What is KYT?
KYT is the practice of monitoring blockchain transactions in real time to assess risk and detect exposure to illicit activity. KYC verifies who a customer is. KYT looks at what their funds are actually doing. It screens the source and destination of a transaction against known sanctioned addresses, darknet markets, ransomware wallets, and mixing services.
KYT is essentially transaction monitoring rebuilt for blockchain data. Banks have run transaction monitoring for decades on wires and cards. KYT does the same job, but reads on-chain data that traditional AML software was never built to interpret.
How is KYT different from KYC?
These two checks happen at different points and answer different questions.
KYT extends KYC rather than replacing it. Identity is pseudonymous on a blockchain, but every transaction is permanent, public, and traceable. That permanence is what makes continuous transaction-level screening possible in a way it never was in cash.
What does KYT actually screen for?
A KYT system continuously checks incoming and outgoing transfers against several risk categories:
- Sanctioned wallet addresses
- Darknet markets and known illicit marketplaces
- Ransomware wallets
- Mixing and tumbling services
- Activity tied to high-risk jurisdictions
- Behavioral patterns such as structuring, layering, or high-velocity movement of funds
Each transaction gets a risk score based on these checks. High-risk transactions trigger an alert before funds move or are withdrawn, giving a compliance team a chance to intervene in real time rather than after the fact.
How does KYT technically work?
KYT platforms ingest blockchain data continuously. They apply attribution models to link wallet addresses to real-world entities where possible. This attribution turns an anonymous string of characters into something a compliance team can act on.
Leading providers include Chainalysis, TRM Labs, and Elliptic. Each combines blockchain analytics, threat intelligence, and rule-based alerting to assign risk categories automatically. This removes the need for manual review of every single transaction. Most major exchanges also connect their KYT provider to a Travel Rule messaging network, so a flagged transaction and its compliance data can be reviewed together rather than in separate systems.
The scale of the problem is real, but smaller as a share of total activity than headlines suggest. Chainalysis has repeatedly revised its illicit volume estimates upward over time. Figures are lower-bound and grow as more addresses get identified. In its 2026 Crypto Crime Report, Chainalysis estimated illicit addresses received at least $154 billion in 2025. That is a 162% increase year over year, driven largely by sanctioned entities and state-backed actors. Even at that scale, illicit activity stayed below 1% of total on-chain volume. Public blockchains are transparent, and that transparency is what makes even that small share identifiable in the first place. Cash-based crime offers no equivalent visibility.
How does KYT connect to the Travel Rule?
KYT and the Travel Rule address related but separate problems. KYT screens a transaction's risk based on its counterparties and pattern. The Travel Rule governs what identifying data must travel with a transaction between VASPs above a set threshold.
In practice, they work together inside the same compliance stack. A KYT alert on a high-risk counterparty often triggers a closer look at whether Travel Rule data was collected and verified correctly for that transfer.
Why does KYT matter for stablecoin payment platforms?
For platforms moving stablecoins across cross-chain bridges or multiple blockchain networks, KYT is what gives visibility into counterparty risk that would otherwise be invisible. A payment can look clean on the surface while the destination wallet is several hops removed from a sanctioned address.
KYT sits alongside OFAC screening and compliance risk management as a required control for any money transmitter or VASP handling on-chain transfers. Continuous, real-time screening at the transaction level is now the baseline expectation from regulators, not an optional add-on for platforms operating at scale in stablecoin payments.
