Chain analysis means studying the public blockchain to group addresses that probably belong to the same person, then linking those groups to real identities.
The main assumptions (heuristics)
- Common input ownership: all inputs in a transaction belong to the same person. The white paper itself noted that multi-input transactions reveal this.
- Change detection: one output is the payment, the other is change. Round amounts and matching script types often reveal which is which (BIP78 names the "change-round-amount" and "change-scriptpubkey" heuristics).
- Address reuse: the same address seen several times links all the payments.
Where identity comes in
The chain does not contain names. Identity usually enters at the edges: exchanges with kyc, invoices, shops, public posts, and network data from wallets that ask third-party servers about your addresses.
Bitcoin's answer
The heuristics are assumptions, not facts, and they can be broken:
- Fresh addresses and coin control avoid giving away links.
- payjoin breaks the common-input assumption for ordinary payments.
- coinjoin makes many-to-many transactions where outputs cannot be matched to inputs.
- Your own full node stops your wallet from revealing your addresses to others.
Chain analysis is used by companies and authorities, for example in the yearly crime reports from Chainalysis. Their figures are estimates built on these same assumptions.