chain analysis

Chain analysis is the discipline of reading a public blockchain to figure out who is doing what — clustering pseudonymous addresses into real-world entities and tracing how value flows between them. Because every Bitcoin or Ethereum transaction is permanently public, the ledger is a uniquely rich forensic dataset, and a whole industry (Chainalysis, Elliptic, TRM Labs and others) has grown up to mine it for exchanges, banks, tax authorities and law enforcement. The uncomfortable truth it exposes is that transparent cryptocurrencies are pseudonymous, not anonymous, and pseudonymity is brittle.

The core technique is heuristic clustering. The common-input-ownership heuristic groups all inputs of a transaction as one wallet. Change-address detection picks out which output returns to the spender using cues like script type, round-number payments, and freshly created addresses. Address-reuse and dust-tracking link transactions over time. Behavioural fingerprints — wallet software quirks, fee strategies, transaction timing, the use of specific token contracts — narrow entities further. None of these is certain on its own, but combined across millions of transactions they produce high-confidence clusters covering large fractions of on-chain activity.

Heuristics become identities when joined to off-chain data. Exchanges enforce know-your-customer rules, so a single deposit from a clustered wallet to a regulated exchange can attach a legal name to thousands of addresses. Network-layer leaks help too: an adversary running many nodes can observe which peer first relays a transaction to estimate its origin IP. Public tags (donation addresses posted online, addresses doxxed on social media, ransom notes) seed the graph with ground-truth labels that propagate outward through the clusters.

Chain analysis is why privacy techniques exist, and the two co-evolve in an arms race. CoinJoin breaks the common-input heuristic; stealth addresses break receiver linkage; confidential transactions remove amount fingerprints; shielded pools remove the graph entirely. Analysts respond with denomination analysis, timing correlation, and flagging of mixer interactions. The realistic stance is that on transparent chains, strong privacy requires deliberate, layered effort, and even privacy coins can leak through metadata if used carelessly.