The Eight-Input Co-Spend and the Exchange Deposit Address
A blockchain analytics team builds a cluster of 19 addresses controlled by Entity X, a suspected ransomware cash-out wallet. The cluster is based on a single transaction with 8 inputs: 7 addresses with no prior history and one address that is a known deposit address of a large exchange. All 8 inputs were spent together to 3 outputs. The analyst also notes that 12 of the 19 addresses received identical 0.015 BTC amounts from the same faucet-like address and were created within 48 hours. The exchange address has processed 2.3 million transactions and is used by many customers. A law enforcement request asks the exchange to identify the customer behind the single exchange input, arguing that all 8 inputs belong to the same person. The exchange's compliance officer must respond.
1. Assess the strength of the common-input-ownership heuristic in this cluster. What alternative explanations could produce the 8-input transaction?
Read the worked answer
The common-input-ownership heuristic is weak here because one of the eight inputs is a known exchange deposit address. That input may be controlled by the exchange, not by the customer, and it may be part of a batch withdrawal, a consolidation, or a shared wallet. A transaction with eight inputs and three outputs can be produced by an exchange sweeping customer deposits, a payment processor, a CoinJoin-like protocol, a smart contract, or a wallet that co-spends unrelated UTXOs. The faucet-like funding of 12 addresses is also weak: a faucet, airdrop, or exchange withdrawal can create many addresses with identical amounts. The cluster of 19 addresses is therefore a hypothesis, not an attribution. The law-enforcement request assumes all eight inputs belong to one person; that assumption is not supported by the transaction alone. The analyst should separate the exchange-controlled input from the seven unknown inputs and state the confidence level for each link.
2. How should the compliance officer respond to the law enforcement request without over-disclosing or misattributing?
Read the worked answer
The compliance officer should first verify the legal process and preserve all records. The response should identify only the exchange account associated with the exchange input, and only to the extent the request and law permit. It should not confirm that the other seven addresses belong to the same customer. A useful response explains the limitation: the exchange address is controlled by the exchange and does not by itself establish control of the other inputs. If the request seeks the customer behind a deposit address, the officer should clarify whether the address is a deposit address assigned to a customer or an internal hot-wallet address. The officer should also avoid disclosing unrelated customers' data and should escalate to legal counsel. Document the reasoning and the scope of the production. If the request is overbroad, seek clarification rather than guessing.
3. What additional evidence would raise or lower confidence that the 7 non-exchange addresses are controlled by one person?
Read the worked answer
Confidence would rise with evidence of a shared controller: the same fee-funding address paying for all seven inputs, sequential nonces or change addresses, consistent transaction timing, the same withdrawal destination, KYC records linking the addresses to one account, or signed messages from the addresses. Confidence would fall if the seven inputs show independent funding histories, if they interact with different services, if the co-spend is a known exchange batch, or if the amounts and timing match a mixer or payment processor. The investigator should also check whether the exchange input is a deposit address assigned to a customer or a hot wallet; if it is a hot wallet, the customer attribution is especially weak. The report should use a confidence scale and distinguish same transaction from same controller. A single co-spend is not enough for a legal attribution.