A public blockchain shows every transaction but labels no one. An address is just a string of characters until something links it to other addresses, or to a real-world identity. Clustering is the set of techniques investigators use to take that first step, grouping addresses that most likely belong to a single wallet, entity, or actor even when nothing on the ledger explicitly says so.
The common-input-ownership heuristic
This is the oldest and most widely used clustering technique, and it starts from a simple technical fact: a Bitcoin-style transaction that spends from multiple addresses as inputs requires a valid private key signature for every one of those inputs. Since producing that signature requires the private key, the addresses used as inputs together in a single transaction are, in the overwhelming majority of cases, controlled by the same entity. Applied across a large transaction history, this heuristic alone can merge thousands of previously separate addresses into a small number of clusters, each representing one likely wallet or service.
Change address detection
Most transactions do not spend an input exactly to the penny, so the difference returns to the sender as a new "change" address, typically one the sender’s own wallet generated automatically. Identifying which output in a transaction is the change, rather than the actual payment, lets an investigator fold that new address into the same cluster as the input addresses. Several patterns help distinguish change from payment: a change output is often a fresh address never seen before in the ledger, while the payment address may already have history; wallets frequently generate change in the same address format and script type as their inputs, while an outside payment address may not; and rounder, cleaner-looking amounts are more often the intended payment than the change, which tends to be an irregular leftover figure.
Behavioral pattern matching
Beyond these structural rules, investigators also look at behavior that tends to be consistent within a single actor’s activity over time: a consistent fee-selection strategy across transactions, a recognizable timing pattern such as activity clustered around particular hours, address reuse habits, and the fingerprint left by a specific wallet software’s way of constructing transactions. None of these signals is conclusive alone, but consistent behavioral fingerprints layered on top of structural clustering meaningfully raise confidence that separate clusters actually belong to the same underlying actor.
No clustering heuristic is infallible, and treating any single one as proof of ownership is a documented source of investigative error. CoinJoin-style transactions and similar coordination techniques are specifically designed to violate the common-input-ownership assumption, and a custodial exchange batching many customers’ withdrawals into one transaction can make unrelated users appear falsely clustered together.
Why this is combined with off-chain evidence
Because every heuristic can produce false positives under the right conditions, competent clustering work is rarely presented as a standalone conclusion. It is corroborated wherever possible against off-chain evidence: know-your-customer data obtained through a legal request to an exchange, IP or device data tied to an account, or independently reported incidents that connect a cluster to a known scam or theft. The cluster narrows the field of candidates considerably. The corroborating evidence is usually what turns a strong probability into something an exchange’s compliance team or a court will actually act on.