What is address clustering?

Address clustering is the process of grouping cryptocurrency addresses that are controlled by the same entity, based on evidence found on the blockchain. Analysts use address clustering to turn thousands of pseudonymous addresses into a smaller set of real-world actors, which is the foundation of blockchain analytics, compliance monitoring, and investigations.

In this context, address clustering refers specifically to blockchain and cryptocurrency analysis. It is distinct from IP address clustering or MAC address clustering in computer networking, and from statistical clustering in data science, which share the word but solve different problems.

Address clustering exists because public blockchains are pseudonymous. Every transaction is visible, but a cryptocurrency address by itself carries no identity. It is a string of characters that anyone can generate, and a single entity can control millions of them. Without a way to group related addresses, investigators and compliance teams would face an unstructured sea of transactions with no clear owners. Address clustering imposes structure on that data by determining which cryptocurrency addresses are likely under common control.

Clustering operates in two distinct layers. The first layer is structural: grouping addresses that share common control, established through evidence on the blockchain. The second layer is attribution: linking that group to a named real-world entity, which depends on off-chain intelligence. Grouping addresses and naming the entity behind them are different operations that rely on different evidence and carry different levels of certainty. Keeping these layers separate is what distinguishes rigorous blockchain analytics from guesswork.

Why does address clustering matter?

Address clustering is not an academic exercise. It sits underneath decisions that affect access to money, the direction of criminal investigations, and the admissibility of evidence in court. Because a label applied to one address propagates to every address in the cluster, the quality of clustering determines the quality of everything built on top of it.

In compliance and anti-money laundering programs, clustering underpins transaction monitoring, sanctions screening, and risk scoring. When a compliance system assesses a counterparty’s risk, it depends on the addresses grouped into that counterparty’s cluster. A single wrong address-to-cluster assignment can contaminate thousands of downstream risk labels, generating false positives that waste analyst time or, worse, false negatives that let real risk through.

In investigations and law enforcement, clustering is the backbone of fund tracing. When an investigator follows stolen or laundered funds from source through intermediary infrastructure to a destination, each step depends on the assertion that certain addresses belong to the same wallet. An error in that structural layer can redirect an investigation toward the wrong target.

For courts and regulators, the reliability of clustering methodology can determine whether blockchain evidence survives legal challenge. As blockchain forensics increasingly informs enforcement actions, opposing counsel will probe how a grouping was produced. Documented method, enumerated failure modes, and a clear separation between structural grouping and attribution are what allow such evidence to withstand scrutiny. Across all of these uses, the audience is compliance officers, financial institutions, and law enforcement, and the standard for accuracy is correspondingly high.

How does address clustering work?

Address clustering works by identifying on-chain signals that reveal shared key control. When the blockchain shows that a set of addresses must have been signed by the same keys, those addresses can be grouped into a wallet segment, meaning a connected portion of a single entity’s wallet that has been established through direct on-chain evidence.

The most established signal is the co-spend heuristic, also known as the common input ownership heuristic or the multi-input heuristic. It is the technique at the heart of Bitcoin address clustering. When multiple addresses appear together as inputs to the same transaction, the private keys required to authorize those inputs must have been available to a single party at signing time. On a Bitcoin-style blockchain that uses the unspent transaction output model, or UTXO model, spending several outputs in one transaction is strong evidence of common control. Analysts use this signal to link addresses across transaction records and expand a wallet segment.

Address clustering is evidence-based, not guesswork. Each grouping decision should rest on a documented method with known conditions under which it could fail. This discipline matters because clustering errors do not stay contained. A single incorrect address-to-cluster assignment propagates to every address in the group, and any label applied to the cluster flows to addresses that may not belong. For this reason, sound clustering favors caution: it is safer to build a smaller, correct cluster than a larger one that absorbs an address from a different wallet.

Common address clustering heuristics

Analysts rely on several established heuristics to group cryptocurrency addresses. Each works well within known limits, and each has failure modes that must be accounted for.

Common input ownership (co-spend) heuristic

The common input ownership heuristic is the foundation of Bitcoin address clustering. When two or more addresses are used together as inputs to a single transaction, they are presumed to share common control, because one party had to hold the keys for all of them. This co-spend heuristic is reliable in ordinary transactions, but it can be broken by collaborative transactions such as CoinJoin and PayJoin, where multiple independent parties combine inputs into one transaction on purpose. Rigorous clustering identifies and excludes these collaborative transactions so they do not create false links between unrelated wallets.

Change address identification

When someone spends part of a UTXO, the remaining value returns to their own wallet as a change output, often sent to a newly generated one-time change address. Change address identification is the practice of detecting which output in a transaction is change and linking it back to the sending wallet. Done correctly, it extends a wallet segment across many transactions. A recognizable pattern here is the peeling chain, where an entity repeatedly spends a small amount and sends the large remainder to a fresh one-time change address, producing a long chain of linked transactions. Address reuse, where the same address receives funds repeatedly, can make grouping easier, but it is a weaker signal than a direct co-spend, and treating address reuse as proof of control can introduce errors.

Behavioral and fingerprinting heuristics

Beyond direct transaction links, analysts study behavioral patterns and wallet software fingerprints. Different wallet implementations produce subtle, characteristic patterns in how they construct transactions, which can suggest that addresses were created by the same software. These signals are useful for generating leads, but they carry an important caveat: a fingerprint alone, without a transactional link between addresses, does not establish co-ownership. Multiple independent wallets can share identical characteristics simply by running the same software, so fingerprints support investigation rather than prove control on their own.

Address clustering on UTXO and account-based blockchains

Address clustering does not work the same way on every blockchain, because different chains use different accounting models. The technique that groups addresses on one chain may not exist on another.

On UTXO-based blockchains such as Bitcoin and Litecoin, transactions consume discrete outputs and can draw on many inputs at once. This makes co-spend analysis possible, and it can group many thousands of addresses into a single wallet segment. The UTXO model is the environment where the term “cluster” was originally coined, and where Bitcoin clustering heuristics are most mature. Much of the foundational research on address clustering was carried out on Bitcoin for this reason.

Account-based blockchains such as Ethereum work differently. Balances live in accounts rather than discrete outputs, and there are no multi-input transactions to reveal common control through co-spending. Clustering on these chains relies on other techniques, including contract deployment analysis, administrative key relationships, and operational patterns. A single externally owned account may represent a complete wallet on its own, while a set of smart contracts governed by a common administrative key may share control without sharing any transaction history. Block explorers such as Etherscan expose the on-chain data used in this analysis, but interpreting control still requires careful method.

This variation is why a single term applied across structurally different chains can create confusion. A number that counts addresses in a Bitcoin cluster does not mean the same thing as one on Ethereum. The right question is not how many addresses a cluster contains, but by what method those addresses were grouped, and to what standard.

From clusters to entities: attribution versus grouping

A common sentence in blockchain analysis is “this address belongs to Cluster X, which is Exchange Y.” That single statement actually encodes three distinct claims, and conflating them is a frequent source of error.

The first is a structural claim: these addresses share common key control. This is an assertion about on-chain evidence, and it is what wallet segment construction establishes. The second is an attribution claim: this group of addresses is associated with a specific named entity. The third is an operator claim: that entity actually controls the wallet infrastructure, rather than merely using someone else’s. Each claim relies on different evidence and carries a different error profile.

Attribution is fundamentally an off-chain activity. No amount of on-chain analysis alone can prove that an address belongs to a particular entity, because identity does not live on the blockchain. Attribution evidence includes direct interaction with a service, seizure data or ground truth recovered when law enforcement seizes infrastructure, third-party confirmation from a regulated entity, and open-source intelligence. Because a single attribution propagates across a wallet segment, every address in the segment inherits the label, which is exactly why the structural grouping underneath it must be sound.

The operator versus beneficiary distinction guards against a subtle but serious error in entity identification. Consider a user’s deposit address at a centralized exchange. Exchanges issue deposit addresses to users, and on-chain structural analysis will group those deposit addresses with the consolidation addresses controlled by the exchange. The address is verifiably associated with the user through transaction records and know your customer documentation, yet the address belongs to the exchange’s wallet infrastructure. The user is the beneficiary, while the exchange is the operator that controls the keys. Attributing that deposit address to the user and propagating it across the exchange’s wallet segment would be correct evidence leading to a wrong conclusion. The same logic applies to nested services, such as a smaller service operating through a larger exchange’s infrastructure. Sound de-anonymization requires stating explicitly whether an entity is the operator or a beneficiary.

The role of machine learning in address clustering

Machine learning has a legitimate and valuable place in address clustering, but its role is often misunderstood. The key point is that machine learning outputs are leads, not forensic facts.

Trained predictive models, including techniques such as random forest classifiers and graph-based network analysis, are well suited to surfacing candidate relationships for analyst review, prioritizing where investigators should focus, detecting anomalies, and recognizing complex behavioral patterns that are impractical to find by hand. Network analysis of the transaction graph, in particular, can reveal structure that points analysts toward relationships worth verifying. Open-source research frameworks such as BlockSci have helped academics and practitioners apply these methods at scale. In each case, the model produces an assessment that points analysts toward something worth examining.

What a trained model cannot do on its own is establish wallet segment membership. Its decision logic is learned from data rather than derived from explicit, auditable rules, which means its conclusions can change with different training data and its failure modes cannot be exhaustively enumerated. That is not a statement about accuracy, since a model can be highly accurate. It is a statement about whether the reasoning can be independently examined and reproduced. Rigorous clustering therefore keeps a clear boundary: the deterministic, auditable structural layer establishes which addresses share control, while probabilistic model outputs extend the system’s reach as intelligence inputs. Machine learning widens the field of view, and scientific method guarantees the foundation.

Risks and common misconceptions about address clustering

Address clustering is powerful, but it has real limits, and misunderstanding them leads to error. The most common misconception is that a cluster is a single, self-evident fact. In reality, a cluster is the product of separate structural and attribution judgments, each of which can be right or wrong independently.

Several techniques are designed specifically to reduce clustering accuracy. CoinJoin and PayJoin combine inputs from multiple independent parties to break the co-spend assumption, and mixing services pool and redistribute funds to sever the on-chain links that clustering depends on. When these techniques are present and not accounted for, naive clustering can produce false groupings. Rigorous analysis identifies them and excludes the affected transactions rather than drawing links through them.

A second misconception is that bigger clusters are better. Sound methodology manages error by favoring false negatives over false positives. A wallet segment that is too small is incomplete but not wrong, while a segment that pulls in one address from a different wallet is a structural error that propagates to every downstream label and analysis. Given the stakes, an incomplete cluster is safer than a contaminated one, so careful analysts accept missing some links in order to avoid creating false ones.

Address reuse and behavioral patterns can both help and mislead. Network-layer signals sit outside the transaction graph entirely. Research into blockchain de-anonymization has studied how ip addresses observed when transactions are broadcast can sometimes be correlated with wallets, though ip addresses are an unreliable signal that adds another source of uncertainty rather than a definitive link. This is why enumerated failure modes and explicit safeguards matter: every heuristic should come with a documented account of the conditions under which it could fail and how those conditions are handled. Framed for compliance and investigations, clustering is a disciplined analytical tool, not a guarantee, and its outputs should carry a clear sense of how they were produced.

Real-world examples of address clustering in action

Address clustering has been central to some of the most significant cryptocurrency investigations and enforcement actions on record. In each case, grouping addresses under common control is what turned a trail of pseudonymous transactions into an actionable investigative lead.

In ransomware response, investigators have used clustering to trace extortion payments to the infrastructure that receives them. Following the 2021 Colonial Pipeline attack by the DarkSide ransomware group, the U.S. Department of Justice traced the ransom on-chain and recovered a large portion of the paid bitcoin, an outcome that depended on linking the relevant addresses and following funds to a point of control.

In laundering investigations, clustering helps follow stolen funds across long chains of intermediary addresses. The funds stolen in the 2016 Bitfinex exchange hack, roughly 120,000 bitcoin, were traced across years of layering before authorities announced a seizure in 2022 and arrests connected to the laundering. Clustering the laundering addresses was essential to reconstructing where the funds moved.

Nation-state cases show the same pattern at scale. Investigators tracking groups such as Lazarus Group, associated with North Korea, rely on clustering to connect the addresses used to launder proceeds from exchange hacks as those funds move toward off-ramps. Mixing services such as Tornado Cash are frequently used in these cases specifically to break clustering, which is why analysts treat mixed flows with explicit caution rather than drawing links straight through them. Across all of these examples, the reliability of the underlying clustering is what makes the resulting conclusions defensible.

How Chainalysis helps organizations understand and monitor address clustering

Chainalysis grounds address clustering in a formal ontology that separates the structural layer from attribution. Wallet segments are established through deterministic, reproducible on-chain analysis with documented methodology and enumerated failure modes, while attribution and operator verification are treated as distinct, evidence-based judgments layered on top. A cluster is only labeled with a named entity once structural integrity, attribution evidence, and operator verification have each been independently satisfied. This rigor has been tested where it matters most: Chainalysis blockchain analytics methodology was found admissible under the Daubert standard in United States v. Sterlingov, the framework that governs the admissibility of expert evidence in U.S. federal court.

That discipline is delivered through purpose-built tools:

  • Chainalysis Reactor: The investigation platform used by law enforcement and compliance teams to trace funds across wallet segments and blockchains, visualize how entities connect, and build cases on a documented evidentiary foundation.
  • Chainalysis KYT (Know Your Transaction): Real-time transaction monitoring that applies clustering and attribution data to screen counterparties, score risk, and surface exposure as transactions happen.
  • Chainalysis Data Solutions: Cluster attribution and threat intelligence delivered as continuously updated data, so investigators and exchanges can act on current infrastructure rather than stale labels.

Because the underlying clustering and attribution are held to a consistent standard, the outputs are built to support both investigative and regulatory demands.

Frequently asked questions about address clustering

Q: What is a cluster address?

A: A cluster, or address cluster, is a group of cryptocurrency addresses linked to the same entity through on-chain evidence and, once attributed, a named real-world actor. The grouping establishes shared control, and attribution connects that group to the entity behind it.

Q: What is address clustering and why is it important in crypto analysis?

A: Address clustering is the grouping of cryptocurrency addresses under common control. It matters because it converts pseudonymous blockchain activity into an entity-level view that compliance teams and investigators can act on, which is the foundation of blockchain analytics.

Q: What is the common input ownership heuristic in Bitcoin?

A: It is the rule that addresses used together as inputs to a single transaction are controlled by the same party. It applies subject to excluding collaborative transactions such as CoinJoin, which deliberately combine inputs from different parties.

Q: How reliable is the multi-input heuristic for Bitcoin address clustering?

A: The multi-input heuristic is highly reliable when its known failure modes are enumerated and safeguarded. This is why rigorous providers document their methodology and exclude collaborative transactions rather than relying on appearance alone.

Q: How does address clustering help with anti-money laundering on the blockchain?

A: By grouping addresses to entities, clustering lets anti-money laundering teams trace fund flows, screen for sanctioned or high-risk counterparties, and monitor transactions in real time. It turns raw transaction data into actionable, entity-level intelligence.

Q: How does address clustering impact privacy in cryptocurrency transactions?

A: Clustering can de-anonymize activity by linking addresses to entities, which reduces the practical privacy of pseudonymous transactions. Techniques such as mixing services, CoinJoin, and PayJoin are designed to disrupt clustering and preserve privacy.

Q: What is the difference between address clustering and attribution?

A: Clustering groups addresses by shared control, which is a structural claim about on-chain evidence. Attribution links that group to a named entity, which is an intelligence claim based on off-chain evidence. They rely on different evidence and are held to different standards.

See how Chainalysis brings clarity to address clustering

Address clustering is only as reliable as the methodology behind it, and that reliability determines whether compliance decisions hold and investigations reach the right target.

Chainalysis gives compliance teams and law enforcement the attribution data and tracing tools to act on clustering with confidence.

Request a demo

Explore Chainalysis Reactor for investigations

Learn how Chainalysis KYT monitors transactions in real time

Read the 2026 Crypto Crime Report