TL;DR: On-chain data gives investors real-time visibility into token movement, holder concentration, service usage, liquidity, and market composition, according to Chainalysis, which uses those metrics to compare a sampling of crypto assets. That shifts crypto risk assessment from narrative-driven judgment to evidence-based analysis, especially for compliance, market surveillance, and fraud monitoring.
At a glance
What this is: Chainalysis argues that on-chain data can turn crypto asset assessment into a more evidence-based exercise by exposing how tokens move, concentrate, and interact with services.
Why it matters: That matters because compliance, fraud, and surveillance teams need a defensible way to assess token risk when traditional market data and issuer disclosures are limited or incomplete.
Context
Crypto asset risk assessment is difficult when the underlying market is fragmented, fast-moving, and only partially visible through traditional financial reporting. On-chain data helps close that gap by showing how assets behave in the network itself, which is a different problem from judging price alone.
For compliance and fraud teams, the identity question is not who owns a brokerage account but how funds, services, and counterparties interact across a distributed transaction graph. That creates a governance need for evidence-based monitoring rather than narrative assumptions about token quality or market legitimacy.
Key questions
Q: How should compliance teams use on-chain data in crypto risk assessments?
A: Compliance teams should use on-chain data as an evidence layer for token movement, concentration, liquidity, and service interaction, then combine it with KYC, sanctions, and transactional monitoring. The goal is to separate normal market behaviour from patterns that suggest laundering, fraud, or manipulation. On-chain data is most useful when it feeds a documented triage process, not when it sits in a standalone dashboard.
Q: What do liquidity and token concentration tell analysts about crypto risk?
A: They show whether an asset can absorb trading pressure and whether control is concentrated in a small set of holders. Thin liquidity can make prices easier to move, while concentration can increase manipulation and exit risk. Together, they help teams judge whether an asset is operationally stable or structurally fragile.
Q: What happens when crypto risk assessments rely only on narrative or market sentiment?
A: Teams miss the behavioural evidence that on-chain data provides, which can hide concentration risk, abnormal service dependence, and suspicious movement patterns. That creates blind spots for compliance, surveillance, and fraud review. Decisions may still be made, but they are less defensible because they are not anchored in observable activity.
Q: How should teams decide when to escalate a crypto asset for closer review?
A: Escalate when the chain shows concentration, weak liquidity, or transaction patterns that do not match the asset's expected market role. Those signals suggest the risk is structural rather than temporary. A clear escalation rule matters because it creates consistency across compliance, fraud, and market surveillance workflows.
Technical breakdown
Why on-chain data changes token risk assessment
On-chain data is the transaction record embedded in a blockchain, so it can reveal how an asset actually moves through wallets, services, and market participants. For risk assessment, that matters because concentration, liquidity, and service usage are observable behaviour signals, not marketing claims. The practical shift is from static due diligence to continuous measurement of market structure and behaviour.
Practical implication: build monitoring around observable token behaviour, not just issuer narratives or exchange listings.
Token distribution, liquidity, and market composition as risk signals
Token distribution shows whether ownership is concentrated in a few holders, liquidity shows how easily an asset can be traded without distortion, and market composition shows where activity is taking place. Together, these metrics help analysts estimate manipulation risk, exit risk, and surveillance difficulty. They are especially useful when the market lacks the disclosure depth that investors expect in traditional assets.
Practical implication: use distribution and liquidity together so one metric does not mask risk in the other.
Why crypto compliance teams need network-level evidence
Compliance teams often need to answer whether an asset sits inside a higher-risk flow pattern, not whether it simply exists on an exchange. On-chain analysis supports that by linking token movement to counterparties, service usage, and concentration patterns that can indicate laundering, scam exposure, or abnormal market structure. The control problem is governance of evidence, not just collection of more data.
Practical implication: align monitoring thresholds and review workflows to network-level evidence that can be defended to auditors and investigators.
Threat narrative
Attacker objective: The objective is to move or disguise value in ways that bypass conventional market visibility and delay compliance intervention.
- Entry occurs through high-risk token activity that is only visible once funds and services are traced across the chain.
- Escalation follows when concentrated holdings, thin liquidity, or heavy service dependence make market manipulation and risky flows easier to hide.
- Impact is a weaker ability to detect fraud, laundering, and market distortion before the asset is used in harmful financial activity.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
On-chain data creates a governance layer above crypto price data. The core shift is that risk assessment can now be tied to observable movement, concentration, and service usage rather than story-driven market commentary. That matters because compliance teams need evidence that survives challenge, not just confidence that a token is popular. The practitioner conclusion is to treat on-chain telemetry as part of governance, not as a niche analyst input.
Token distribution is a control signal, not just a market metric. Concentration tells you where power and exit risk sit, and that changes how quickly an asset can become operationally risky during stress or manipulation. In practice, this is closer to exposure management than research commentary. The practitioner conclusion is to include holder concentration in approval, monitoring, and escalation criteria.
Liquidity and market composition are early warning indicators for abuse patterns. Assets with thin liquidity or narrow market composition can be harder to monitor and easier to distort, which makes fraud and laundering signals less visible. That is especially relevant where compliance teams rely on exchange-centric views that miss off-platform behaviour. The practitioner conclusion is to widen risk review beyond venue data alone.
Crypto risk assessment is becoming an evidence discipline, not a reputation discipline. The article points to a broader market change in which investigators and compliance teams can test claims against chain behaviour. That reduces dependence on issuer narratives and improves defensibility when assets need to be approved, restricted, or escalated. The practitioner conclusion is to anchor decisions in repeatable telemetry.
Identity and access governance still matters in a blockchain-native market. Even though the article is about market risk, the operational question is who can move assets, through which services, and under what controls. That makes wallet governance, transaction monitoring, and service access part of a broader identity security posture. The practitioner conclusion is to connect crypto asset review to access governance where custody or service accounts are involved.
What this signals
On-chain visibility is becoming a baseline governance input for crypto markets. Teams that still depend on descriptive market narratives will miss the structural signals that actually shape risk. The operational question is no longer whether the data exists, but whether the organisation can turn it into repeatable review criteria.
Crypto asset review now sits at the intersection of compliance and security governance. When holder concentration, liquidity, and service usage drive risk decisions, the controls around monitoring and escalation matter as much as the asset itself. That makes the programme closer to evidence management than portfolio commentary.
For practitioners
- Define token risk thresholds from chain behaviour Set review thresholds for concentration, liquidity, and service dependence so analysts escalate on observable market structure rather than intuition.
- Incorporate on-chain telemetry into compliance triage Use transaction paths, counterparties, and service usage as input to monitoring rules for fraud, AML, and market surveillance cases.
- Separate asset approval from venue familiarity Avoid treating exchange presence as a proxy for safety, and require evidence on holder spread, liquidity depth, and behavioural patterns.
- Link custody governance to asset-risk review Where teams manage wallets, service accounts, or delegated access, ensure those controls are reviewed alongside the asset's movement profile.
- Build repeatable escalation criteria for abnormal flows Document what patterns trigger escalation so compliance and security teams can defend decisions when assets show unusual concentration or movement.
Key takeaways
- On-chain data shifts crypto asset review from opinion-led judgment to evidence-led analysis based on observable behaviour.
- Token concentration, liquidity, and market composition are practical signals for fraud, manipulation, and compliance risk.
- Teams that rely on exchange presence or market narrative alone will miss the structural patterns that matter most.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | Crypto asset review depends on knowing what assets and flows exist across the environment. |
| ID.RA-02 — Cyber Threat Intelligence | On-chain telemetry functions as threat and risk intelligence for unusual market behaviour. | |
| DE.AE-03 — Anomalous Activity is Detected | Abnormal concentration or flow patterns are the observable signals this article elevates. | |
| Recommendation — Inventory token exposure, market venues, and monitored services before building risk thresholds. Feed on-chain indicators into risk intelligence workflows and refresh escalation rules regularly. Define anomalous token movement patterns and route them into compliance and investigation triage. | ||
| MITRE ATT&CK | TA0010 — Exfiltration | The article's risk lens includes value movement and concealment across the chain. |
| Recommendation — Map suspicious asset movement to exfiltration patterns and investigate unusual transfer paths. | ||
Key terms
- On-chain data: Data recorded directly on a blockchain, including transfers, balances, and contract interactions. It provides a time-stamped view of activity that can be analysed without depending on a service provider's narrative, making it useful for tracing risk, behaviour, and market structure.
- Token distribution: The spread of token ownership across holders and wallets. Distribution helps analysts understand whether an asset is broadly held or concentrated in a few addresses, which affects manipulation risk, market resilience, and the credibility of governance signals.
- Liquidity: The ease with which an asset can be bought or sold without causing large price movement. In crypto, liquidity is a practical risk indicator because thin markets are easier to distort, harder to monitor, and more likely to hide abnormal trading or laundering patterns.
- Market Composition: Market composition is the mix of participant types holding or using a cryptocurrency. It helps analysts see whether activity is concentrated among exchanges, retail users, service providers, or higher-risk segments. This perspective matters because the character of participation can shape both investment risk and the credibility of observed market demand.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need a structured way to govern identities, credentials, and access in modern security programmes.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org