Transaction activity that investigators can actually work from.
Cali Activity is the transaction-activity surface of the Cali platform. It consolidates on-chain events into a single, investigator-grade table with risk bands, detectors, entity context, typologies, and an AI panel that explains why activity appears risky and where to start reviewing.
Built for high-volume alert queues, case investigations, and law-enforcement work where every row must be cleared, escalated, or documented.
Investigators spend hours switching between block explorers, spreadsheets, OSINT tools, and internal notes. This module consolidates activity into one view, enabling immediate identification of risk location and rationale.
- Eliminates multi-tab investigation drift
- Ensures consistent, defensible decision-making
- Accelerates triage and reduces backlog pressure
- Investigator-grade transaction table with multi-chain input
- Risk bands, detectors, and entity context in one surface
- Typology suggestions and AI narrative per row or subset
- Source/destination chain exposure overview
- Full transaction details panel with copy-ready fields
- Demixing and de-obfuscation of mixer-adjacent flows by reconstructing inbound/outbound context around privacy services
A wallet shows a series of mid-value USDT transfers across five services in 22 minutes. This module auto-surfaces "structuring-like behavior," highlights key intervals, and links related addresses. The investigator moves to Graph to confirm flow, then OSINT for exposure checks, then Report Station for documentation.
- Normalizes native, internal, token, NFT, and DeFi events into a single transaction view.
- Applies risk bands and detectors to surface potential structuring, layering, service exposure, and abnormal behavior.
- Displays chains, assets, counterparties, labels, and entity signals side by side for every row.
- Integrates with Graph, OSINT, Balance, and Report Station workflows as cases develop.
- Exchange and fintech compliance teams
- Banks and VASPs reviewing customer wallets and flows
- Crypto compliance & AML investigation teams
- Fraud, investigations, and recovery units
- Law-enforcement and public-sector forensic teams
AI reads the same metrics the investigator sees—risk bands, detectors, counterparties, services, and time windows—and proposes candidate explanations, typologies, and next steps.
- Explains in plain language why a transaction, wallet, or cluster appears higher-risk.
- Suggests candidate typologies (e.g., structuring-like, mixer exposure, scam funnel) for human review.
- Points to specific rows, hops, or services worth examining first.
- Generates draft text investigators can refine into case notes or reporting language.
AI does not make the final decision; analysts remain in control. AI accelerates draft creation and reduces cognitive load.
This module surfaces both pattern-based and context-based signals. Examples include:
- Clustering around mixers, privacy services, or risky venues.
- Structuring-like behavior just under key thresholds or in tight time windows.
- Rapid forwarding across chains or services consistent with layering or cash-out.
- Entity, label, and OSINT context pulled in from other parts of the Cali platform.
Signals are designed to be intelligible to investigators and auditable for supervisors—not opaque scoring. Cali does not treat mixer exposure as a dead end; instead, it reconstructs surrounding hops, timing patterns, and counterparty relationships to enable investigative demixing and analyst reasoning.
This module is typically the first and most heavily used surface in Cali. It's where alerts land, where transactions are first seen, and where many cases begin.
- From here, investigators can move to Graph for provenance, OSINT for sanctions and adverse media, Balance & Assets for holdings, and Pivot for pattern analysis.
- Cases and notes can then be carried forward into Report Station to generate SAR-style reports and internal memoranda.
This module is a product in its own right and also the front door into the broader Cali platform.
Start with the activity surface your team uses every day.
Activity is where crypto investigations usually begin. We prefer to show it on top of real alerts, real wallets, and real flows—so you can see how it behaves in your program, not just in a demo script.