Why device fingerprinting misses crypto fraud

Device fingerprinting links accounts by the device they use. That works until a crypto fraud ring rotates devices, VPNs and wallets for every account it opens. Each account then looks new and clean. Linking the wallets behind those accounts, through shared funding and shared exits, catches what device signals alone miss.

The short version: device tools see the session but never the wallets behind it. Chain analytics sees wallets but never the actor. A crypto fraud ring lives in the gap between the two. This guide explains what each layer does well, how rings work around both, and how to add the missing wallet dimension without replacing the tools you already run.

What does device fingerprinting do well?

Device fingerprinting is good at recognizing a returning device, and that solves a lot of fraud. It is worth being clear about this before looking at its limits, because the fix is to add a layer, not to rip one out.

A device fingerprint is a profile built from attributes a browser or app exposes during a session: operating system, browser version, screen size, fonts, language, time zone, hardware details and similar signals. Combined, they produce an identifier that stays fairly stable for one device. When a second account logs in from the same device, the tool can link the two.

That gives a fraud team real coverage:

• Duplicate accounts on one device. Someone opening five accounts from the same laptop is caught early and cheaply.
• Automation and emulators. Many device tools detect headless browsers, scripted sign-ups and emulated phones.
• Network signals. VPN, proxy and data center traffic can be scored, and mismatches between stated and observed location raise risk.
• Session behavior. Login velocity, odd navigation and account takeover patterns show up at the session level.
• Low friction. It runs in the background, so honest customers rarely notice it.

For a card-funded platform, this covers a large share of the opportunistic fraud that arrives every day. The trouble starts when the money moves on-chain and the people abusing the platform are organized.

How do crypto fraud rings work around device fingerprinting?

Crypto fraud rings work around device fingerprinting by making every account look like a different, ordinary customer at the session level. They rotate the device, the network and the wallet for each account, so no two sessions share the signals a device tool links on.

Bonus abuse is where this is most visible. In its North America online gaming report, published in March 2026 and based on a survey of 993 online gaming decision-makers, LexisNexis Risk Solutions found bonus abuse was cited by 78% of respondents as a top threat to their business, ranking it the most prevalent form of fraud in the sector. The same release says account creation and withdrawals account for roughly 60% of total fraud exposure. Those are the two points where a ring enters and leaves. For the signals specific to incentive abuse, see our guide to bonus abuse detection.

A typical ring follows the same pattern:

1. Fresh device per account. Cheap phones, factory resets, emulators and anti-detect browsers give each account its own fingerprint.
2. Fresh network per account. Residential proxies and rotating VPN exits give each session a plausible, different IP address and location.
3. Fresh wallet per account. Creating a crypto wallet costs nothing and takes seconds, so every account deposits from an address with no history on your platform.
4. Small, normal-looking activity. Each account deposits a modest amount, claims the incentive, meets the terms with low-risk activity and requests a withdrawal.
5. Consolidation off-platform. The value from all accounts is moved on-chain to a small number of addresses the ring controls.

At steps 1 to 4, your device tool sees a series of clean, unrelated sessions. Every rule you run passes, because every account on its own looks fine. Step 5 happens on-chain, outside the view of any session-based tool.

This is the core of the device fingerprinting limitations problem for crypto platforms. The tool is not failing at its job. It is answering "have I seen this device before?" correctly. The ring has simply made sure the answer is always no.

An illustrative example

Here is how that looks in practice. The figures are illustrative, not client data.

Over two weeks, twelve accounts sign up. Each uses a different phone or browser profile and a different VPN exit. Each deposits from a wallet that has never touched your platform, claims the signup bonus and withdraws after meeting the terms. Your device tool scores all twelve sessions as low risk. Your manual reviewers see twelve small, ordinary accounts.

On-chain, the picture is different. All twelve deposit wallets were funded by transfers from the same source wallet within a few hours of each other. Most of the withdrawals land at the same exit address. Individually, each account took one small bonus. Together, one actor took twelve.

What does chain analytics see, and what does it miss?

Chain analytics sees wallets and the transfers between them. It misses the actor on your platform: which accounts, sessions and sign-ups belong to the person moving the funds.

Blockchain analytics tools are built to answer questions about addresses. Where did these funds come from? Has this wallet touched a sanctioned entity, a scam, a darknet market or another high-risk counterparty? Which addresses appear to be controlled together? For compliance teams, this is essential. It supports screening, transaction monitoring and investigations.

What it does not have is your platform's view. A chain analytics tool can tell you that a deposit address received funds from a risky source. It cannot tell you that the same actor also opened eleven other accounts on your platform last week, each with a clean device and a clean wallet. It does not see your sign-ups, your bonuses, your sessions or your withdrawal requests.

That leaves two partial views side by side:

A bonus abuse ring rarely trips chain analytics either. Its wallets are fresh. They have no exposure to sanctioned or known-bad entities. They just happen to share funding and an exit with each other. Neither layer is asked the question that would expose them: are these separate accounts actually one actor?

What changes when you add the wallet dimension?

Adding the wallet dimension changes the unit of review from the account to the actor. Instead of scoring each account alone, you see every account and wallet that belongs to the same actor, and you judge the group.

Rotating devices is cheap for a ring. Rotating money is harder. The value still has to come from somewhere and go somewhere, and those movements are public on-chain. Shared funding, shared exits and repeated patterns across wallets link accounts that look unrelated at the session level.

Once the accounts are grouped, the rules you already have can run again across the whole group. Total gain, deposit addresses, platforms hit and win streaks look very different at cluster level. Individually each account passes. Together they are obviously a ring. This is the idea behind multi-accounting detection that links accounts across wallets: stop judging accounts one at a time when the risk sits in the group.

On the Addressable Anti-fraud platform, this works in four stages:

1. Surface. On-chain rules flag a candidate wallet from public activity alone.
2. Expand. The graph pulls in every other wallet and session belonging to the same actor.
3. Re-score. Rules re-run across the whole cluster, where the totals look nothing like the parts.
4. Classify. The pattern gets named, and independent signals have to agree before anything is flagged.

Each flag arrives named, as one of a set of fraud types. These include signup-bonus abuse, referral abuse (self-referral rings and farmed referral chains), arbitrage exploitation, rakeback wash trading, pass-through laundering (value in, value out, minimal play in between) and multi-account farming (one actor, many accounts, shared funding and infrastructure).

In the illustrative example above, the twelve accounts stop being twelve low-risk sessions. They become one cluster with one funding source, one main exit and twelve bonuses taken. That is a finding an analyst can act on.

What should you look for in crypto fraud detection tools?

Look for crypto fraud detection tools that link accounts to the wallets behind them, judge risk at the actor level, and explain every flag in terms an analyst can check. Wallet screening alone and device scoring alone each leave the same gap.

Use these questions when you assess any tool, including ours:

The explainability point deserves weight. A bare risk score tells an analyst nothing about what to check. A reason such as "matches a known referral-abuse signature" or "two transfers from a known-risky entity" tells them exactly where to look. They can verify it in minutes and act, or clear it. A cleared flag is also useful: it becomes a label that improves future results.

How do you add a wallet layer without replacing your stack?

You add a wallet layer next to the tools you already run. Your device fingerprinting keeps watching sessions. Your verification tooling keeps doing verification. The wallet layer adds the one view neither can produce on its own: which accounts and wallets belong to the same actor.

Addressable Anti-fraud is built for that position. It does not replace device fingerprinting or verification tooling, and it does not perform verification itself. It adds the layer neither side can see on its own. The output is a set of named, explained flags that sit next to the signals your team already uses.

Starting does not require a technical project. Public deposit addresses are all that is needed. Nothing is installed on your properties, nothing is shared and there is no integration. The first output is the actors costing you money: the wallets, the clusters and what they have taken. That matters in a sector where, in the same LexisNexis Risk Solutions survey, 81% of respondents said even moderate onboarding friction can drive customers to competitors. A wallet layer that starts from public deposit addresses adds no new step to sign-up.

Once the layer is in place, your team keeps control of every decision:

• Policy. You set your own thresholds, weights and bands.
• Actions. You choose what each band triggers: allow, monitor, hold or deny. Any blocking is a decision in your policy, configured by your team.
• Review. Uncertain cases go to your review queue, not to an automatic decision.
• Dry run. You can test any change against the last thirty days before it goes live.

There is also a network effect. When an actor is flagged anywhere in the network, their risk on your platform rises the same day, before they have done anything to you. Your data never leaves your tenant. Only the derived risk state is shared. Infrastructure is isolated, only derived risk state is shared between tenants, and retention, deletion and reuse terms are set by contract. Human review is the default.

To see how this fits the rest of your controls, read more about crypto fraud detection on the Addressable Anti-fraud platform.