Chain Analysis

Chain analysis is the industry and craft of extracting information about real-world identities and behaviors from the public Bitcoin blockchain. Specialized firms (Chainalysis and Elliptic among them) sell this analysis to exchanges, law enforcement, governments, and compliance teams.

The methods rely on the fact that Bitcoin's chain is fully public and never forgets. Common techniques:

• Address clustering. Use transaction patterns (the common-input-ownership heuristic, change-output detection, timing correlations) to group addresses that probably share an owner.
• Exchange / KYC anchoring. Match clustered addresses to known on-ramps (exchanges that hold customer identity records) and demand those records when needed.
• OFAC / sanctions tagging. Flag specific addresses tied to ransomware, sanctioned entities, or stolen-funds investigations.
• Behavioral profiles. Identify mixing patterns, CoinJoin participation, exchange-to-cold-storage flows, and so on.
• Network-layer correlation. Combine on-chain analysis with eavesdropping on the peer-to-peer network to link broadcasts to IPs.

What chain analysis is good for:

• Tracing stolen funds to the exchanges they land on, where they can be frozen and recovered.
• Identifying ransomware payouts and the wallets behind them. In 2021 the US Treasury sanctioned the exchange SUEX for laundering proceeds of at least eight ransomware strains, after analysis of its known transactions tied over 40 percent of them to illicit actors.
• Compliance: exchanges checking incoming deposits against sanctions lists.

What chain analysis is also used for:

• Mass surveillance of ordinary users' financial activity.
• "Tainted coin" determinations that erode fungibility and create two-tier markets.
• Targeting and deanonymization of activists, journalists, and dissidents in repressive jurisdictions.

The defenses are the privacy techniques covered elsewhere in this glossary: avoid address reuse, use CoinJoin or PayJoin where applicable, prefer Lightning for payments, run your node over Tor, avoid KYC choke points where possible.

Chain analysis isn't going away. Privacy-preserving Bitcoin use is a discipline, not a default.

Go deeper in Privacy on Bitcoin - how the heuristics work, where the name attaches, what the tools get wrong, and the defenses that still hold.