Address clustering and attribution

Educational only. Do not assist with harassment, non-consensual doxxing, or sanctions evasion. High-stakes conclusions require legal and compliance process—not a vendor UI alone.

Why clustering exists

Addresses are pseudonymous. Clustering infers that multiple addresses are likely controlled by the same real-world actor, so analysts can reason about “wallets” rather than isolated strings.

All clustering is probabilistic—wrong merges and missed links happen.

UTXO chains (e.g. Bitcoin)

• Common input ownership heuristic (CIOH) — If two (or more) addresses appear as inputs to the same transaction, they are often assumed to be controlled by the same spender (standard wallet behavior). Exceptions exist (coinjoin, collaborative txs, some privacy techniques).
• Change outputs — Many spends send value to a recipient and “change” back to a new address controlled by the sender; change-detection heuristics try to link those outputs to the same wallet cluster over time.

Privacy practices (coinjoin, careful coin selection) weaken naive clustering.

Account-based chains (e.g. EVM)