Typology Engine
Pre-built laundering pattern libraries, a custom typology builder and AI-driven cluster matching against known threat-actor playbooks.
What the Typology Engine delivers
The Typology Engine is your laundering playbook. It pairs a library of known laundering patterns with an AI detector that scores any actor's on-chain behavior against those patterns — telling you which known threat-actor playbook a cluster most resembles, and why.
A curated catalog of laundering typologies (ransomware, mixing, peel chain, pig-butchering…), each with behavioral indicators and the threat actors who use them.
Create your own typology — name it, set category and severity, list behavioral indicators and tag associated threat actors.
Score any actor's on-chain cluster against the whole library and get ranked percentage matches with reasoning and likely attribution.
Matches name the most likely threat actor (e.g. Lazarus Group) and cite the exact indicators observed in the cluster.
- 1
Start on the Library tab to browse the pre-built laundering patterns. Use the category dropdown to filter by family (ransomware, mixer laundering, peel chain, etc.).
- 2
Each card shows the pattern's severity, behavioral indicators (▸ bullets) and the known threat actors associated with it. A lock icon marks a built-in pattern.
- 3
Click 'New Typology' (top-right) to create your own: enter a name, choose category and severity, write a description, add indicators and list associated threat actors.
- 4
Your custom typologies appear in the library alongside the built-in ones and can be deleted with the trash icon (built-ins are protected).
- 5
Switch to the AI Detection tab to match a real cluster: pick an actor, then hit 'Run detection'.
- 6
The engine returns a verdict headline plus ranked matches — each with a match %, matched indicators, likely threat actor and glass-box reasoning. Only matches above 40% are shown.
Sanctions Evasion Route
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Mixer Layering
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Darknet Settlement
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Ransomware Cash-Out
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Ransomware Cash-Out
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Darknet Settlement
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Ransomware Cash-Out
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Pig-Butchering Funnel
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Ransomware Cash-Out
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Mixer Layering
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.
Sanctions Evasion Route
A recurring laundering pattern characterized by a sequence of structured on-chain behaviors designed to obscure fund origin.