The myth that cost a couple $3.6 billion
In August 2016, roughly 119,754 BTC were stolen from the Bitfinex exchange. The thieves did what most people imagine makes crypto untraceable: they shattered the loot into thousands of tiny transactions, bounced it between hundreds of addresses, and waited. They believed the trail had gone cold. It had not. Every one of those hops was written into a public ledger that never forgets. Six years later, in February 2022, investigators followed the money hop by hop and seized about 94,636 BTC — worth ~$3.6 billion, the largest financial seizure in U.S. history at the time. Ilya Lichtenstein later pleaded guilty to laundering the funds.
This is the central lesson of blockchain privacy: a blockchain is not anonymous. It is pseudonymous, and those two words are worlds apart. Anonymity means your actions can never be tied back to you. Pseudonymity means you act under a stable false name — an address — and everything that name ever does is public and permanent. If anyone ever connects that pseudonym to the real you, they don't just learn your last transaction; they unlock your entire history at once.
What an address actually hides — and what it doesn't
Recall from the cryptography rung that an address is a hash of a public key — on Ethereum, the last 20 bytes of the Keccak-256 of the key. It contains no name, no email, no passport number. In that narrow sense it is private: `0x742d…f44e` reveals nothing about who you are. The mistake is thinking that's where the story ends.
An address is better thought of as a pen name printed on a public billboard that records every payment you make under it, forever. The pen name protects you only until two things happen, and on a public chain both happen constantly: (1) the pen name is linked to other pen names you control, and (2) one of those names is tied to your legal identity. Step (1) is statistical detective work; step (2) usually just needs one careless touch of a regulated service. Together they are the field of chain analysis.
Two structural facts make this tractable. First, the ledger is public: anyone with a block explorer can read every transaction, balance, and link, with zero special access. Second, it is permanent: because of immutability, deanonymization is retroactive. A clustering technique invented in 2025 can be aimed at a transaction from 2014, because that transaction is still sitting there, byte-for-byte. You cannot delete your past.
The analyst's toolkit: clustering heuristics
The foundational paper is Meiklejohn et al., A Fistful of Bitcoins (2013), which showed you could collapse millions of Bitcoin addresses into a far smaller number of real-world entities using simple, reliable rules. Commercial firms like Chainalysis turned those rules into industrial tooling. The two workhorse heuristics are:
1. Common-input-ownership. To spend several UTXOs in one transaction, you must sign with every corresponding private key. So if a transaction has inputs from addresses A and B, the overwhelming default assumption is that one wallet controls both — merge them into a cluster. 2. Change-address detection. When you pay 1.5 BTC out of a 1.8 BTC coin, the chain sends ~0.3 BTC back to you as change. Analysts spot the change output by tells: it goes to a never-before-seen address, it's the non-round "leftover" amount, it shares the script type of the inputs. The change address is yours too — fold it into the cluster.
// Two Bitcoin-style transactions, as a block explorer would show them.
// TX_a: a single wallet (keys A and B) pays a merchant and gets change.
{
"txid": "a1f0...9c",
"vin": [
{ "addr": "bc1q...A", "value": 0.80 }, // signed by key A
{ "addr": "bc1q...B", "value": 1.00 } // signed by key B
],
"vout": [
{ "addr": "bc1q...M", "value": 1.50 }, // merchant: round, long-lived address
{ "addr": "bc1q...C", "value": 0.29 } // change: odd amount, brand-new address
]
// fee = (0.80 + 1.00) - (1.50 + 0.29) = 0.01
}
// TX_b: later, that same change is forwarded to an exchange deposit address.
{
"txid": "b7e2...4d",
"vin": [ { "addr": "bc1q...C", "value": 0.29 } ],
"vout": [ { "addr": "bc1q...KRAKEN_DEPOSIT", "value": 0.289 } ]
}- Common-input-ownership on TX_a: A and B both signed, so cluster them → {A, B}.
- Change detection on TX_a: output M is a round 1.5 to a reused merchant address; output C is the odd 0.29 leftover to a fresh address, so C is change → {A, B, C}.
- Follow TX_b: C is spent into a Kraken deposit address. Kraken is a regulated, identity-verified exchange.
- Deanonymize: a subpoena to Kraken returns the verified owner of that deposit address — and the whole cluster {A, B, C}, plus its entire history, now belongs to a named person.
The choke point: from cluster to courtroom
Clustering alone gives you a pseudonymous graph: thousands of addresses grouped into entities labeled "Entity 1, Entity 2…" To attach a real name, an analyst needs a single anchor point where on-chain pseudonyms collide with off-chain identity. That anchor is almost always a regulated on/off-ramp — a custodial exchange that, under anti-money-laundering law, must verify customer identity (KYC) before letting fiat in or out.
The instant funds from a cluster flow into (or out of) a KYC'd exchange deposit address, the entire cluster becomes deanonymizable on request. Law enforcement issues a subpoena; the exchange returns the name, ID document, and IP logs behind that address. This is also why taint analysis — tracking what fraction of a balance descends from a known-illicit source — matters commercially: exchanges screen incoming deposits and freeze or report "tainted" coins. One link to the real world retroactively colors everything upstream and downstream.
This is not theoretical. The 2013 takedown of the Silk Road marketplace, the 2019 dismantling of the "Welcome To Video" abuse site (hundreds of arrests across dozens of countries), and the Bitfinex recovery above all turned on the same move: cluster the addresses on-chain, then pin one of them to an identity via a regulated service. The blockchain was the prosecution's best witness — it had recorded everything and could not be told to forget. This is deanonymization in its purest form.
Why the account model can leak even more
Bitcoin's UTXO model at least encourages a fresh address per receipt, which is why UTXO privacy practice leans on never reusing addresses. Ethereum's account model is, by default, worse for privacy: one persistent account holds your balance and you reuse it for everything. There is no change address to hide behind — your entire balance and history hang off a single, stable identifier. Add a human-readable ENS name like `alice.eth` and you have published a phone book entry linking a memorable handle to that account.
Analysts have richer techniques beyond clustering. A dusting attack sends a trivial amount of "dust" to thousands of addresses; if a victim later spends that dust together with their other coins, the common-input heuristic merges those addresses for the attacker. Amount and timing correlation matches a withdrawal of 4.917 ETH at 03:11 to a deposit of 4.915 ETH at 03:14 somewhere else. And network-level deanonymization ignores the ledger entirely: by watching transaction propagation across the peer-to-peer network, an adversary running many connected nodes can often guess which IP address first broadcast a transaction — tying a wallet to a physical location before it ever lands in a block.
What pseudonymity costs you — and what's next
Beyond surveillance, transparent chains quietly erode fungibility — the property that any one unit of money is interchangeable with any other. A fungible coin should be worth exactly as much as the next, but if every coin carries a permanent, auditable history, an exchange can refuse a "tainted" coin that once passed through a sanctioned address — even five owners ago, through no fault of yours. A dollar bill doesn't remember who held it; a transparent UTXO does. That memory is great for catching thieves and corrosive for ordinary users who simply want money that behaves like money.
The rest of this rung is the counterattack, in escalating strength. Next, mixers and CoinJoin break the link between coins by pooling many users together. Then privacy coins hide amounts and parties outright, using stealth addresses and shielded pools. Then zero-knowledge enables fully private smart contracts. And finally, the hard policy tension: privacy tools like privacy pools collide head-on with regulatory compliance and sanctions. Each tool buys privacy in a different currency — usability, an anonymity set, trust, or legality.