AI in On-Chain Forensics: What's Real, What's Hype in 2026

Every analytics tool released this year shipped with an "AI" feature. Some of it is load-bearing: the parts of the forensic stack that were always going to be statistical finally are. Some of it is wallpaper. This piece sorts one from the other.

AI has become the obligatory feature pill, the way "blockchain" was in 2017 and "decentralized" was in 2021. Every forensic platform you can name, ours included, ships something marketed as AI in 2026. Some of it does real work. Some of it dresses up what was already statistical inference and calls it new. The question worth asking is which is which, because both kinds of feature ship under the same label.

What follows is where AI is load-bearing in on-chain forensics today, where it's well-intentioned but redundant, and where it's straight-up marketing.

Where AI is load-bearing

1. Wallet clustering at scale

Clustering is the hardest unsolved problem in on-chain forensics. The naive shared-funder approach stopped working years ago, since any sophisticated operator fans out through intermediary wallets. The better approach combines many weak signals (funding lineage, gas patterns, claim patterns, co-trade timing, contract-interaction fingerprints) and learns which combinations predict coordination.

This is a machine-learning problem at heart, and the platforms that have moved off rule-based clustering have improved their accuracy materially. AI doesn't "find" cabals. It ranks candidate clusters by how strongly the evidence supports coordination, and the investigator still adjudicates. The candidate list it produces is 100x more useful than what rules alone deliver.

2. Entity / infrastructure labeling

Labeling a wallet as "Binance hot wallet" or "DeDust v2 router" is partly attestation (the exchange or DEX tells you), partly heuristic (this wallet's interaction patterns match a known type), and increasingly partly inferred from large-scale pattern matching against labeled examples.

The third part is where ML does real work. Manually labeling every infrastructure wallet across every chain doesn't scale. A model trained on confirmed labels can propose new ones across thousands of addresses per day, which a human curator then approves. Arkham's entity coverage on EVM, hard to replicate as it is, comes out of a pipeline like this.

3. Narrative summarization

Pulling a forty-line transaction trace and producing a paragraph that says "this wallet bought UTYA via STON.fi using 200 TON, then transferred half to a known KOL address, then sold the other half on DeDust" is the kind of task LLMs do very well. It compresses an investigator's reading time by an order of magnitude.

The constraint that matters: the summary has to be grounded in the on-chain data, not hallucinated. The right architecture is retrieval-first. Pull the structured transaction trace from your indexer, then ask the LLM to describe it. Anything the model says that isn't in the retrieved data should be treated as suspect.

Our token summaries on Intel Maps work this way. We pull the holder distribution, the cluster shape, the KOL overlay, and the pool data, then ask the model to describe what's there in plain language. The model never looks anything up on its own. It summarizes what the deterministic pipeline hands it.

4. Anomaly detection on streaming data

Detecting that a wallet has just done something out of character (an unusual size, an odd counterparty, a strange hour) is a classic statistical problem. The simple version, z-scores on rolling windows, has been around forever. The newer version uses sequence models trained on a wallet's own history to flag deviations in behavior rather than just in magnitude.

This is where the value is most concentrated for institutional users: an alert that says "this KOL's wallet just bought a token whose pattern matches your watchlist" is meaningfully different from "this KOL's wallet just bought something with X dollars." The first is anomaly detection. The second is a threshold alarm.

Where AI is redundant but harmless

Token "grades" by LLM

A handful of platforms now ask an LLM to grade a token from A to F. It sounds futuristic and is almost entirely a rebrand of rule-based scoring. The grade comes from clean, deterministic metrics (concentration, holder count, pool depth) run through a weighted average, and the LLM narrates the verdict.

There's nothing wrong with this. It's fine UX for end users, but AI isn't doing the grading. The rules grade; the LLM is the front end. We do the same thing on Intel Maps and we're upfront about it: the grade is deterministic math, and the narrative around it is generated.

Natural-language query interfaces

"Ask the chain a question" interfaces are becoming standard. Type "what wallets bought UTYA in the last hour" and get back a table. Translating English to SQL is a real LLM application, but the underlying answer is a database query. Useful for non-technical users; the value is the data, not the AI layer on top.

Where AI is mostly hype

"AI-powered" sentiment scores from social

Pulling Twitter and Telegram mentions and producing a sentiment score is a problem language models can technically solve. The catch is that crypto social signals are extraordinarily noisy and easy to manipulate. Half of any sentiment number comes from people paid to post; the other half is bots. A "sentiment score" that the token's operator can move by buying a hundred more posts ranks the paid-shilling industry rather than the market.

Sentiment is downstream of price, not upstream. When the price moves, the sentiment moves. A "predictive" sentiment signal that's being deliberately manufactured is the opposite of predictive.

"AI agents" that trade for you

The strong claim is that an agent watches the chain, identifies opportunities, and trades them for you. The weak version exists (rule-based bots have for years, and LLMs can write better strategy code than the average user). The strong version, an agent that meaningfully outperforms a competent human trader working from the same data, is not a public-product reality in 2026.

What's real: agents that surface candidates, score them against a rubric, and queue them for a human to review. What's mostly marketing: agents pitched as autonomous traders.

"Train your own model on the chain"

A category of products lets you fine-tune a small model on chain data and ask it questions. The technical claim is real; the practical value to a normal investigator is usually small. The hard part of on-chain forensics is getting clean, labeled, infrastructure-aware data, not querying it. A fine-tuned model trained on bad data answers bad questions with confidence, the same way a bad query on a bad database does, only with more apparent sophistication.

What we shipped, and why

Intel Maps ships AI in three places: cluster scoring (ML, load-bearing), token narrative summaries (LLM, grounded in retrieved data), and the on-page assistant (LLM, grounded in the token's own forensic record). We don't ship a sentiment score, an agent, or a "talk to the chain" interface. We don't believe in the first, and the other two aren't where we add value.

The principle we run on: AI is the right tool when the underlying problem is statistical and the alternative is rules that don't scale. It's the wrong tool when the problem is data quality, attestation, or coverage, because no amount of clever modeling fixes a feed that's wrong.