Chain analysis companies read the blockchain and group addresses into clusters that probably belong to the same person or business. They sell the results to exchanges, banks and governments.
The main heuristics
- Common input ownership: inputs spent together in one transaction probably belong to the same wallet.
- Change detection: a round payment amount and an odd leftover, a reused address type or script, often reveal which output is the change.
- Address reuse: every payment to the same address is linked for good.
- Timing and amounts: a withdrawal of an unusual amount soon followed by a deposit elsewhere.
Where names come from
The chain holds no names. Identity enters at the edges: an exchange that verified your identity, an online shop with your delivery address, a public donation address, a post where you shared an address. One link is enough to label a whole cluster.