FORENSIAWeb3 forensicsOpen workspace

Why addresses are not grouped

The most common Bitcoin tracing technique is one Forensia deliberately does not apply. Here is what it is and why.

2 min read · Bitcoin analysis

#Plain languageIn plain terms

The classic move in Bitcoin analysis is this: if two addresses are spent together as inputs to one transaction, assume the same person controls both. Apply that across the whole chain and addresses collapse into large clusters, each treated as one owner.

It is powerful and it is often wrong. Forensia does not do it. It shows which addresses were spent together and leaves the conclusion to you.

#How it worksHow it works

There is no clustering step in a Forensia lookup. Input addresses are shown as they are. Nothing merges them, no cluster identifiers are assigned, and no label is carried from one address to another.

#Technical detailThe exact rules

Input addresses are used in only five places:

  • as labels in the rows and on the graph;
  • on an address lookup, to work out what the searched address itself spent in each transaction;
  • to count distinct contributors in the equal-output shape check;
  • for the self-transfer rule when guessing the change output;
  • for the input-order trait.

Every Bitcoin result carries a limitation finding that says this outright:

LookupFindingWhat it states
Transactionfinding:bitcoin-clustering-limitInputs are not automatically clustered.
Addressfinding:bitcoin-attribution-limitOwnership and intent remain unassigned.

Why the assumption fails

SituationWhat actually happened
CoinJoinSeveral unrelated people funded one transaction on purpose.
PayJoinThe sender and the recipient both contributed inputs.
Exchange batchingA custodian spent coins it holds for many customers.
Shared custodySeveral parties must sign, and each holds some of the inputs.
Delegated signingA service signs on behalf of others.

One wrong merge is enough to join two unrelated clusters, and the error then spreads to everything connected to either.

#LimitsWhat it does not tell you

  • Spending inputs together can still be a useful ownership lead. Forensia simply does not turn it into a conclusion for you.
  • No Bitcoin finding is ever graded high confidence.
  • A change-output guess is not fed into any grouping.
  • No Bitcoin address is given an identity label by Forensia. Sanctions screening is a separate, exact-match check against a published list.