KYT (Know Your Transaction)

What is KYT (Know Your Transaction)?

Know Your Transaction (KYT) monitors, analyses, and assesses cryptocurrency transactions in real time, flagging financial crime risks, sanctions exposure, and suspicious activity. While Know Your Customer (KYC) verifies a user’s identity during onboarding, KYT continuously monitors how funds move after the account is active.

Core focus: identity vs. behavior

KYT shifts the focus from static identity checks to transaction behaviour. It addresses the "clean skin" paradox: a user may pass KYC with a legitimate, stolen, or synthetic identity, then use the account to move funds through mixers or other high-risk services.

• KYC asks: who is this person?
• KYT asks: what are they doing, and where did this money come from?

How KYT works in practice

Turning pseudonymous blockchain data into meaningful insights involves several steps.

Blockchain monitoring provides real-time visibility by analysing transactions across multiple networks. Wallet attribution links blockchain addresses to known entities — such as exchanges, darknet markets, or high-risk services. Risk scoring then assigns a level — low, medium, or high — based on factors like the counterparty, asset type, and transaction patterns.

Forensic techniques add another layer of analysis. Wallet clustering groups addresses controlled by the same entity. Taint analysis traces the movement of funds connected to illicit activity. Cross-chain tracing follows assets as they move between blockchains such as Bitcoin and Ethereum.

Risks identified by KYT

A strong KYT system can help identify transaction patterns and risk indicators associated with financial crime.

Money laundering risks may involve patterns such as layering, where funds move through multiple transactions or wallets, or structuring, where larger transfers are divided into smaller amounts. KYT can also help flag potential sanctions exposure and transactions associated with known hacks, phishing attacks, scams, darknet marketplaces, or ransomware-related activity.