Exposure and multi-hop taint: how risk is calculated

When a service shows "risk 72/100" or "12% of funds linked to the darknet", there is concrete mathematics behind those numbers. In this lesson we break down how a number is derived from a transaction graph: what exposure is, how the "paint" of a risky source travels through a chain of transfers, how the haircut and FIFO models differ, and why distant hops should weigh less than near ones.

▶ Video lesson: how a risk score is calculated (English narration).

Direct risk versus indirect risk

The first distinction, without which no report can be understood, is the difference between direct and indirect risk.

Direct risk (1 hop)The address under review received funds directly from a risky counterparty or sent funds to one. There are no intermediaries between you and the source. This is the strongest signal: if a wallet received USDT straight from a sanctioned OFAC-listed address, there is nothing to discuss.
Indirect risk (2+ hops)There are intermediate addresses between you and the source. The money came from a wallet that itself had earlier received it from a mixer. The longer the chain, the weaker the link and the more cautiously it must be interpreted.

The practical meaning is simple: direct contact with sanctions or a hack is almost always a stop factor, whereas an indirect link 4–5 hops away through dozens of ordinary wallets is often background noise that almost any active address has. The task of scoring is not to panic at any link, but to quantify how much risky money there is and how close it is to the wallet under review.

What is exposure

Exposure is the share of a wallet's funds that can be traced to a risky source or to a risky recipient. It is measured in percentages or as an absolute amount.

The key idea: scoring works not with "yes/no" but with shares. A wallet is rarely 100% clean or 100% dirty. The real picture is "41% of incoming funds trace to P2P exchanges without KYC, 6% to a darknet market, the rest to centralised exchanges with verification". Such an exposure profile is the raw material for the final assessment.

Two directions are distinguished, and they must not be confused (a separate lesson 4.2 is devoted to this):

Incoming exposureWhere the money came into the wallet from. Answers the question "am I laundering someone else's crime?".
Outgoing exposureWhere the wallet sends money to. Answers the question "am I financing something prohibited?".

Multi-hop taint: the "paint" of a risky source is distributed along the chain of transfers and weakens with each hop. The wallet under review inherits only the share that physically flowed down to it.

Taint analysis: how the paint flows through the graph

Taint (literally a "stain", "contamination") is the method by which risk is "carried" through the transaction graph from the source to your address. Imagine that a risky wallet paints its coins red. The question then is what share of that paint will reach the address under review through the intermediate transfers.

The mechanics with a single example. Suppose address X received 10 ETH, of which 3 ETH came from a mixer (a risky source) and 7 ETH from an ordinary exchange. Then:

We calculate X's direct exposure. 3 of 10 ETH are painted → X's tainted share = 30%.This is the incoming exposure of the first hop.
X sends 5 ETH to address Y. The question: how many "red" ETH went to Y?The answer depends on the painting model — see haircut versus FIFO below.
Y inherits part of the paint. Its own exposure now depends both on X and on its other incoming transfers.This is how risk propagates to the second hop and beyond.

It is precisely because of step 2 that there is not one but several competing taint models. The choice of model radically changes the result, so it must be understood.

Haircut versus FIFO: two painting models

The problem is that coins on the blockchain are fungible. When clean and dirty funds have mixed on an address, and then part of it goes further, it is physically impossible to say "which exactly" coins were sent. So the models introduce different assumptions.

Haircut (proportional painting)We assume that any outgoing transfer carries paint in proportion to the overall share of contamination in the balance. If the balance is 30% painted, then every unit that leaves is 30% painted too. In the example above, of 5 ETH, 1.5 ETH of paint go to Y. The model is soft, "smears" risk in a thin layer across the whole graph, and decays quickly.
FIFO (First In, First Out)We assume that coins are spent in the order they arrived: first in, first out. Then the exact order of transactions matters. If the dirty 3 ETH arrived before the clean ones, then the very first outgoing transfer "scoops out" exactly those. The model is strict, able to trace a specific amount to a specific recipient, and is used in forensics and court proceedings.

Why this matters in practice. The very same wallet may show "4% risk" under haircut (smeared) but under FIFO "these specific 3 ETH came from a mixer and went to such-and-such exchange". Haircut answers the question "how contaminated is the balance on average", FIFO answers "where did the dirty coins physically go". Commercial platforms usually combine the two: haircut for scoring, FIFO/poison ("poisoning" — the entire mixed output is deemed dirty) for investigations.

There is also a third, harshest logic — poison / taint-by-association: any touch of dirty funds makes the entire wallet dirty (100%), without accounting for shares. It produces a huge number of false positives and, in its pure form, is almost never used for scoring, but it appears in some sanctions interpretations where the mere fact of contact matters.

Decay by hops and taint inflation

A healthy scoring system must decay with distance. A link at 1 hop and at 6 hops cannot weigh the same — otherwise almost any address would turn out to be "linked" to anything, since the blockchain is a highly connected graph.

DecayThe weight of a risky contribution decreases with each hop — for example, by a multiplier of 0.5 or via a threshold "beyond N hops we do not count". Direct contact weighs at full strength, the sixth hop almost nothing.
Cut-off thresholdMany engines simply truncate the analysis at 5–10 hops: beyond that the signal is indistinguishable from background and adds only noise and computational load.

Taint inflation — the beginner's main mistake. If you add up exposure across all paths without decay and without normalisation, the figures "balloon" and exceed 100%. A single dirty source reached by ten parallel paths may be counted ten times. The result: a wallet with a real 5% risk looks like it is "80% linked to crime". A correct engine normalises the contribution by the amount that actually flowed down and does not count the same coin twice.

Hence the practical skill of reading reports: always look not only at the percentage, but also at the distance (how many hops) and at the model (haircut or FIFO). "30% indirect exposure at the 5th hop under haircut" and "30% direct exposure under FIFO" are two fundamentally different situations with different management conclusions.

A case analysed from start to finish

Let's put it all together. A client sends an address and asks to check it before accepting a payment.

Build the incoming graph. We go back through the transactions 5 hops, marking known sources by their labels.Exchanges, mixers, sanctions, darknet, P2P.
Calculate direct exposure. 0% direct contact with hard flags — already good.Direct contact with sanctions would have closed the question immediately.
Calculate indirect exposure by haircut with decay. We get: 4% via a mixer at the 3rd hop, 22% via no-KYC P2P at the 2nd hop.Each contribution multiplied by decay over distance.
Interpret. 4% mixer at the 3rd hop is background noise. 22% P2P is a moderate flag — worth asking the client about the source of funds.The number by itself is not a decision — it is an input to judgement.

Lesson conclusion. Exposure is shares, not a verdict. Taint shows how these shares flow through the graph, and the painting model (haircut/FIFO) and hop decay determine what the raw graph turns into. The figure "risk 72" is meaningless without answers to three questions: what share, at what distance, under what model. In the next lesson we break down how these shares are assigned weights — why sanctions weigh more than a casino, and how the final number 0–100 is born from an exposure profile.

← Programme Programme →

This material is educational.