Published in


Free Bitcoin Forensics - Part 1
  1. All the sender addresses belong to the same person/entity.
  • Address reuse — as mentioned, address reuse is horrible for your privacy, especially if the address is reused for change.
  • Unnecessary inputs — in the following transaction it is very likely that the address that starts with 363… is the change address while the address starting with 1Kr… is the destination because if the opposite was the case, the transaction would not need to have as many inputs, one would have been enough (although some wallets are badly programmed and take unnecessary inputs for no reason, so take this with a grain of salt):
  • Round numbers — if one of the outputs has a round amount (say exactly 1 BTC) it’s more likely to be the destination address. The same thing applies when the amount denominated in USD is round (say output was worth exactly 100 USD at the time it was transferred).
  • Sending to a different address type — most wallets designate the change address to be the same type as the input addresses, so you may be able to rule out outputs that do not match the input address type.
  • Wallet quirks — some wallets will always put the change address first, last, or in some other non-random way.
  • Fee bumping — generally, the fee will be bumped from the change address output. If an observant attacker monitors the mempool before the fee was bumped and after they would be able to pick up on which output is the change.
  • One of the outputs being vastly bigger than the other — referring to situations like this:
  • Even without the change address being reused, it would have been obvious it was the change address due to the output being so much bigger than the others. In all likelihood, the other outputs are payouts of some sort.

Also, Read

Get Best Software Deals Directly In Your Inbox



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store