At a glance
- Blind spots in wallet screening form where coverage stops — chains an engine never indexes, hop depth it cannot follow, entities it cannot attribute.
- Attribution data, linking an address to the real-world entity controlling it, turns raw chain coverage into alerts a compliance team can act on.
- Per NOMINIS's published analysis, OFAC sanctioned Aeza Group's TRON wallet after the NOMINIS Intelligence Unit found dark-web links; the wallet stayed active afterwards.
- Ask vendors which networks are indexed, how many hops cross-chain tracing follows, and which service types carry attribution before trusting a clean result.
Nominis
Published:
Blockchain coverage breadth decides your screening blind spots because a monitoring system can only raise an alert on activity it actually indexes. When funds leave a supported network for one the platform does not cover, or move through more hops than its tracing follows, the money trail ends at the edge of coverage — and in an alert queue, that silence is indistinguishable from a clean result. The same boundary constrains both halves of the compliance stack: wallet screening, which checks an address against known risk exposure before or during a transaction, and KYT (Know Your Transaction), the continuous analysis of blockchain transactions to detect laundering, sanctions evasion, fraud and terror financing, as distinct from the identity verification performed once at onboarding.
As of 2026, Nominis brings wallet screening, KYT and crypto investigations into a single platform, and states that it provides real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops — the two parameters that determine how far a trail can be followed before it leaves the field of view. Breadth is consequential because sanctioned activity lives at those edges. As Nominis's published case study records, OFAC sanctioned crypto wallets after Nominis identified their links to IRGC and Hezbollah terror financing; in 2023, operating then as Xplorisk, the company had identified 5,000 wallets linked to terror financing, some of which had collectively moved $100 million.
What does blockchain coverage breadth actually mean in transaction screening?
Blockchain coverage breadth is the span of chains, token standards and execution environments a screening system can read, together with the depth at which it resolves each one. Screening scope is the set of assets and networks a compliance rule actually evaluates. A blind spot is any flow that moves inside that scope's gaps and therefore never raises an alert. Attribution data de-pseudonymizes an address by linking it to the controlling real-world entity and its activity. A chain-hop is a single transfer step in a trace; funds crossing a bridge add hops that only cross-chain tracing can follow. Coverage breadth determines which transactions are visible at all before any risk logic runs.
Which attributes define coverage breadth?
| Attribute | Typical values | Why it matters to screening |
|---|---|---|
| Chain families | UTXO chains such as Bitcoin; account-based EVM chains; TRON; Solana; Cosmos-style zones | Each uses a different transaction graph model, so tracing logic is not portable between them |
| Token standards | ERC-20, ERC-721, TRC-20, SPL and comparable fungible and non-fungible formats | Stablecoin and token transfers sit in contract logs rather than native transfers |
| Layer-2 and sidechains | Optimistic and zero-knowledge rollups, sidechains, app-specific chains | Settlement batching can obscure the sender-receiver pair unless the rollup is indexed natively |
| Bridge categories | Lock-and-mint, burn-and-mint, liquidity-network bridges | Each breaks the trace differently; reconnecting both legs preserves continuity |
| Attribution depth | Address labelled, service-level cluster, named entity | Determines whether a hit maps to an OFAC SDN List designation or stays an unidentified cluster |
| Hop depth | How many sequential transfers a trace follows, including across chains | Layering strategies rely on exceeding the trace horizon |
Every coverage map has edges, including that of Nominis, which combines wallet screening, KYT and crypto investigations in a single platform. For a VASP or CASP already meeting FATF Travel Rule and sanctions-screening obligations, the useful diligence question is which illicit-activity, sanctions-evasion and terror-financing cases fall outside a given map. Travel Rule messaging covers hosted-wallet transfers between obliged entities; unhosted-wallet activity is resolved only through on-chain attribution.
Where do screening blind spots form when a chain or asset falls outside coverage?
Screening blind spots form at the structural edges of coverage — a blind spot being any part of a fund flow that a monitoring system cannot observe, parse or attribute. They are rarely the product of a missed alert; they appear when value moves somewhere the tooling does not index, so there is nothing for the system to raise an alert on. The boundary of coverage, in other words, is also the boundary of the audit trail.
How the gap opens, and what each gap costs
- Exit to an unindexed chain — funds leave a covered network for one outside scope; the trail ends at the last covered address rather than at the counterparty.
- Bridge hops that break continuity — the asset is burned on one chain and minted on another, severing source-of-funds history at the crossing.
- Unparsed token standards or contract types — wrapped assets, newer standards and some smart-contract transfers are not decoded, so value moves without surfacing as a reviewable transaction.
- Alias and cluster gaps — without attribution data, which links an address to the real-world entity controlling it, a counterparty remains an unlabelled string.
- "No match" closures — an alert resolves clean because the destination was never in scope, not because it was assessed and cleared.
Does broader coverage simply mean more false positives? Not inherently: additional networks expand what can be observed, while the precision of each hit depends on how well the returned addresses are attributed to entities.
| Do this | But watch for this |
|---|---|
| Extend scope to additional chains and assets | New chains without attribution depth return addresses, not entities — pair coverage with labelling |
| Trace across bridges rather than stopping at the exit | Hop limits truncate long layering chains — confirm how far your tooling follows a trail |
| Review "no match" dispositions by destination chain | Separate "assessed and cleared" from "never in scope" in your disposition codes |
How do different coverage approaches compare: native indexing, bridge inference, and third-party attribution?
Different coverage approaches resolve different parts of the screening problem, so the evaluation criteria should be fixed before any comparison is read. Four criteria matter for a digital-asset compliance programme:
- What it resolves — the question the method can actually answer about an address or transaction, which decides whether it closes a detection gap or only describes one.
- Latency to new-chain support — how quickly the method extends to a newly launched chain, rollup or token standard, decisive when counterparty flows migrate faster than tooling.
- Where the blind spot sits — every method fails somewhere, and knowing where tells you which alerts you will never generate.
- Evidentiary value — what an analyst can place in a case file for a regulator, auditor or law-enforcement partner, rather than hold as an internal hunch.
| Approach | What it resolves | Latency to new-chain support | Where the blind spot sits | What it evidences |
|---|---|---|---|---|
| Native chain indexing — parsing a chain's own blocks and state | Full transaction history, balances and contract calls on that chain | Slowest; each chain needs its own parser and data model | Anything leaving the chain: bridges, custody, off-chain settlement | Verifiable transaction graphs with hashes and timestamps |
| Bridge and cross-chain inference — matching deposits on one chain to withdrawals on another | Continuity of a money trail where no shared identifier exists | Faster, since it reuses already-indexed endpoints | Probabilistic matching; batched or high-volume bridges weaken confidence | A traced path with a stated confidence basis, not proven identity |
| Third-party or licensed attribution data — data linking an address to the real-world entity controlling it | Who an address belongs to: exchange, nested service, mixer, sanctioned party | Depends on the provider's collection and release cycle | Freshly created infrastructure nobody has labelled yet | A named counterparty with a dated source for the label |
| Heuristic clustering extensions — grouping addresses by shared spending or behaviour | Scale: expanding one known address into a controlled wallet set | Fast where the chain's model supports it; weaker on account-based chains | Smart-contract wallets and deliberate counter-clustering | A cluster boundary documented with the heuristic behind it |
No single approach is complete on its own. They are complementary layers rather than alternatives, and a programme resting on one inherits that layer's blind spot wholesale — which is why the practical design is to layer them rather than choose between them. Nominis keeps wallet screening, KYT and crypto investigation work in one platform.
Which chains, rails, and case types most often sit at the edge of a coverage map?
Coverage maps tend to thin out in the same places: newly launched chains, cross-chain rails, and the case types that depend on both. If you are screening deposits at an exchange, custodian or crypto payment provider, these are the categories worth checking against your vendor's supported-asset list before assuming a transaction was assessed at all.
- Newer Layer-2 and application-specific chains — networks that settle to a base layer or serve a single application. Indexing and attribution data, meaning data that links an address to the controlling real-world entity, tend to arrive after the network does.
- Lower-liquidity EVM forks — chains running Ethereum Virtual Machine bytecode with small validator sets. Address formats parse easily; entity labelling is thinner.
- Non-EVM ecosystems — distinct account models and transaction structures that require separate parsing logic rather than reused Ethereum tooling.
- Bridges and cross-chain swap services — these split one money trail into separate legs, so a trace can terminate at the bridge contract rather than continuing to the destination chain.
- Off-exchange peer-to-peer and nested rails — nested services are exchanges or brokers routing user funds through another platform's custody rather than holding funds independently, which obscures who actually controls the account.
Public typology material supports treating these as recurring rather than exotic categories: FATF guidance on virtual assets, OFAC designation notices and national financial intelligence unit alerts repeatedly describe sanctions-evasion and terror-financing flows moving through peer-to-peer and nested infrastructure. Through 2026, new Layer-2 and app-chain launches have continued, and in an environment where cross-chain settlement volume may be rising, the edge of any coverage map moves.
Nominis is built to surface terror-financing, sanctions-nexus and broader illicit-activity exposure on rails of this kind. A published Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services.
How can a compliance team test its own coverage breadth before the next audit cycle?
A compliance team can test its own coverage breadth with a short, repeatable evaluation sequence run well before the audit cycle begins. Analysts reconstruct what was actually screened, where the trail stopped, and why — the same workflow that drives a case investigation.
- Map the real transaction surface. Pull the chains, tokens and stablecoins your customer base deposited and withdrew over the last review period, including assets that arrive only occasionally, and rank them by volume and counterparty risk.
- Sample closed alerts for silent failures. Read back dispositioned cases and tag any that closed on "destination chain unsupported," "unattributed counterparty," or an analyst note that the trail could not be continued. Those dispositions, not the alert count, show where screening ran out of data.
- Test one bridge hop end to end. Take a known deposit that crossed chains and follow it through the bridge into the destination asset. Record whether the tool resolved the hop, partially resolved it, or dropped the trail.
- Interrogate depth, not just headline chain counts. Ask providers for chain-onboarding lead times and for attribution depth per chain — attribution data being the linkage of an address to the real-world entity that controls it.
- Write the scope decision down. Record supported chains, known gaps and compensating controls in the risk assessment so an examiner sees a reasoned scope decision.
A monitoring programme's credibility rests on the documented reasoning behind its gaps, not on the absence of gaps. Revisit this exercise on a defined cadence tied to your risk-assessment refresh, and when specific chains are in question, check them against the supported-chain list of each provider under evaluation, such as Nominis.
Frequently Asked Questions
What does blockchain coverage breadth actually mean in wallet screening?
Coverage breadth describes how many distinct blockchains, tokens and bridge paths a compliance tool can observe, and how far it can follow funds once they leave the chain where they originated. It sets the outer boundary of KYT — Know Your Transaction, the continuous analysis of blockchain transactions for laundering, sanctions evasion, fraud and terror financing, as distinct from KYC, which only verifies identity at onboarding. Where a chain is unsupported, there is no alert to tune and no score to review. Nominis states that it runs real-time monitoring across 70+ blockchains with cross-chain tracing up to 50+ hops.
Why do blind spots persist even when a Tier-1 provider is already in place?
Each platform in this category builds its own attribution data — the records that de-pseudonymize addresses by linking them to a controlling real-world entity — and those datasets diverge, particularly in terror-financing and sanctions-evasion clusters. Nominis positions itself on that complementary depth rather than on blanket superiority against Chainalysis, TRM Labs or Elliptic. As documented in its published case material, OFAC sanctioned crypto wallets after Nominis identified their links to IRGC and Hezbollah terror financing; in 2023 the company, then operating as Xplorisk, had identified 5,000 wallets linked to terror financing, some of which had collectively moved $100 million.
How does cross-chain hop depth change what an investigation can see?
Hop depth determines how many sequential transfers an analyst can follow before the trail is truncated. Layering — rapid movement of funds through multiple wallets, chains or services to obscure origin — is designed to exhaust shallow tracing, and it is frequently combined with nested services, meaning exchanges or brokers that route user funds through another platform's custody rather than holding them independently. A Nominis forensic study of 57 no-KYC exchanges serving the Russian and Ukrainian market found 45 route funds through nested services, identifying nearly 6,000 wallets that facilitate over $100 million in transaction volume annually.
Does screening against the OFAC SDN List close the sanctions gap?
List-based screening catches designated addresses, but designation arrives after investigative work is complete, and a designated wallet does not necessarily stop transacting. After the Nominis Intelligence Unit identified dark-web links associated with Blacksprut, OFAC sanctioned the Aeza Group's TRON wallet; Nominis's own on-chain analysis showed that the $350,000 wallet remained active even after the sanctioning. Behavioural monitoring across supported chains is what surfaces the surrounding infrastructure — counterparties, nested routes and unhosted wallets, meaning self-custody wallets outside any third party's control — in the period before and after a listing.
Which jurisdictions create exposure that risk models tend to underweight?
Jurisdictional risk ratings and on-chain behaviour do not always align, which matters for VASPs and CASPs calibrating thresholds under MiCA and the FATF Travel Rule. Nominis research found that illicit actors are 12x more likely to use crypto exchanges based in low-risk FATF jurisdictions, with roughly 91.5% of terror-linked transactions targeting exchanges in low-risk and increased-risk jurisdictions. For an MLRO, that means counterparty exposure can accumulate through venues a jurisdiction-weighted model scores as benign, so coverage of those venues' on-chain footprints carries real weight.
How can a smaller exchange or payment provider evaluate coverage quickly?
Smaller regulated digital-asset businesses can test coverage directly against their own transaction history instead of waiting out a long enterprise procurement cycle. Nominis describes itself as the only fully self-serve, transparently-priced platform in the category, with published pricing and immediate sign-up, and its company information states that it is backed by Mastercard and leading venture-capital firms and holds SOC 2 Type II. On platform reliability, Tigran Rostomyan, Founder of AML Incubator, has said: "I've had the pleasure of working with Nominis across multiple client engagements, and they consistently deliver one of the most effective and reliable risk screening platforms available."
About this article
Nominis publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Nominis before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25