Blockchain analytics: how on-chain analysis traces crypto
Your name isn't on the blockchain. Here's how investigators connect addresses to people anyway.
Blockchain analytics is the practice of studying public blockchain data to group addresses that likely belong to the same owner, label them (an exchange, a scammer, a ransomware group), and follow money between them. It works because Bitcoin and Ethereum are pseudonymous, not anonymous: every transaction is public, and patterns plus data from exchanges that check ID often reveal who is behind an address. Investigators used it to seize 63.7 of the 75 bitcoins paid in the Colonial Pipeline ransom in 2021 and 94,000 bitcoins stolen from Bitfinex. Privacy coins and mixers try to break these links, with mixed success and growing legal risk.
Pseudonymous, not anonymous
A Bitcoin or Ethereum address is a pseudonym: a name that isn't yours but that you use repeatedly. Everything done under it is public forever. The moment it's linked to you, by an exchange withdrawal, a public post, or a payment to someone who knows you, your history under that address, and often linked addresses, becomes readable. The basics are in is crypto anonymous?; this guide explains how the linking is done.
How addresses get clustered
Analytics tools apply rules of thumb ("heuristics") to group addresses into likely wallets:
- Common-input ownership. When a Bitcoin transaction spends coins from several addresses at once, all of them almost certainly belong to the same wallet, because one party had to sign for every input. Satoshi Nakamoto pointed this out in section 10 of the Bitcoin white paper.
- Change detection. Most payments create a "change" output going back to the sender. Clues like round amounts, address types and timing often reveal which output is change, linking it to the sender.
- Address reuse. Using one address many times ties all those payments together. On Ethereum, an account is naturally reused, so its whole history sits in one place.
- Behavior patterns. Timing, fee settings, wallet software fingerprints and amounts that move together all add evidence.
From clusters to names
Clusters become meaningful once someone labels them. Firms build databases of addresses belonging to exchanges, payment processors, darknet markets, scams and sanctioned groups, from their own deposits and test transactions, public records, court cases and leaks. Then:
- Exchanges screen deposits and withdrawals against those labels to meet anti-money-laundering rules, and can freeze funds tied to theft.
- Law enforcement follows stolen funds to an exchange and then uses legal process to obtain that exchange's customer records.
- Stablecoin issuers can freeze tokens at addresses linked to crime.
| Case | What tracing achieved |
|---|---|
| Colonial Pipeline ransomware (2021) | In June 2021 the US Justice Department announced it had seized 63.7 bitcoins of the ransom, about $2.3 million at the time. |
| Bitfinex hack (2016) | In February 2022 investigators traced and seized about 94,000 of the stolen bitcoins, then worth about $3.6 billion. |
| Ronin bridge hack (2022) | The FBI attributed the theft to North Korea's Lazarus Group within weeks. See NFT gaming. |
Analytics also has limits and error rates. Heuristics can be wrong, labels can be mistaken, and courts have examined how reliable some of these tools are.
Privacy coins and mixers
- Monero hides senders, receivers and amounts by default, using ring signatures, one-time "stealth" addresses and confidential amounts.
- Zcash lets users choose shielded transactions that use zero-knowledge proofs to hide details; many Zcash transactions are not shielded.
- Mixers and coinjoins pool many users' coins so that outputs can't easily be linked to inputs.
These tools have legitimate uses, such as keeping your salary or donations private, and they are also used by criminals. The legal picture has moved: the US sanctioned the Tornado Cash mixer in 2022 and lifted those sanctions in March 2025 after court challenges, while developers of other mixing services have been prosecuted. Several exchanges have delisted privacy coins in some regions. See the Monero fact sheet.
Sensible privacy for ordinary users
- Use a fresh receiving address for each payment where your wallet supports it.
- Don't post addresses or screenshots of balances publicly.
- Assume anything you do through an exchange is visible to that exchange and, on request, to authorities, including tax authorities.
- Know that anyone you pay can look up your address's history, and adjust what wallet you pay from.
Criminals ask for crypto because they believe it can't be traced. If someone insists you pay in crypto, or offers to "recover" stolen crypto for an upfront fee, it's almost always a scam. See crypto scams.
Related reading: Crypto crime and money laundering · Crypto recovery scams · Zero-knowledge proofs, explained simply · Crypto regulation in the United States
Frequently asked questions
What is on-chain analysis?
Studying public blockchain data, such as transactions, addresses and flows between them, to understand who is doing what. Investigators use it to trace funds; traders use similar data to watch exchange flows and large holders.
How do blockchain analytics companies trace crypto?
They group addresses that likely share an owner using heuristics like common-input ownership and change detection, label clusters belonging to known services, and follow funds between them. Exchange records then connect clusters to real identities.
Is Monero traceable?
Monero is designed to hide senders, receivers and amounts by default, which makes standard blockchain analytics far harder. Its privacy can still be weakened by mistakes, such as how coins are bought and sold on exchanges.
Can police trace Bitcoin?
Often, yes. US authorities have traced and seized ransomware payments and stolen bitcoin, including about 94,000 BTC from the 2016 Bitfinex hack.
Is using a crypto mixer illegal?
Laws differ by country and have changed. In the US, Tornado Cash sanctions were lifted in March 2025, but running an unlicensed mixing service has led to prosecutions, and exchanges may block funds that passed through mixers.
Where to next
Sources
- Bitcoin: A Peer-to-Peer Electronic Cash System, section 10 (Satoshi Nakamoto)
- Privacy (Bitcoin Wiki)
- DoJ seizes $2.3M in bitcoin paid to Colonial Pipeline attackers (Dark Reading, June 2021)
- Justice Department recovers $3.6 billion in bitcoin from 2016 Bitfinex hack (Engadget, February 2022)
- A legal whirlwind settles: Treasury lifts sanctions on Tornado Cash (Venable, April 2025)
- Moneropedia (getmonero.org)
Written for beginners and checked against the sources listed. Last reviewed November 4, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.