Wallet clustering analysis is a core technique in blockchain forensics that groups multiple cryptocurrency addresses into a single entity — typically a person, exchange, or organization. Understanding how clustering works explains both how blockchain investigators trace stolen funds and why it’s harder than it sounds.
What Is Wallet Clustering?
Wallet clustering (also called address clustering or entity clustering) uses blockchain heuristics to link multiple wallet addresses to the same controlling entity. On public blockchains like Bitcoin and Ethereum, all transactions are transparent — but users typically control many addresses. Clustering attempts to group these addresses based on behavioral and technical patterns in how they transact.
Key Clustering Heuristics
Common Input Ownership (CIO)
The most powerful Bitcoin clustering heuristic: when a transaction has multiple inputs, all those input addresses are assumed to be controlled by the same wallet. This is because signing multiple inputs in one transaction requires access to all corresponding private keys — only one entity can do this. This single heuristic allows investigators to link hundreds of addresses from just a few transactions.
Change Address Detection
Bitcoin transactions often send change back to the sender. Analysts identify change outputs by their behavioral characteristics (round number payment to recipient, change amount returning to a new address controlled by sender). Linking change addresses expands the cluster further.
Behavioral Fingerprinting
Transaction timing patterns, fee preferences, coin selection algorithms, and interaction with known services can all link addresses behaviorally even when technical heuristics fail.
How Clustering Supports Scam Investigations
When a victim sends cryptocurrency to a scammer’s wallet, investigators start with that wallet address and apply clustering to identify all related addresses. If any address in the cluster has interacted with a KYC-verified exchange, a legal process can link the cluster to a real identity. This is the foundation of most successful law enforcement crypto seizures. Read more in our crypto forensics explainer and our guide on whether stolen crypto can be tracked.
Limitations of Wallet Clustering
- CoinJoin and mixing: Transactions that intentionally combine inputs from multiple users break the CIO heuristic
- Privacy coins: Monero, Zcash (shielded), and similar protocols obscure inputs, outputs, and amounts
- Cross-chain bridges: Moving funds between blockchains can disrupt clustering by creating new addresses with no prior history
- False positives: Exchanges and custodians use address-reuse patterns that can incorrectly cluster many distinct users together
