chain analysis

chain analysis is the business of following money on public blockchains - clustering addresses, spotting change outputs and turning bitcoin's transparency into leads.

every bitcoin transaction is public forever, and chain analysis (blockchain analysis) turns that transparency into attribution. the core toolkit is heuristics: multiple inputs in one transaction very likely belong to one wallet (common-input-ownership), the "change" output returning leftover funds usually stays under the same owner's control, and patterns like peeling chains betray consolidation toward exchanges.

firms in this industry maintain massive clusters mapping millions of addresses to entities, enriched by off-chain data: kyc records from exchanges, leaked database dumps, publicly declared donation addresses. the usual endgame is not on-chain magic but the chokepoint - coins traced to a deposit address at an exchange that complies with a subpoena.

this playbook drove many headline takedowns: silk road's movement of coins, the alphabay investigation, hydra, and the tracking of dormant wallets years later. the recurring lesson is that the arrest came from linkage at the edges - deposits, withdrawals, reused addresses - not from breaking tor or pgp.

defensive hygiene follows: never reuse addresses, understand change behavior, assume any coin that touched a compliance-heavy exchange is tagged forever, and read our beginner chain analysis explainer plus wallet hygiene checklist before moving meaningful amounts.