How blockchain analysis tracks your crypto

8/11/2026 • SwapCherry

A fresh crypto address is a fresh label, not a clean slate. Analysts may treat both addresses as one actor when one wallet funds both, the same user moves funds between them within minutes, or one deposits to a known exchange account.

But the blockchain doesn’t print your legal name. Analysts can group and score public transactions. They can match them with an exchange account, IP record, public post or other off-chain clue. Privacy means reducing unnecessary links while accepting that transparent blockchains remain observable.

I’ll show you the signals investigators use, test the fresh-address assumption against one ordinary swap, then give you a lawful routine for reducing exposure. The useful controls are mostly boring wallet habits. Good.

In this article

• Your crypto is public even when your name is not
• A single transaction can reveal more than its destination
• “I used a fresh address” does not settle the question
• Does moving across chains hide me?
• The Bitfinex case shows why “traceable” does not mean “instantly identified”
• The useful privacy controls are mostly wallet habits
• Is privacy itself illegal?
• A practical privacy routine for your next swap
• What investigators can prove—and what they cannot

Your crypto is public even when your name is not

A blockchain exposes addresses, transfers, amounts, timestamps, and contract calls according to its design. It generally doesn’t display a legal name beside an address.

Chainalysis Reactor organizes transaction flows and service labels. The tool shows related addresses and possible attribution clues. A public address label or post might connect activity to a person; IP records and other service data may add evidence. Those clues become stronger when they converge.

So picture one actor controlling several credentials. An address is one credential among many. A new one can inherit links from its funding source, timing, contracts, or destination.

So privacy means limiting linkability. You’re trying to reduce the easy joins between wallets, services, and your public identity. A no-account swap may avoid one identity-collection event; it cannot make a public transaction private. See the site’s privacy guide for broader wallet and service controls.

A single transaction can reveal more than its destination

Many privacy explainers get sloppy here. They treat an address as a person. So analysts examine how addresses receive funds, make transactions, and pay out.

And on Bitcoin and other UTXO-based chains, the common-input heuristic treats multiple inputs spent in one transaction as likely controlled by one entity. And that inference remains evidence rather than a universal rule. Meiklejohn and colleagues’ 2013 academic research helped establish this approach. CoinJoin and PayJoin can complicate the inference. Treat the heuristic as evidence, not a universal rule.

Ethereum uses an account model, so the common-input heuristic doesn’t transfer directly. So analysts examine relationships such as:

• Common funding: several accounts receive their first gas from one source.
• Timing correlation: related actions occur within a narrow window.
• Contract behaviour: accounts repeat the same calls or sequence.
• Common deposit context: multiple wallets send to the same exchange deposit address. Analysts compare any available memo, amount or timing patterns.

So the published methodology considers that signal especially useful on account-based chains because the exchange destination can provide a shared service context. It still doesn’t prove that one person controlled every sending wallet. A shared exchange deposit address can create a false positive by linking wallets to the same service or account context without establishing common ownership.

The methodology describes 50 wallets receiving their first 0.01 ETH from one source within 30 minutes as a near-conclusive sybil indicator. Twenty or more near-simultaneous token events may suggest one automated operator. Behavioural similarity is weaker because unrelated users can follow the same script.

So consider a lawful user who swaps BTC for USDT. They send the USDT through a bridge to another chain and deposit it at an exchange within 20 minutes. The user funds the new account’s gas from the old wallet. On that account-based destination chain, funding source, timing, bridge activity, and exchange deposit give an analyst several edges to test.

I can explain the signals, but I can’t tell you what confidence score an investigator would assign to a particular wallet without the chain data, labels, and service records.

“I used a fresh address” does not settle the question

Fresh addresses are useful beginner-level privacy hygiene. A broader privacy model also considers funding, timing, and destinations.

For account-based chains, the published methodology ranks the following signals this way:

Deep Blue Alpha describes its own 0–12 confidence score: 8 or higher means high-confidence cluster membership. A score of 5–7 means medium confidence. Below 5 probably indicates independent wallets. That score applies only to this methodology and has no industry-wide meaning.

It also recommends recursing only about two hops outward. Beyond that, popular contracts, shared exchanges, and common wallet software can pull unrelated activity into an oversized cluster. More graph is not automatically more truth.

In the BTC-to-USDT example, the analyst can test whether the old wallet funded the new account, whether the bridge transfer followed soon after, and whether the resulting funds reached the exchange deposit linked to the same user. The output is a confidence-weighted hypothesis about the activity. It does not identify a person.

That distinction matters. A cluster can be wrong, incomplete, or too broad. Attribution needs supporting records.

Does moving across chains hide me?

Bridges change the route; they don’t grant a clean break.

A typical chain-hopping model follows four stages.

1. Origin chain: assets begin on one network.
2. First conversion: they cross through a bridge, atomic swap or exchange.
3. Additional hops: they move through another chain, token, or privacy-focused asset.
4. Integration: they reach a fiat off-ramp or service where identity may enter.

FluxForce’s chain-hopping typology notes that bridges, atomic swaps and DEX aggregators can make attribution harder to interpret. They do not remove timestamps, amounts, contract calls or service touchpoints. The activity doesn’t depend on one centralized mixer, either. The graph changes. The records remain.

The same typology identifies several detection signals: movement across four chains and three assets within minutes; conversion into a privacy coin within seven days; or a bridge transaction followed by fresh-address clustering. They can flag activity for review without proving wrongdoing. A legitimate DeFi user can produce similar activity while moving funds for fees, liquidity, or an application.

In the running example, the user’s BTC-to-USDT swap comes first. The USDT then crosses a bridge to another chain, while the old wallet funds gas for the fresh account. The sequence finishes within 20 minutes. The exchange deposit comes next. The compact graph connects the speed, asset changes, bridge activity, and eventual service touchpoint.

Monero hides transaction details with ring signatures, stealth addresses, and RingCT by default. Zcash allows users to shield transactions, while Dash’s PrivateSend provides weaker mixing. These properties affect what observers can see on particular legs. Transparent activity before conversion, after conversion, or at an off-ramp remains available for analysis.

The Bitfinex case shows why “traceable” does not mean “instantly identified”

The 2016 Bitfinex theft involved 119,754 BTC. The DOJ’s February 2022 account, described in ForensicBlock’s case analysis, valued the seizure of approximately 94,000 BTC at about $3.6 billion.

The laundering activity included darknet markets, peel chains, chain hopping and mixing services. ForensicBlock’s account reports that Ilya Lichtenstein and Heather Morgan were arrested in February 2022, pleaded guilty in 2023, and were sentenced in 2024.

The ledger preserved the transaction trail. Identity attribution required additional evidence connecting that trail to real people. Traceability narrows possibilities; it doesn’t print a name beside a transaction.

The useful privacy controls are mostly wallet habits

The privacy industry likes exotic machinery. Start with the habits that prevent avoidable links.

• Use a fresh receiving address for each distinct payment. Modern wallets can generate addresses automatically. One public address then exposes less history.
• Avoid casual UTXO consolidation. Combining coins from unrelated sources can link those sources. Coin control lets you choose which UTXOs a Bitcoin transaction spends.
• Consider CoinJoin carefully. Wasabi and Samourai have been cited as CoinJoin examples, but availability, provider policies, and legal treatment require current checking. CoinJoin changes how easily transaction history can be linked. It does not guarantee anonymity. A deposit or withdrawal can still be delayed, rejected, or reviewed, and the public chain remains observable.
• Use a VPN for a narrow network benefit. A VPN changes which network provider sees your IP. The wallet app and RPC provider can still collect connection data. So can the exchange and other services. Excellent at hiding an IP from one party; remarkably bad at hiding a transaction from the chain.
• Protect keys and accounts separately. Hardware wallets keep keys offline, while authenticator-app 2FA protects account access better than SMS in ordinary use. Neither hides transaction history.
• Limit unnecessary identity collection where lawful. No-account services can avoid one KYC intake, but no account or ID at SwapCherry does not prevent blockchain screening, transaction monitoring, or identity collection at a later service.
• Keep hashes, addresses, and labels private. Publish them only when support, tax, or another concrete need requires it.
• Use a small test transaction for operational safety. It checks an address or route. It doesn’t alter visibility.

The defensive mapping is straightforward. Use separate funding sources where practical. Choose a legitimate, unhurried route. Treat an exchange deposit as potentially attributable to your account. Use coin control to avoid unwanted UTXO merging.

Is privacy itself illegal?

Privacy is lawful in many places. Deliberately disguising criminal proceeds, evading sanctions, or ignoring tax duties raises a different legal question.

FATF’s July 2020 virtual-asset red-flag guidance identified rapid cross-chain conversion as a high-risk pattern. FATF Recommendation 15 applies AML/CFT obligations to virtual-asset service providers, and its 2021 updated guidance discusses cross-chain and DeFi risks. These rules provide context. They do not decide whether your individual transaction is lawful.

FinCEN Advisory FIN-2019-A003 discusses cross-chain and privacy-coin conversion in the context of suspicious-activity reporting. Europol’s 2022 Internet Organised Crime Threat Assessment describes chain hopping as an obfuscation method used by ransomware groups, darknet markets, and state-sponsored actors.

A source-reported snapshot from the practical privacy material describes privacy coins as legal in the United States, subject to tax reporting; covered by EU AML rules without being inherently illegal; and restricted in China and India. That snapshot is jurisdiction-dependent and requires current local verification. Rules can change, and service policies can be stricter than law.

Every extra bridge, swap, and off-ramp adds records that may need explaining. Keep records of acquisition and swaps. Also record transfers, disposal, cost basis and dates. Follow applicable tax, sanctions, and AML rules, and get local advice when the amount or exposure is material. Review the service’s AML policy, terms, and privacy policy.

A practical privacy routine for your next swap

Before you broadcast a transaction, ask:

1. Decide what you’re protecting against. It might be an ISP, public address reuse, an exchange or casual observers.
2. Generate a fresh destination address and avoid publishing it.
3. Check the funding path. Avoid unrelated UTXO consolidation. Watch the source of gas for a new account.
4. Confirm whether the destination service will attach the deposit to your verified account.
5. Choose a route for a legitimate operational reason. A rushed cross-chain move can create more signals without serving a real purpose.
6. Secure keys with suitable wallet storage and protect accounts with authenticator-app 2FA.
7. Keep private records for tax and support purposes. Publish hashes only when necessary.
8. Check current local rules before using privacy coins, CoinJoin, bridges or services without account verification.
9. If operational failure is the concern, send a small test first. Treat it as an address check, never as a privacy measure.

For the worked BTC-to-USDT example, that means using a fresh destination address, avoiding unnecessary UTXO consolidation, funding account-based gas deliberately, and declining a rushed multi-chain route when the bridge serves no real purpose.

SwapCherry embeds ChangeNOW’s exchange widget. According to the supplied service information, it requires no account or ID. That describes the interface’s account requirement, not a promise that the widget or its underlying service makes a transaction anonymous. The blockchain remains observable, and the service can still screen transactions.

If you’re applying this routine to the example pair, the BTC-to-USDT swap page is the relevant execution page. Review SwapCherry’s AML policy, privacy policy, and terms before using the widget.

What investigators can prove—and what they cannot

“Tracing the funds is half the job. The other half is producing evidence a court will accept.” The forensics guide uses that line to mark the gap between an analytical result and courtroom evidence.

Federal Rules of Evidence 902(13) and 902(14) allow certain electronic records to be self-authenticated through certification by a qualified person when the process is documented and reproducible and relevant hashes verify.

In United States v. Sterlingov, the defense challenged commercial tracing software over unpublished error rates and a lack of peer review. That challenge is a useful reminder that software output can be examined rather than accepted as magic.

Record the source and destination. Identify the service that can attach your identity. Preserve your tax records. If you can’t explain a route’s purpose, don’t take it. That is privacy practice. Reduce unnecessary links. Keep records. Public chains remain public.