The foundational narrative of Bitcoin included, from its inception, an implicit promise of privacy. The generation of addresses without direct linkage to real-world identities led to a widespread perception — still active in segments of the ecosystem — that operating on the network implied a degree of anonymity.
The blockchain constitutes a public, immutable, and globally replicated ledger, where every transaction is permanently recorded and accessible to any node on the network. Far from being anonymous, Bitcoin operates under a regime of pseudo-anonymity: addresses function as pseudonyms, and the entire transactional history associated with each of them is fully traceable.
This article examines, from a technical perspective and without rhetorical concessions, the mechanisms through which blockchain tracing dismantles privacy in Bitcoin, the tools and methodologies employed by analysts, and the implications this scenario presents for users, developers, and the industry at large.
Bitcoin does not hide transactions; it makes them public. Each value transfer propagates through the network and consolidates into a block, remaining available for query by any participant. The sender’s address, the recipient’s address, and the transferred amount are fields recorded in plain text. The sole layer of obfuscation resides in the address being an alphanumeric string — a hash of a public key — without an associated name natively.
An entity can generate and control millions of addresses, and the absence of a personal identifier on-chain does not prevent the establishment of links between addresses and, subsequently, between addresses and legal or natural persons through analytical techniques. Bitcoin’s transparency, paradoxically, converts it into one of the most traceable financial networks, since each movement leaves a permanent and verifiable digital footprint.
This process consists of grouping addresses that, based on on-chain evidence, are presumed to be under the control of a single entity. Clustering transforms a dispersed set of pseudonyms into clusters representing units of control — which in practice equates to identifying wallets or sets of wallets belonging to the same actor.
The most consolidated heuristic in this field is the co-spend heuristic, also known as the common input ownership heuristic or the multi-input heuristic. In Bitcoin’s UTXO model, a transaction can have multiple inputs, each referencing an unspent output from a prior transaction.
To sign a transaction with multiple inputs, the signer must possess the private keys corresponding to each of those inputs. Therefore, if multiple addresses appear as inputs in the same transaction, the co-spend heuristic groups them as belonging to the same controlling entity.
This fundamental heuristic is supplemented by others, such as the change address heuristic. When a transaction has two outputs — one corresponding to the payment and another to the change — and one of them resembles a newly generated address, that change address is typically attributed to the same controller as the inputs. Tools such as BACH (Bitcoin Address Clustering based on multiple Heuristics) implement multiple clustering heuristics and visualize the internal structure of clusters, enabling more granular analysis.
The second pillar is entity attribution. Clustering resolves which addresses are linked to each other, but does not identify to whom they belong. Attribution is an off-chain process that associates an address cluster with a real-world entity.
This association is achieved through the integration of data external to the chain: information from exchanges that have applied KYC procedures, public registry data, judicial seizures revealing addresses controlled by a defendant, and open-source intelligence (OSINT) that cross-references digital traces with on-chain activity.
Chainalysis, the market leader in blockchain analysis, has recently proposed a formal ontology for clustering and attribution that explicitly separates the structural layer (address grouping) from the attribution layer (name assignment), aiming to standardize these processes and make them defensible in judicial proceedings.
The FADE framework, presented in 2026, represents an advance in this direction. FADE integrates three modules — deanonymization, graph construction, and graph analysis — and operates over the entire Bitcoin blockchain. Its deanonymization module combines the multi-input heuristic with improved methods for identifying single-use change addresses, reused change addresses, and change addresses based on peel chains.
Validation experiments demonstrate that FADE outperforms reference methods in terms of completeness and precision. The capacity of these frameworks to reconstruct security incidents at the user level — not just the address level — evidences the maturity achieved by deanonymization techniques.
Clustering and attribution are the building blocks; transaction flow tracing is the operational application. Given that each UTXO has a complete history traceable back to its originating block, analysts can track fund movement forward and backward through the transaction graph. This analysis relies on graph analysis, where nodes are addresses (or clusters) and edges are transactions. Entity adjacency analysis identifies interaction patterns between clusters, and taint analysis quantifies the proportion of funds originating from a particular source that reach a given destination.
The industry has developed specialized tools such as Chainalysis Reactor, which allows investigators to visualize and analyze transaction graphs at scale. The effectiveness of these tools in law enforcement contexts is documented: in 2025, the United States Department of Justice utilized blockchain analysis to seize 127,000 BTC controlled by the founder of the Prince Group; the Federal Bureau of Investigation (FBI) resolved a contract killing case through blockchain analysis; and Italian authorities dismantled an illicit cryptocurrency exchange with support from Chainalysis. These cases are not exceptions; they constitute evidence that blockchain tracing has become a standard operational capability of investigative agencies.
The ecosystem has developed mechanisms to mitigate Bitcoin’s traceability, but accumulated evidence indicates that these countermeasures face structural limitations.
Mixers (or tumblers) , centralized services that pool funds from multiple users to obfuscate their origin, have been subject to increasingly sophisticated forensic analysis. A 2025 study proposed an approach based on wallet fingerprints, using statistical measurements of mixer behavior to identify and distinguish between deposit addresses, withdrawal addresses, and internal service addresses. The implemented tool automates the de-obfuscation process and produces individual money transfers.
The effectiveness of these techniques has been verified in police operations: in November 2025, Europol, in collaboration with authorities from Switzerland and Germany, dismantled Cryptomixer, seizing over 25 million euros in Bitcoin and 12 terabytes of data. The 2025 conviction of the founders of Samourai Wallet — whose Whirlpool service coordinated Bitcoin mixing among users — to sentences of five and four years in prison reinforces the regulatory and technical trend against mixers.
Single-use addresses and layer-2 protocols such as the Lightning Network offer privacy improvements, but with limitations. In Lightning, the majority of users in 2025 opt for mobile wallets with Lightning Service Providers (LSPs), which implies that the provider visualizes the entirety or the majority of payments, materially reducing privacy. The adoption of privacy protocols on Bitcoin’s base layer remains marginal — less than 1% of network transactions utilize these protocols — and no standardized adoption of stealth addresses has been observed.
Taproot, the soft fork upgrade implemented in 2021, introduced privacy improvements by hiding unused script paths, but analytical tools can still recognize transaction patterns and address types, which reduces anonymity. Recent research has proposed clustering methods based on specific block numbers for Taproot, indicating that the upgrade has not closed the traceability gap.
The inherent traceability of Bitcoin has consequences that transcend the sphere of criminal investigations. For legitimate users, each transaction executed from an address linked to an identity — through an exchange with KYC, an online purchase, or a donation — exposes the entire transactional history of that address and, by extension, of the entire cluster to which it belongs.
The blockchain analysis industry, led by Chainalysis, has developed a surveillance ecosystem that combines on-chain data with off-chain intelligence. The 2026 revelation that WalletExplorer, an address clustering service, is operated by Chainalysis and records visitors’ IP addresses, sharing that information with other business lines of the company, illustrates the vertical integration of surveillance capabilities. A user querying an address on WalletExplorer is not only verifying public information; they are revealing their own IP and their interest in that address to an actor with attribution capabilities.
The five-year prison sentence imposed on Keonne Rodriguez, co-founder of Samourai Wallet, for developing privacy software for Bitcoin, has been received with alarm in sectors of the crypto community. The debate on whether Bitcoin should incorporate native privacy features — such as those offered by Zcash — faces opposing positions: Michael Saylor has argued that native privacy would give sovereign states reasons to ban Bitcoin, while privacy advocates maintain that both objectives can be reconciled.
