Chainalysis vs TRM Labs vs Elliptic: Blockchain Analytics Compared

Last updated: 2 November 2026 · every coverage figure, certification and price below rechecked on the vendor’s own page on 2 November 2026

In the Chainalysis vs TRM Labs vs Elliptic decision, Chainalysis (9.2/10) is the safest default for a licensed exchange or bank that needs deep investigations, TRM Labs (8.9) is the best fit for multi-chain teams that want to tune their own risk rules, and Elliptic (8.7) wins on cross-chain screening, VASP due diligence and the only published price of the three. All three have the attribution data regulators expect; the right one depends on your chains, your case load and your budget.

We read every product page of all three vendors on 2 November 2026 and scored them on the same fixed rubric we use across our crypto compliance hub; the weights are on our methodology page. The articles ranking for this comparison quote chain counts that do not match the vendors’ own pages, so every figure below links to its source. Nothing here is legal advice.

The Decision Kernel

Pick by the work your team does most, then check chains and price. Investigations-heavy teams lean Chainalysis, rule-tuning screening teams lean TRM Labs, and bridge-heavy or budget-capped teams lean Elliptic. The scores sit within half a point of each other, so your own data should break the tie.

• Law enforcement liaison, large case load, court evidence: Chainalysis Reactor, with KYT for monitoring.
• Many chains and long-tail tokens, own risk appetite: TRM Labs Wallet Screening and Forensics.
• Bridge and cross-chain exposure, counterparty VASP checks: Elliptic Lens plus Discovery.
• Need a price before the first sales call: Elliptic, the only one with a public listing.

Chainalysis vs TRM Labs vs Elliptic at a Glance

	Chainalysis	TRM Labs	Elliptic
Score	9.2	8.9	8.7
Best for	Investigations and regulator familiarity	Configurable multi-chain screening	Cross-chain screening and VASP due diligence
Screening product	KYT, Address Screening	Wallet Screening, Transaction Monitoring	Lens
Investigation product	Reactor	Forensics	Investigator
Screening coverage (stated)	400+ networks, 50M+ tokens	184+ blockchains, 1.9B+ assets	60+ blockchains, 250+ bridges
Investigation coverage (stated)	27+ blockchains, 300+ bridges and DEXs	65+ blockchains	65+ blockchains (company figure)
Security (stated)	SOC 2 Type 2, FedRAMP	Annual SOC 2 audit, 99.95% uptime SLA	SOC 2 Type 2, ISO 27001, ISO 22301
Published price	None	None	$50,000 or $100,000 per unit a year (AWS)

Each vendor gets 0 to 5 on six criteria: chain coverage (20%), attribution data (20%), compliance workflow (20%), investigations (15%), security and deployment (15%) and price transparency (10%). Elliptic loses a point on coverage but gains one on price, because it is the only vendor of the three that publishes any price at all. Chainalysis edges TRM on investigations because Reactor’s stated swap, bridge and integration depth is the widest we found.

1. Chainalysis: 9.2/10

Chainalysis sells KYT for transaction monitoring, Address Screening for onboarding and withdrawals, and Reactor for investigations. Reactor says it is used by 1,500+ organizations and has helped freeze and recover $34B+ in stolen funds. Reactor states 27+ blockchains, 40M+ assets, 325M+ swaps, 300+ bridges and DEXs and 134K+ real-world counterparties.

• Monitoring breadth: the KYT FAQ lists 400+ networks and 50M+ tokens.
• Screening: Address Screening adds liquidity pool risk, continuous monitoring with alerts when a risk score changes, time-based and counterparty analysis.
• Integrations: Reactor connects to KYT, Cellebrite, Siren and i2, which matters for teams that already run those forensic tools.
• Security: the platform page cites SOC 2 Type 2 and FedRAMP.
• Free tier gone: the Chainalysis sanctions oracle is marked deprecated and no longer maintained, so do not build on it.

2. TRM Labs: 8.9/10

TRM Labs runs screening, monitoring and investigations on one attribution graph. Its Wallet Screening page covers 1.9B+ assets across 184+ blockchains, including all ERC-20 tokens, with responses under 400 ms. TRM is the most configurable of the three: over 155 settings for ownership, counterparty and indirect exposure risk.

• Glass-box attribution: TRM Forensics shows the source and a confidence score for each attribution, which helps when you must explain an alert to an examiner.
• Pattern detection: Signatures flags peel chains and layering across 65+ blockchains, and Seed Analysis and the Co-Case Agent speed up case work.
• Intel sharing: TRM’s investigator network lets verified investigators flag addresses and alerts exchanges in real time; TRM cites $1.5M frozen and $800K located in examples.
• Reliability: a 99.95% uptime SLA and an annual SOC 2 audit, both stated on the Forensics page.
• Public docs: its sanctions documentation says the Sanctions API and Chainabuse API docs need no login, handy for a quick technical review.

3. Elliptic: 8.7/10

Elliptic splits its suite into Lens for wallet and transaction screening, Investigator for tracing and Discovery for VASP due diligence. Lens runs wallet and transaction screening in one workspace with one case queue, across 60+ blockchains and 250+ bridges. Elliptic says it has labelled 1B+ addresses and covers 99% of global trading volume.

• Investigator: Investigator builds graphs automatically, which Elliptic says cuts graph-building time by up to 60%, with one-click cross-chain tracing and exportable evidence.
• Discovery: Discovery scores VASPs against peers, tracks risk month over month and supports Travel Rule counterparty checks, drawing on 13 years of data.
• Security: the trust page lists SOC 2 Type 2, ISO 27001, ISO 22301, ISO 9001 and ISO 14001; the home page states 99.9% uptime.
• Published price: the AWS Marketplace listing shows 12-month contracts at $50,000 and $100,000 per unit.

Chain Coverage Compared

Coverage is where comparison articles disagree most, because each vendor states a different number for each product. Screening coverage and investigation coverage are separate figures, so compare the product you will actually buy. The chart and table show only what each vendor page says.

Product	Stated coverage	Source
Chainalysis KYT	400+ networks, 50M+ tokens	KYT FAQ
Chainalysis Reactor	27+ blockchains, 40M+ assets, 300+ bridges and DEXs	Reactor page
TRM Wallet Screening	184+ blockchains, 1.9B+ assets, all ERC-20s	Wallet Screening page
TRM Forensics	65+ blockchains, 1.9B+ assets	Forensics page
Elliptic Lens	60+ blockchains, 250+ bridges	Lens page
Elliptic (company)	65+ blockchains, 1B+ addresses labelled	Home page

Screening and Monitoring Compared

All three screen wallets before onboarding and monitor transactions after they settle, and all three re-screen addresses as new risk data arrives, so the basic job is covered by any of them. The differences are in how much you can tune, how alerts reach a queue and how fast the API answers.

Feature	Chainalysis	TRM Labs	Elliptic
Products	KYT, Address Screening	Wallet Screening, Transaction Monitoring	Lens
Risk tuning	Risk scores, alert on score change	155+ configurations	Configurable risk rules
Continuous re-screening	Yes, continuous monitoring	Yes, pre and post transaction	Yes, continuous re-screening
Stated speed	Not stated	Under 400 ms	Not stated
DeFi coverage	Liquidity pool risk assessment	All ERC-20 tokens	250+ bridges
Case handling	KYT alerts, Reactor cases	Case management in Forensics	One case queue for wallets and transactions

Investigations Compared

Reactor, Forensics and Investigator all trace funds across chains, attribute addresses to real-world entities and export evidence for a report or a court filing, so each can carry a full case. Reactor states the widest swap and bridge data, Forensics the clearest attribution sourcing and Investigator the most automation.

Capability	Chainalysis Reactor	TRM Forensics	Elliptic Investigator
Stated chains	27+	65+	65+ (company figure)
Cross-chain	300+ bridges and DEXs, 325M+ swaps	Cross-chain tracing on one graph	One-click cross-chain tracing
Attribution detail	134K+ real-world counterparties	Source and confidence score per label	1B+ addresses labelled
Automation	Integrations with Cellebrite, Siren, i2	Signatures, Seed Analysis, Co-Case Agent	Auto graphs, up to 60% faster graph building
Intel sharing	Not stated	Real-time investigator network	Not stated

Security and Reliability

Your bank partner and examiner will ask for the vendor’s audit reports, so check what each one states publicly before the security review starts. All three publish a SOC 2 claim, but they differ on government authorisations, ISO certifications and whether an uptime figure appears on the public pages at all.

	Chainalysis	TRM Labs	Elliptic
SOC 2	Type 2	Annual SOC 2 audit	Type 2
Government	FedRAMP	Not stated	Not stated
ISO	Not stated on pages read	Not stated on pages read	27001, 22301, 9001, 14001
Uptime	Not stated on pages read	99.95% SLA	99.9% stated

Pricing: What Is Actually Published

Only Elliptic publishes a price. Its AWS Marketplace listing sells 12-month contracts at $50,000 per unit (Tier 1) or $100,000 per unit (Tier 2), where a unit is your expected screening volume. Chainalysis and TRM publish no price, so treat any figure for them in other comparisons as an estimate.

The listing does not say how many checks a unit covers or what overage costs, so ask Elliptic before you compare it with per-check tools.

To size a $50,000 unit, compare it with the published per-check prices from smaller tools: AMLBot credits run from $1 down to $0.10 a check, and BlockSec lists Phalcon from $0.10 a check. Our own arithmetic: $50,000 divided by $1.00 is 50,000 checks a year, and divided by $0.10 is 500,000 checks a year.

Checks a year	At $1.00 a check	At $0.10 a check	Elliptic Tier 1 unit
25,000	$25,000	$2,500	$50,000
50,000	$50,000	$5,000	$50,000
250,000	$250,000	$25,000	$50,000
500,000	$500,000	$50,000	$50,000

How to Run a Fair Bake-Off

Ask all three for a two-week trial on the same data, then compare attribution rates, not demos. The script below is an example of the scoring step: it reads each vendor’s export of the same 50 past deposits and counts how many got a named entity. Replace the file names with your own exports.

# example: compare attribution on the same 50 deposits
import csv
vendors = {"chainalysis": "chainalysis.csv", "trm": "trm.csv", "elliptic": "elliptic.csv"}
for name, path in vendors.items():
    rows = list(csv.DictReader(open(path)))
    named = sum(1 for r in rows if r["entity"].strip())
    high = sum(1 for r in rows if r["risk"] in ("high", "severe"))
    print(f"{name}: {named}/{len(rows)} attributed, {high} high-risk alerts")

Each export needs an entity column and a risk column; map each vendor’s field names to those two before you run it. Then review every high-risk alert by hand and record which ones were false positives.

1. Pick 50 past deposits, including at least 10 you already know are risky.
2. Send the same list to all three vendors and get exports from each.
3. Compare attribution rate, high-risk alerts and false positives side by side.
4. Trace one closed case end to end in Reactor, Forensics and Investigator.
5. Ask each vendor for its SOC 2 report and a quote at your real check volume.

Which One Should You Choose?

If you are	Choose	Why
A licensed exchange with a large investigations team	Chainalysis	Reactor depth, FedRAMP, KYT coverage
A multi-chain exchange that wants its own risk rules	TRM Labs	155+ configurations, 184+ chains, glass-box attribution
A bridge-heavy or DeFi-facing platform	Elliptic	250+ bridges in Lens, one-click cross-chain tracing
A custodian vetting counterparty VASPs	Elliptic	Discovery peer-relative VASP scores
A team that needs a budget figure now	Elliptic	Published AWS Marketplace tiers

Custodians choosing a screening vendor alongside a custody provider can start with our institutional crypto custody guide, and treasury teams can compare tooling in our crypto treasury management guide.

Final Verdict

Chainalysis, TRM Labs and Elliptic are all credible primary engines for a regulated firm, and less than one point separates them on our rubric. The choice comes down to whether your team spends more time on investigations, on tuning screening rules or on cross-chain and counterparty checks, and on how much price certainty you need up front.

1. Chainalysis (9.2): deepest investigations and the widest stated monitoring coverage.
2. TRM Labs (8.9): the most configurable screening with clear attribution sourcing.
3. Elliptic (8.7): cross-chain and VASP strength, plus the only published price.

Frequently Asked Questions