Risk analysis

Detected patterns, volume scaling, and response examples from the Wavy Node risk scoring system.

This page covers the patterns Wavy Node detects and how to interpret the results you receive from the Scan Risk endpoint. For an overview of how risk scores work, see Risk scores.

Detected patterns

The analysis engine identifies the following risk patterns in the transaction graph:

Pattern	Severity	Description
mixing	Critical	Use of mixing services to hide fund origins
peel_chain	High	Transaction chains to fragment and obscure funds
structuring	High	Splitting amounts to avoid reporting thresholds
round_tripping	Medium	Funds returning to origin after multiple hops
mass_wallet_creation	Medium	Coordinated creation of multiple wallets
wash_trading	Medium	Artificial transactions to simulate volume
exchange_hopping	Low	Rapid movement between exchanges to break traceability

Volume scaling

Detection thresholds adjust based on the wallet’s transaction volume to reduce false positives for high-activity addresses.

Transactions	Scaling factor
Under 1,000	1.0x
1,000 - 10,000	1.5x
10,000 - 50,000	2.0x
50,000 - 100,000	2.5x
Over 100,000	3.0x

Response examples

Clean wallet

{
  "address": "0x1234...",
  "riskScore": 10,
  "riskLevel": "minimal",
  "suspiciousActivity": false,
  "patterns": []
}

No detected patterns. Standard monitoring applies.

Registered exchange

{
  "address": "0x3f5ce5fbfe3e9af3971dd833d26ba9b5c936f0be",
  "riskScore": 0,
  "riskLevel": "minimal",
  "suspiciousActivity": false,
  "patterns": [],
  "metadata": {
    "isRegisteredExchange": true,
    "exchangeName": "Binance"
  }
}

Registered exchanges receive an 80% discount on their risk score.

Suspicious address

{
  "address": "0xabcd...",
  "riskScore": 78,
  "riskLevel": "high",
  "suspiciousActivity": true,
  "patterns": [
    { "type": "mixing", "confidence": 0.85, "severity": "critical" },
    { "type": "peel_chain", "confidence": 0.70, "severity": "high" }
  ]
}

Mixing combined with peel chain. Requires immediate investigation.

Critical risk

{
  "address": "0xmixer...",
  "riskScore": 92,
  "riskLevel": "critical",
  "suspiciousActivity": true,
  "patterns": [
    { "type": "mixing", "confidence": 0.95, "severity": "critical" },
    { "type": "structuring", "confidence": 0.88, "severity": "high" },
    { "type": "round_tripping", "confidence": 0.82, "severity": "medium" }
  ]
}

Multiple laundering techniques detected. Urgent escalation and regulatory report required.