
Heuristic clustering with confidence scoring, evidence capture and versioning.
- Python
- Spark
- Graph algorithms
- 04
Analytics Store
Columnar store for flows plus a graph store for traversal.
- ClickHouse
- Graph store
- Materialised views
- 05
Ingestion
Multi-chain event decoding, protocol normalisation and label ingestion.
- Rust
- Kafka
- ABI/IDL decoding
- 06
Chains
Full-history indexing across EVM networks and Solana.
- EVM
- Solana
- Archive nodes
What the product does.
The capability set the demonstration is built around.
Wallet intelligence
Per-address profile with behaviour classification, counterparty mix and risk signals.
Entity tracking
Address clustering into entities with confidence scoring and evidence trails.
Transaction graphs
Multi-hop flow traversal with path highlighting and value attribution.
Token flows
Source-to-destination flow analysis across bridges, pools and exchanges.
Protocol analytics
Normalised metrics for lending, DEX, bridge and staking protocols.
Alerts
Behavioural rules over the flow graph with routed notifications and case creation.
Dashboards
Composable analyst dashboards saved and shared across a team.
Challenges, and the MaatX approach.
The problems that actually decide whether a system like this survives production — and how we address each one.
Clustering heuristics are probabilistic but get read as certainty
Every cluster carries a confidence score and the specific evidence that produced it. The UI never renders an inferred identity without its score, and low-confidence members are excluded rather than quietly included.
Multi-hop traversal over billions of events does not fit an OLTP query
Flows are pre-aggregated into entity-level edges in a columnar store, so a four-hop traversal reads summarised edges instead of walking raw transactions.
A graph with 40,000 nodes is not a visualisation, it is a smear
Traversals apply value and confidence thresholds before rendering, and the UI states the limit it hit rather than silently truncating the result.
Labels decay and wrong labels are worse than none
Labels are versioned with a source and an attestation count. Single-source labels are marked as such, and conflicting labels surface as a conflict rather than last-write-wins.
Changing a heuristic invalidates past conclusions
Clustering runs are versioned and reproducible. A case references the run that produced its conclusion, so a later heuristic change does not silently rewrite history.
The stack behind it.
Chain coverage
- Ethereum
- Arbitrum
- Base
- Polygon
- Solana
- Archive nodes
Ingestion pipeline
- Rust
- Kafka
- ABI/IDL decoding
- Protocol normalisation
- Reorg-safe cursors
- Checkpointed backfill
- Schema registry
Entity resolution
- Python
- Spark
- Graph algorithms
- Common-input heuristic
- Gas-funding heuristic
- Behavioural fingerprinting
- Versioned clustering runs
Labels & confidence
- Versioned label store
- Source provenance
- Attestation counts
- Confidence scoring
- Conflict surfacing
- Sanctions list ingestion
Analytics stores
- ClickHouse
- Graph store
- Materialised views
- AggregatingMergeTree
- Pre-aggregated entity edges
- Partition pruning
- Parquet cold storage
Traversal & alerting
- Go
- GraphQL
- Cursor pagination
- Multi-hop traversal
- Value attribution
- Behavioural rule engine
- Traversal budgets
Analyst workspace
- Next.js
- React
- TypeScript
- SVG
- Canvas rendering
- Force-directed layout
- GraphML & CSV export
How it grows with the business.
The same system at three stages. Most products should not start at the third — but the architecture should not have to be thrown away to get there.
Single-chain wallet intelligence with labels and basic flow tracing.
- One chain, full history indexed
- Address profiles and counterparty mix
- Two-hop flow tracing
- Manual label management
Entity resolution, graph exploration and alerting.
- Heuristic clustering with confidence scores
- Multi-hop graph traversal and visualisation
- Behavioural alert rules and case management
- Protocol-level normalised analytics
Cross-chain intelligence with shared labels and real-time signals.
- Cross-chain entity resolution through bridges
- Shared label network with attestation
- Sub-block streaming alerts
- Explainability view for every clustering decision
Where it could go next.
Directions this system would extend into.
- 01
Cross-chain entity resolution linking behaviour across bridges
- 02
Natural-language query over the flow graph
- 03
Shared label network with attestation and reputation
- 04
Real-time streaming alerts at sub-block latency
- 05
Explainability view that shows exactly why two addresses were clustered
Turning raw chain activity into entity-level intelligence someone can act on?
We built MERIDIAN to work through exactly this. Tell us where you are and we will tell you what we would do differently for your constraints.