How your crypto actually gets traced.

The short version

• Bitcoin is not anonymous — it is a permanent public ledger with pseudonyms attached. Blockchain analysis undoes the pseudonym. It never has to break any cryptography to do it.
• Almost all of the work is done by five cheap heuristics and one anchor. The heuristics group addresses into a wallet. The anchor — nearly always an exchange that holds someone's identity documents — attaches a name to the group.
• Attribution flows through the whole cluster, in both directions in time. Name one address and you have named every address grouped with it, including transactions made years earlier.
• Account-based chains are easier to trace, not harder. On Ethereum, Tron and Solana one address is one persistent identity by design, and reuse is the normal mode of operation rather than a mistake.
• Most real deanonymisation happens off-chain. IP addresses, wallet telemetry, block-explorer lookups, shipping addresses and subpoenaed exchange records supply the name far more often than the ledger does.
• What genuinely breaks the link is crossing into a ledger that cannot be read. What does not: a fresh address, more hops on a transparent chain, or a VPN.
• The analysis is retroactive and the ledger is permanent. A chain examined in 2032 contains everything you did in 2026, and the tooling only gets better. Privacy is a decision you make at transaction time or not at all.

Who is actually watching

It is worth being concrete about this, because the mental image most people carry — a detective squinting at a block explorer — has nothing to do with how the work is done. Blockchain analysis is a mature commercial software industry with a handful of large vendors, an established customer base, and a product that is essentially a searchable, labelled map of every public chain.

The vendors you will hear named are Chainalysis, Elliptic, TRM Labs, Crystal and Merkle Science, alongside a layer of public-facing tools such as Arkham and the ordinary block explorers. Their software does two things: it ingests every transaction on the major chains and clusters the addresses, and it maintains a proprietary database of labels attaching real-world entities to those clusters.

The customers matter more than the vendors. The largest single group is crypto businesses themselves — exchanges, payment processors and custodians run every incoming deposit through a screening product before crediting it, because their banking relationships and licences depend on being able to show they did. Then come banks, revenue authorities, financial intelligence units, law-enforcement agencies, insurers and a growing number of ordinary corporates. This is the important part: the surveillance layer is not primarily aimed at investigations. It is a continuous, automated, always-on screening service applied to the ordinary user by default.

The labels themselves are assembled from unglamorous sources. Analysts open accounts at exchanges and make small deposits to learn the shape of that exchange's addresses. They scrape forums, donation pages and social media where people publish addresses. They ingest court filings, seizure notices and sanctions listings. They buy or receive data from partners. They send tiny amounts to addresses to observe how they behave. None of this requires special access, and the accumulated result is that a substantial share of economically active addresses on the major chains already carries some label.

The five heuristics that do most of the work

Clustering is the first half of the problem: deciding that a set of separate addresses is really one wallet. Nearly all of it is done by a small number of techniques that have been public and well understood since the earliest academic work on the subject over a decade ago. They are not secrets and they are not sophisticated. They are just extremely effective on data that was published voluntarily.

1. Common-input ownership

This is the one that does the heavy lifting, and unlike the others it is close to a proof rather than a guess. On Bitcoin and other UTXO chains, a transaction that spends two coins must be signed with the private key of each. If a transaction spends a coin sitting at address A and a coin sitting at address B, then whoever built it held both keys, so A and B belong to the same wallet.

Applied across the entire chain, this single rule collapses hundreds of millions of addresses into a far smaller number of entities. It is transitive and it compounds: A merges with B today, B merges with C next month, and the cluster grows without ever shrinking. The only meaningful exception is a transaction deliberately constructed by several parties at once — which is exactly what a collaborative transaction such as a CoinJoin is, and exactly why it exists.

2. Change-output detection

UTXO chains have no concept of partial spending. To pay someone 0.04 BTC out of a 0.5 BTC coin, the wallet spends the whole coin and creates two outputs: the payment and the change coming back to itself. Identifying which output is the change lets an analyst follow the same wallet forward into its next transaction, and the next, indefinitely.

There are a dozen signals for this and wallets leak them constantly. A round-number output is usually the payment while the ragged remainder is the change. An output whose address format matches the input format, when the other output does not, is usually the change from a wallet that has not upgraded. An output that is later spent together with coins already in the cluster was change. An address seen for the first time is more likely to be change than a reused one. Chained together, this produces the pattern analysts call a peel chain: one large coin walking through dozens of transactions, shedding payments as it goes, entirely trackable.

3. Address reuse

The cheapest signal of all, and still widely available. Any address that receives more than once has told the world that both receipts belong to the same recipient. Published donation addresses, a tip address in a forum signature, a mining payout address, a merchant address printed on an invoice, an address pasted into a support ticket — each is a permanent, self-supplied identifier. It costs nothing to avoid and a great deal of clustering still rests on it.

4. The exchange anchor

Everything above produces an unnamed cluster. This is the step that gives it a name, and it is where the whole enterprise actually succeeds or fails.

Custodial exchanges issue each user a dedicated deposit address, which means the exchange knows exactly which verified customer that address belongs to. Analysts identify these addresses at scale by depositing to the exchange themselves and observing the pattern, and by watching the batched withdrawal transactions that hot wallets produce. The result is a large, well-maintained map of which addresses belong to which platform.

The consequence for you is direct. If any address in your cluster has ever sent to or received from an identified exchange deposit or withdrawal, your cluster is now labelled as belonging to a customer of that exchange — and that exchange holds your identity documents, your bank details and your address, and will produce them on lawful request. One anchor point is enough. It does not matter how many transactions separate it from the coin someone is interested in, because the cluster is a single object.

5. Amount and timing correlation

The last heuristic applies where the chain of custody passes through something the analyst cannot see inside — a service, a bridge, a swap, a custodial wallet. The inside is opaque; the two edges are not.

If 1.0037 BTC enters a service and 1.0031 BTC leaves it eleven minutes later, and no other flow that day resembles either, then the entry and the exit are the same money and the graph reconnects across the gap. This is routine and it is cheap. It is also why the useful question about any privacy tool is not whether it hides its internals but whether it destroys the amount and timing relationship between what went in and what came out.

From cluster to name to score

Put the pieces together and the pipeline is short. Heuristics build a cluster. An anchor names it. Every historical transaction in that cluster becomes attributed at once, and every future one is attributed as it happens.

Two properties of this are worth sitting with. The first is that it works backwards. Attribution obtained in 2027 applies to a transaction made in 2022, because the ledger is permanent and the cluster is retroactive. There is no expiry and no statute of limitations on the data itself. The second is that it is inference, not proof. Clusters are built from probabilistic signals, and a wrong merge — a wallet implementation that broke an assumption, a shared custodial address, a CoinJoin misread — permanently contaminates everything on both sides of the error.

That second property is the one that reaches ordinary users, through risk scoring. Vendors assign addresses a score derived from their proximity in the graph to activity classified as high risk. The score is inherited rather than earned: coins that passed through several unrelated hands before reaching you can arrive carrying a history you had nothing to do with. When a custodial exchange freezes a deposit and asks a bewildered user to explain the origin of funds they bought on that same exchange three weeks earlier, this is the mechanism. It is also a good reason to read what a service commits to in writing before a flagged deposit is your problem — our order-status guide covers what actually happens when a deposit is held, and the service ranking scores each provider on exactly this policy.

Why Ethereum, Tron and Solana are easier

A common assumption is that Bitcoin is the surveilled chain and everything newer is somehow less exposed. The opposite is true. Account-based chains are substantially easier to analyse than Bitcoin, for structural reasons that no amount of care on your part will change.

• One address is one persistent identity. There is no UTXO model, no change output, and therefore no clustering problem to solve. Your account address is your account address across every transaction you have ever made on that chain. What clustering has to infer on Bitcoin is simply given for free here.
• Reuse is the design, not a mistake. You cannot practise address hygiene in the Bitcoin sense without running a separate wallet for every purpose and moving funds between them, which is itself a linkable act.
• Interaction history is a fingerprint. Token approvals, contract calls, NFT holdings, airdrop claims, governance votes and a named handle in a naming service all sit permanently against your address. The set of applications you have touched is often specific enough to identify you on its own.
• Most users never talk to the chain directly. Wallets query hosted node providers, which see your IP address alongside every address you ask about. That single relationship links network identity to chain identity for a very large share of activity.
• Stablecoin issuers can act unilaterally. The major fiat-backed issuers maintain blocklists and can freeze balances at specific addresses on request, which makes the largest asset class on these chains the least neutral one.

The practical upshot: a USDT balance on a high-throughput chain is among the most legible assets in the entire ecosystem. That is fine for what it is good at — moving dollar value quickly and cheaply — and it is worth understanding that convenience is what you are buying. Our stablecoin chain comparison covers the trade-offs network by network.

The off-chain layer, where it usually actually happens

Everything to this point has been about the ledger. In practice, most identification does not come from the ledger at all. It comes from the plumbing around it, which is far leakier and much less discussed.

• Transaction origin on the network. A transaction has to be broadcast to a peer somewhere. An observer with connections to many nodes can often infer where a transaction was first seen and therefore where it came from. This is a real technique, not a theoretical one, and it is why running your own node or routing over Tor matters.
• Lightweight wallets ask servers about you. A wallet that does not hold the chain has to ask someone which coins are yours. That server learns your entire address set and your IP address in one query. Older filtering schemes intended to obscure this leak more than users assume.
• Block explorers. Looking up your own transaction on a public explorer, from your ordinary connection, hands that operator a timestamped link between your IP and the address you care about. It is one of the most common self-inflicted leaks in the entire subject, and it is committed by people who are otherwise careful.
• Wallet and application telemetry. Price feeds, update pings, crash reporting and embedded analytics can all associate a device with a wallet, and the fiat price ticker in a wallet's interface is a request to somebody's server.
• The physical world. A hardware wallet delivered to your home, a purchase shipped to your name, a bank transfer that funded your first buy, a phone number attached to an account. The chain is not where these live, and they are usually what closes an investigation.
• Legal process and inter-agency reporting. Exchanges answer subpoenas. Travel-rule messaging passes originator and beneficiary details between regulated businesses on transfers above thresholds. From 2026, international frameworks begin exchanging account data between tax jurisdictions automatically, a subject we cover in the tax guide.
• You, in public. An address posted once in a public place is attached to whatever account posted it, permanently and searchably, and screenshots are indexed too.

The lesson is not that the cryptography is weak. It is that the cryptography is almost never what fails. Our wallet hygiene guide is the operational companion to this section.

What actually breaks the link, ranked honestly

Ranked by how much they genuinely defeat the analysis described above, with the caveats stated rather than omitted.

• 1. Crossing into an opaque ledger — the only structural break. Monero does not publish recipient addresses, does not identify which input is being spent, and does not publish amounts. There is no address graph to cluster and no amounts to correlate, so the techniques in this guide have no data to consume. The honest caveats: statistical work has found weaknesses in very old transactions made under earlier protocol rules, network-level observation of where a transaction was broadcast still applies, and the transparent legs on either side of your Monero use remain fully visible. What you break is the middle, which is usually what matters. Private crypto explained covers the mechanisms in detail.
• 2. Shielded Zcash — strong cryptography, smaller crowd. The zero-knowledge construction is excellent and arguably the most elegant in the field. The practical limitation has been that only a portion of activity uses the shielded pool, and value that enters and leaves it in matching amounts at correlated times can sometimes be linked around it. It has improved considerably and remains a meaningfully private option when used shielded end to end.
• 3. Collaborative transactions on Bitcoin. A CoinJoin deliberately violates the common-input-ownership heuristic by having many participants sign one transaction together. It genuinely raises the cost of analysis. Three caveats: enforcement action against major coordinators in recent years has thinned the ecosystem considerably, statistical matching of input and output amounts can partially unpick some rounds, and the most common failure is the user's own — spending mixed and unmixed coins together afterwards undoes the entire exercise in one transaction.
• 4. Lightning — genuinely better, but not a privacy system. Payments routed over Lightning are not written to the public ledger at all, which removes them from this analysis entirely and is a real and underrated benefit. But opening and closing a channel are on-chain events, and the routing graph is partially observable. Treat it as a large default improvement over on-chain Bitcoin rather than as anonymity. See the Lightning swap guide.
• 5. A non-custodial swap — depends entirely on where you land. This deserves precision rather than marketing, so it gets its own section below.

Where a swap actually sits in the graph

A swap changes the analysis in exactly one way: it inserts a party that is not you between two transactions, and it changes the asset. Whether that constitutes a break depends on the destination.

Swapping between two transparent assets is a hop, not a break. Send Bitcoin, receive Ethereum, and both legs are permanently public. The amounts are mechanically related through the quoted rate and the timestamps are minutes apart. Reconnecting the two sides is routine amount-and-timing correlation of the kind described above, and adding further transparent hops mostly makes the pattern more distinctive rather than less. This is worth being blunt about, because a great deal of the industry implies otherwise.

Swapping into an opaque asset is a genuine structural break. Send Bitcoin, receive Monero, and the outgoing leg simply cannot be read. There is no published receiving address to correlate, no readable amount, and therefore nothing on the far side for the graph to attach to. The chain of custody ends at the swap, and continues in a form the analysis cannot consume. That is the whole reason BTC to XMR is the most-requested route in this space — the BTC to XMR guide covers doing it properly.

The remaining question is what the service knows. One party observed both legs at once: the swap itself. Any service that processed your order could, in principle, correlate the deposit with the payout, because it had to in order to execute. What it does with that ability is a policy question rather than a cryptographic one, and it is the correct thing to interrogate before you use anyone.

Our own answer, stated plainly because this guide would be worthless without it: we have no accounts, so there is no profile to build. Deposit addresses are single-use and retired after settlement. We keep no persistent request logs, we run no third-party analytics and we ship no tracking scripts — details on the transparency page and the privacy policy. We are also a routing layer over upstream liquidity, which means an upstream provider sees the leg it fills, and we say so rather than implying the route ends with us. What no service can do is make a transparent destination asset private. If the coin you receive is readable, the analysis continues on the other side of us, and any provider telling you otherwise is selling something. That is the same standard we apply in is crypto swapping anonymous.

What does not work, and is sold as though it does

• A fresh address. Correct hygiene, close to worthless against clustering by itself. The first time you spend it alongside another coin, common-input ownership merges it into everything else you own.
• More hops on a transparent chain. Peel chains are precisely what the tooling is built to follow. Twelve self-transfers produce a distinctive pattern and a clear direction of travel; they do not produce ambiguity.
• Consolidating carefully separated coins. The most common self-inflicted defeat there is. Months of coin control, undone permanently by one transaction that sweeps several coins into a single output.
• A VPN on its own. Fixes a network leak, which is worth doing, and does nothing whatsoever to the ledger. Network privacy and ledger privacy are different problems with different solutions.
• Custodial mixing services. Handing your coins to an operator who now holds the complete correlation between deposits and withdrawals replaces a public risk with a concentrated private one, in a category that has been the primary target of enforcement action. Structurally, you have not removed the observer; you have appointed one.
• Anything advertised as untraceable. Nothing is untraceable. Tracing has a cost, and privacy tools raise that cost by varying amounts against varying adversaries. A vendor unwilling to state the limits of their tool has told you something useful about the tool.

Name the adversary before you pick the tool

Most bad privacy decisions come from skipping this step. The measures below range from free to genuinely expensive in convenience, and which ones are rational depends entirely on who you are trying to be private from.

• Commercial surveillance — data brokers, ad networks, exchange risk scoring, anyone who buys the output. This is the adversary almost everyone actually has, and it is defeated by ordinary hygiene: fresh addresses, coin control, no explorer lookups from your own connection, a node or Tor. Entirely achievable.
• A counterparty, an employer, an acquaintance, or anyone you paid. Someone who knows one of your addresses and can read a public chain from it. Address discipline plus an opaque asset for the sensitive leg closes this. Achievable.
• A motivated private party with money — a litigant, a creditor, an investigator. Commercial analysis tooling and civil legal process. Hard, frequently achievable, and dependent on whether an identity anchor exists anywhere in your history.
• A well-resourced state with legal process, time and cooperation from your counterparties. Assume they can, if they care enough. Every custodial relationship you have ever had is discoverable, and the ledger is permanent. Do not build anything on the assumption that this adversary fails.

And the line that keeps a legitimate privacy practice legitimate, which we repeat across this site because it matters: privacy is about who gets to see your finances by default. It is not a mechanism for evading obligations you actually owe. Those two things are perfectly compatible, they are separated cleanly in the tax guide, and conflating them is how people turn a lawful preference into a legal problem.

The practical checklist

Six things, in the order they matter. None of them can be applied retroactively, which is the entire point.

1. Name the adversary. Decide what you are defending against before you spend anything on defending against it.
2. Fresh address, every single receipt. Never publish one, never reuse one. Free, and it denies the cheapest heuristic its input.
3. Coin control, always. Keep coins of different origins in separate accounts and never spend them together. One merge is permanent.
4. Close the network leaks. Your own node or Tor for broadcasting; never look up your own addresses on a public explorer from your normal connection.
5. Cross an opaque ledger for a real break. If continuity has to end rather than lengthen, the destination asset must be unreadable. Extra transparent hops do not do this.
6. Do not undo it on exit. Come out into a wallet with no history with the one you started from, in an amount that does not mirror the deposit, at a time that does not correlate with it.

Related reading

For what a swap conceals and what it does not, see is crypto swapping anonymous. For the cryptography behind opaque ledgers, see private crypto explained. For the operational hygiene that closes the leaks described here, see wallet hygiene for privacy swaps. For the most-used route out of a transparent chain, see the Bitcoin to Monero guide, and for acquiring Monero in the first place, how to buy Monero without KYC. For the regulatory backdrop, see is no-KYC swap legal where you live, and for the vocabulary used throughout, the glossary.

Frequently asked questions