Wallet Privacy and Address Clustering, Explained

Public blockchains are exactly that, public. Every transaction is permanently visible to anyone, and while addresses are pseudonymous strings rather than names, they are not anonymous. Specialised firms and researchers use a set of well-understood techniques to link many addresses back to a single person or organisation, a practice called address clustering. Understanding how it works is the first step to deciding how much privacy you actually have, and how to protect what remains.

Pseudonymous is not anonymous

When you transact, nothing on-chain says “this is your name.” But the moment one of your addresses is tied to a real identity, at an exchange that ran identity checks, through a public donation address, or by a merchant you paid, that link can spread to every other address the analysis groups with it. The ledger never forgets, so a connection made today can expose transactions you made years ago. This is the core reason crypto privacy is a hygiene practice, not a one-time setting.

How address clustering works

Clustering is the process of grouping addresses that probably belong to the same entity. Analysts rely on a handful of heuristics, rules of thumb that are usually, though not always, correct.

The common-input-ownership heuristic

The most powerful technique on UTXO chains like Bitcoin is the common-input-ownership heuristic (CIOH). The Bitcoin Wiki states the assumption plainly: “if a transaction has more than one input then all those inputs are owned by the same entity.” The logic is that spending several inputs together requires the private keys for all of them, so one wallet probably controls them. Wallets routinely combine multiple inputs to fund a single payment, which quietly links those addresses together every time it happens.

Change-address detection

When you spend, leftover value usually returns to you as change at a newly created address. If an analyst can pick out which output is change, they extend the cluster to that new address too, following your funds forward in time. Detection clues include address reuse, round-number payment amounts (change is typically irregular), wallet “fingerprints” left by different software, and mismatched address formats between the outputs.

Address reuse

Reusing one address to receive multiple payments is the single biggest self-inflicted privacy leak. It stacks all of that activity under one identifier and, as the Bitcoin Wiki puts it, an output to a reused address “is very likely to be a payment output, not a change output,” which also helps analysts solve the change problem. The long-standing recommendation is blunt: use a fresh address for each receipt.

Off-chain data and timing

Clustering rarely stops at the chain. Analysts combine on-chain patterns with off-chain signals: exchange identity records, IP addresses leaked when broadcasting transactions, merchant databases, social-media posts of an address, and timing correlations. Once one address in a cluster is de-anonymised, the label can propagate to the whole group.

What the research shows

Academic work established years ago that these heuristics scale. The foundational 2013 study “A Fistful of Bitcoins” by Meiklejohn and colleagues demonstrated that simple, automated heuristics could collapse a very large number of distinct Bitcoin addresses into a far smaller set of entity clusters, and then attach real-world labels to many of them by transacting with services directly. Later research refined change-address detection and multi-heuristic clustering further. The practical takeaway is not a specific percentage but a direction: naive on-chain behaviour is highly linkable by default.

Account-based chains behave differently

On Ethereum and similar account-based chains, the model is different. People often reuse one address across many applications, so activity is concentrated by design rather than split across UTXOs. That makes clustering by common inputs less relevant but linkage by reuse even easier: a single address can accumulate your entire DeFi, NFT, and transfer history in one place. Interacting with the same counterparties, or funding a “fresh” wallet from an old one, ties them together immediately.

How dusting attacks exploit clustering

Attackers actively try to trigger these heuristics. In a crypto dusting attack, someone sends a tiny amount of crypto (“dust”) to many addresses, then watches to see whether recipients later combine that dust with their other funds in a single transaction. If you do, the common-input heuristic links the dusted address to your main holdings. A related nuisance, address poisoning, plants look-alike addresses in your history hoping you copy the wrong one later. Both weaponise the public, permanent nature of the ledger.

Privacy hygiene you can actually apply

You cannot make a public chain private, but you can reduce how easily your activity is clustered.

• Do not reuse addresses. Let your HD wallet generate a fresh receiving address for every payment. This is the highest-impact habit.
• Separate your activity. Keep distinct wallets for distinct purposes, for example one for exchange withdrawals and another for long-term savings, and avoid mixing their coins in one transaction.
• Be careful funding new wallets. Sending from an old address to a “new” one links them. Understand that the connection is permanent and public.
• Do not consolidate dust. Leave unexpected tiny deposits untouched so you do not link them to your real funds. Some wallets support “coin control” to choose which inputs you spend.
• Mind the tools you trust. Query the chain through your own node where possible; third-party wallet servers and explorers can log which addresses you look up.
• Remember the identity link. Any address you hand to a service subject to KYC and AML rules can tie your identity to whatever that address touches.

Watching your own footprint

The same tools analysts use are available to you. Reading your transactions on an explorer, as covered in how to read a block explorer, shows exactly which inputs and outputs you are combining and where change goes. Because clustering ultimately rests on how public keys and addresses relate, a solid grasp of public and private keys makes the whole picture clearer.

The realistic bottom line

Blockchain analysis is a mature, commercialised field, and law-enforcement and compliance teams use it routinely. Perfect anonymity on a transparent ledger is not achievable through casual habits alone. But most everyday linkage comes from avoidable behaviour, reusing addresses, consolidating unrelated coins, and leaking off-chain identity, rather than from any inherent flaw you cannot control. Treat every address as potentially public-facing, assume connections are forever, and your on-chain footprint becomes far harder to assemble into a single profile.

Who uses clustering, and why it matters to you

Clustering is not an abstract academic exercise. Commercial blockchain-analytics firms sell it to exchanges, banks, and government agencies to trace fund flows, screen deposits, and build cases. Exchanges use it to comply with anti-money-laundering obligations; investigators use it to follow stolen or illicit funds. For an ordinary, law-abiding user this has two practical consequences. First, your financial history is more exposed than a bank statement, because it is public rather than held by one institution. Second, “guilt by cluster” is possible: if your address is grouped, correctly or via a false positive, with an address later flagged as high-risk, an exchange’s automated screening might question a perfectly legitimate deposit. Good hygiene reduces both the exposure and the chance of being tangled into someone else’s cluster.

Wallet fingerprinting in more detail

Beyond inputs and change, analysts read subtle “fingerprints” that different wallet software leaves on transactions, the ordering of inputs and outputs, the fee-estimation style, the address formats used, whether certain optional fields are set, and how the transaction is structured. These patterns can suggest which software created a transaction, and sometimes distinguish your transactions from unrelated ones sharing a block. Fingerprinting rarely identifies you by itself, but it strengthens other heuristics, helping an analyst decide which output is change or whether two transactions came from the same wallet.

The limits of clustering

It is worth being precise about what clustering can and cannot do, so you neither panic nor grow complacent. Heuristics are probabilistic, not proof: the common-input assumption breaks on collaborative transactions like CoinJoin, and change detection produces false positives. A cluster is a best guess about shared ownership, and a wrong guess can wrongly associate you with strangers. At the same time, the sheer volume of public data means casual users are highly linkable by default. The honest summary is that clustering is powerful and widely deployed, imperfect enough to produce errors, yet more than good enough to undo lazy privacy habits.

A simple weekly habit

Privacy erodes through small, repeated leaks, so the countermeasure is also a habit rather than a one-off. When you receive funds, generate a new address instead of reusing an old one. When you spend, notice whether your wallet is combining coins from unrelated sources, and use coin-control features if it offers them. Ignore unsolicited dust deposits rather than sweeping them into a payment. And keep a mental firewall between addresses you have handed to identity-verified services and addresses you would rather keep unlinked to your name. None of these steps is technical or time-consuming, yet together they defeat the most common heuristics that would otherwise stitch your activity into one profile. Privacy on a public ledger is not a switch you flip once; it is the cumulative result of many small choices, each of which either adds a link to your cluster or withholds one.

Sources

• Privacy: common-input-ownership, change detection, address reuse — Bitcoin Wiki
• Ethereum accounts and addresses — ethereum.org
• A Fistful of Bitcoins: Characterizing Payments Among Men with No Names — Meiklejohn et al. (UC San Diego / IMC 2013)
• Protect your privacy — Bitcoin.org