Timechain Wiki

Address reuse and chain analysis

20 min read

Chain analysis takes Bitcoin's public transaction graph, resolves it into clusters of addresses controlled by single entities, then resolves clusters into real-world identities. It is performed at industrial scale by commercial firms (Chainalysis, TRM Labs, Elliptic, Merkle Science, Crystal, Coinfirm) serving government, law enforcement, exchange compliance, and private-investigator customers. Clustering rests on a few robust heuristics — the common-input-ownership heuristic, change detection, and address reuse (the single most damaging behaviour a holder can adopt). Identity resolution rests on KYC records, court-orderable exchange data, address-tag leaks, and surveillance integrations. The practical defence is address-reuse avoidance combined with coin control to avoid co-spending unrelated UTXOs. Chain-analysis outputs feed the KYC-data-to-home-invasion pipeline Common attack vectors catalogues, making this upstream of the physical-attack threat model rather than an abstract privacy concern.

Why this note matters

Most newcomers think of Bitcoin as either “totally anonymous” or “totally transparent” — both wrong. The actual property is pseudonymity with linkability: addresses are pseudonyms, but the public transaction graph plus a few robust heuristics resolves most ordinary wallet activity into identifiable clusters. Once a cluster is identified — via an exchange KYC record, a public address disclosure, a tagged transaction, or any of a dozen other channels — the firm can trace forward and backward through the graph.

The note matters because:

  • It establishes the chain-analysis industry as a real adversary, not a theoretical concern; the principal firms have hundreds of millions in revenue and serve every major exchange, bank, and law-enforcement agency that touches Bitcoin.
  • It anchors the address-reuse-as-the-primary-failure message that organizes the Privacy practice cluster.
  • It connects to the physical-attack threat pipeline Common attack vectors describes — chain analysis is upstream of the KYC-data-to-home-invasion pattern Lopp documents.
  • It defines what the privacy-enhancing tools (CoinJoin, PayJoin, Stealth addresses and Silent Payments) are defending against.

A holder who treats chain analysis as a structural feature of Bitcoin’s design and adapts behaviour accordingly preserves practical privacy; ignoring it exposes a non-academic threat surface.

What chain analysis is

Bitcoin’s blockchain is a public ledger. Every transaction — its inputs, outputs, amounts, timestamps, and ordering — is permanently visible to anyone. Addresses themselves are pseudonymous strings; they do not carry identity by default. But the transaction graph that links addresses together carries enormous structure, and that structure is what chain-analysis firms exploit.

The work happens in two phases:

  1. Clustering — group addresses into clusters that one entity controls. This uses on-chain heuristics (described below) and produces a dataset of clusters without identity attached.
  2. Identity resolution — attach a real-world identity to each cluster. This uses KYC records, exchange data (often court-ordered), public address disclosures (donation pages, “tip jars,” Twitter screenshots), behavioural fingerprints, surveillance integrations, and dark-pool intelligence.

The output is a tagged graph: for each transaction in Bitcoin’s history, the firm can often say which clusters were involved, and for many clusters, which real-world entity controls them.

This work is done at industrial scale. Chainalysis publishes an annual “Crypto Crime Report” with quantitative claims about flows across the network. TRM Labs and Elliptic serve compliance functions at every major exchange. The intelligence has matured to the point where its accuracy is good enough to be the basis for criminal prosecutions, civil asset seizures, and exchange compliance decisions — and increasingly, opportunistic-criminal targeting.

The clustering heuristics

Three heuristics do most of the work.

Common-input-ownership heuristic (CIOH)

The rule: if multiple UTXOs are spent as inputs in the same transaction, they are presumed to belong to the same entity.

Why it works: spending a UTXO requires signing with the private key. A transaction with multiple inputs requires multiple signatures, normally produced by one wallet under one user’s control. Multi-party coordinated spending (CoinJoin, PayJoin, multi-sig with distributed signers, atomic swaps) breaks this assumption — but in ordinary single-user wallets, CIOH is correct in well over 99% of cases.

Implication: every ordinary spend tells the chain-analysis firm “these UTXOs are co-owned.” Over time, that’s enough to merge clusters together.

The exceptions:

  • CoinJoin transactions deliberately violate CIOH by having multiple unrelated participants pool inputs into one transaction.
  • PayJoin transactions violate CIOH by including the recipient’s UTXO alongside the sender’s — the heuristic incorrectly merges the two parties.
  • Multi-sig signed by geographically-distributed signers could in principle violate CIOH, but in practice the keys are typically grouped into the same operational identity, so the heuristic still effectively clusters them.
  • Atomic swap inputs can violate CIOH in cross-chain operations.

The chain-analysis firms know about these exceptions and increasingly account for them — but every CoinJoin transaction the firms can identify becomes a “this is a CoinJoin, don’t apply CIOH” exception, while every ordinary transaction continues to inform clustering.

Change-detection heuristics

The rule: when a transaction has two outputs, one is typically the payment to a counterparty and the other is the sender’s change. Identifying which is the change resolves the wallet’s continuing UTXO pool.

Why it works: most ordinary spends look like “send X to recipient, receive change back.” Several signals identify the change:

  • Round-number heuristic: payments are often round numbers (0.1 BTC, 0.01 BTC, fiat-denominated round amounts). Change is the residual — almost never round.
  • Address-type heuristic: a wallet typically receives change to addresses of the same type as its receive addresses (P2WPKH change for a SegWit wallet, P2TR change for a Taproot wallet). If one output is the wallet’s typical address type and the other isn’t, the matching one is change.
  • Sequence heuristics: within a wallet’s derivation path, change addresses follow a separate branch (m/0/* vs m/1/* in BIP-44). The chain-analysis firm doesn’t see the derivation path directly but can infer the pattern from sufficient observations.
  • First-spend heuristic: an output that is later spent in a transaction that combines it with known-wallet inputs is the change.
  • Optimal-change heuristic: wallets sometimes select inputs to minimize change relative to payment, producing a payment-larger-than-change pattern.

Implication: identifying change keeps the sender’s wallet cluster intact across the spend. The recipient’s address joins the recipient’s cluster; the change joins the sender’s.

Wallet-fingerprinting: the way a wallet builds transactions — input selection algorithm, fee estimation, RBF flagging, script type choices — leaks a fingerprint. Different wallet software produces structurally distinguishable transactions. Some wallets are widely-used (Bitcoin Core wallet, Electrum, Sparrow); a transaction’s fingerprint plus its other features narrows the wallet identity considerably. Wallets that deliberately avoid distinguishable fingerprints (notably Wasabi historically; Sparrow’s privacy mode) reduce this signal but cannot eliminate it.

Address reuse

The rule: an address that appears as an output in multiple transactions belongs to the same entity in all of them.

Why it works: each Bitcoin address is derived from a public key (or a script). Reusing the same address means the same public key — and once the holder spends from that address, the public key is also revealed (it’s in the spending input’s script). All future appearances of that address are obviously linked to the same wallet.

Why it is the single most-damaging behaviour: address reuse instantly collapses any clustering ambiguity. Two transactions to the same address are unambiguously to the same recipient. The chain-analysis firm doesn’t need any heuristic — the linkage is exact.

Why holders do it anyway:

  • Mental shortcut: holders think of “their Bitcoin address” as a single identifier, like an email.
  • Cost: generating a fresh address takes a few clicks; some interfaces make it harder than it should be.
  • Convenience: a donation page or “tip jar” with one address is easier to maintain than rotating addresses.
  • Misunderstanding: many holders don’t realise the privacy cost.

The cumulative effect: a holder who reuses one address for receive over years builds the chain-analysis firm a perfect dossier — every payment in, every spend out, every counterparty, all linked. Address reuse defeats the privacy properties that the rest of the privacy stack tries to preserve.

Identity resolution: how clusters become names

Clustering produces a graph of pseudonymous clusters. Identity resolution attaches names. The principal channels:

Exchange KYC records. Every major exchange records the deposit and withdrawal addresses used by KYC-verified customers. Chain-analysis firms have direct relationships with exchanges (for compliance functions) and can also receive these records via court order. See KYC leakage for the full treatment of this channel.

Public address disclosure. Donation addresses, “tip jars,” addresses posted to Twitter or Reddit, addresses published in blog posts, addresses leaked in screenshots — any voluntary disclosure links the cluster to whoever made the disclosure.

Tagged transactions. Some addresses are systematically tagged because of their function: known exchange hot wallets, mining pool payouts, gambling-site deposit addresses, ransomware payment addresses, known mixer outputs. Chain-analysis firms maintain large databases of tagged addresses.

Surveillance integrations. Some chain-analysis firms maintain relationships with intelligence agencies, providing direct access to flows. The 2023 Treasury Department designations of mixing services were informed by such integrations.

Behavioural fingerprinting. Time-of-day patterns, fee-paying patterns, recipient counterparty patterns. A wallet that always pays the same set of recipients in a recognizable cadence builds a fingerprint that, combined with one identity disclosure, identifies the wallet.

Dark-pool intelligence. Some firms operate informant networks within the broader crypto ecosystem. Trade-secret protected; difficult to enumerate.

Address poisoning attacks. A more recent vector: attackers send dust to a target address from an attacker-controlled address that looks similar. If the target later copies the wrong address from their transaction history, the funds go to the attacker — but separately, the dust itself is a probe that can be analyzed and correlated. (This is distinct from chain-analysis but uses the same address-graph machinery.)

The output is a graph in which most active clusters are tagged with a real-world identity or category. The remaining un-tagged clusters are presumptive single-entity wallets without identity attached — which is the privacy property a careful holder is trying to preserve.

The chain-analysis industry

A short inventory of who is doing this and for whom.

Chainalysis (US-based; founded 2014). The largest and most-visible firm. Government and law-enforcement contracts (IRS, FBI, DEA, DOJ); compliance services for exchanges and banks; annual “Crypto Crime Report.” Reportedly raised >$500M in funding; valuation has fluctuated with the crypto cycle.

TRM Labs (US-based; founded 2018). Compliance-focused; serves exchanges, banks, fintech, and government customers. Strong investigations focus.

Elliptic (UK-based; founded 2013). Long-established; serves banks, exchanges, and regulators. Particularly strong on the European market.

Merkle Science (Singapore-based; founded 2018). Asia-Pacific focus; expanding to other markets. Behavioural-analytics emphasis.

Crystal Intelligence (Liechtenstein-based; founded 2018). Investigations-focused; European market.

Coinfirm (Poland-based). Compliance-focused; smaller market share but established.

Internal exchange teams. Major exchanges (Coinbase, Kraken, Binance, others) operate internal chain-analysis teams that complement external vendors.

Government agencies. The IRS Cyber Crimes Unit, FBI Virtual Currency Initiative, and equivalents in other major jurisdictions operate internal capabilities, often built on commercial vendor data plus proprietary intelligence.

The customer base in broad strokes:

  • Exchanges and banks (compliance) — by far the largest commercial segment; KYC/AML requirements drive the bulk of revenue
  • Government and law enforcement — investigations, civil seizures, criminal prosecutions
  • Private investigators — divorce cases, civil disputes, judgment-enforcement
  • Private surveillance — corporate due diligence, competitive intelligence, opportunistic targeting

The last category is the one most relevant to Common attack vectors. Chain-analysis output that identifies “this person controls 100 BTC at this address cluster” is a marketable input to physical-attack targeting operations.

Address-reuse hygiene as the foundational defence

Almost every practical privacy improvement starts with address-reuse hygiene. The discipline:

Generate a fresh receive address for every payment. All modern HD wallets (Seed phrases and BIP-39 BIP-44/49/84/86 derivation) produce a near-infinite supply of receive addresses from a single seed; using fresh ones costs nothing. The wallet UI typically defaults to fresh; the holder should leave that default in place.

Never publish a static “donation address.” A persistent address on a website, profile, or social-media bio is an identity-bound endpoint that links every payment to one recipient cluster. Use payment-protocol alternatives instead: BIP-21 URIs with rotated addresses, BIP-353 DNS-based payment instructions, or Stealth addresses and Silent Payments BIP-352 payment codes (when wallet support exists).

For ongoing income (subscriptions, service fees), generate a fresh address per payment if the counterparty can support it. Some services support per-payment addresses (BTCPayServer; Strike’s address-rotation); others default to a static address that you must accept as a leak.

Coin control: don’t combine unrelated UTXOs in one transaction. Each transaction’s input set triggers CIOH clustering. Combining a UTXO received from one counterparty with a UTXO received from another tells chain-analysis these two counterparties pay the same recipient. Many wallets default to combining whatever inputs minimize fees, which is privacy-hostile; better wallets (Sparrow, Wasabi, Samourai historically) make coin control explicit.

Maintain separate wallets for different purposes. The tiered-wallet pattern from Hot vs cold storage applies here: a hot wallet for spending, a cold wallet for savings, ideally a third wallet that holds KYC-tainted coins separately from the post-mixing/post-acquisition stack. Each wallet’s transactions are clustered separately as long as no transaction combines UTXOs across wallets.

Avoid wallet-fingerprint leaks. The wallet’s transaction-building patterns leak which wallet software produced the transaction. For most holders this is acceptable; for privacy-focused holders, wallets that deliberately mimic common patterns (Sparrow’s privacy options) reduce the leak.

Don’t post addresses to social media or messaging. Voluntary disclosure is the single most-direct identity-resolution channel. A “look at my balance” screenshot is an address-cluster identifier the holder has just handed to chain-analysis.

These defences are operational rather than cryptographic. They cost almost nothing to adopt; they materially improve the privacy floor for any holder.

What chain analysis cannot do (limits and degradations)

Chain analysis is powerful but not omniscient. Several honest limits:

It is probabilistic, not deterministic. Clustering relies on heuristics; the heuristics have known failure modes. A CoinJoin participant cannot be definitively linked to their post-mixing UTXO without additional information. The chain-analysis firm assigns confidence levels; those confidence levels are sometimes overstated in marketing material but real in the underlying methodology.

It degrades when the heuristics break. A holder who systematically avoids address reuse, uses coin control, and occasionally CoinJoins forces the firm to rely on weaker signals. The cluster’s privacy floor rises — not to zero traceability, but to “ambiguous within a defined anonymity set.”

It cannot pierce well-implemented privacy tools. Bitcoin CoinJoin implementations (Wasabi’s WabiSabi, JoinMarket, Samourai’s Whirlpool historically) produce equal-output structures that the firm can identify as CoinJoin but cannot link participant inputs to outputs with high confidence. Newer designs like BIP-352 Silent Payments (see Stealth addresses and Silent Payments) decouple payment notification from on-chain footprint in ways that further limit clustering.

It depends on identity-resolution channels remaining open. A holder who never KYC’s, never posts addresses, and acquires coins through non-KYC channels has no chain-analysis identity-resolution surface available to the firm. The cluster exists; the name attached to it does not.

Lightning Network activity is largely invisible. Routed Lightning payments do not appear on-chain. Channel open and close transactions appear; their on-chain footprint is identifiable. But the routed payments inside an opened channel are off-chain. See Lightning privacy properties for the full treatment of what Lightning does and doesn’t hide.

Historical analysis cannot retroactively un-do good privacy practice. A holder who started with good hygiene from year one has a different practical privacy profile than a holder with a long history of address reuse who then started practicing hygiene. But hygiene from any point forward improves the floor going forward; the past cannot be un-leaked, but the future can be tightened.

The honest read: chain-analysis is effective enough to be a real adversary for ordinary holders, but defeatable enough that privacy-practising holders maintain meaningful practical privacy. The cluster of techniques that defeat it — address-reuse hygiene, coin control, CoinJoin, PayJoin, careful identity hygiene, Lightning use — collectively raise the cost of identity resolution to levels that most non-state adversaries will not pay.

Counter-arguments and tensions

”Everything on the blockchain is public anyway, so privacy practice is pointless”

The argument: Bitcoin’s transaction graph is permanently visible; chain-analysis is an inevitable consequence of the design. Any privacy practice is fighting against the protocol’s structure.

Response: Visibility is not the same as linkability or identifiability. The public graph is observable, but observers cannot resolve clusters to identities without additional information. Privacy practice is fighting against identifiability, not visibility — and identifiability depends on heuristics and identity-resolution channels that holders can deny. The “everything is public” framing is a defeatist mistake; the relevant property is what an external observer can practically derive, not what is theoretically encoded.

”Chain analysis is overrated; most attribution is wrong”

The argument: Chain-analysis firms market aggressively; their actual attribution accuracy is lower than they claim; relying on their work has produced wrongful prosecutions and seizures.

Response: The criticism has merit — chain-analysis claims have been challenged successfully in court, and the firms’ confidence levels are sometimes overstated. But the practical effect on the holder’s threat model is what matters: a firm that resolves your cluster to your identity with 80% confidence still feeds that resolution into compliance decisions, court orders, and physical-attack targeting. The 20% error rate is the holder’s problem only if the holder is wrongly attributed; the 80% accuracy rate is the holder’s problem if the holder is correctly attributed. The defensible position treats chain-analysis as a real threat with imperfect-but-significant capabilities, not as either omniscient or impotent.

”Privacy practice attracts attention from authorities; it’s safer to act normal”

The argument: A holder who CoinJoins or otherwise demonstrably practices privacy raises flags with compliance systems; the safer course is to look like every other ordinary user.

Response: This is a real tension, not dismissible. CoinJoin participation is in some jurisdictions a flag for enhanced compliance review; exchanges have historically frozen accounts that deposited post-CoinJoin coins. The tension is genuine: privacy practice has a visibility cost. Two honest responses: (1) for holders whose threat model is dominated by physical-attack targeting and chain-analysis-driven civil exposure, the privacy benefit outweighs the compliance friction; (2) for holders whose threat model is dominated by regulatory exposure, the compliance-friction cost may outweigh the privacy benefit. The right answer depends on the holder’s specific threat model — see Threat modeling for self-custody — and is not a one-size-fits-all decision. The Privacy practice cluster’s notes treat each tool’s compliance footprint explicitly so the holder can make an informed trade-off.

”Most chain-analysis exposure is downstream of KYC; address-reuse hygiene is small potatoes”

The argument: The biggest identity-resolution channel is exchange KYC, not on-chain heuristics. Address-reuse hygiene is irrelevant if the holder has any KYC exposure at all.

Response: Partially true; KYC is the dominant identity-resolution channel (see KYC leakage). But the two threats compound rather than substitute. A holder with KYC exposure but good address-reuse hygiene has a cluster that resolves to “this person’s KYC-tainted stack” but cannot easily be merged with the rest of their holdings. A holder with KYC exposure and address-reuse leak has the entire stack merged into one cluster, fully resolved. Address-reuse hygiene matters most for the post-KYC stack — the coins acquired after the KYC entry, where the holder can still preserve clustering ambiguity going forward. The two defences operate at different layers and both pay off.

”The chain-analysis-to-home-invasion pipeline is overstated; ordinary people aren’t targeted”

The argument: Lopp’s database documents specific cases but they’re a small fraction of the holder base. The targeting threat is real for high-profile holders but not for ordinary ones.

Response: The 2024-2025 Physical Bitcoin Attack database surge that Common attack vectors documents is the operational counter-argument. The attacker base has expanded from organized-crime targeting of high-net-worth holders to opportunistic attacks on identifiable-but-modest holders. The underlying data pipeline (KYC leaks plus chain-analysis output) makes ordinary holders findable in ways that didn’t exist before 2020 at meaningful scale. The “ordinary people aren’t targeted” framing was defensible in 2018; it is less defensible in 2026. Holders should not assume they are too small to be worth attacking — the targeting cost has dropped enough that opportunistic attackers can profitably target modest holdings.

Open questions for further development

  • The chain-analysis industry’s customer mix has expanded from law-enforcement to broader commercial and private surveillance. What is the current breakdown of how the firms’ output is used, and how is that mix shifting? The annual reports are marketing artifacts; better data would inform the threat model.
  • BIP-352 Silent Payments and BIP-78 PayJoin adoption rates remain low as of 2026. What is the realistic trajectory for these tools to materially shift the privacy floor for the median holder, and what wallet-software adoption is the gating constraint?
  • Lightning Network’s share of payment volume is growing. As more economic activity moves off-chain, what happens to chain-analysis’s marginal value? The firms have responded by acquiring Lightning-analysis capabilities; how mature is that capability?
  • Address-reuse hygiene assumes good wallet UI defaults. Several major mobile wallets still have UX patterns that nudge toward reuse. What’s the wallet-adoption-vs-default-pattern landscape, and which wallets should the section explicitly call out as privacy-hostile vs privacy-respecting?
  • The legal status of operating chain-analysis-resistant tools (CoinJoin, mixing services) has shifted considerably (Samourai indictment 2024, Tornado Cash sanctions 2022, ongoing cases). How does the section treat the legal uncertainty in a way that informs holders without becoming a legal-advice section?

Canonical sources for this note

The chain-analysis industry (primary materials):

  • Chainalysis — annual Crypto Crime Report (2020-2026); various white papers on clustering methodology and KYT (Know Your Transaction)
  • TRM Labs — Illicit Crypto Ecosystem Report (annual); investigative case studies
  • Elliptic — Crypto Hub reports; case studies on specific investigations

Academic and independent analysis:

  • Meiklejohn, Pomarole, Jordan, Levchenko, McCoy, Voelker, Savage — A Fistful of Bitcoins: Characterizing Payments Among Men with No Names (2013) — the foundational academic paper on Bitcoin transaction clustering; the original CIOH formalization
  • Möser, Soska, Heilman, Lee, Heffan, Srivastava, Hogan, Hennessey, Miller, Narayanan, Christin — An Empirical Analysis of Traceability in the Monero Blockchain (2018) — adjacent work demonstrating clustering vulnerabilities in privacy coins
  • Goldfeder, Kalodner, Reisman, Narayanan — When the cookie meets the blockchain (2018) — web-tracker-to-blockchain identity linkage
  • Nick — Data-Driven De-Anonymization in Bitcoin (2015) — earlier work on heuristic clustering

Practitioner literature:

  • 6102bitcoin’s Bitcoin Privacy Guide — practical-defences walkthrough; widely-respected in the privacy-practising community
  • Bitcoin Q+A podcast — episodes on chain-analysis and privacy practice
  • Wasabi Wiki and JoinMarket documentation — practical CoinJoin orientations include chain-analysis primers
  • The OXT.me and mempool.space explorers — practical tooling for seeing what chain-analysis sees

Counter-perspective:

  • Open Privacy Research Society materials — critiques of chain-analysis methodology and the over-claiming of attribution accuracy
  • Court filings in cases challenging chain-analysis-based prosecutions (sealed and unsealed)

Adjacent threat-context:

  • Lopp — Physical Bitcoin Attack Database (annual updates) — empirical data on the chain-analysis-to-physical-attack pipeline. See Jameson Lopp.
  • LegacyCipher synthesis (April 2026) — operationalizes the threat model into the Self-custody section’s operational guidance.

As of 2026-05-15: the chain-analysis industry is mature and well-capitalized; the privacy-tool side is mature but operationally constrained by wallet-software adoption gaps and regulatory friction.

Companion threat note (same sub-cluster):

  • KYC leakage — the identity-resolution channel that turns clusters into names

The defences (other Privacy practice notes):

The threat-modeling framework this operationalizes:

Address-reuse-hygiene operational notes:

Adjacent thinker pages:

  • Jameson Lopp — the empirical foundation for the chain-analysis-to-physical-attack pipeline

The sub-MOC home:

Graph View

Backlinks