Commercial platforms: Chainalysis, TRM, Elliptic, MistTrack

When the free foundation is not enough — when you need deep multi-hop analysis, clustering, fresh attribution — commercial platforms come into play. They are expensive, differ in focus, and are not all-powerful. In this lesson we break down what each of the four key platforms can do, roughly how much it costs, when they are genuinely needed, how to build a working process without a corporate budget, and — most importantly — what these tools fundamentally do NOT see.

The tool stack in layers: at the bottom, the free foundation (explorers, lists, labels); above it, affordable aggregators (MistTrack and consensus services); at the top, the heavy corporate platforms. The goal is to use the minimum sufficient layer.

Four platforms: what each can do

ChainalysisThe industry standard "for the big players": banks, major exchanges, regulators and law enforcement. The Reactor (investigations, a visual graph) and KYT (real-time transaction monitoring) products. The strongest attribution, officially recognised in courts across many jurisdictions. Expensive and enterprise-oriented.
TRM LabsA strong rival to Chainalysis, with an emphasis on broad network coverage and a convenient API. Popular with fintech and crypto companies, and growing in the public sector. Good for monitoring and compliance "out of the box."
EllipticA British platform, strong in sanctions compliance and coverage, and an early market player. Products for screening wallets and transactions, with high-quality sanctions and typology analytics.
MistTrack (SlowMist)The most affordable of the "serious" ones. From the SlowMist security team. Built for investigations and tracking stolen funds, strong on Asian platforms and Tron/USDT. It has a free tier with limits and a relatively cheap API — a real option for small businesses and the individual analyst.

How to choose. Chainalysis/TRM/Elliptic are the corporate segment, with contracts and a high barrier to entry. MistTrack is the entry point for those without $10k+/year: it delivers in-depth risk categories and tracking at a reasonable price. In its own stack AMLConsensus relies on MistTrack as the paid layer on top of the free foundation — precisely because of its price/depth ratio.

Ballpark prices and the access model

Exact prices are usually not public (enterprise contracts on request), but the order of magnitude matters for the choice.

Chainalysis / TRM / Elliptic. Corporate subscriptions, typically from tens of thousands of dollars a year, often with a minimum contract and training.Justified for licensed VASPs, banks, large platforms.
MistTrack. There is free web access with limits; the paid API/subscription is an order of magnitude cheaper than enterprise, priced per request/package.Suits small business, escrow, individual compliance.
Aggregators/consensus services (including AMLConsensus). Pay per check or by subscription; they combine the free foundation and paid layers, returning the result at the price of a single check.A way to get depth without a direct, expensive contract.

Don't overpay for depth you don't need. For most tasks (checking a counterparty before a one-off payment, accepting funds in a small business) a corporate platform is overkill: the free foundation plus one check in an affordable service settles the matter. Expensive platforms are needed where the volume of checks and regulatory requirements make your own subscription cost-effective.

When a commercial platform is genuinely needed

You are a regulated VASPA licensed exchange/exchanger is required to have industrial-grade KYT monitoring and an auditable tool. Here there is no way around Chainalysis/TRM/Elliptic.
A large volume of checksHundreds/thousands of addresses a day cannot be checked by hand — you need an API and automation.
A serious investigationTracking stolen funds through mixers and bridges, preparing materials for court/law enforcement — a task for Reactor/MistTrack.
You need court-admissible attributionOfficial platform reports carry weight in proceedings; a homemade check does not.

If none of these is about you, a platform is probably overkill, and the foundation plus one-off checks will do.

A working process without a big budget

A practical strategy for a small business and a solo analyst is multi-level escalation: the expensive tool is switched on only when the cheap one has not given an answer.

Level 1 · free
explorer + sanctions + labels + freeze

→

Level 2 · cheap
1 check in MistTrack / a consensus service

→

Level 3 · expensive
enterprise platform/expert

Always start with level 1. It is free and often gives a final answer (direct sanctions, a freeze, obvious labels).Don't spend a paid quota on the obvious.
Escalate to level 2 when uncertain. When you need deep categories, multi-hop, clustering — take one paid check.Cache the result: repeat checks of the same address don't waste the quota.
Level 3 — only for large sums and investigations. When the cost of an error is high or an official report is required.For a one-off task you can hire an expert who has access rather than buying a subscription.

The economics. Such a cascade delivers up to 90% of corporate-compliance quality at a small fraction of its cost. The consensus approach is built on exactly this principle: assemble the free foundation, add an affordable paid layer, cache and reuse — and deliver the result at the price of a single check, escalating to the expensive only when it is justified.

What the tools do NOT see

The final and most important topic. Even Chainalysis is not all-powerful. Understanding the limits protects you from false confidence.

The real identity behind an addressThe blockchain is pseudonymous. The tool sees "this address is Exchange X," but not "this withdrawal was made by John Smith." A link to identity comes only from the exchange's own KYC, at the authorities' request.
Off-chain and intra-exchange movementsA transfer inside an exchange, between clients, does not hit the blockchain. Once funds reach a large exchange, the trail "breaks off" — beyond that point only a request to the exchange itself helps.
The intent and context of a transactionThe tool cannot tell a salary payment from a drug payment if the counterparty is not tagged. Scoring is about flow statistics, not about meaning.
The very latest and private schemesA new mixer, a fresh hack, private networks (Monero) — until attribution appears, or fundamentally opaque. The absence of a flag ≠ cleanliness.
False attributionA label may be mistaken or stale. The tool returns a confident number even where the data is inaccurate.

The course's chief caution. A platform's "green" result means "within the available data nothing bad was found," not "guaranteed clean." And a "broken trail" at the entry to an exchange is not a dead end in the investigation but the point where an off-chain request through the exchange's compliance or law enforcement takes over the baton. A tool is an amplifier of the analyst's judgment, not a replacement for it.

Takeaway for the lesson and for Section 5. The tools line up in layers: the free foundation (explorers, sanctions lists, labels, on-chain freezes) covers most cases; affordable paid services (MistTrack, consensus aggregators) add depth without a corporate budget; the heavy platforms (Chainalysis, TRM, Elliptic) are for regulated players and serious investigations. A professional takes the minimum sufficient layer, escalates deliberately, and always remembers the limits: no tool sees identity, off-chain movements or intent. The final decision is made by a human — the tools merely supply the facts and probabilities.

← Programme Programme →

This material is for educational purposes.