GraphSense TagPacks: Intelligence Source Guide

GraphSense TagPacks are attribution tags for blockchain addresses published as plain YAML in a public repository, where every tag carries the source it came from and a stated confidence level. It is small next to the commercial label sets and it is the only one whose claims you can actually audit.

At a glance

Source	GraphSense TagPacks
Category	Cryptocurrency & Blockchain › Blockchain Analytics & Attribution
Homepage	https://github.com/graphsense/graphsense-tagpacks
Machine interface	`https://raw.githubusercontent.com/graphsense/graphsense-tagpacks/master/packs/`
Format	`TEXT`
Access	Open — no account required
Disciplines	Cryptocurrency Intelligence
Mission domains	Financial Crime, Anti-Money Laundering

Open attribution tags for blockchain addresses. — as catalogued in the platform’s own source registry.

A TagPack is a YAML file that binds cryptoasset addresses to real-world labels together with the evidence for the binding. The format is deliberately simple. A pack has a header – a title, a creator, a description and a last-modified date – and a list of tags. Each tag identifies an address, the currency or network it belongs to, a label naming the actor or service, and, critically, a source field recording where the claim came from: a URL to a seizure notice, a court filing, a research paper, a service's own published address disclosure, or a description of the method used. Tags carry a category drawn from a controlled taxonomy describing what kind of entity it is – exchange, marketplace, mixing service, wallet provider and so on – and, where relevant, an abuse category from a second taxonomy covering illicit activity types. A confidence field records how the tag was obtained, using a controlled vocabulary of acquisition methods rather than a made-up numeric score, so that a label taken from an operator's own website is distinguishable from one inferred by crawling or by manual investigation. Additional fields support real analytical work: a flag indicating whether the tag may legitimately be propagated to an entire address cluster, a last-modified date per tag, free-text context, and a reference to a canonical actor defined in a companion actor pack so that many differently spelled labels resolve to one real-world entity. Values inherited at pack level cascade to individual tags, which keeps files readable. A companion command-line tool validates packs against the schema and the taxonomies and loads them into a tag store for querying.

Every commercial blockchain analytics product asserts identities and none of them show their working. TagPacks invert that: the corpus is smaller by orders of magnitude and every entry states what it rests on, which makes it the only attribution source in this category that can survive an adversarial question about provenance. That has three consequences that matter in practice. It is auditable, so an analyst, a defence lawyer or a peer reviewer can follow a tag back to the document that generated it and form their own view, which is exactly what a vendor label does not permit. It is composable, because the format is plain text under version control, so an organisation can maintain private packs of its own attributions in the same schema alongside the public corpus and process both identically – which is how attribution should be handled inside any serious investigative organisation. And it is a calibration instrument: running the public corpus against a commercial product's labels on the same addresses tells you how much the commercial labels are worth on the classes of entity where independent evidence exists. For CRYPTINT and AML work the correct positioning is not as a replacement for commercial attribution but as the provenance backbone underneath it. Where a tag exists here, you have a citable basis for the claim. Where it does not, you have learned only that nobody in the open research community has published one, which is the normal state of the vast majority of addresses.

What a record actually contains

The fields you will be working with, what each one means, and whether it is something you can pivot on. Read the meanings carefully — more analysis is wrecked by misreading a field than by failing to find one, and a field that looks like an observation is often an inference.

Field	Type	What it means	Pivot value
`address`	string	The cryptoasset address the tag applies to, in its native format. This is the join key against chain data and against every other attribution source, and it is the only element of a tag that is not a claim.	Chain data, block explorers, and the same address in commercial label sets and sanctions designations.
`currency`	enum	The network the address belongs to. Necessary rather than decorative, because address formats overlap across compatible chains and a tag applied to the wrong network attributes an unrelated history to an actor.	The corresponding chain's explorer and the actor's presence on other chains.
`label`	string	The human-readable name of the entity the address is associated with. Free text by design, which means the same actor appears under several spellings across packs and that label matching alone will fragment an entity into pieces.	The actor reference, which is the field that resolves those variants to a single canonical entity.
`source`	string	Where the claim came from – a URL, a citation or a description of the method. This is the field that distinguishes this corpus from every commercial alternative, and a tag whose source is weak or generic should be weighted accordingly rather than accepted because it is in a repository.	The cited document itself, which is what you read before relying on the tag.
`category`	enum	The entity type from a controlled taxonomy – exchange, marketplace, mixing service, wallet provider, payment processor and similar. Categories are more durable and more reliable than specific identities, because service behaviour persists while ownership changes.	The regulatory treatment applicable to that category, and the class of legal request that can reach it.
`abuse`	enum	Where applicable, the illicit activity type from a second controlled taxonomy – ransomware, extortion, sextortion, scam and so on. Present only where the tag concerns abuse, and absent for the majority of ordinary service tags.	Case reporting and typology literature for that abuse class, which is where the behavioural pattern is documented.
`confidence`	enum	How the tag was obtained, expressed as a controlled vocabulary of acquisition methods rather than as an invented number. A label published by the service itself and a label inferred from a web crawl are different kinds of evidence and this field says which you have.	The source document, which should corroborate the stated method.
`is_cluster_definer`	enum	Whether the tag may be propagated from this address to the whole address cluster it belongs to under common-input heuristics. Getting this wrong in either direction is the most consequential modelling error available with this data – propagating a deposit-address tag across an exchange cluster mislabels enormous numbers of addresses.	The cluster itself, in whatever analytics system computes it, and the behavioural evidence for or against the propagation.
`lastmod`	timestamp	When the tag was last modified, at pack or tag level. It is the only ageing signal available and it records maintenance rather than validity – a tag touched last year may describe an address that changed function two years ago.	Current on-chain behaviour of the address, which is the practical test of whether the label still fits.
`actor`	string	A reference to a canonical actor defined in a companion actor pack, carrying the entity's identity and attributes independently of the many labels that name it. This is what makes entity-level analysis possible over a corpus of free-text labels.	All other tags referencing the same actor, across packs and across chains.
`context`	string	Free-text notes on the tag – qualifications, the circumstances of collection, known limitations. Frequently the most informative field in a tag and, being unstructured, the one most often discarded during ingestion.	The analyst's own assessment of how much weight the tag can bear.
`pack_header`	string	Title, creator, description and modification date for the pack as a whole, with values that cascade to individual tags. The creator is a real attribution signal: packs contributed by a named research group carry different weight from anonymous submissions.	The creator's other packs and published work, which is how you calibrate a contributor.

Coverage — and what is not in it

Coverage is narrow, deliberate and uneven, and understanding its shape matters more than knowing its size. The corpus concentrates on the entities that open research and law enforcement publication have documented: darknet marketplaces, ransomware families, well-known exchanges and services, mixing services, sanctioned addresses, and the proceeds of publicly reported thefts and seizures. It is strongest exactly where public evidence exists, which is a direct consequence of the requirement that each tag carry a source, and it is empty across the enormous space of ordinary addresses about which nothing has been published. Chain coverage follows the platform's supported networks, centred on the major UTXO and account-based chains rather than attempting breadth across every token ecosystem. Geographically and linguistically the corpus reflects its contributor base, which is European and North American research and law enforcement communities, so a regional exchange with substantial local volume and no English-language coverage is very likely absent. Temporally, tags accumulate as research is published rather than on a schedule, and there is no continuous ingestion process behind the public repository – updates arrive through contributions and merges, so activity is episodic. The last-modified fields tell you when a pack was touched; nothing tells you when a tag was last confirmed to be true, and that distinction is the one that matters for anything historical.

Known blind spots

Absence of evidence here is not evidence of absence. These are the conditions under which GraphSense TagPacks will not show you something that is nevertheless real:

The corpus is small. Compared with commercial label sets covering hundreds of millions of addresses, this covers a tiny fraction, and the overwhelming majority of addresses you will encounter in casework are absent. Absence carries no information whatever about an address.
It reflects what has been published, not what exists. The source requirement that makes the corpus trustworthy also makes it systematically biased toward entities that have been written about, prosecuted or seized, and away from ongoing, unreported and regionally reported activity.
Contribution is episodic. There is no continuous collection pipeline behind the public repository, so a service that changed its addresses last month will not be updated until someone contributes the change, and nothing indicates that a pack has fallen behind.
Labels are free text and fragment. The same actor appears under multiple spellings across packs, and any analysis that groups by label rather than by the actor reference will split one entity into several and undercount its activity.
Cluster propagation is a decision the data only partially makes for you. The cluster-definer flag is present but its correctness depends on the contributor's judgement and on the clustering used downstream, and a mismatch between the two produces mislabelling at scale.
There are no negative assertions. The corpus records that an address is associated with an entity; it never records that an address is not, or that a previous attribution was withdrawn, so a corrected claim leaves no trace for anyone working from an older copy.
Confidence describes acquisition method, not accuracy. A tag can be acquired by the most reliable method available and still be wrong, and users routinely read the confidence vocabulary as a probability, which it is not.
Chain coverage is bounded by the platform's supported networks, so token ecosystems and newer chains outside that scope are simply not represented, and an analyst working across many chains will find large parts of the problem unaddressed.
Nothing is versioned in a way that supports historical queries. You can check out an old commit, which is more than most sources offer, but there is no field recording the period during which a tag was valid, so historical attribution remains an inference.

Write the blind spot into the product. A statement that something “was not observed in GraphSense TagPacks” is defensible; a statement that it “did not happen” is not, and the difference is what survives cross-examination.

Access, licensing and what you may do with it

Access model: Open — no account required

Access is a git clone. The repository is public, the files are plain YAML, and there is no account, key, quota or negotiation. That is the entire access story and it is the source's most underrated property: the whole corpus fits comfortably in local storage, can be diffed between versions, can be reviewed line by line, and can be carried into an air-gapped environment. Individual packs can also be fetched directly over HTTPS from the raw file paths, which is convenient for a targeted pull but is a worse pattern than cloning because it gives you no history and no integrity context. The companion command-line tool validates packs against the schema and the controlled taxonomies before ingestion, and using it is not optional in any serious pipeline: it catches malformed addresses, unknown categories and missing required fields that would otherwise enter your store as silent corruption. The same tool supports loading into a tag store for querying. The most important thing an organisation should take from the access model is the private-pack pattern: your own attributions, written in the same schema and validated by the same tool, processed alongside the public corpus, with the source field forcing your own analysts to record why they believe what they believe.

Licence

The repository states its licence terms and the correct action is to read them at the version you are using rather than to rely on any summary, including this one. Two structural points apply regardless. First, a tag is a small factual assertion with a citation, and the licence on the collection governs the compilation rather than extinguishing whatever rights attach to the material a source field points at – so quoting a tag is straightforward and reproducing the substance of a copyrighted report it cites is a separate question. Second, tags name entities and, occasionally, natural persons, which makes parts of the corpus personal data in jurisdictions with omnibus data protection regimes; the openness of the licence does not resolve your obligations as a controller when you ingest, enrich and redistribute it. For contributions, the practical constraint is on what may go in rather than what may come out: the public repository is for tags with citable public sources, and confidential attribution derived from investigative material, legal process or commercial licences belongs in a private pack, not in a pull request. That boundary is a compliance issue for the contributor and it is the mechanism that keeps the public corpus defensible.

Rate limits and fair use

There is no rate limit in any meaningful sense, because the correct access pattern is to clone the repository once and pull updates periodically rather than to make per-address requests to a service. That eliminates the entire category of throughput and etiquette concerns that dominate hosted sources, and it is why the corpus is well suited to environments with restricted or no outbound connectivity. Refresh cadence should be driven by contribution activity rather than by a schedule: pull weekly, diff against your previous state, and review what changed. The diff is the valuable artefact – a new pack from a research group, a set of tags added after a seizure, a category correction – and reviewing it takes minutes because the volume is small. Where the corpus is loaded into a tag store and queried locally, throughput is a property of your own infrastructure and is not a constraint. The only discipline worth imposing is validation before ingestion, every time, using the provided tooling, because the cost of a malformed tag entering an attribution store and propagating through a cluster is far higher than the cost of the check.

Licensing changes, and it changes without warning. A dataset that was free for research this year may not be free for commercial or evidential use next year. Confirm the current terms before you build a dependency on it, and record the terms you relied on alongside the data — the licence in force at the time of collection is part of the provenance.

Collecting it

How GraphSense TagPacks is actually pulled, in the order you would set it up. Prefer the bulk or export interface over per-item lookups wherever one exists: it is kinder to the publisher, faster for you, and gives a reproducible snapshot rather than a series of point-in-time answers you cannot reconstruct later.

Method	Format	Cadence	Notes
Repository clone with periodic pull	bulk	Weekly	The primary and correct method. Gives you the whole corpus, its history and the ability to diff between states, with no service dependency and no rate limit. Works offline and in restricted environments.
Change review by diff	text	Per pull	Review what changed since the last pull rather than reprocessing everything. New packs, new tags and corrections are individually meaningful and the volume is small enough that a human can actually read them.
Schema and taxonomy validation	text	Before every ingest	Run the tagpack tool against each pack to check the schema, the category and abuse taxonomies, and address formats. Malformed tags that reach an attribution store are far more expensive than the validation step.
Direct raw file fetch	text	Ad hoc	Individual packs can be pulled directly over HTTPS. Convenient for a one-off look and inferior to cloning for anything systematic, because it discards history and integrity context.
Private pack authoring	text	Continuous	Write your own attributions in the same schema, validated by the same tool, held in your own repository. This is the highest-value use of the format and it forces analysts to record a source for every claim they make.
Tag store load and query	bulk	Per refresh	Load public and private packs into a queryable store so that address lookups happen locally. Keeps attribution lookups off the network entirely, which matters for both throughput and disclosure.

Ingesting it into the platform

Every step below is idempotent and cursor-based: interrupt one and it resumes from where it stopped rather than duplicating rows or losing progress. Collection is recorded per source, so a feed that quietly stops publishing shows up as a stale timestamp instead of silently thinning your coverage.

Register the repository as a versioned source — sources.php records the clone with its commit identifier, so that every attribution in the platform can be traced to the exact corpus state it came from. Version-pinned provenance is the whole reason to prefer this source and discarding it at ingest wastes it.
Validate before anything is written — collect.php runs schema and taxonomy validation on each pack and rejects the pack rather than the tag on failure, because a pack that fails validation is a pack whose contributor's other tags also deserve review.
Preserve the source and confidence fields as first-class properties — ingest.php stores the source citation and the confidence vocabulary term on every attribution record. These are the fields that distinguish this corpus from commercial labels, and pipelines that flatten a tag to address-plus-label destroy its entire advantage.
Resolve labels through the actor reference, not the string — resolve-tags.php groups tags by their actor reference where present and treats bare labels as unresolved variants requiring review. Grouping by label text fragments single entities across spellings and is the commonest analytical error with this data.
Respect the cluster-definer flag explicitly — Attribution propagates from an address to a cluster only where the flag permits it and only where the platform's own clustering is compatible. correlate.php records propagated attributions as derived rather than asserted, so that a downstream analyst can tell the difference.
Cross-reference against sanctions designations and commercial labels — enrich-local.php compares each tag with published designations and any vendor labels held, recording agreement, silence and conflict separately. Conflicts between an auditable tag and an unauditable vendor label are the most informative records the platform will hold on attribution quality.
Diff each refresh and alert on changes to relied-upon tags — cron.php pulls on a schedule and alerts.php fires when a tag that supports an existing case record is modified or removed. Because the corpus records no negative assertions, a silent removal is otherwise invisible to anyone working from an ingested copy.
Surface attribution with its provenance at the point of use — Address attributions appear on blockchain.php and in case records with the source citation and confidence term displayed rather than hidden behind a label, so that an analyst sees what the claim rests on at the moment they decide whether to rely on it.

Registered sources and their last-collected state are listed in sources.php, and the scheduled chain that keeps them current is in automation.php.

How it is wrong, and how to tell

Every dataset is wrong in characteristic ways. Knowing which ways is the difference between using a source and being used by one, and it is the part of source evaluation most often skipped because it is the part that takes work.

Quality here should be assessed on a different axis from commercial label sets, because the trade is explicit: far less coverage in exchange for verifiable provenance. On accuracy, tags sourced from an entity's own published disclosures, from seizure notices, from court documents and from published research are as good as those documents, and you can check because the citation is there. Tags sourced from crawls and from manual inference are weaker and say so through the confidence vocabulary, which is a form of honesty that no commercial product offers. The corpus therefore supports a graded assessment per tag rather than a single vendor-level trust judgement, which is a substantial methodological advantage. The weaknesses are equally clear. Maintenance is uneven, because contribution is voluntary and episodic, so tags decay without any signal beyond a modification date that records editing rather than validation. Label normalisation is imperfect and depends on contributors using the actor mechanism. Coverage gaps are severe and non-random, concentrated away from regions and entity types that generate little English-language publication. And a small number of tags will simply be wrong, as in any human-curated corpus, with the mitigating property that a wrong tag here is falsifiable by anyone who reads the source, which is not true anywhere else in this domain.

Characteristic false positives

Reading absence as evidence. The corpus covers a small fraction of addresses, so a lookup returning nothing is the expected outcome and says nothing about the address. Analysts who use it as a screening list rather than an enrichment source will systematically clear addresses that deserve attention.
Reading the confidence vocabulary as a probability. It describes how a tag was acquired, not how likely it is to be true. A tag acquired by the most reliable available method can still be wrong, and a low-confidence tag can be entirely correct.
Propagating a tag across a cluster when the flag does not permit it. A single deposit address tagged with a customer's name, propagated across an exchange's cluster, mislabels an enormous number of unrelated addresses and produces confident downstream findings that are pure artefact.
Grouping by label string. The same actor appears under several spellings and case conventions across packs, so label-based aggregation fragments entities and undercounts them, silently and without any error indicator.
Applying a current tag to historical activity. Addresses change function, and a tag added this year may be applied by an analyst to transactions from five years ago when the address was controlled by someone else entirely. Nothing in the record prevents this.
Trusting a tag without reading its source. The source field exists to be followed, and a proportion of sources are thin – a generic reference, a dead link, a forum post. A tag with a weak source is weaker than a commercial label with none, because you know exactly how weak it is and you chose to use it anyway.
Chain mismatch. Address formats overlap between compatible networks, and a tag applied under the wrong currency value attributes an unrelated transaction history to the labelled actor.
Assuming the public corpus is the whole corpus. Organisations maintain private packs, and the public repository is by design limited to publicly citable sources, so its silence reflects publication practice rather than the state of knowledge.

None of these make the source unusable. They make it a source that requires corroboration before an assertion built on it goes into a product, which is true of every source and admitted by few.

Ageing

Tags age silently, which is the source's principal operational weakness. The modification date records when a file was edited, not when anyone confirmed the tag was still true, so a pack updated last month may contain tags nobody has revisited in years. Service address sets rotate constantly – exchanges deploy new hot wallets, retire old ones, and occasionally sell or transfer infrastructure – so a service tag has a real validity period that the record does not express. Abuse tags age differently and more slowly: an address that received ransomware payments in a given campaign received them permanently, so the historical claim remains true even when the address is dormant, and these are the most durable tags in the corpus. Actor identities age at the pace of corporate change, which is faster than most analysts assume in this sector. The characteristic stale artefact is a service label applied to activity from a period during which the address belonged to a different operator, producing a clean and wrong narrative. Two defences are available and both are cheap. Compare the tag's date against the transaction dates you are analysing and flag the gap explicitly. And test the label behaviourally: an address tagged as an exchange hot wallet should still behave like one, and where it does not, the tag is the thing that is wrong.

What this source feeds

A source is only worth what it lets you conclude. These are the disciplines that collect through it, the mission domains it serves and the data points it yields — every one is a tag, so you can follow any thread from here into the rest of the library.

Collected by these intelligence disciplines

Cryptocurrency Intelligence

Serves these mission domains

Yields these data points

Cryptocurrency Address

How each sector uses GraphSense TagPacks

The same dataset is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The records are shared — the constraints, thresholds and outputs are not.

🎖 Military and defence

The relevant application is threat finance analysis in environments where commercial licences cannot be deployed – restricted networks, air-gapped analytical enclaves, coalition settings where a vendor contract cannot be extended to partners. Because the corpus is a set of text files under version control, it can be carried into those environments, reviewed for content before introduction, and used without any external dependency, which is a property no hosted analytics product shares. The auditable provenance also matters for release: a finding built on tags whose sources are public documents can be shared with partners and can be written into products at low classification, because the underlying basis is open. The limitations are coverage, which is narrow, and currency, which is uneven, so this should be one input alongside intelligence reporting rather than the attribution layer on its own.

🕵 National intelligence

For CRYPTINT this is the reference corpus against which other attribution should be calibrated. Running it against a commercial product's labels on a common address set produces a direct, quantitative view of where the vendor agrees with independently sourced claims and where it does not, which is the only practical way to form a defensible opinion about a black-box product. It is also the right schema for an organisation's own attribution: writing internal tags in the same format, with a mandatory source field, imposes a discipline that is otherwise very hard to enforce, and it makes internal and open attribution processable by the same tooling. Because collection is a git clone, using it discloses nothing about which addresses you care about, which is a meaningful counterintelligence advantage over every hosted alternative.

👮 Law enforcement

The value to investigators is evidential rather than volumetric. When a tag supports a step in an investigation, its source field points at a document – a seizure notice, a judgment, a published report – which is the thing that can actually be put before a court, and that is a fundamentally different position from citing a commercial platform's label. The corpus will not cover most addresses in a typical case, so it supplements rather than replaces the analytics products, but where it does cover an address the attribution comes with a citable basis at no cost. The private pack pattern is directly applicable to law enforcement practice: attributions derived from production orders, subscriber records and case material can be maintained internally in the same schema, with the source field recording the legal instrument, which produces an auditable internal attribution store. Keep that material out of the public repository.

🔍 Private investigation and corporate security

For an investigator without a commercial licence, this is a free and honest attribution layer, and its honesty is the point. It will tell you when it knows something and it will not fabricate a name when it does not, which protects you from the failure mode that ends careers in this field – reporting a confident identification to a client that turns out to be wrong. Use it as an enrichment step over addresses already identified through tracing, read the source behind any tag that will appear in a client report, and quote the source in the report rather than the tag. Where an address is not covered, say so plainly: the absence of a public attribution is a truthful and useful statement, and it is considerably better than an unverifiable label presented as a finding.

📰 Journalism and OSINT media

This is the attribution source a reporter can actually stand behind, because every claim comes with a citation that can be printed, checked by a reader and put to the subject for comment. That changes the reporting calculus entirely compared with a vendor label whose basis cannot be described. The practical workflow is to trace with whatever tool is convenient, then check the addresses that matter against this corpus, and build the published attribution only on tags whose sources you have read and are willing to cite. Coverage will be thin, and where it is, the honest sentence is that no publicly sourced attribution exists for the address – which is far stronger journalism than an unsourced name. Do not treat the corpus as authoritative because it is open; read the sources, because some are stronger than others.

🌍 NGO, humanitarian and human rights

For organisations doing sanctions monitoring, illicit finance research and victim support without software budgets, this provides a free attribution layer with citable sources, which is exactly what advocacy and regulatory submissions require. A claim in a public report that an address belongs to a particular service is defensible when it cites the same document the tag cites, and indefensible when it cites a commercial screenshot. The abuse taxonomy also supports aggregate work on categories of harm – ransomware, extortion, scam infrastructure – in a way that is transparent enough to be published as method. The constraint is coverage, particularly outside Europe and North America, and organisations working in under-covered regions should consider contributing the attributions they establish, since the corpus improves only through contribution and their evidence is often the only public evidence there is.

🎓 University and research

This is the most research-usable attribution corpus in the domain, for reasons that are structural rather than incidental: it is openly licensed, version-controlled, schema-validated, provenance-bearing and small enough to inspect completely. Studies can state exactly which corpus version they used, other researchers can obtain the same version, and every attribution in an analysis can be traced to a source that a reviewer can evaluate. That is not possible with any commercial label set at any price. The corresponding limitations must be stated: coverage is a convenience sample driven by publication practice, not a probability sample, so any prevalence estimate derived from it is biased in a direction that can be described but not corrected. It is also a research object in itself, for work on attribution methodology, on the reliability of address clustering, and on how open evidence in this field is actually produced and by whom.

Playbook: working GraphSense TagPacks end to end

A repeatable sequence from first pull to finished product. Each phase states what you are trying to establish, not merely what to click — the objective is a defensible chain of reasoning, not a completed checklist.

Phase 1 — Clone the corpus and pin the version

Take a full clone rather than fetching individual files, and record the commit identifier alongside any analysis. Version pinning is what makes your work reproducible and it is available here in a way it is not for any hosted attribution source. An analysis that cannot say which corpus state it used has thrown away the source's main advantage.

Phase 2 — Validate before ingesting anything

Run the schema and taxonomy validation over every pack. This catches malformed addresses, unknown category terms and missing required fields, all of which enter an attribution store silently and cause errors that are extremely difficult to trace back later. Reject and review at the pack level, not the tag level.

Phase 3 — Understand the taxonomies before using the categories

Read the entity and abuse taxonomies and understand what each term is defined to mean. Terms like exchange, wallet provider and mixing service have specific definitions with regulatory implications, and using them with everyday meanings produces analysis that will not survive review by anyone who knows the standards.

Phase 4 — Resolve entities through actor references

Build your entity model on the actor references rather than on label strings, and treat unresolved labels as a backlog to work through rather than as entities. Label-based grouping fragments actors across spellings and is the difference between an entity that appears in a hundred transactions and one that appears in four.

Phase 5 — Read the source before relying on any tag

Follow the citation. A tag whose source is a court document or an operator's own disclosure is strong; a tag whose source is a dead link or a generic reference is weak, and the corpus does not rank them for you. This step is the entire reason to prefer this source and skipping it reduces it to a smaller, worse commercial label set.

Phase 6 — Decide cluster propagation deliberately

Apply the cluster-definer flag as an explicit rule in your pipeline and record every propagated attribution as derived rather than asserted. Where your own clustering differs from the one the contributor assumed, do not propagate at all. This decision determines whether your attribution store is useful or is quietly wrong at scale.

Phase 7 — Compare tag dates against the activity you are analysing

For every attribution that carries weight, compute the gap between the tag's modification date and the transactions it is being applied to, and flag large gaps in the analysis. Addresses change hands and change function, and applying a recent label to old activity is the most frequent source of confident historical error.

Phase 8 — Cross-check against commercial labels and sanctions designations

Run the same addresses against any vendor product you have and against published designations. Record agreement, conflict and silence separately. Conflicts deserve investigation and are usually informative; silence is the normal condition and should not be recorded as anything at all.

Phase 9 — Test attributions behaviourally

An address tagged as an exchange hot wallet should behave like one – high counterparty counts, characteristic consolidation patterns, continuous activity. Where behaviour contradicts the label, trust the behaviour and treat the tag as stale or wrong. On-chain behaviour is observable and a tag is a claim.

Phase 10 — Write your own attributions in the same schema

Maintain private packs for everything your organisation establishes, using the same fields and the same validation, with the source field recording the legal instrument, document or method behind each claim. This is the highest-value thing to take from this source, and it costs nothing but discipline. Keep confidential material out of the public repository.

Phase 11 — Contribute back what you can source publicly

Where your work establishes an attribution from public evidence, contribute it. The corpus improves only through contribution, its gaps are concentrated in under-covered regions and entity types, and an organisation that consumes an open corpus for years without contributing has made a choice worth examining.

Phase 12 — Diff every refresh and re-check relied-upon tags

Pull weekly, review the diff, and specifically check whether any tag underpinning an existing case record has been modified or removed. The corpus records no negative assertions, so a withdrawn tag is silent to anyone holding an older copy, and only diffing surfaces it.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

What to pair it with

No single source carries a finding. These are the datasets that corroborate, extend or contradict this one — and a source that contradicts is worth more than one that agrees, because it is the only thing that will tell you when you are wrong.

Source	Relationship	What it adds
GraphSense	prerequisite	The open-source analytics platform the tag format was designed for, providing the clustering and transaction analysis that tags are applied to. Understanding its cluster model is necessary to use the cluster-definer flag correctly.
GraphSense TagPack Management Tool	prerequisite	The validation and ingestion tooling for packs. Using it is the difference between an attribution store you can trust and one that has accumulated silent corruption.
OFAC sanctions lists	corroborates	Officially designated addresses with a published legal basis. The one attribution source in this ecosystem that carries legal force, and the correct first check before any community or commercial tag.
Arkham Intelligence	contradicts	Broad commercial attribution without disclosed provenance. Comparing the two on a common address set is the practical way to calibrate how much an unauditable label is worth.
Breadcrumbs	extends	Free visual tracing that produces the address sets this corpus then enriches. Tracing and attribution are separate steps and are best done with separate tools.
Block explorers	prerequisite	Chain data for verifying that a tagged address exists on the stated network and behaves consistently with its label. Behavioural testing is the cheapest available check on a stale tag.
Commercial analytics platforms	extends	Coverage across hundreds of millions of addresses that no open corpus approaches, with the trade-off of undisclosed methodology. The two are complements rather than alternatives.
INTERPOL	corroborates	International law enforcement work on darkweb and virtual asset taxonomies, which is part of the standards context the category vocabularies sit in.
Europol	extends	Published organised crime assessments that supply the typology context for abuse categories and that are themselves citable sources for new tags.

Legal, ethical and operational constraints

The licence on the repository governs reuse and should be read at the version you are using; do not infer it from the fact that the material is public. Beyond licensing, two obligations attach. Tags associate addresses with entities and sometimes with natural persons, which makes those records personal data in omnibus data protection jurisdictions – ingesting, enriching and redistributing them makes you a controller with accuracy, proportionality and retention obligations, and the openness of the source does not discharge them. Where a tag concerns an individual and appears to be wrong, that is a matter to raise with the maintainers rather than to silently propagate. The contribution side carries the sharper constraint: material derived from investigative files, production orders, commercial licences or confidential sources must not be contributed to a public repository, and doing so may breach legal obligations, disclosure rules and contracts. The private pack mechanism exists precisely so that such attribution can be handled in the same format without being published. Finally, an attribution is an assertion about an identifiable party, and republishing one carries defamation exposure in the ordinary way – the mitigating factor here, unusually, is that you can read and cite the evidence before you do it.

Operational security

This is the only attribution source in the category that discloses nothing about what you are investigating. Cloning a public repository reveals that you took a copy of a public repository, and every subsequent lookup happens against your own storage, so the addresses you care about never leave your infrastructure. That property is worth more than it sounds: with every hosted analytics platform, the set of addresses you query is a precise statement of your investigative interest held by a commercial third party, and here it is not. For sensitive work this is the decisive argument for keeping a local tag store even when you also hold commercial access, because it lets you do the first pass of attribution without telling anyone anything. Two residual considerations. Contributing a tag is a public act that discloses what you know and, by implication, what you were working on and when, so contribution timing is an operational decision rather than an administrative one. And if you host your own packs in a repository, its access controls are your attribution store's access controls, which deserves the same care as any case system.

Two rules that hold regardless of jurisdiction. Collection that is lawful is not automatically proportionate, and a dataset assembled for one purpose does not carry consent for another. Where the records concern identifiable people, the question is not only whether you may hold the data but whether holding it serves the purpose you are accountable for.

Is it earning its place?

Sources accumulate. Feeds get added during an incident and are never reviewed again, and a decade later the pipeline is carrying dead weight that nobody dares remove. These are the measures that show whether GraphSense TagPacks is contributing anything, and they are worth baselining now so the answer is available later.

Hit rate of the corpus against the addresses in your live casework, tracked over time, which tells you honestly how much of your attribution burden it carries and where the gaps are concentrated.
Proportion of relied-upon tags whose source documents were actually retrieved and read, which should be complete and which is the discipline that distinguishes use of this source from use of any other.
Agreement, conflict and silence rates against commercial labels on a common address set, maintained as a standing calibration of vendor attribution quality.
Number of propagated attributions versus asserted ones in your store, since propagation is where scale errors originate and an unmonitored ratio is a warning sign.
Median gap between a tag's modification date and the dates of the transactions it is applied to, as a running measure of how much historical error your pipeline is exposed to.
Count of private pack tags authored internally with a recorded source, which measures whether the provenance discipline has actually been adopted or merely admired.
Number of tags contributed back to the public corpus from your own publicly sourced findings, which is the only metric that determines whether the corpus improves.

Beware of volume. Indicator counts rise easily and say almost nothing. Unique contribution — findings this source produced that no other source in your stack would have — is the measure that matters, and it is usually far lower than anyone expects.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

The source field is the product. Everything else in a tag exists in every commercial label set; the citation is what you are here for, and a workflow that ingests tags without following sources has bought the disadvantages of a small corpus and none of its advantages.
Confidence is a method, not a probability. Learn the vocabulary and what each term means about how the tag was obtained, and never convert it into a number for a scoring model without documenting exactly what you assumed.
Actors, not labels. Build entity analysis on the actor references and treat bare label strings as unresolved. This one decision prevents the most common quantitative error made with the corpus.
Cluster propagation is a policy decision your pipeline must make explicitly. Encode it, log it, and mark propagated attributions as derived. Attribution that spreads implicitly through a cluster is attribution nobody can audit, which defeats the purpose.
Absence means nothing here and means nothing anywhere. The corpus covers a small slice by design, and an analyst who lets a negative lookup reduce suspicion has inverted the source's semantics.
Test the label against the behaviour. Chain data is observable and a tag is a claim; where an address does not behave like the thing it is labelled as, the tag is the weaker of the two and should be treated accordingly.
Adopt the schema internally before you worry about coverage. Making your own analysts record a source for every attribution they assert is worth more to an organisation than any number of imported tags.
Pin the version in every product. A finding that says which commit of the corpus it used is reproducible; one that says the tag was in the repository is not, and the difference costs nothing at the time and everything later.
Contribute where you can and keep confidential material out. The gaps in this corpus are concentrated exactly where the fewest organisations are willing to publish, and the discipline of separating publicly sourced from privileged attribution is one every serious team needs anyway.

Questions analysts actually ask

How does this compare with a commercial label set?

Orders of magnitude less coverage, and provenance for every entry. Commercial products will label far more of your addresses and will not tell you why. Use them together: this corpus is the auditable backbone and the calibration reference, and the commercial set is the coverage layer whose claims you should treat as unverified.

What does the confidence field actually mean?

It describes how the tag was obtained – from the entity's own disclosure, from service data, from a crawl, from manual investigation – using a controlled vocabulary. It is a statement about method, not about probability of correctness. Reading it as a percentage is the most common misuse of the schema.

Can I apply a tag to every address in the same cluster?

Only where the cluster-definer flag permits it and only where your clustering matches the assumption behind the tag. Propagating a tag that identifies a single deposit address across an exchange's cluster mislabels vast numbers of unrelated addresses and produces findings that look robust and are entirely artefact.

How current is the data?

Uneven, and the record will not tell you. Modification dates record when a file was edited, not when anyone confirmed a tag was still true. Contribution is voluntary and episodic. Always compare a tag's date against the transaction dates you are applying it to and flag the gap in your analysis.

Can I contribute tags from my own investigations?

Publicly sourced ones, yes, and the corpus depends on it. Anything derived from investigative files, legal process, confidential sources or licensed commercial data must not go into the public repository – use a private pack in the same schema. Getting that boundary wrong can breach disclosure rules and contracts.

Why is an obviously well-known exchange missing?

Because nobody has contributed a publicly sourced tag for those addresses. Coverage tracks publication and contribution, not importance, and the gaps are widest for services outside the English-language research community's attention. Absence reflects the corpus, not the entity.

Is it usable offline or in a restricted environment?

Yes, and this is one of its strongest properties. It is a git repository of text files, so it can be reviewed, transferred and used with no network dependency and no service to call. Every lookup after the clone happens on your own infrastructure.

Does using it tell anyone what I am investigating?

No. You take a copy of a public repository and query it locally, so the addresses you look up never leave your environment. That is a real advantage over every hosted attribution service, where your query set is a precise disclosure of your investigative interest to a commercial third party.

Can I cite a tag in a report or in court?

Cite the source the tag points at, not the tag. The corpus is a compilation of claims with citations, and its value is that it takes you to a court filing, a seizure notice or a published disclosure that can stand on its own. Also record which version of the corpus you used, so the finding is reproducible.

Standards, formats and interoperability

What this source speaks natively, and what it has to be translated into before a partner can consume it. Work that arrives in a recognised format is easier to defend, easier to hand over and easier to automate against:

The TagPack YAML schema, which defines the required and optional fields for tags and packs and is enforced by the validation tooling rather than left to convention.
The entity and abuse taxonomies used by the category and abuse fields, which are controlled vocabularies with defined concepts rather than free labels, developed in collaboration with law enforcement and research partners.
The actor pack mechanism, which provides canonical real-world entity records so that many differently spelled labels resolve to one actor across packs and chains.
Common-input-ownership clustering as described in the open literature, which is the model the cluster-definer flag presupposes and which must match your own clustering for propagation to be valid.
Git and semantic versioning of the corpus, which give reproducible, citable corpus states – a property no hosted attribution source offers.
FATF virtual asset service provider definitions, which are the regulatory concepts the entity categories approximate and which determine what identifying a category actually implies.
STIX 2.1 and MISP for exporting attributions with their source and confidence into intelligence sharing workflows without losing the provenance that makes them worth sharing.
Sanctions authority designation publications, which are the authoritative attribution layer that community tags should always be checked against first.

References

Primary documentation and authoritative references for this source. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

GraphSense TagPacks — GraphSense. The public repository itself, with the packs, the schema and the current licence terms. Clone it rather than browsing it; the history is part of what makes it useful.
GraphSense TagPack Management Tool — GraphSense. Validation and ingestion tooling for packs and actor packs, including the checks against the controlled taxonomies. Use it on every ingest without exception.
GraphSense — GraphSense. The wider open-source project – transformation pipeline, libraries and API – which supplies the clustering model that tags are applied against.
AIT Austrian Institute of Technology — AIT. The research institute where the platform and the tag format originated, and a route to the published research behind the clustering and attribution methods.
Iknaio Cryptoasset Analytics — Iknaio. The commercial entity associated with the platform's continued development, relevant to any assessment of the project's maintenance and longevity.
OFAC Sanctions Programs and Information — US Department of the Treasury, Office of Foreign Assets Control. Designated cryptoasset addresses with published legal bases. The authoritative attribution layer that any community corpus should be checked against first.
FATF — Financial Action Task Force. Definitions of virtual assets and service providers, which are the regulatory concepts the entity taxonomy approximates and which determine what a category label implies operationally.
INTERPOL — INTERPOL. International law enforcement work on darkweb and virtual asset classification, part of the standards environment the category vocabularies sit within.
Europol — European Union Agency for Law Enforcement Cooperation. Organised crime assessments covering cryptoasset abuse typologies, useful both as interpretive context and as citable source material for new tags.
Blockchair — Blockchair. Multi-chain explorer for verifying that a tagged address exists on the stated chain and behaves consistently with the label applied to it.
Chainalysis — Chainalysis. Commercial analytics vendor representing the opposite trade-off – very broad coverage, undisclosed provenance – and therefore the natural comparison for calibration.
Breadcrumbs — Breadcrumbs. Free visual tracing tool that produces the address sets this corpus enriches, illustrating the useful separation between tracing and attribution.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this source: it ingests the corpus at a pinned version with schema and taxonomy validation, keeps the source citation and confidence term on every attribution record, resolves entities through actor references rather than label strings, applies cluster propagation only where the flag permits and marks it as derived, and alerts when a tag underpinning a live case is changed or withdrawn.. Browse the full source catalogue, or follow any tag above into the rest of the library.