How Blockchain Transactions Work
Every Bitcoin or Ethereum transaction is permanently recorded on a public ledger. Transactions have inputs (source addresses) and outputs (destination addresses plus change). The blockchain is fully transparent: anyone can see every transaction ever made.
Addresses are pseudonymous, not anonymous. They can be linked to real identities through various techniques.
Bitcoin Address Formats
Bitcoin uses several address formats, each with distinct characteristics:
- Legacy (P2PKH): starts with
1, the oldest format (e.g.,1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa-- Satoshi's genesis address) - SegWit (P2SH): starts with
3, supports multi-sig and reduced fees - Bech32 (P2WPKH): starts with
bc1, native SegWit, lowest fees, most modern
Each format is interchangeable -- a user can control addresses in all three formats from the same wallet. Recognising the format helps analysts understand the sophistication and habits of a wallet owner.
Wallet Clustering Techniques
Wallet clustering is the process of grouping addresses that are likely controlled by the same entity:
- Common-input-ownership heuristic: if addresses A and B are both inputs to the same transaction, they are likely controlled by the same entity (they had to sign with both private keys)
- Change address detection: when you send Bitcoin, the "change" goes to a new address you control -- this links the change address to the sender
- Address reuse: many users reuse addresses, making tracking easier
- CoinJoin detection: a privacy technique that mixes multiple users' transactions together to break the common-input heuristic -- detectable by its distinctive multi-input multi-output pattern
Identifying Known Entities
Attributing blockchain addresses to real-world entities is a key part of blockchain OSINT:
- Blockchain analysis companies (Chainalysis, Elliptic) maintain databases mapping addresses to known entities (exchanges, darknet markets, ransomware operators)
- Exchange deposit addresses are identifiable: when you deposit to Coinbase or Binance, the deposit address is linked to your KYC'd account
- Publicly known addresses: donations pages, payment processors, and seized wallets are all attributed
- Address labels on Blockchair and other explorers crowdsource entity identification
Ethereum-Specific Analysis
Ethereum has a richer data model than Bitcoin, opening additional avenues for investigation:
- Smart contracts, token transfers (ERC-20), and NFTs (ERC-721) all leave on-chain traces that can be analysed
- ENS (Ethereum Name Service):
.ethdomains resolve to addresses and often reveal the owner's identity - Contract interactions: you can see every DeFi protocol, NFT marketplace, and token a wallet has interacted with
- Internal transactions: contract-to-contract calls that reveal complex financial flows
OSINT Tools for Blockchain Analysis
Here are some useful tools for blockchain investigations:
