GraphSense is an open-source, MIT-licensed cryptoasset analytics platform that clusters blockchain addresses and attaches attribution tags, giving investigators much of what commercial forensics suites offer without the licence fee. It covers Bitcoin, Ethereum and Tron, and it is built for scale, ingesting an entire chain and letting you follow funds across millions of addresses. This tutorial walks through what GraphSense actually does, how its two core techniques combine, and how to start using its TagPack ecosystem to trace ransom payments.
One honest caveat before the how-to. GraphSense is a heavy platform, not a website you log into. The full stack expects real infrastructure, and most individual analysts start with its open TagPacks and hosted endpoints rather than a from-scratch deployment. This piece covers both paths.
What is GraphSense?
GraphSense is a general-purpose cryptoasset analytics platform developed in the academic and open-source community and released under a permissive MIT licence. Unlike the closed commercial tools, its entire software stack is public, which means you can read exactly how its clustering and attribution work rather than trusting a black box. That transparency matters in an evidentiary context, where methodology has to withstand scrutiny. The platform grew out of research at the Austrian Institute of Technology and is documented in a peer-reviewed paper, so its heuristics are published, not proprietary. It pairs naturally with the manual methods in our on-chain payment-tracing walkthrough, automating at scale what a block explorer makes you do by hand.
How does address clustering work?
Clustering is the first of GraphSense’s two pillars. It applies heuristics to group many addresses into the maximal set likely controlled by one real-world actor. The workhorse is the common-input-ownership heuristic: when several addresses are spent together as inputs to a single transaction, they are almost certainly held by the same wallet, so GraphSense merges them into one cluster. Run that across a whole chain and a lone ransom address becomes a cluster of hundreds or thousands of addresses, all attributable to the same operator. This is exactly the manual heuristic from basic tracing, industrialised and applied to every transaction at once.
What are TagPacks, and why do they matter?
Clustering tells you which addresses move together; it does not tell you who they belong to. That is the job of attribution tags, and GraphSense packages them as TagPacks. A TagPack is a structured, machine-readable file that associates a cryptoasset address with context: an exchange name, a known ransomware wallet, a sanctioned entity, a service label. GraphSense maintains a public collection of TagPacks, and you can build private ones for your own intelligence. The power move is the combination: attach one confirmed tag to a single address inside a large cluster, and that label propagates contextual meaning across every address in the cluster. One verified ransom-wallet tag can illuminate an operator’s entire on-chain footprint.
How do you actually start using it?
There are two realistic entry points. The lighter one is the TagPack ecosystem. GraphSense publishes a command-line TagPack tool that lets you create, validate and manage attribution tags without standing up the whole analytics engine, and the public TagPacks repository is a usable intelligence source on its own. Install the tool, pull the public tags, and you can already enrich addresses you are investigating. The heavier path is a full deployment: GraphSense ingests raw blockchain data into a big-data backend and runs the clustering with a distributed compute engine, then exposes results through a REST API and a graph dashboard. That path needs real hardware and patience, which is why the project also spun off a hosted commercial service for teams that want the platform without the operations burden. Start with TagPacks, graduate to the full stack when the caseload justifies it.
Where does GraphSense fit against commercial tools?
GraphSense is the strongest free equivalent to the paid forensics suites, and its openness is a genuine advantage for anyone who has to defend a method in court or a report. What it does not have is the vast proprietary attribution database that vendors like Chainalysis have built by scraping, buying and confirming labels at scale, so out of the box a commercial tool will name more entities than GraphSense will. The pragmatic reading is that GraphSense gives you world-class clustering plus whatever attribution you and the community can assemble, which for ransomware work is often enough to reach the exchange off-ramp where legal process takes over. For OSINT teams that also pivot on operator identities, it slots neatly beside the selector work in our threat-actor handle pivoting guide.
Frequently asked questions
Is GraphSense free?
Yes. GraphSense is open source under the MIT licence, and the full stack plus its public TagPacks are freely available on GitHub. A separate commercial hosted service exists for teams that do not want to run the infrastructure themselves.
Which blockchains does GraphSense support?
GraphSense supports Bitcoin, Ethereum and Tron, along with related assets on those chains. Its architecture is built to ingest and analyse whole chains rather than single addresses.
What is a TagPack?
A TagPack is a structured, machine-readable file that associates cryptoasset addresses with attribution context, such as an exchange or a known ransom wallet. TagPacks can be public or private, and one tag on a clustered address adds context to the whole cluster.
Can I run GraphSense on a laptop?
Not the full analytics stack, which expects server-grade infrastructure to ingest and cluster entire blockchains. You can, however, use the TagPack tool and public TagPacks on a normal machine, which is the usual starting point.
How does GraphSense compare to Chainalysis?
GraphSense offers comparable, openly documented clustering, but it lacks the large proprietary attribution database commercial vendors have built, so paid tools typically name more entities. GraphSense’s advantage is transparency and cost.