Criminal balances are the funds currently held by addresses attributed to illicit actors, including services and private wallets. Criminal whales are private wallets holding at least $1 million in cryptocurrency and receiving more than 10% of their funds from illicit addresses. The first measures illicit holdings overall, while the second isolates large private stores of dirty funds.
How criminal balances and criminal whales differ in blockchain investigations
Investigators use criminal balances to describe the total funds tied to illicit actors across the blockchain, regardless of whether those funds sit in services or private wallets. Criminal whales are a narrower subset: private wallets that hold at least $1 million in cryptocurrency and source more than 10% of their funds from illicit addresses. The distinction is about scope versus concentration.
Why the two metrics answer different investigative questions
Criminal balances are useful when you want a broad picture of how much illicit value remains in circulation, how funds are distributed, and whether a criminal ecosystem still has meaningful holdings across many addresses. Criminal whales answer a different question: where large private stores of dirty funds have accumulated, and whether those holdings may represent higher-value targets for tracing, disruption, or seizure analysis.
That difference matters because a large total balance does not necessarily mean a few high-value private wallets exist. Likewise, a criminal whale is not defined by the total size of the criminal economy, but by wallet concentration and the share of illicit provenance feeding that wallet. The whale metric is therefore more selective and more operationally focused.
What changes in practice when an address qualifies as a criminal whale
Criminal balances can include funds held by services as well as private wallets, so they are a population-level measure. Criminal whales exclude services and focus on private wallets, which makes the category more useful for follow-the-money work where investigators care about custody, control, and the likelihood that a single actor can move the value. A whale can indicate that illicit proceeds have been consolidated rather than dispersed.
That consolidation can shape the next investigative step. If funds are spread across many illicit addresses, the analyst may focus on network mapping and clustering. If value appears concentrated in a whale wallet, the focus often shifts to attribution confidence, transaction timing, off-ramp exposure, and whether the wallet is likely to be reused or rebalanced.
Risk and Threat Considerations
These metrics can be misread if investigators assume that size alone proves control, or that every large wallet with illicit exposure has the same operational significance. Criminal balances may overstate actionable concentration, while criminal whales can understate distributed laundering activity when funds are fragmented across many smaller wallets.
Failure mechanism: Analysts may overfit to a single threshold or attribution rule and miss the difference between total illicit holdings and private-wallet concentration, especially when services, mixers, or layered transfers blur ownership and provenance.
Impact: The result can be weaker prioritisation, missed seizure opportunities, and inaccurate assessments of how much illicit value is still liquid, concentrated, or recoverable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Tracks illicit wallet access and reuse patterns that affect attribution and movement. |
| Recommendation — Map wallet reuse and access patterns to credential abuse indicators in your tracing workflow. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Supports inventorying illicit addresses and clustering them into actionable holdings. |
| ID.RA-01 — Asset vulnerabilities are identified and documented | Applies to assessing exposure, concentration, and tracing uncertainty in illicit holdings. | |
| Recommendation — Inventory attributed addresses and maintain a current holdings view for investigative prioritisation. Document concentration, provenance, and attribution uncertainty for each flagged wallet. | ||
Practitioner Guidance
What to verify: Treat criminal balances as a breadth metric and criminal whales as a concentration metric. Before acting on either, verify whether the wallet is a service, a private store, or part of a larger cluster, because that classification changes how meaningful the number is.
Decision rule: If the question is “how much illicit value exists overall,” use criminal balances; if the question is “where are the large private holdings that may matter operationally,” use criminal whales.
Practitioner takeaway: The useful distinction is not just size, but whether the metric is measuring the ecosystem’s total illicit value or the concentration of that value in private wallets that are more directly attributable and actionable.
Related resources from NHI Mgmt Group
- What is the difference between pseudonymous cryptocurrency activity and actual anonymity in criminal investigations?
- What is the difference between blockchain analysis and traditional electronic evidence in a criminal investigation?
- What is the difference between transaction monitoring and deeper blockchain investigations in NFT compliance?
- What is the difference between blockchain identity and federated identity?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
