Attribution, Clustering, and Wallet Identification
This domain tests how you move from addresses to entities and how you express confidence. Attribution is an evidence claim; clustering is a heuristic that proposes candidate links.
Clustering heuristics
- Common-input ownership (UTXO): inputs signed in one transaction are controlled by one key holder - unless the transaction is a collaborative construction such as a CoinJoin or PayJoin.
- Change heuristic: the change output is usually a new address, same script type as inputs, and non-round.
- Funder heuristic (Ethereum): the first address that sends native ETH to a new address pays its gas and often belongs to the same operator.
- Deposit-address reuse: exchanges may reuse deposit addresses per customer; a reused address can link deposits to one account after KYC production.
- Temporal and behavioural: repeated co-spend timing, identical gas price settings, and nonce ordering.
Attribution evidence
Attribution normally needs off-chain corroboration: KYC records from a VASP, withdrawal logs, IP or device data, account recovery emails, or public statements. On-chain labels are leads, not verdicts.
Worked example
Five Ethereum addresses each receive 0.02 ETH from the same funder address, then interact with a bridge contract within one hour. Reasoning: the funder link clusters them; the timing and target contract support common control. To attribute to a person, obtain the exchange withdrawal record for the funder address and match the customer. Without that, report a cluster controlled by an unidentified operator.
Traps
- Treating a cluster as a legal person.
- Applying common-input ownership to CoinJoin transactions.
- Clustering exchange omnibus wallets as one customer.
- Presenting a label as proof of attribution without corroboration.