How address clustering works
A blockchain shows addresses, not owners. Clustering infers the owners from behaviour, using heuristics such as:
- Common input ownership: addresses spent together in one transaction share an owner
- Change detection: the output that returns the remainder belongs to the sender
- Deposit sweeps: addresses emptied into the same main wallet belong to one service
- Behaviour: timing, fee settings and address types typical of one wallet's software
Where address clustering goes wrong
The first heuristic is as old as Bitcoin: its white paper notes that a transaction with several inputs necessarily reveals that those inputs had the same owner. Transactions built jointly by several users, such as CoinJoin, break that rule on purpose.
Account-based networks such as Ethereum have no inputs to combine, so other signals are used. A wrong merge can tie an innocent customer to a sanctioned entity, which is why analysts treat a cluster as evidence to weigh, not as fact.
Who relies on address clustering
Blockchain analytics providers build and maintain the clusters, then attach names to them, a separate step called attribution. Exchanges, on-ramps and payment firms consume the result through wallet screening and transaction monitoring: a deposit is scored by the clusters its funds passed through, not by single addresses.
Where Address clustering shows up in a platform
Modules that do the work
- Compliance reportingTransaction monitoring, the Travel Rule and regulatory reports, ready for your regulator.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.