Privacy guideUpdated 2 November 2026

What is blockchain analysis? How companies and police turn public addresses into names.

sections: 9
min read: 11
primary sources: 12

Fig. 00How analysts put names on addresses

Short answer: it's reading a public ledger until the addresses have names.

In June 2025, US agents moved to seize $225.3 million tied to investment scams. The first tool the government's release names: blockchain analysis.

No wiretap. No informant. A ledger anyone can download, and a few rules applied very patiently.

In this guide you'll see what analysts start with, the rules that group addresses into owners, where the names actually come from, how often the rules are wrong, what a risk score means for your wallet, and what analysis can't see.

Let's get into it.

01What analysts start with: the same data you can see

There's no secret feed. Blockchain analysis starts from the public ledger: every transaction, every address, every amount, every timestamp. The same data any block explorer shows you for free.

What analysts add is scale and method. They load the entire history into a graph, where addresses are dots and payments are lines, then run rules over it.

The whole method in five steps. Only step four needs anything from outside the chain.

This guide is written for the person on the other side of that graph: you. For a coin-by-coin view of what each chain makes public, see our main guide, is crypto anonymous?

02Grouping addresses: the rules that do most of the work

One address says little. A group of addresses that all belong to one person says a lot. Grouping is the heart of the job.

The spent-together rule

To spend from an address you need its key. So if one transaction spends from three addresses, one person (or one wallet) held all three keys. Bitcoin's white paper itself says multi-input transactions necessarily reveal that their inputs were owned by the same owner.

Run that rule over millions of transactions and the groups snowball. A shares with B, B shares with C, so A, B and C are one owner.

Each payment that spends two addresses together draws a line. Every connected group is treated as one owner.

The change rule

Bitcoin-style coins pay in whole pieces and send the leftover back as change. Spot which output is the change (a fresh address, an odd amount, the same address type as the inputs) and it joins the sender's group. Our guide to whether Bitcoin can be traced draws one of these transactions clue by clue.

The weaker signals

The Bitcoin Wiki lists the rest: reused addresses, round numbers, matching timing, the fingerprint of a particular wallet app, peel chains, and the IP addresses nodes see when a payment is broadcast. Each one is weak. Combined, the wiki calls it data fusion: many small leaks adding up to one strong link.

03Ethereum and Tron: no change, different clues

Account chains work differently. On Ethereum, an address is a long-lived account that holds its own balance, with no change outputs. The change rule has nothing to grab.

It doesn't need to. One account already holds its whole history in one place. And analysts follow who paid the fees.

Two wallets that look separate, both funded by one fee payer. That funding links them.

On Tron, moving USDT burns TRX for fees, so someone has to send TRX to the wallet first. Police-affiliated researchers published a method in 2025 that tracks exactly those fee flows to find wallets meant to look separate. More in how USDT is traced on Tron.

04Where the names come from

Here's the part most explanations skip. The chain holds no names. Every label on a group arrives from somewhere else.

Names flow in from outside the chain. One label can name a whole group.

Exchanges that checked ID. Under the FATF rules, regulated services verify customers and keep records. The address they paid you is in your file.
Test purchases. The 2013 study's researchers bought from Bitcoin businesses 344 times, just to learn their addresses. It is still one of the ways an address gets its label.
Public posts. Donation addresses, forum signatures, screenshots. All searchable.
Police and sanctions lists. Addresses named in court cases and on government sanctions lists get labelled for everyone.

05How accurate is blockchain analysis?

The rules are guesses. Good ones, but guesses, and the best-known study of them measured how often they miss.

The 2013 study known as A Fistful of Bitcoins called the spent-together rule "quite safe", since the sender must hold every key. It called the change rule "significantly less safe", and put numbers on it:

How often the change rule guessed wrong in the 2013 study, as the researchers refined it. Source: Meiklejohn et al., 2013.

Even refined, one bad merge glued 1.6 million keys belonging to big services into a single false "owner", until the team added more rules to split it. In the end, 1,070 hand-tagged addresses named 2,197 groups covering over 1.8 million addresses.

So: powerful, and fallible. A cluster is evidence, not proof, which is why investigations pair it with records from outside the chain.

06Risk scores: what analysis means for your wallet

For most people, analysis shows up as a risk score. Exchanges run incoming deposits through analysis software, which checks how close the coins sit to a flagged group: a hack, a sanctioned address, a scam.

The fewer payments between your coins and a flagged wallet, the higher the score. The exact scale differs by company.

A high score can mean a held deposit and questions about where the coins came from, even if you did nothing wrong and the coins simply passed through bad hands earlier.

What lowers the odds: receive into an address you use for one purpose, be careful about accepting coins from strangers, and keep records of where your coins came from in case anyone asks.

07Who uses blockchain analysis

Three kinds of user, three jobs.

Exchanges and payment companies, to screen deposits and meet their compliance duties.

Police and tax agencies. The US Department of Justice says it traced the Colonial Pipeline ransom by reviewing the Bitcoin public ledger. In 2024 it convicted the operator of a bitcoin mixing service after what it calls painstaking tracing through the blockchain. And in 2025 agents used blockchain analysis to seize $225.3 million tied to investment scams.

Researchers, who started it all in public, as the next section shows.

08A short history of blockchain analysis

The field is older than most people think, and it was built in the open.

From the white paper's own warning to a $225.3 million seizure.

2008. The Bitcoin white paper itself notes that spending together links addresses.
2011. Researchers show the public history can be combined with outside information to link activity to people.
2012. The entire transaction graph is mapped and analysed.
2013. Test purchases and two rules name over 1.8 million addresses.
2021 to 2025. The methods reach courtrooms: a ransom traced, a mixing service's operator convicted, $225.3 million seized.

09What blockchain analysis can't see

Every rule has a gap. Knowing them tells you what actually protects you.

What each step does to the analyst's rules
Step	What it breaks	What still works
CoinJoin	The spent-together rule	What you do with the coins afterwards
A fresh address per payment	Address reuse	Spending those addresses together later
Separate fee funding	The fee-payer link on Tron and Ethereum	Where the token itself came from
Monero	Nearly every grouping rule	The edges: where you buy or sell it
No ID-linked account	The name, the one thing the chain lacks	Grouping, which still happens, without a face

The Bitcoin Wiki describes how CoinJoin breaks the spent-together rule on purpose: many people sign one transaction, so the inputs no longer share an owner. Monero hides sender, receiver and amount by default.

The last row is the simplest. Analysis can group a wallet forever and still not know whose it is, if no link to a name ever enters the group. Most names enter through an account that checked ID. A swap with no account doesn't create that record. For the routine, read how to send crypto anonymously; to see what we keep and why, read how a swap works here.

One honest limit

Analysis reads history, and history doesn't change. Groups formed from your old payments stay formed. Privacy starts with the next wallet, not by cleaning the last one.

Keep reading

How we checked this

Written by the team that runs the SilentMule swap desk. The rules and their error rates come from the original research papers, linked where each figure appears. Cases come from the US Department of Justice's own releases. No analytics company's marketing claims are used. Last checked 2 November 2026. Spotted something wrong? Tell us and we fix it.

Sources

A wallet with no past. No account, no ID.

Analysis needs a link to a name. A swap with no account leaves no customer file: your coins in, the coin you want out, paid to a wallet you just made.

Monero, which gives the grouping rules little to work with
What lands is shown before you send
Fast lands within the hour, Stealth on the day you pick

Questions, answered.

How does blockchain analysis identify people?

It doesn't, on its own. It groups addresses into likely owners using the ledger, then a name arrives from outside: an exchange's ID records, a purchase, a public post or a police file. One named address can name a whole group.

What is address clustering?

Grouping addresses that probably belong to one owner. The main rule: addresses spent together in one transaction share an owner, because the sender needed every key. Groups then merge as more payments link them.

How accurate is blockchain analysis?

It depends on the rule. In a 2013 study, the rule for spotting change addresses was wrong 13% of the time at first and 0.17% once refined. The spent-together rule is much safer, but a cluster is evidence, not proof.

Can blockchain analysis trace Monero?

Not in the usual way. Monero hides the sender, the receiver and the amount of every payment, so the grouping rules have little to work with. The edges, where Monero is bought or sold, are still visible to the exchange involved. What Monero hides, and where it leaks.

Is blockchain analysis legal?

Yes. It reads public data. Exchanges use it to meet their compliance duties, and police use it in investigations.

Why was my deposit held by an exchange?

Often because its analysis software scored the coins as too close to a flagged wallet, such as a hack or a sanctioned address. That can happen even if you did nothing wrong and the coins passed through bad hands earlier.

Does a new wallet beat blockchain analysis?

Only if nothing links into it. Fund a new wallet straight from an ID-checked exchange and it joins your group on day one.

Analysis needs a name.

Don't hand one over. The mule never asks.

Load the mule How it works