Address forensics and clustering: following funds on-chain
The heuristics investigators use to link addresses and follow money on Bitcoin and EVM chains, where each one breaks, and how to reach conclusions that hold up.
Updated 14 Sept 2026 · Advanced · 5 min read
In short
- Clustering groups addresses that probably share an owner. On Bitcoin the strongest clue is addresses spent together in one transaction; on EVM chains it is shared deposit addresses and funding sources.
- Every heuristic has known failure modes, CoinJoin above all. Treat a cluster as a hypothesis with a confidence level, not a fact.
- Good forensics is documented: each link has its evidence, its source and a statement of how sure you are, so someone else can check the reasoning.
What forensics can establish
Public blockchains record every movement of value but not who controls an address. Forensics joins the two. It uses patterns in transactions to decide which addresses probably share an owner, and labels from outside the chain, such as a known exchange wallet or a sanctions listing, to suggest who that owner might be. The output is a set of inferences. How to read an address report covers the individual fields; this guide covers the reasoning behind them.
Bitcoin: common-input ownership
To spend several outputs in one transaction, the spender must be able to sign for all of them, so inputs spent together usually share an owner, a point the Bitcoin white paper itself makes. Apply that rule across transaction after transaction and addresses group into a cluster that approximates a wallet.
It fails in two well-known ways. In a CoinJoin, many people deliberately combine their inputs in one transaction and receive equal-sized outputs, so the rule would merge strangers. In a PayJoin, the recipient quietly adds an input of its own to the payment, which breaks the assumption while making the transaction look ordinary. Good tools detect equal-output CoinJoins and refuse to cluster across them; PayJoins are designed to be indistinguishable.
Our address checker detects the common CoinJoin patterns, including Whirlpool’s fixed pool sizes, and leaves them out before it clusters addresses.
Bitcoin: change, peel chains and dust
Following money means deciding which output of each transaction is the payment and which is change. The usual clues, strongest first:
- An output back to one of the inputs’ own addresses. That is address reuse, and it gives the change away almost for certain.
- The only output with the same script type as the inputs, because wallets usually make change in their own address type.
- The only non-round amount when the others are round. People pay 0.05 BTC; change is whatever is left.
Other patterns describe behaviour. A peel chain passes a large sum through a series of fresh addresses, splitting off a small payment at each hop, a pattern common when funds are being laundered or paid out in pieces. Dust, tiny outputs sent unasked, is sometimes used to tag wallets so that spending it links them together. Each of these is a probability, and a report should say so.
EVM chains: accounts and their habits
An EVM account is a single balance, so there are no inputs to merge. Clustering relies on behaviour instead:
- Deposit addresses. Exchanges give each customer a unique deposit address that forwards to a hot wallet. Several addresses paying into the same deposit address very probably belong to the same customer.
- Gas funding. A new address needs ETH for gas before it can do anything. Whoever sent that first ETH is a strong lead to the owner, or to the service the owner used.
- Shared behaviour. Addresses that approve the same unusual contracts, act in lockstep or transact at the same hours often share a controller. That is how airdrop teams find people running hundreds of wallets.
- Names and signatures. An ENS name, a signed message or a public post tying an address to an identity is often the link that turns a cluster into a person or a company.
Smart accounts complicate this. A Safe, or an account using EIP-7702, can have its transactions submitted and paid for by someone else, so the address that paid the gas is not necessarily the owner.
Labels, hops and exposure
A cluster becomes useful when one of its addresses carries a label. Labels range from authoritative, such as the OFAC sanctions list, through curated lists of exchange and bridge wallets, to community tags, and each should carry its source. Exposure then measures how funds connect to labelled entities. Direct exposure is a transaction with the labelled address itself; indirect exposure passes through one or more intermediate hops.
Indirect exposure weakens quickly with distance. Large exchanges and services sit at the centre of the transaction graph, so a few hops out a large share of ordinary addresses can be connected to something flagged. Decide in advance how many hops matter for your purpose, and why.
Our address checker shows the evidence behind every point of its risk score: the factor, the counterparties involved and the source of each label. Paid plans follow flows across several hops, and a free account already keeps private tags and a case file for your findings.
Building a case others can check
- Start from a precise question: whose funds are these, where did they go, did they touch a sanctioned party?
- Record every step: the address, the transaction, the heuristic applied and how confident you are in it. Private tags and case files keep that trail in one place.
- Prefer links that rest on more than one heuristic. A change guess later confirmed by common-input spending is stronger than either on its own.
- Look actively for reasons you might be wrong: CoinJoins, PayJoins, custodial wallets that mix many customers’ funds, and shared services.
- Screen the addresses that matter against the sanctions list, and use bulk screening when there are many.