How blockchain analysis catches people
How blockchain analysis catches people
In 2016, thieves stole 119,754 BTC from Bitfinex. Authorities recovered a large portion of the stolen funds even after five years: in February 2022, they arrested Ilya Lichtenstein and Heather Morgan and seized approximately 94,000 BTC.
A new wallet address is not a clean slate. It is one more pseudonym in a ledger that never forgets. Privacy coins can hide the middle of a transaction’s path especially well; the fiat edges are where ordinary users often become legible again.
People keep treating a fresh address as an escape hatch. That explanation is wrong at the first step. This guide follows the path from public addresses to probable wallet entities, transaction graphs, exchange records, and identity attribution. Then it covers mixers, privacy coins, regulation, and safer swapping habits.
In this article
- Crypto tracing starts with a permanent public record
- The Bitfinex case shows why old transactions still matter
- A cluster turns separate addresses into a probable entity
- The graph reveals what a wallet does next
- The exchange is often where a pseudonym meets a name
- Mixers increase uncertainty but do not guarantee privacy
- Privacy coins hide more of the graph, not every real-world connection
- Restrictions change access without always banning ownership
- Your wallet habits still matter more than a dramatic privacy claim
- Privacy is a spectrum—and tracing standards are still evolving
Crypto tracing starts with a permanent public record
A transparent blockchain records addresses, amounts, timestamps, inputs, outputs, and relationships between transactions. Anyone can inspect the history. Analysts look for patterns in it.
“Pseudonymous is not anonymous” is the useful starting point. An address usually acts as a label rather than a legal identity, but that label can gather a recognizable history: repeated transactions, shared inputs, deposits to known services, and links to previously attributed wallets.
The existing SwapCherry analytics guide covers the basic idea that blockchains preserve transaction records. Next, investigators turn those records into a case.
Chainalysis reports $40.9 billion in illicit crypto activity for 2024 and projects more than $51 billion for 2025. A separate secondary report gives $24.2 billion for 2024 because the reports use different measurement scopes. These figures are estimates, not a complete census.
Blockchain analysis does not magically reveal a person’s name. It builds a case from public transaction patterns, clustering, attribution databases, exchange records, subpoenas, and sometimes device evidence.
The Bitfinex case shows why old transactions still matter
The Bitfinex case is useful because the delay was enormous. Funds stolen in 2016 remained relevant even after sitting still or travelling through a complicated route.
The case account describes funds moving through thousands of hops, AlphaBay, a Monero conversion, and later KYC-linked exchange activity. In February 2022, authorities arrested Lichtenstein and Morgan and seized approximately 94,000 BTC.
The public ledger supplied the historical record. Exchange records and other evidence helped connect endpoints to people.
The case shows that time and complexity add investigative work without necessarily removing the evidence. A long chain of transactions is a larger research problem. It is still a chain.
A cluster turns separate addresses into a probable entity
Consider a Bitcoin transaction with inputs from addresses A and B and outputs to C and D. Analysts ask who could authorize the inputs, then which output might represent leftover funds.
In ordinary Bitcoin transactions, spending multiple inputs generally requires authorization for each input. Analysts therefore often treat the inputs as controlled by one entity. This is the co-spend heuristic.
That conclusion is probabilistic. It describes likely control of the inputs, not the name of the person behind them.
Analysts may also treat a fresh output as likely change in common transaction patterns, especially when the other output goes to an established destination. Wallet software and transaction structure vary, so this is another clue rather than proof.
A simplified reading looks like this:
A and B are inputs. C is the payment output, and D may be change.
If a later transaction spends D alongside another address already associated with the cluster, the relationship becomes stronger. Repeated signals across a large ledger can produce clusters that approximate wallets, businesses, or other entities.
Blockchain explainers often call this “proof.” It isn’t. A wallet cluster shows probable shared control. It does not identify a person.
CoinJoin is a deliberate complication. Multiple independent users construct a transaction together, weakening the assumption that shared inputs belong to one controller. Clustering remains useful, but the analyst has to account for the transaction pattern.
The graph reveals what a wallet does next
After clustering, analysts can represent each cluster as a node and each transaction as an edge. The question becomes: which probable entity received the funds, and what happened afterward?
A typical investigation may proceed like this:
- Identify a transaction associated with theft, fraud, or another known event.
- Trace outputs forward to see where the funds travelled.
- Trace inputs backward to examine their source.
- Compare amounts, timing, and transaction structures across chains and services.
- Mark points where funds merge, split, or reach a known entity.
Forward tracing follows proceeds outward. Backward tracing works toward origin. The first is useful when investigators begin with stolen funds; the second helps establish how value reached a suspect wallet.
In the Bitfinex case, the reported movement from Bitcoin into Monero and back changed the data investigators had to compare. It raised the cost of analysis while leaving identifiable activity around the conversion points.
Analysts may also use demixing, which examines timing and amounts to estimate relationships between mixer inputs and outputs. When several sources merge into one wallet, proportional attribution can assign shares of later outputs to earlier inputs, including for asset-forfeiture calculations.
What does the graph establish? It shows control relationships and fund flows. Attribution requires more.
The exchange is often where a pseudonym meets a name
The exchange boundary is less glamorous than graph theory, and far more important to an ordinary user. Many people who convert crypto to fiat encounter a service that collects identity information.
A common investigative workflow has three stages:
First, identify the deposit address. Investigators may use attribution databases that associate addresses with exchanges and other services.
Second, preserve the blockchain evidence. The transaction history, wallet relationships, timestamps, and relevant analysis need to be documented before account information is sought.
Third, obtain records through legal process. A subpoena or court order may require an exchange to provide account information and identity documents. It may also require transaction records and related data. Large exchanges in the United States, Europe, the United Kingdom, and Asia-Pacific often have procedures for responding to valid legal requests. Cross-border cases may require mutual legal assistance.
In the Bitfinex case, the exchange endpoint supplied a route from on-chain activity to identity-verified accounts. That route did not come from a wallet address alone.
The weakest part of this model is provider attribution: public readers usually can’t inspect an analytics company’s labels or error rate. Treat those labels as leads that need corroboration. They are not infallible answers.
Investigators can add device forensics, open-source intelligence, and other records to test the attribution. The blockchain starts the inquiry; it rarely finishes the identity question by itself.
Mixers increase uncertainty but do not guarantee privacy
A mixer combines inputs from multiple users and returns equivalent amounts minus a fee. CoinJoin is a Bitcoin pattern where several parties build one transaction together.
Mixing changes the direct visual link between an input and a later output. Transactions remain available for analysis, along with timing, amounts and mixer-related activity.
Timing and volume correlations can narrow the possibilities. The mixer may form a recognizable cluster. If its infrastructure is seized, investigators may obtain address datasets or operational records that change the picture.
Mixing is not a privacy force field. Deliberate use of a known mixing service may also be evidence of an intent to conceal, even when investigators cannot reconstruct every hop. That creates compliance and legal exposure independent of whether every hop can be reconstructed.
CoinJoin also changes how analysts interpret the co-spend heuristic. The transaction may contain inputs controlled by unrelated users, so a mechanical clustering rule produces a bad result unless the analyst recognizes the pattern.
Do not treat a mixer as a guarantee, and do not use one as a substitute for understanding the records created before and after the transaction.
Privacy coins hide more of the graph, not every real-world connection
Privacy coins provide stronger ledger-level protections than transparent chains, but Monero and Zcash take different approaches.
| Asset | Main privacy mechanism | Practical trade-off |
|---|---|---|
| Monero | Ring signatures blend a real input with decoys; stealth addresses create one-time receiving addresses | Privacy is built into ordinary transactions, while exchange support and fiat conversion vary |
| Zcash | Shielded transactions use zk-SNARKs to hide sender, receiver, and amount | Privacy is optional because Zcash also supports transparent transactions |
Monero’s ring signatures make it difficult to identify the real input among decoys. Stealth addresses prevent a public address from acting as a simple, reusable label for incoming transactions.
Zcash shielded transactions hide the sender, receiver, and amount through zk-SNARKs. Its transparent mode gives users a choice and may make the asset easier for some platforms to support than a system that requires private transactions every time.
The protocol’s protection applies to the transaction data it hides. Earlier and later records remain outside that protection. Implementation, wallet behaviour, exchange records, and user mistakes also affect practical privacy.
A user who moves from transparent Bitcoin into Monero and later converts back to Bitcoin may create identifiable timing and amount relationships around those transfers. The private middle section raises the tracing cost; the on-ramp and off-ramp can still connect activity to a customer account.
Can investigators trace privacy coins? Their internal transactions resist direct ledger reading. Surrounding services and user behaviour may supply the missing context.
Privacy coins are meaningfully more private than transparent chains. They still operate inside an economy with wallets, exchanges, payment services, and legal records.
Restrictions change access without always banning ownership
At least 10 countries impose bans or strict exchange restrictions on privacy coins, according to WhySoGeek. That is a secondary estimate drawn from incomplete global data.
A platform may delist Monero because its compliance team considers private transactions difficult to monitor. Delisting can limit buying and selling through that platform without making possession illegal.
Imagine an exchange removing Zcash deposits. Your access to that market has changed. The event alone does not establish a direct legal ban on owning Zcash in every jurisdiction.
Rules remain local and can change. Gate.com reported that India’s Financial Intelligence Unit added Monero, Zcash, and Dash to its restricted list in January 2026. Check the rules that apply where you live before relying on a general online summary.
Your wallet habits still matter more than a dramatic privacy claim
The useful privacy decision is usually mundane: know what the protocol hides, then avoid handing the missing context to a service by accident.
- Verify the destination details. Before you confirm, match the asset and network to the destination’s instructions. An Ethereum token sent over the wrong network may require recovery support, if recovery is possible at all.
- Keep accurate transaction records. Save the dates, assets, amounts, and transaction IDs. Keep the fees and purpose of each swap for tax reporting and account questions.
- Treat fresh addresses as pseudonyms. A new address can separate activity in some situations, but it offers no universal anonymity guarantee.
- Check the privacy mode. Monero’s default design differs from Zcash’s choice between shielded and transparent transactions.
- Expect the exchange boundary to matter. Privacy inside a network does not remove identity checks or records at every on-ramp and off-ramp.
- Think carefully before using a known mixer. It can complicate tracing and attract legal or compliance attention.
For a straightforward swap, we recommend SwapCherry: a fast service with a low 0.5% fee and no KYC or registration.
This convenience still leaves transactions subject to ordinary blockchain and service-level records. You remain responsible for checking the destination address and network, keeping your records, and understanding the privacy properties of the assets involved.
Privacy is a spectrum—and tracing standards are still evolving
Privacy is a spectrum measured at each handoff. Look at the ledger and wallet first. Then check the exchange and surrounding records. Analytics keeps improving those handoffs; privacy protocols make some links harder to read. Neither fact changes the practical rule: know what each step exposes before you approve it.
In June 2026, CoinDesk reported on Chainalysis’s proposal for common blockchain-tracing ontology and standards.
Before you swap, answer three questions: what the asset hides, what the service records, and what you’ll need to document later. If you can’t answer those, pause before confirming.