AI in On-Chain Forensics: What's Real, What's Hype in 2026

Every analytics tool released this year shipped with an "AI" feature. Some of it is genuinely load-bearing — the parts of the forensic stack that were always going to be statistical, finally are. Some of it is wallpaper. This is the honest cut.

AI has become the obligatory feature pill, the way "blockchain" was in 2017 and "decentralized" was in 2021. Every forensic platform you can name — us included — ships something marketed as AI in 2026. Some of it does real work; some of it is dressing up things that were already statistical inference and calling them new. The important question is which is which, because both kinds of feature ship under the same label.

Here is our honest read on where AI is actually load-bearing in on-chain forensics today, where it is well-intentioned but redundant, and where it is straight-up marketing.

Where AI is actually load-bearing

1. Wallet clustering at scale

Clustering is the hardest unsolved problem in on-chain forensics. The naive shared-funder approach has been countered for years — any sophisticated operator fans out through intermediary wallets. The better approach combines many weak signals (funding lineage, gas patterns, claim patterns, co-trade timing, contract-interaction fingerprints) and learns which combinations actually predict coordination.

This is genuinely a machine-learning problem, and the platforms that have moved off rule-based clustering have moved their accuracy materially. The honest framing: AI does not "find" cabals; it ranks candidate clusters by how strongly the evidence supports coordination. The investigator still adjudicates. But the candidate list is 100x more useful than what rules alone produce.

2. Entity / infrastructure labeling

Labeling a wallet as "Binance hot wallet" or "DeDust v2 router" is partly attestation (the exchange or DEX tells you), partly heuristic (this wallet's interaction patterns match a known type), and increasingly partly inferred from large-scale pattern matching against labeled examples.

The third part is where ML is doing real work. Manually labeling every infrastructure wallet across every chain does not scale; a model trained on confirmed labels can propose new ones across thousands of addresses per day that a human curator then approves. Arkham's entity coverage on EVM, the depth of which is genuinely hard to replicate, is downstream of this kind of pipeline.

3. Narrative summarization

Pulling a forty-line transaction trace and producing a paragraph that says "this wallet bought UTYA via STON.fi using 200 TON, then transferred half to a known KOL address, then sold the other half on DeDust" is the kind of task LLMs do very well. It compresses an investigator's reading time by an order of magnitude.

The key constraint is that the summary has to be grounded in actual on-chain data, not hallucinated. The right architecture is retrieval-first: pull the structured transaction trace from your indexer, then ask the LLM to describe it. Anything the model says that isn't in the retrieved data should be treated as suspect.

Our token summaries on Intel Maps work this way. We pull the holder distribution, the cluster shape, the KOL overlay, and the pool data, then ask the model to describe what is there in plain language. The model never "looks up" anything itself; it summarizes what the deterministic pipeline gave it.

4. Anomaly detection on streaming data

Detecting that a wallet has just done something out of character — an unusual size, an unusual counterparty, an unusual time — is a classic statistical problem. The simple version (z-scores on rolling windows) has been around forever. The newer version uses sequence models trained on a wallet's own history to flag deviations in behavior rather than just in magnitude.

This is where the value is most concentrated for institutional users: an alert that says "this KOL's wallet just bought a token whose pattern matches your watchlist" is meaningfully different from "this KOL's wallet just bought something with X dollars." The first is anomaly detection; the second is a threshold alarm.

Where AI is redundant but harmless

Token "grades" by LLM

A handful of platforms now ask an LLM to grade a token A through F. This sounds futuristic and is almost entirely a rebranding of rule-based scoring. The grade comes from clean, deterministic metrics (concentration, holder count, pool depth) put through a weighted average; the LLM just narrates the verdict.

There is nothing wrong with this — it is fine UX for end users — but it is not AI doing the grading. The grading is rules. The LLM is the front end. We do the same thing on Intel Maps and we're upfront about it: the grade is deterministic math; the narrative around it is generated.

Natural-language query interfaces

"Ask the chain a question" interfaces are becoming standard. Type "what wallets bought UTYA in the last hour" and get back a table. The translation from English to SQL is a real LLM application; the underlying answer is just a database query. Useful for non-technical users, but the value is the data, not the AI layer on top.

Where AI is mostly hype

"AI-powered" sentiment scores from social

Pulling Twitter / Telegram mentions and producing a sentiment score is a problem language models can technically solve. The catch is that crypto social signals are extraordinarily noisy and easy to manipulate. Half of any sentiment number is the people who get paid to post; the other half is bots. A "sentiment score" that the operator of the token can shift by paying for a hundred more posts is not signal, it's a leaderboard for the paid-shilling industry.

The honest framing: sentiment is downstream of price, not upstream. When the price moves, the sentiment moves; a "predictive" sentiment signal that is being deliberately manufactured is the opposite of predictive.

"AI agents" that trade for you

The strong claim is that an agent watches the chain, identifies opportunities, and trades them on your behalf. The weak version of this exists (rule-based bots have for years; LLMs can write better strategy code than the average user). The strong version — an agent that meaningfully outperforms a competent human trader using the same data — is not a public-product reality in 2026.

What is real: agents that surface candidates, score them against a rubric, and queue them for a human to review. What is mostly marketing: agents that are pitched as autonomous traders.

"Train your own model on the chain"

A category of products lets you fine-tune a small model on chain data and ask it questions. The technical claim is real; the practical value to a normal investigator is usually small. The hard part of on-chain forensics is getting clean, labeled, infra-aware data, not asking questions of it. A fine-tuned model trained on bad data answers bad questions confidently — the same way a bad query on a bad database does, just with more apparent sophistication.

What we shipped, and why

Intel Maps ships AI in three places: cluster scoring (ML, load-bearing), token narrative summaries (LLM, grounded in retrieved data), and the on-page assistant (LLM, grounded in the token's own forensic record). We do not ship a sentiment score, an agent, or a "talk to the chain" interface, because we don't believe in the first and the second two are not where we add value.

The principle we run on: AI is the right tool when the underlying problem is statistical and the alternative is rules that don't scale. It is the wrong tool when the underlying problem is data quality, attestation, or coverage — because no amount of clever modeling fixes a feed that is wrong.