Chain Analysis: How Your Bitcoin Transactions Are Traced

Blockchain surveillance is a multi-billion dollar industry. Companies like Chainalysis, Elliptic, and CipherTrace (now part of Mastercard) provide law enforcement and regulated businesses with tools to trace Bitcoin flows, identify mixer usage, and flag risky transactions.

The Major Players

Chainalysis is the market leader, providing tools to government agencies in 60+ countries. Their Reactor product visualizes fund flows across addresses and entities. Elliptic focuses on real-time transaction screening for financial institutions. CipherTrace (Mastercard) specializes in DeFi compliance and cross-chain tracing.

Tracing Techniques

1. Common Input Ownership Heuristic

The foundational assumption: if two inputs appear in the same transaction, they are likely controlled by the same entity. This allows analysts to cluster addresses into wallets. It's highly reliable for standard transactions but fails against CoinJoin, where inputs from different users are deliberately combined.

2. Change Address Detection

When you send Bitcoin, any excess (change) returns to a new address you control. Analysts detect change outputs through patterns: round-number sends (the non-round output is change), address type matching, and script reuse. This reveals your remaining balance and links new addresses to your wallet.

3. Amount Analysis

If 1.23456 BTC enters a mixer and 1.22456 BTC (minus exactly 1% fee) exits shortly after, the correlation is obvious. Effective mixers counter this with output splitting, fee randomization, and time delays.

4. Temporal Analysis

Depositing to a mixer and withdrawing within minutes creates a strong timing signal. Even with address obfuscation, the tight time window narrows the set of possible senders. This is why configurable time delays (up to 72 hours in some mixers) are a critical privacy feature.

5. Demixing Algorithms

Advanced techniques attempt to reverse mixing by analyzing the mixer's transaction patterns. If a mixer has predictable behavior — fixed pool sizes, consistent fee structures, regular payout intervals — analysts can build probabilistic models to match inputs and outputs.

What Defeats Chain Analysis

• CoinJoin with equal denominations: Breaks the common-input heuristic and makes amount analysis impossible.
• Long time delays: Extending the delay to 24–72 hours defeats temporal analysis.
• Output splitting: Distributing outputs across 5–16 addresses prevents simple amount matching.
• Fee randomization: Variable fees prevent pattern detection based on exact fee deduction.
• Large anonymity sets: The more users in a mixing pool, the harder it is to correlate specific inputs and outputs.
• Cross-chain bridges: Moving to Monero (which has ring signatures by default) and back creates a gap that chain analysis cannot bridge.

AML Risk Scores

When your coins land on a regulated exchange, they receive a risk score based on their transaction history. Coins that have passed through a known mixer are flagged as high-risk. Some exchanges freeze these deposits pending investigation; others reject them outright.

Services like Mixtum counter this by sourcing mixed outputs from exchanges, so the coins have no prior mixer association in their transaction history.