Blockchain Analysis Basics

Blockchain analysis turns Bitcoin's greatest strength — auditability — into a surveillance mechanism. Understanding these methods clarifies what mixers and CoinJoin actually defeat.

Address clustering

The common-input-ownership heuristic assumes all addresses in a single transaction's inputs belong to one wallet. Over time, analysts build clusters representing a single user's aggregate holdings.

Change address detection

When you pay 0.5 BTC from a 1 BTC UTXO, the remainder returns to a change address you control. Statistical models predict which output is payment versus change, further expanding clusters.

Exchange deposits

Depositing to a KYC exchange is the single largest deanonymization event for most users. The exchange knows your identity and can map your entire cluster retroactively.

Timing and amount correlation

Even without identity leaks, matching deposit and withdrawal amounts within time windows can link mixer inputs to outputs — especially on low-volume services.

Defensive implications

Effective privacy requires breaking multiple heuristics simultaneously: graph links, amount correlation, and timing. Professional mixers introduce delay, fragmentation, and external liquidity. Read how mixing addresses each attack vector.