Transaction tracing and on-chain analysis

On a public blockchain such as Bitcoin’s, every transaction is recorded forever and can be read by anyone. This makes it possible to follow the path of a value from address to address, even years later. This work has a name: on-chain analysis, the study of data recorded on the blockchain itself (on-chain) to understand who is moving what.

This article explains the ideas behind tracing, its limits and the rules surrounding its use. It does not recommend companies or tools and does not teach how to evade tracing. The situation described is as of October 8, 2026. For the side of those who want to protect their own privacy, see Privacy on public blockchains.

The starting point: an open ledger

The Bitcoin blockchain records each transaction with its inputs, where the money comes from, and its outputs, where it goes. Participants appear as addresses, without names. The Bitcoin whitepaper compares the result to a stock exchange’s tape, which shows the time and size of each trade without saying who the parties are (Nakamoto, section 10).

Following a value from one output to the next input is simple: the data is there. The hard part is answering two questions. Which addresses belong to the same person or company? And who is that person or company?

Clustering addresses: the heuristics

A heuristic is a rule of thumb that is usually right but not guaranteed. On-chain analysis uses several of them to group addresses into clusters that probably have the same controller.

The reference academic study is A Fistful of Bitcoins, by researchers from the University of California, San Diego, and George Mason University, published in 2013. It describes two heuristics (Meiklejohn et al.):

1. Common inputs. If two addresses appear as inputs to the same transaction, they are controlled by the same user. The logic is that, to build the transaction, whoever signs it needs the private keys for all the inputs. The Bitcoin whitepaper itself already acknowledged this link as unavoidable (Nakamoto, section 10).
2. Change address. In Bitcoin, a received amount has to be spent in full. If you have 4 and want to pay 3, the transaction creates two outputs: 3 to the recipient and 1 back to a new address of yours, the change. Identifying which output is the change makes it possible to link that new address to the payer.

The second rule is much riskier than the first, because change carries no mark. The authors took precautions, such as not labeling anything when in doubt, and estimated a false positive rate of 0.17%. They themselves stress that this rate can only be estimated, because there is no way to know for certain what is and what is not change.

On Ethereum, the task starts from a different point. The network uses accounts and, in the editorial team’s observation, many people use the same account for a long time, which already concentrates the history in one address. The details of this model are in What is Ethereum.

Putting names to the clusters

A cluster of addresses remains anonymous until one of them is linked to the real world. In the 2013 study, the researchers made 344 transactions with exchanges, online wallets and shops to tag addresses whose owners they knew. They then extended each tag to the whole cluster. In this way, they identified about 1.9 million public keys linked to some service or identity, about 16% of the total at the time. In many cases, the “identity” was a forum username, not a legal name (Meiklejohn et al.).

The study also followed stolen funds and funds that left Silk Road, the illegal marketplace of the time. In most cases, the tracing was straightforward, and large sums reached exchanges. The authors note that reaching the exchange does not identify the perpetrator, but it allows authorities with subpoena power to find out the account holder. Because exchanges function as mandatory points of passage for entering and leaving the system, they concluded, Bitcoin did not seem, at that time, particularly attractive for laundering money.

This remains the central mechanism today: the blockchain shows the path; whoever knows the customer at the end, usually a centralized exchange, provides the name.

Who uses tracing

• Authorities. Police, financial intelligence units and sanctions agencies follow the flows of crimes such as ransomware and scams. In 2022, when sanctioning the Tornado Cash mixer, the US Treasury attributed to the service more than US$ 7 billion laundered since 2019, including more than US$ 455 million stolen by a group linked to North Korea (US Treasury), figures that exist only thanks to this kind of analysis.
• Exchanges and service providers. They need to monitor transactions and check whether addresses appear on sanctions lists, as described below.
• Victims and researchers. Someone who has been scammed can track where the funds went, which helps when filing a report; see how in crypto scams.

The method’s limits

On-chain analysis is powerful, but it has limits you need to know before trusting a result.

• They are inferences. Heuristics make mistakes. A cluster may join addresses of different people or separate addresses of the same person. The conclusion “this address belongs to so-and-so” is a hypothesis until confirmed by other evidence, such as the exchange’s customer records.
• Contamination is not guilt. Receiving an amount that passed, many steps earlier, through a suspicious address does not make you a suspect. In the editorial team’s assessment, the more distant the link, the less it says.
• Obfuscation. Mixers, coins with protocol-level privacy and hops between networks via bridges make tracing harder, although they do not make it impossible in every case.
• Code is not a person. In the Tornado Cash case, the US Court of Appeals for the Fifth Circuit ruled in 2024 that immutable smart contracts, which no one controls, are not property that can be blocked under the sanctions law used by the US government (Fifth Circuit). The Treasury lifted the sanction in March 2025 (US Treasury). The episode shows that identifying a flow does not, on its own, settle the legal question of who can be held liable.

The rules in Brazil

Law 9,613/1998, Brazil’s anti-money laundering law, requires the persons listed in Article 9, including virtual asset service providers, to identify customers, record virtual asset transactions above thresholds set by the authority and pay special attention to operations that may indicate a crime, reporting them to Coaf (Brazil’s financial intelligence unit) within 24 hours (Law 9,613/1998, Articles 10 and 11).

BCB Resolution 520/2025, issued by the Banco Central do Brasil (Brazil’s central bank) and in force since February 2, 2026, regulates these providers. Among other points, it requires controls to identify sanctions lists and sanctioned wallet addresses, in Brazil and abroad, when the provider hires third parties, and requires banning the offer of assets designed to facilitate anonymity or make it harder to identify the holder (BCB Resolution 520). The full obligations, including the travel rule, are in anti-money laundering on crypto platforms.

Companies’ reports feed Coaf’s work. When the analysis points to well-founded indications of money laundering or another offense, Coaf produces a Financial Intelligence Report (RIF) and sends it to the competent authorities, under confidentiality (Coaf).

What about privacy? The LGPD (Brazil’s General Data Protection Law) considers personal data any information related to an identified or identifiable person, and says that data used to build the behavioral profile of an identified person may also be personal (LGPD, Articles 5 and 12). In the editorial team’s assessment, a company that links addresses to customers is processing personal data and must comply with the law. The LGPD does not apply, however, to processing carried out exclusively for the investigation and prosecution of criminal offenses, which has its own rules (Article 4, III).

Takeaways

• Tracing is possible because the public blockchain keeps everything; identification depends on heuristics and, above all, on whoever knows the customer at the end.
• The results of on-chain analysis are inferences with a margin of error, which need confirmation before becoming an accusation.
• In Brazil, exchanges are required to monitor and report suspicious transactions to Coaf, and the processing of data linked to individuals is subject to the LGPD.