Where crypto labels come from, and why your AI agent needs to know

In short: Crypto labels, the names attached to blockchain addresses, are not all equal. How far a label can be trusted depends on how it was made. At the base is research: an investigator identifies the entity behind an address first-hand and keeps the evidence. That researched address becomes a seed. Clustering grows from the seed, finding many more addresses the same entity controls from the way it moves money, and passes the seed's name to them with a probability attached. Machine-learning models go a step further out: they predict a name with no seed at all, from patterns alone, so they are probabilistic from start to finish.

An AI agent treats whatever label it is given as fact and builds on it, so the kind of label it holds sets a ceiling on everything it concludes. Researched labels come with evidence someone else can check. Clustered labels are only as good as the seed and the people doing the clustering. Predicted labels are leads. An AI agent needs to be told which it has been given.

Key terms

• Label (attribution): a name attached to a blockchain address saying which entity controls it. An entity is the real-world business or person behind the address, for example an exchange, a scam, or a mixer, a service that blends many people's coins together to hide where they came from. Labels name entities, not wallets: a wallet is only the software someone uses to hold their keys, and it does not exist on the blockchain.
• Clustering: finding the other addresses an entity controls, starting from one known seed address and following how money moves between them, then giving them all the seed's label. The word has other meanings in data analysis; in this article it always means this.
• Seed: an address whose entity has already been identified by research, with the evidence kept. Clustering starts from the seed and passes its label to the other addresses it finds for the same entity.
• Predicted label: a label guessed, with no seed, by a computer model that has learned what the addresses of exchanges, mixers and other services usually look like.
• Provenance: the trail that shows where a label came from and how it was established.
• Evidence grade: a label backed by a documented source that can be handed over and checked by someone else, such as a court or a compliance team.

Why does the source of a label matter more now?

A label is a claim about who controls an address. Investigators have always acted on such claims, but a person reading a label can pause and ask where it came from. An AI agent does not pause. It takes the label as given and builds on it: which address to stop at, whose money this is, what goes into the report. If the label was a guess presented as a fact, every conclusion that follows carries the same error, across hundreds of addresses.

The quality of an AI agent's output is set by the quality of the information it is given to work with. For an AI agent tracing stolen funds, labels are the most important piece of that information. So the question "where did this label come from?" has moved from a footnote to the centre of the case.

How do investigators produce labels?

Researched labels are established by people. An investigator identifies the business behind an address and writes down how they know, at the time, with a source. At Chainlabs that means every label carries provenance documentation and supporting evidence such as screenshots, URLs and wallet addresses, and attributions are verified before publication.

Research is slow and expensive, and on its own it does not scale. It is the gold standard for three reasons. It is the only method that produces a named entity with evidence behind it. It is what the other two methods, clustering and machine-learning models, are built on: clustering needs researched seeds to spread, and models need researched examples to learn from. And it is what the other two are checked against. When anyone tests a clustered or predicted label, the test is whether it matches what research found.

How does clustering produce labels?

Clustering starts from a seed, an address research has already tied to an entity, and looks for the other addresses that entity controls. Some of the rules are simple. If several addresses are used together to pay for one transaction, one person or company almost certainly controls all of them, because that is how wallet software spends. Other rules spot the "change" a payment sends back to its sender, or recognise the way an exchange sweeps customer deposits into its own pool. Beyond these fixed rules sit transaction and operating patterns: how a particular service organises its addresses, funds them and moves money between them. These differ by blockchain and by service, and reading them is investigative work, not a formula. Run across a whole blockchain, clustering turns one known address into many of the addresses the same entity controls, each carrying the seed's name with a probability attached.

That is clustering's strength: a reach no team could match address by address. But good clustering is not only rules. Someone has to research the entities, check competing labels, and decide whether a link between two addresses means common control or a customer, a custodian or a shared service. Two providers running the same rules on the same seeds produce clusters of very different quality, which is why the provider matters as much as the method.

Its weaknesses are as well known as its strengths. Some wallets are built to beat the rules. One technique, called CoinJoin, lets strangers who have never met combine their payments into a single transaction on purpose, so the "used together, same owner" rule points at a group of unrelated people.

An exchange keeps many customers' funds together in shared wallets, which look to clustering like one owner, so it can tell you an address belongs to the exchange but never which customer was behind it. On newer blockchains, some services hold many users' funds in a single shared account on the blockchain, which can make unrelated people look like one entity. And clustering has one limit that matters more than all of these: it can say that a group of addresses belongs together, but it cannot say who they belong to. The name always comes from a seed, an address somebody has already identified. A clustered label is only as good as that seed, with clustering's own chance of error added on top.

How do machine-learning models produce labels?

A machine-learning model is shown a large set of addresses whose owners are already known, learns what the addresses of exchanges, mixers, gambling sites and other services tend to look like, and then guesses a label for addresses nobody has identified. It needs no seed: it works from how an address behaves on the blockchain alone, so the result is probabilistic from start to finish. It is fast and cheap, and it reaches further than any other method. That makes it useful for triage, meaning deciding where to look first in a list of ten thousand addresses.

But a guess is a probability, not a finding. There is no source to show when someone asks how the model knows. Its mistakes come in batches: a model that misreads one pattern misreads every address that shares it. It goes stale as behaviour on the chain changes. And it cannot be questioned the way a human investigator can be; a model cannot explain to a judge why it decided what it decided. A predicted label is a good reason to look harder at an address. It is not a reason to write in a report that the address belongs to a named exchange.

What makes a label evidence grade?

A label is fit to go into a report when four things can be said about it: what it rests on, how sure the source is, when it was true, and where the evidence is kept. A label that can answer all four can be defended when someone asks how you know. A label that cannot is an assertion.

The clearest illustration came in court. In 2024, in the Washington DC trial of the man who ran Bitcoin Fog, a mixing service that blended its customers' coins to hide their origin, the defence tried to have the clustering software used by prosecutors thrown out. Their argument was that nobody had published how often it gets things wrong, and no independent experts had reviewed it. The court let the evidence in, and its reasons are the point. The software's results had been checked against records the prosecutors had obtained from exchanges, and against transactions traced by hand. Clustering was accepted because first-hand records backed it up. The inference got into evidence on the strength of the research behind it.

What should an AI agent be told about every label?

A reliable feed should share the following:

• where the label came from
• how sure the source is
• when it was last true
• whether there is evidence behind it.

With those four, the AI agent can behave the way a careful investigator does. When the label is a researched record, it can stop at the exchange and ask for the account holder. When the label comes from clustering, it can treat it as a strong indication of which entity controls the address, not a proven fact. When the label is a model's prediction, it can treat it as a lead to check. And in the report, it can say which kind each label was.

Without those four, every label looks the same to the AI agent. A guess and a documented finding both become "the data says", and the report ends up resting on whichever label was weakest.

So the practical test for any attribution data an AI agent uses is simple. Does every answer say where the label came from, how sure it is, when the data was last updated, and whether evidence exists? If the data returns only a name, it is asking the AI agent, and the investigator behind it, to take it on trust.

How Chainlabs labels addresses, and what the Chainlabs MCP server passes on

Chainlabs identifies who is behind blockchain addresses, with evidence-backed entity data at scale. The Chainlabs network of investigators establishes attributions first-hand, and every label carries provenance documentation and supporting evidence. Clustering then multiplies that research: starting from investigator-established seeds, labels are extended across more than 510 million addresses, with investigators checking competing labels and resolving whether a link means common control or a customer, a custodian or a shared service. The researched record and the clustered one are never blended into a single label. Chainlabs coverage is strongest where research is the only route to a name: more than 800 regional exchanges, the smaller exchanges serving one country or language, and more than 2,000 OTC desks, the brokers who arrange large crypto trades privately outside exchanges, as well as crypto ATMs and darknet marketplaces, across more than 30 blockchains. Chainlabs data is updated daily and already sits behind several leading compliance platforms.

The Chainlabs MCP server brings that data into Claude or any AI agent that supports MCP, and it passes the provenance on. Every attribution says what it is based on: "our record for this address", meaning Chainlabs identified the owner first-hand, or "clustering", meaning the address is in a group of addresses Chainlabs has tied to that entity, with a confidence level of high, medium or low. Every answer carries the date of the data and says whether evidence is available on request. When a researched record and clustering point to different entities, the AI agent is shown both. The agent gets the same four things an investigator would demand, for every address, at every step of a trace.

Chainlabs is opening the Chainlabs MCP server to a small group of design partners, free during testing. If you already use AI in your investigations and want every label to carry its source, we would like you to test it.

To join the trial, email mcp@chainlabs.ai.

Frequently asked questions

How can an AI agent tell whether a crypto label was researched or inferred?

Only if the data says so. Most label feeds return a name and nothing about where it came from. The Chainlabs MCP server marks every attribution as "our record for this address" or "clustering", gives a confidence level on clustered answers, and says whether evidence is available, so the AI agent can treat each kind differently.

What does evidence-grade attribution mean?

A label backed by a documented source that can be handed over and checked: what it rests on, how sure the source is, when it was true, and where the evidence is kept. Chainlabs labels carry provenance documentation and supporting evidence, available on request where Chainlabs traced the address itself.

Why are researched labels the gold standard?

Because research is the only method that produces a named entity with evidence behind it, and because clustering and machine-learning labels both depend on researched data to work and to be checked. The Chainlabs network of investigators establishes attributions first-hand, which is the foundation of Chainlabs data.

How can I test the Chainlabs MCP server?

Chainlabs is offering the Chainlabs MCP server free during testing to a small group of design partners. Email mcp@chainlabs.ai to join.