Crypto glossary
Address clustering
Address clustering uses heuristics to group blockchain addresses that are probably controlled by the same person or entity, a core technique of chain analysis.
The best-known heuristic, common-input ownership, assumes that all inputs spent together in one Bitcoin transaction belong to the same wallet, since signing them requires their private keys; Satoshi Nakamoto's white paper already noted this privacy limitation. Another identifies the change output, the part of a transaction returned to the sender, by patterns such as address type or round payment amounts. On account-based chains like Ethereum, analysts link addresses through funding sources, deposit addresses at exchanges, timing and shared contract interactions.
Clustering turns millions of anonymous addresses into a manageable number of entities. Once one address in a cluster is attributed, for example to an exchange or a darknet market, the whole cluster can be labelled, which is how analytics firms map flows between services.
The heuristics are probabilistic. CoinJoin transactions deliberately break common-input ownership, PayJoin hides which output is change, and a single mistake can merge unrelated users into one cluster. Good practice for privacy-conscious users, such as avoiding address reuse, aims to defeat these techniques.
Example
A user combines three small UTXOs into one payment. An analyst applying the common-input heuristic links all three addresses, and since one was used to withdraw from a KYC exchange, the whole cluster is tied to that user.