Address Clustering and Entity Labelling

A blockchain shows every transaction between addresses, but an address by itself is just a string of characters — no name attached. Users routinely control dozens or thousands of addresses at once, so treating each address as a separate "person" wildly overcounts how many distinct participants are actually trading. Address clustering is the analytical technique that groups addresses controlled by the same underlying entity, turning a sea of anonymous strings into something closer to "Exchange X's hot wallet" or "Fund Y's cold storage."

The co-spend heuristic

The most reliable clustering signal comes from Bitcoin's UTXO model: when a transaction spends inputs from multiple addresses at once, the sender must have controlled the private keys for all of those input addresses — you can't spend an address's coins without its key. So any transaction with multiple input addresses is strong evidence those addresses belong to the same wallet, and are transitively merged into one cluster. Run this rule across the entire chain and addresses collapse into a much smaller number of probable real-world entities.

From cluster to label

Clustering alone gives you an anonymous group of addresses. Entity labelling attaches a name to that group by matching its behavioral fingerprint against known patterns: an address cluster that receives small, frequent deposits from thousands of distinct addresses and periodically consolidates them into large batched withdrawals looks like an exchange's hot wallet, and can often be confirmed by matching a labelled deposit address that a researcher has verified by making a real, small deposit to a known exchange and watching where it lands.

Worked example

An analyst observes a transaction with three input addresses spending together into a single output; by the co-spend heuristic, those three addresses are merged into one cluster. Tracking that cluster over months, it shows a pattern: thousands of small inbound transfers each day, and roughly nightly batch transfers of collected funds into a handful of very large, well-known cold-storage addresses. A researcher confirms the label by sending $50 to what they believe is that exchange's public deposit address and watching it appear in the cluster within minutes. The cluster is now labelled "Exchange Z," and every future transaction touching those addresses can be attributed to that exchange rather than treated as an anonymous counterparty.

What this means in practice

Address clustering underlies most exchange proof-of-reserves checks, sanctions screening, and flow-of-funds analysis used by compliance teams and researchers. But clustering has known blind spots: modern wallet software that avoids combining unrelated inputs, coin mixers designed specifically to break the co-spend link, and account-based chains like Ethereum (where one address can act alone without the multi-input pattern) all make clustering considerably harder or less reliable.