In the field of Web3 on-chain association analysis, 'static evidence chains' have always been unable to adapt to the 'dynamic evolutionary nature' of on-chain behavior—traditional tools can only generate 'associative snapshots at a certain point in time', such as 'current address A and B behavioral fingerprint similarity 85%' or 'current position concentration rate 60%', but cannot trace 'how the association evolved over time from non-existence to existence, from weak to strong', nor can they capture dynamic risks reliant on time-series logic, such as 'gradual market control' or 'periodic money laundering'. For example, a certain controlling entity gradually increased its holdings over three months, with the position ratio rising from 30% to 70%, yet traditional static evidence chains only marked 'high risk' at the final stage, missing every intermediate risk warning; a certain money laundering address changed transfer routes over different time periods, and the static evidence chain failed to link time-series behaviors, causing a break in the money laundering trail. Bubblemaps' core innovation lies in constructing 'a time-series evidence chain system for on-chain association analysis', upgrading the association evidence chain from 'static snapshot' to 'dynamic timeline', redefining the capability of on-chain association analysis for identifying dynamic risks.
I. Core limitations of traditional static evidence chains: Why has time-series become key for dynamic risk identification?
The 'static mode' of traditional on-chain associated evidence chains is essentially based on 'single time slice data', and its limitations become increasingly prominent with the dynamic complexity of on-chain behavior, specifically manifested in three core contradictions:
1. Evidence chain without a time dimension: Unable to trace the evolution logic of associations
Traditional tools' associative evidence only reflects 'current states', lacking 'historical evolution trajectories': users see 'addresses A and B associated', but cannot know if 'the two suddenly became associated (e.g., a one-time transfer), or formed the association gradually over 30 days (e.g., daily synchronized transactions)'; they see 'position concentration rate 60%', yet cannot judge 'whether it was concentrated from the initial issuance or gradually concentrated through 10 increases'—the 'time-series logic' of association formation directly determines the nature of risk: sudden associations may be normal cooperation, while gradual associations are more likely to indicate covert control; initial concentration may be team lock-up, while gradual concentration is likely to be malicious accumulation. Traditional static evidence chains lack the time dimension, making it impossible to distinguish these key differences, leading to a risk misjudgment rate exceeding 35%.
2. Dynamic risk warning delay: Unable to capture 'periodic risk signals'
The core feature of on-chain dynamic risks (such as gradual market control, periodic money laundering) is that 'risk accumulates gradually over time', but traditional static evidence chains only trigger warnings when 'risk thresholds are met', missing the intermediate warning windows: for instance, if a token's associated cluster's position ratio rises from 30% to 70%, traditional tools only warn when the ratio reaches 60% (high-risk threshold), but ignore the '5% weekly increases' as periodic signals; a certain money laundering address transfers funds in three stages (with 10-day intervals between each stage), traditional tools only identify money laundering behavior in the final stage, missing the signals of the preceding stages laying the groundwork for the funding chain. This 'post-warning' model results in users being unable to avoid risks in advance; in one case, an exchange, due to delayed static warnings, only intervened when a token's position concentration rate reached 70%, by which time many users had already entered due to prior increases, ultimately resulting in losses exceeding $6 million.
3. Fragmentation of evidence across time periods: Unable to connect 'fragmented time-series behaviors'
Some on-chain risk behaviors exhibit 'fragmentation across time periods': a certain controlling entity may synchronize transactions in the first week, pause interactions in the second week, transfer funds across chains in the third week, and re-synchronize increases in the fourth week—traditional static evidence chains, due to isolated storage by time slices, cannot connect these 'fragmented behaviors' into a complete associated logic, leading to 'synchronized transactions in the first week being deemed normal, while increases in the fourth week being considered independent actions', ultimately missing the overall control risk. An audit report shows that traditional tools have a 42% miss rate in identifying associations of 'fragmented time-series behaviors' due to cross-time fragmentation.
II. The technical architecture of Bubblemaps' time-series evidence chain system: From 'snapshot' to 'timeline'
Bubblemaps' time-series evidence chain system is not simply 'adding timestamps', but is based on the project's established '23-dimensional behavioral fingerprints', 'real-time risk monitoring engine', and 'Intel Desk distributed verification' technical foundation, constructing a full time-series technical closed loop of 'collection-generation-tracking-warning', which includes four core modules:
1. Real-time behavioral time-series collection: Capturing 'millisecond-level on-chain behavior trajectories'
To ensure the integrity and accuracy of time-series data, the project develops an 'on-chain behavior real-time collection engine' to achieve millisecond-level capture and storage of key data for associated analysis:
• Multi-dimensional time-series data collection: The engine captures on-chain data every 100 milliseconds, covering 'transaction timing (timestamps and interval patterns of each transaction), interaction timing (time distribution and frequency changes of contract calls), funding timing (time series of transfer amounts and flow changes), feature timing (daily variation in 23 dimensions of behavioral features, such as Gas fee pattern similarity, contract interaction overlap)', ensuring no key time-series nodes are missed;
• Time-series data structured storage: Adopts a two-dimensional storage structure of 'timeline + feature dimension'—the horizontal axis is time (precise to seconds), and the vertical axis consists of 23 dimensions of behavioral features and associated indicators (such as behavioral fingerprint similarity, position concentration rate). Each time point stores the corresponding data value and the original on-chain transaction hash. Users can drag the timeline to view related data and evidence at any moment;
• Cross-chain time-series data collaboration: For cross-chain association scenarios, the engine synchronously collects time-series data from different public chains, aligning 'cross-chain timestamps' (converting the block timestamps of different public chains to a unified UTC time), ensuring that 'the first day of trading for an Ethereum address' and 'the first day of trading for a Solana address' can be compared on the same timeline, solving the problem of cross-chain time-series data fragmentation.
2. Multi-stage evidence chain generation: Construct evidence according to 'associated evolution stages'
The project divides the evidence chain into four stages: 'germination period, growth period, stable period, and recession period', based on the time evolution logic of associations, generating exclusive evidence for each stage to solve the problem of 'static evidence unable to reflect evolution logic':
• Germination period evidence (association similarity 30%-50%): Captures 'initial signals of association', such as 'two addresses first appearing with the same contract interaction, Gas fee patterns beginning to converge', evidence is marked with 'germination period features: interaction overlap rises from 10% to 40%, no direct funding association', helping users identify early signs of association;
• Growth period evidence (association similarity 50%-80%): Recording 'the process of strengthening associations', such as 'daily synchronized transaction frequency increasing from 1 to 5 times, and indirect funding loops beginning to appear', evidence is marked with 'growth period features: consecutive 15 days of transaction synchronization rate exceeding 60%, with 3 occurrences of indirect funding association', prompting users to pay attention to risk accumulation;
• Stable period evidence (association similarity above 80%): Solidifies 'the stable state of associations', such as 'behavioral fingerprint similarity stabilizing above 85%+, forming a fixed loop of funding', evidence is marked with 'stable period features: behavioral fingerprint similarity exceeding 85% for 30 consecutive days, funding loop rate reaching 90%', clearly indicating high-risk status;
• Recession period evidence (association similarity drops below 50%): Tracking 'the process of weakening associations', such as 'reduced frequency of synchronized transactions, increased differences in behavioral features', evidence is marked with 'recession period features: interaction overlap drops from 80% to 40%, funding loop breaks', alerting users to risk mitigation.
Each stage of evidence is accompanied by 'time-series change charts' (e.g., daily change curve of behavioral fingerprint similarity) and 'key time node annotations' (e.g., 'first appearance of funding association time: 2024-03-15 14:30'), allowing users to clearly trace the complete evolution logic of the association.
3. Dynamic association evolution tracking: Real-time updating of time-series evidence chain
The project develops a 'time-series evolution tracking algorithm' to continuously compare 'current time-series data' with 'historical baselines', dynamically updating the stages and content of the evidence chain, addressing the problem of 'static evidence not adapting to behavioral changes':
• Automatic stage transition: When the association similarity rises from 45% to 55%, the algorithm automatically transitions the evidence chain from the 'germination period' to the 'growth period' and supplements 'new feature evidence for the growth period' (such as increased synchronous transaction frequency); when the similarity drops from 85% to 45%, it automatically transitions to the 'recession period', marking the 'key reasons for the weakening of association' (such as changes in interaction habits of a certain address);
• Abnormal time-series behavior marking: If an associated feature shows a 'mutation' during a certain time period (e.g., behavioral fingerprint similarity jumps from 60% to 90%, position ratio increases by 10% in one day), the algorithm automatically marks 'abnormal time-series nodes' and generates a 'mutation analysis report' (e.g., 'the sharp increase in similarity is due to two addresses simultaneously transferring to the same exchange, transaction hash: 0x...'), helping users identify artificial manipulation signals;
• Historical evidence version tracing: All changes in the evidence chain and content updates retain historical versions, allowing users to view the evidence chain evolution process from '2024-03-01 to 2024-04-01' through the 'timeline slider', comparing the differences in associated features at different times, such as viewing all evidence changes of a certain associated cluster 'from the germination period to the stable period'.
4. Time-series risk warning model: Early warnings based on 'time-series feature trends'
The project abandons the 'static threshold met warning' model and constructs a 'time-series risk warning model', triggering warnings in advance by analyzing the 'time trends' of associated features (such as growth rates, fluctuation frequencies), solving the problem of 'dynamic risk warning delays':
• Trend warning: If the 'weekly growth rate of the associated cluster's position ratio stabilizes at 5%', the model predicts through linear forecasting that 'the ratio will reach 70% (high-risk threshold) in 4 weeks', triggering a 'trend warning' 2 weeks in advance, marked with 'Warning basis: weekly position growth of 5%, expected to meet high risk in 4 weeks';
• Periodic warning: If a certain address's 'cross-chain transfer behavior shows a 7-day cycle' (funds are synchronized every Monday), the model triggers a 'periodic warning' 12 hours before the 'periodic node', reminding users to pay attention to the upcoming fund transfer;
• Mutation warning: If associated features show 'non-periodic mutations' (e.g., behavioral fingerprint similarity rises from 60% to 90% within one hour), the model immediately triggers a 'mutation warning', accompanied by 'all on-chain transaction records during the mutation period', helping users quickly locate the cause of abnormalities.
As of Q4 2024, the average early warning time for this warning model has reached 72 hours, with a dynamic risk interception accuracy of 94.2%, improving efficiency by 3 times compared to traditional static warnings.
III. Industry implementation: The dynamic risk identification value of time-series evidence chains
Bubblemaps' time-series evidence chain system has been implemented in three core scenarios: 'progressive market control identification, periodic money laundering tracking, cross-chain time-series association analysis', addressing the pain points of traditional static evidence chains, and its value is reflected in specific practical breakthroughs:
1. Progressive market control identification: Capturing risk signals of 'gradual increases' in advance
Traditional tools only issue warnings when the concentration rate meets the threshold, while the time-series evidence chain achieves early intervention through tracking the increase in holdings:
• A case of a certain meme coin controlling the market: A token's associated cluster from March to June 2024 increased its holdings by 5% weekly, with the position ratio rising from 30% to 70%—traditional tools only issued a warning when the ratio reached 60% in June, by which time many users had already entered. Bubblemaps' time-series evidence chain marked 'the first appearance of synchronized holding signals' in March (germination period, 30% ratio), triggered a 'trend warning' in April (growth period, 45% ratio), and pushed a warning of 'will reach high risk in 4 weeks' in May (approaching stable period, 55% ratio). The exchange subsequently limited leveraged trading of that token in advance, ultimately reducing user losses by 70%;
• Distinguishing holding logic: A certain DeFi token has a position concentration rate of 60%, which traditional tools deem 'high risk'; the time-series evidence chain, through tracing time-series, discovers that 'this concentration rate is the team's lock-up from the initial issuance, and has steadily decreased over the past 6 months (from 60% to 55%)', determining it as 'low-risk lock-up', avoiding misjudgment of quality projects.
2. Periodic coin washing tracking: Connecting the complete chain of 'fragmented time-series behaviors'
Money laundering behaviors are often conducted in stages, and traditional static evidence chains cannot connect them. The time-series evidence chain achieves complete tracking through the timeline:
• A certain cross-chain money laundering case: A money laundering group transferred funds in three stages: in March, funds were dispersed through 10 addresses on Ethereum (germination period, no obvious association), paused interactions in April (behavior silence), and in May transferred to Solana via a cross-chain bridge and split the transfer (growth period, cross-chain association signal appeared), and in June concentrated transfers into exchanges on Solana (stable period, funding loop)—traditional tools could not connect the behavior of March and May due to April's silence, missing the money laundering signal; Bubblemaps' time-series evidence chain connected the behavior from March to June through the 'timeline', discovering that 'the behavioral fingerprint similarity of Ethereum addresses in March and Solana addresses in May exceeded 85% (e.g., similar transfer interval patterns)', and marked 'the April silence period as a deliberate avoidance of tracking', ultimately helping compliance agencies fully restore the money laundering chain, freezing over $12 million in involved funds.
3. Cross-chain time-series association analysis: Aligning the association logic of 'multi-chain time-series behaviors'
Cross-chain associated behavior often evolves across public chains over time. Traditional tools cannot recognize this due to fragmented time-series data. The time-series evidence chain achieves precise association through cross-chain timeline alignment:
• A certain institution's cross-chain sub-account case: An institution opened sub-accounts on Ethereum (April), Solana (May), and Tron (June), with each public chain sub-account spaced one month apart and no direct transfers—traditional tools failed to identify associations due to isolated evidence across public chains; Bubblemaps' time-series evidence chain, through 'cross-chain timeline alignment', found that 'the sub-account addresses on the three public chains, after their respective launches, maintained the time-series features of 'synchronized trading at 14:00 daily, consistent Gas fee patterns, and final fund flow directed to the same cold wallet'', determining it as a cross-chain association. The exchange subsequently marked the sub-account addresses of the three public chains as high risk, preventing cross-chain risk from being overlooked.
IV. Industry insights: Time-series is the 'dynamic insight capability' of on-chain association analysis
Bubblemaps' time-series evidence chain system practice provides key insights for the Web3 on-chain analysis field: the essence of on-chain behavior is 'dynamic evolution', the formation of associations, accumulation of risks, and flow of funds cannot be separated from the time dimension—traditional static evidence chains only capture 'results', ignoring 'process', while 'the time-series logic within the process' is precisely the key to judging risk nature and avoiding risks in advance.
Current Web3 on-chain risks are shifting from 'overt sudden' to 'covert gradual', with gradual market control and periodic money laundering becoming mainstream dynamic risks, traditional static evidence chains can no longer cope. Bubblemaps' practice proves that time-series evidence chains are not merely 'supplements to static evidence', but a 'core upgrade' for on-chain association analysis—they elevate association analysis from 'recognizing current states' to 'insight into evolution logic, predicting future trends' through the addition of the time dimension, truly possessing dynamic risk identification and warning capabilities.
In the future, with the application of AI technology in time-series feature prediction (such as predicting the evolution direction of associations via machine learning), time-series evidence chains will further upgrade to 'predictive time-series analysis'. As the pioneer of this paradigm, Bubblemaps' core value lies not only in technological innovation but also in pointing the industry in the right direction—the next generation of competitiveness in on-chain association analysis lies in the deep insight and application capability of the 'time dimension'.
