← All posts
Tools10 min read2026-08-11

The small-firm AML stack: what to actually use in 2026

If you investigate wallets at a firm that can't justify a $50,000 enterprise contract, your real stack is Etherscan plus whatever you've duct-taped around it. This is an honest guide to the tools worth adding — including the ones that aren't mine — and a clear-eyed look at where every one of them stops.

A disclosure before anything else: I build CredScore, one of the tools at the end of this guide. Everything above it is a genuine recommendation with no affiliate anything — most of it is free, and I'd recommend the same list to a friend who'd never heard of my product. The reason I can afford to be honest is that none of these tools do what mine does, and mine doesn't do what they do.

The shape of the problem

A wallet investigation has three phases, and analysts chronically budget time for the wrong one. Phase one is seeing the record: what did this wallet do? Phase two is following the money: where did funds come from and go? Phase three is the verdict: what does it mean, what do we do, and how do we defend that call when someone asks in six months? The free-tool ecosystem has gotten genuinely good at phases one and two. Phase three is still mostly an analyst, a blank document, and a deadline.

Phase one: the record

Etherscan (and its API)

You already use the explorer. The underrated move is the API: if your team repeatedly pulls transfer lists, first/last activity, counterparty tables, or wallet ages by hand, a few hundred lines of script turn hours of tab-hopping into a one-command wallet profile. For a small team, an internal Etherscan-API toolkit probably has the best return on investment of anything in this guide, because it removes the boring work between the data and your brain.

Phase two: following the money

MetaSleuth

Visual fund-flow tracing from BlockSec, with a usable free tier. You paste an address and build the flow — A to B to C to exchange — on one canvas instead of seventeen tabs. If manual tracing is your daily grind, test it this week.

Breadcrumbs

Same category, board-style workflow, also with a free tier. Which one fits is mostly ergonomics; run both against a closed historical case and keep the one your hands like. There is no wrong answer here.

Arkham

The heavyweight of the free stack: entity attribution at serious scale, relationship views, alerts. When your question is "who is behind this address and what else do they touch," Arkham is usually the fastest free answer. Standard caveat that any investigator should already live by: treat third-party attribution as a lead, not as evidence. Labels are sometimes wrong, and your case file shouldn't inherit someone else's mistake.

Dune

The sleeper. Learning enough SQL to use Dune upgrades you from "what happened to this wallet" to "show me every wallet that received funds from these 37 addresses in the 30 days before the incident." One analyst who can write queries turns one-off investigations into repeatable ones the whole team reuses.

Data-handling note, because it matters in this job: before you paste addresses from live casework into any third-party tool, know what that tool publishes. Some platforms list recently-queried or recently-traced addresses publicly — which can amount to announcing what you're investigating. Read the privacy posture of every tool in your stack; prefer tools where your lookups are private or unlisted by default.

Phase three: the verdict — where the free stack ends

Here's the uncomfortable arithmetic. When the trace is done and the attribution is checked, nothing above has made a decision. Every tool so far hands you data and a graph, and the graph does not clear a wallet, escalate a wallet, or write the memo. An analyst does — usually the most senior one, usually under time pressure, and the write-up routinely takes longer than the trace did. That conclusion also carries the career risk: it's the part with your name on it, the part an auditor reads.

This is the phase CredScore was built for, and the disclosure from the top of the page applies. You paste the wallet and get a deterministic 0-100 risk score, a Proceed / Review / Escalate recommendation, and a written rationale where every driver cites its evidence — inbound concentration percentages, structural flow patterns, dormancy, sanctions matches — in about fifteen seconds. The output exports as a case-file-ready report with the engine version and timestamp pinned. And because the engine is deterministic, every verdict seals the raw inputs it consumed, so the exact decision can be re-executed months later even though the chain has moved on — the property auditors always ask for and almost never get.

What CredScore does not do: it is not a tracing canvas, its attribution database is hand-verified but deliberately small, and it covers six chains (Ethereum, Tron, Base, Arbitrum, Optimism, Polygon) rather than thirty. It does not replace anything above — it finishes what they start.

The stack, assembled

  • Etherscan + a small API toolkit — the record, automated.
  • MetaSleuth or Breadcrumbs — the flow, visualized. Free tiers.
  • Arkham — the attribution, free, treated as leads not evidence.
  • Dune — the unusual questions, repeatable.
  • CredScore — the verdict and the defensible artifact. $99/mo, first analysis free.
  • TRM / Chainalysis / Elliptic — if and when the budget arrives, they add massive attribution depth and regulatory tooling. Nothing above becomes obsolete when they do; the free stack keeps doing the daily work.

Total cost: under $100 a month, most of it free. That's not a discount version of an enterprise platform — for the daily reality of a small firm's casework, phases one through three covered end to end, it's simply the right-sized stack.

If you want to pressure-test the phase-three claim, run a wallet you already know cold through the free analysis — a closed case, a public incident address, anything you can verify against your own conclusion. Your lookup stays unlisted, and if the engine misses something you caught, I genuinely want to hear about it: that feedback is how the engine has gotten every improvement it has.