Every transaction on a public blockchain sits in a ledger anyone can read, forever. That fact confuses a lot of people building in this space, because the wallets themselves carry no name, no address, no phone number. A string of characters moves funds from one string of characters to another, and nothing in that transaction says who pressed the button. The confusion is understandable, but it’s also exactly backwards from how investigators treat the data.
Pseudonymous means the identity layer is missing, not that the trail is missing. Every input and output, every amount, every timestamp, every counterparty wallet is permanent and public. A blockchain forensics team doesn’t need a name attached to a wallet to start working. They need patterns, and patterns are something a ledger produces in abundance. This article walks through how that works in practice, because the gap between “the blockchain is anonymous” and “the blockchain is traceable in detail” is exactly where a lot of compliance teams get caught flat-footed.
Pseudonymous isn’t anonymous: what a blockchain actually reveals
A bank statement shows your transactions to your bank and to regulators who subpoena it. A public blockchain shows every transaction to everyone, instantly, with no subpoena required. The only thing standing between that data and a real identity is the link between a wallet address and a person, and that link gets built from multiple directions at once.
Every transaction reveals the amount moved, the exact time, the sending address, the receiving address, and often the transaction fee paid, which has its own fingerprint depending on which wallet software constructed it. None of that is private. It’s sitting in full view on a ledger that thousands of nodes store independent copies of. The question was never whether the data exists. It’s whether someone has done the work to connect it to a name.
Address clustering: how analysts link thousands of wallets to one owner
Most crypto users assume that spreading funds across many addresses buys them separation. In practice, the way wallets construct transactions tends to undo that separation on its own.
The clearest example is the common-input-ownership heuristic. When a transaction spends from multiple addresses as inputs at the same time, that’s strong evidence all those addresses are controlled by the same wallet, because a wallet typically needs the private keys for every input it spends. A person who thinks they’re using a dozen separate addresses for privacy is often just handing an analyst a dozen addresses to cluster into one entity the first time their wallet software combines them in a single spend.
A second pattern comes from change addresses. When a transaction sends more value than the payment requires, the wallet generates a new address to return the leftover funds, often within the same transaction. Analysts have built models that identify which output in a transaction is the change and which is the actual payment, based on patterns like address reuse, output ordering, and rounding behavior. Once a change address is identified, it gets folded into the same cluster as the spending wallet.
Run these heuristics across a full copy of a blockchain’s history and the result is a map: not of individual addresses, but of entities, each one representing a wallet, an exchange, or a service, built from potentially thousands of addresses linked by behavior rather than by any label on the chain itself.
Naming names: how exchanges, mixers, and darknet markets get tagged
Clustering gets you anonymous entities. Attribution is the step that puts a name on one.
Chain analysis firms build attribution databases the way any intelligence operation builds a target list: slowly, from many sources, cross-referenced against each other. Some addresses get identified because an exchange or service publishes its own deposit addresses. Others get tagged because investigators open accounts at an exchange themselves, send test transactions, and observe which cluster lights up on the receiving end. Darknet market addresses often surface through law enforcement operations that seize servers or accounts and recover address books directly. Court documents, leaked data sets, and even a service’s own marketing material routinely confirm which addresses belong to which entity.
Once a handful of addresses inside a cluster are confirmed as belonging to, say, a named exchange, the entire cluster inherits that label. A transaction that looks like gibberish to a casual observer, two long strings of characters, shows up in an analyst’s dashboard as “funds moved from an unhosted wallet to Exchange X” because the clustering and the attribution work has already been done ahead of time, independent of any specific investigation. This is the library that gets queried the moment a new case opens.
Tracing funds through mixers and cross-chain bridges
Mixers exist specifically to break the clustering logic above, and for a period they were genuinely effective at it. A mixer pools funds from many users and pays out from that shared pool, severing the direct input-output link a clustering heuristic relies on.
Tracing through a mixer today relies less on breaking its cryptography and more on timing, amount, and pattern analysis around it. If a user deposits 2.4 of an asset into a mixer and a withdrawal of a similar amount, net of a typical fee, appears from the mixer’s pool a short time later to a new address, that correlation is a lead, not proof, but leads compound. Analysts also watch for behavioral fingerprints: a user who mixes funds and then immediately sends the output to an exchange address that was never touched before defeats a large part of the obfuscation, because the exchange sits on the other side of the real chokepoint described below.
Cross-chain bridges add a different kind of challenge. Funds that move from one blockchain to another via a bridge break the single-ledger assumption that most tracing tools were originally built around, since the receiving chain has its own address space and its own history. Investigators have adapted by tracking the bridge’s own deposit and withdrawal contracts, which are usually a small, known set of addresses, and by correlating amounts and timing across the two chains the same way they would across a mixer. It’s slower work than single-chain tracing, and it’s the area where tooling has had to catch up fastest, but a bridge is not a blank wall. It’s a narrower pipe with its own visible endpoints.
The real chokepoint: where KYC data meets on-chain data
Everything described so far produces clusters, labels, and probability-weighted connections between wallets. None of it, by itself, produces a legal name. That last step happens at a much more mundane point: the moment someone converts crypto to fiat, or fiat to crypto, through a regulated exchange.
A regulated exchange collects identity documents at onboarding as part of its KYC obligations. It assigns deposit addresses to verified accounts. The instant a traced cluster of on-chain activity touches one of those deposit addresses, the pseudonymous trail and the identity record meet. This is the actual chokepoint that makes blockchain forensics tools effective for regulators and law enforcement: not the cryptography of the chain, but the fact that almost every path from crypto back to spendable value in the real economy eventually crosses a KYC’d on-ramp or off-ramp.
This is also why the subpoena process still matters so much in cases that otherwise look purely technical. A chain analysis firm can hand an investigator a tightly built cluster with high confidence it belongs to a single actor. Turning that into a name still usually requires a legal request to the exchange that holds the KYC record tied to the address where that cluster first touched regulated fiat rails. The on-chain work narrows the search from millions of addresses to a handful. The off-chain legal process closes it.
What this means if you’re building or operating a crypto product
If your product touches crypto rails in any way, deposit addresses, withdrawal processing, custody, even a payment option that settles in a stablecoin, you are very likely sitting at or near one of these chokepoints yourself, whether or not you’ve thought of your product that way.
A few practical implications worth sitting with:
- Your deposit addresses, once attributed, become permanent labels in third-party databases that regulators and other compliance teams query. Address hygiene and internal wallet management matter more than they might seem to on a quiet day.
- Chain analysis tooling is commercially available, not just a law enforcement capability. Competitors, counterparties, and your own compliance team can and should be running the same category of screening your regulators will eventually expect to see evidence of.
- The quality of your KYC data is what makes or breaks an investigation’s final step, which means your onboarding and identity verification processes aren’t a separate workstream from your crypto risk posture. They’re the hinge the whole chokepoint turns on.
- Mixer and bridge exposure in your transaction history, even where your own users weren’t the ones doing anything wrong, can still surface in screening tools as a risk flag that needs an explanation on file.
None of this requires you to become a forensics shop yourself. It does require knowing, concretely, where your product’s on-chain footprint intersects with the identity data you already hold, and being able to produce that mapping on request rather than building it for the first time during an examination.
Where the tools still struggle: privacy coins and emerging obfuscation
It would be inaccurate to leave the impression that every blockchain is this transparent. Privacy-focused chains that use ring signatures, stealth addresses, or zero-knowledge proofs to hide sender, receiver, or amount information are built specifically to defeat clustering and the common-input heuristics described above, and they largely succeed at the chain level. Forensic work against these assets leans much more heavily on the off-chain chokepoint: exchange records, IP metadata, timing correlation with other known events, rather than on-chain graph analysis, because the graph itself is designed not to cooperate.
Newer obfuscation techniques, including more sophisticated cross-chain routing and privacy-preserving bridges, are an active area where tooling is still catching up rather than comfortably ahead. Treat any claim that a given technique is fully untraceable with some skepticism, and also treat any claim that forensics tools see everything with the same skepticism. The realistic picture is a moving line, with transparent chains well mapped, privacy chains still largely resistant, and a wide, shifting middle ground in between.
If your product touches crypto rails, start mapping where your KYC data intersects with on-chain exposure using the framework in A Founder’s Roadmap to Fintech Compliance: What to Handle at Each Stage of Growth.