What is chain analysis?

The practice of clustering addresses and tracing flows to attribute on-chain activity to real entities, sold as software to exchanges, banks, and law enforcement.

It works because public ledgers are permanent and because ordinary usage leaks patterns: reused addresses, change outputs, timing, and above all the moment funds meet an exchange holding identity records. Exchanges use it to score incoming deposits, which is how a deposit can be frozen over a link several hops back that you knew nothing about.

Its conclusions are probabilistic. Vendors sell risk scores rather than findings, an exchange acting on one owes you no explanation, and disputing a false attribution is slow and often futile. The practical defense is not to mix funds whose history you do not know.

How it works

The core technique is clustering. When a Bitcoin transaction spends several inputs at once, the common-input-ownership heuristic assumes one party controls all of them, which links addresses that were never publicly connected. Change output detection adds more links, and repeated use of the same address collapses them entirely.

Attribution then attaches names to clusters. Vendors label known exchange deposit addresses, mining pools, sanctioned addresses published by authorities such as the United States Office of Foreign Assets Control, and services identified through their own transactions.

Scoring runs the graph backward from a deposit. Software traces the funds through some number of hops and assigns a risk figure based on exposure to labeled categories. Each exchange sets its own threshold for what triggers a hold, a request for source-of-funds documents, or an account closure, and those thresholds are not published.

On account-based chains such as Ethereum the heuristics differ, because there are no inputs to cluster, but the same labeling and tracing logic applies to addresses and contract interactions.

Example

Illustrative. You buy 0.05 BTC peer to peer and later deposit it to an exchange. The software traces the coins back three hops and finds that two hops before you received them they passed through a service the vendor labels as high risk. The deposit is flagged. The exchange holds it and asks for documentation of where you obtained the coins. You did nothing wrong and the history predates your ownership, but the burden of explaining it sits with you.

Why it matters when you buy

Buying on a regulated exchange and withdrawing to your own wallet gives coins a clean, documented origin, which is the single most useful thing you can do to avoid a deposit hold later. Coins acquired peer to peer, from a mixer, or from an unknown counterparty carry a history you cannot see. The exchange pages show which venues are licensed and where, and what is KYC explains the identity side.

Related terms

kyt — the transaction monitoring that consumes these scores; coin control — choosing which outputs you spend; coinjoin — deliberately breaking the clustering heuristics; mixer — the service that triggers the worst scores; ofac screening — the sanctions list layer.

Questions

Can chain analysis identify me personally?

Not from the chain alone. It links addresses into clusters and labels clusters as services. Your name enters only where a cluster touches a business that holds your identity documents, which in practice means an exchange.

Are the risk scores accurate?

They are estimates built on heuristics, and vendors do not publish error rates. Exchanges nonetheless act on them, so a false positive costs you time and documentation regardless of whether the underlying inference was sound.

Does using a new address each time help?

It prevents the simplest linking, but it does not defeat clustering, because spending several outputs in one transaction reconnects them. Address hygiene is a floor rather than a solution.