{"id":37252,"date":"2019-09-05T07:00:14","date_gmt":"2019-09-05T04:00:14","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=37252"},"modified":"2025-08-29T14:20:19","modified_gmt":"2025-08-29T11:20:19","slug":"how-bitcoin-transactions-are-tracked","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/how-bitcoin-transactions-are-tracked\/","title":{"rendered":"How Bitcoin transactions are tracked"},"content":{"rendered":"
\n
\n

1<\/span><\/p>\n

What do addresses on the Bitcoin network look like?<\/strong><\/p>\n

\n

Bitcoin addresses are strings of Latin letters and digits. They do not contain their owners\u2019 names, which can give users a false sense of full anonymity. However, transactions are recorded on the Bitcoin network without encryption, so they can be traced.<\/p>\n

Much depends on how an address is used and what traces of activity it leaves. For instance, transactions to or from an address placed in its owner\u2019s email signature or on forums are fairly easy to track.<\/p>\n

If, by contrast, the address was created in a separate system accessed via the Tor anonymity network and received coins solely from a mining pool such as Eligius, which does not require registration, the task becomes far harder.<\/p>\n

Even so, by deploying serious analytical tools and investing time and resources, one can get very close to the bitcoin holder.<\/p>\n<\/div>\n<\/div>\n

\n

2<\/span><\/p>\n

What can any user track?<\/strong><\/p>\n

\n

The simplest tools for tracing transactions are the many explorers of the Bitcoin blockchain<\/a>. They are typically used to check that an operation has succeeded rather than sitting unconfirmed.<\/p>\n

Anyone can play sleuth and, in a few clicks, pull up a given address\u2019s past transactions, current balance, amounts moved, and lists of input and output addresses. Enter a transaction identifier (TXID, TxHash), address, hash or block height into a block explorer\u2019s search bar to see status instantly.<\/p>\n

Try starting with Block Explorer<\/a> or Blockchain.com<\/a>. Similar data, with different presentation, are also available from OXT<\/a>, Token View<\/a>, Blockcypher<\/a>, Insight<\/a>, Sochain<\/a> and Blockstream Bitcoin Explorer<\/a>. With Cryptocurrency Alerting<\/a> you can set alerts for activity on an address of interest, while Blockseer will \u201cfollow the bitcoin\u201d, visualising links among addresses that participated in transactions.<\/p>\n<\/div>\n<\/div>\n

\n

3<\/span><\/p>\n

Can you hide from tracking?<\/strong><\/p>\n

\n

Given Bitcoin\u2019s pseudo-anonymous nature, anti-tracking measures offer only relative protection. Even CoinJoin, a popular technique that combines multiple users\u2019 transfers into a single transaction with many outputs and does not require handing coins to a third-party service, does not guarantee full anonymity. Inputs and outputs still appear on-chain, and transactions can be identified using toolsets such as coinjoinsudoku.<\/p>\n

Even so, such measures are worth taking to avoid becoming an easy mark for crypto-fraudsters. In some cases, generate a new address for each transaction or counterparty, avoid sending sensitive transactions via exchange accounts, and use open-source wallets.<\/p>\n<\/div>\n<\/div>\n

\n

4<\/span><\/p>\n

Are there commercial tools for tracking BTC transactions?<\/strong><\/p>\n

When transactions must be traced very quickly or on an ongoing basis, manual analysis becomes inefficient. Commercial offerings add layers of proprietary context atop public data to show who is interacting with whom on the network. Here are the best-known options.<\/div>\n<\/div>\n
\n

5<\/span><\/p>\n

Chainalysis<\/strong><\/p>\n

\n

Perhaps the best-known player in Bitcoin-tracing is the American blockchain analytics startup Chainalysis. Since 2015 it has helped the US Internal Revenue Service (IRS) identify people evading taxes on cryptocurrency operations. The company works with Europol, law-enforcement agencies around the world and crypto-exchanges.<\/p>\n

Its core products are Chainalysis Reactor and Chainalysis Know Your Transaction (KYT). Reactor lets investigators launch automated inquiries from any starting point given even a small crypto-data lead. KYT, built as an anti-money-laundering tool, uses an API to monitor vast data volumes in real time and flag high-risk transactions. For example, since autumn 2018 the cryptocurrency exchange Binance has used Chainalysis KYT \u201cto build a blockchain ecosystem where everyone will feel safe\u201d.<\/p>\n

Chainalysis\u2019s tools are not publicly accessible, making it impossible to assess the methodology or rule out false positives. In court cases, parties have at times questioned the reliability of Chainalysis\u2019s transaction data for this reason.<\/p>\n<\/div>\n<\/div>\n

\n

6<\/span><\/p>\n

Crystal<\/strong><\/p>\n

\n

In January 2018 Bitfury Group, one of the world\u2019s largest developers and providers of blockchain solutions, unveiled Crystal for financial institutions and law-enforcement agencies\u2014built specifically for Bitcoin-related investigations.<\/p>\n

Crystal analyses the Bitcoin blockchain, focusing on specified addresses and transaction sets, and also goes off-chain to gather relevant data from available sources such as websites and thematic forums.<\/p>\n

The tool visualises fund flows down to the final address and conversion of cryptoassets into fiat, and emails the results to the client. Whereas manual tracking can be overwhelmed by branching flows of funds, Crystal produces a list of concrete addresses that received the money and enumerates every path the funds took.<\/p>\n

Investigations can go deeper into transaction risk assessment and track suspicious activity at a BTC address. The developers say that by applying a unique clustering algorithm, Crystal can ultimately identify the real name of a coin holder.<\/p>\n

Version 2.2 added several investigator-friendly features. Clients can configure notifications on activity for a given address, add all addresses from a transaction to monitoring and visualisation with one click, and trace operations conducted between addresses via intermediaries.<\/p>\n

As proof of effectiveness, its creators cite the WannaCry ransomware case. In May 2017 it inflicted almost $1bn of damage in four days, hitting Britain\u2019s National Health Service, Telef\u00f3nica in Spain, America\u2019s logistics giant FedEx and users in 150 countries. Using Crystal, its creators tracked the movement of funds from the attackers\u2019 Bitcoin wallets in three hours\u2014to off-ramps via the Changelly and ShapeShift exchanges\u2014and determined who was behind the attacks.<\/p>\n

\"How<\/p>\n

https:\/\/www.youtube.com\/watch?v=ElfdWsLCip4<\/a><\/p>\n<\/div>\n

Bitfury also investigated the September 2018 hack of the Japanese exchange Zaif, which lost $60m in cryptoassets, including 6,000 bitcoins.<\/p>\n

The researchers found that part of the loot was sent for cash-out via the Binance exchange; another part was split into small sums and scattered to numerous addresses via mixers, gaming services and other exchanges; and 30% remained at previously unseen addresses presumed to belong to the attacker. Those addresses, registered to unknown persons, were then placed under continued observation in Crystal.<\/p>\n<\/div>\n<\/div>\n

\n

7<\/span><\/p>\n

Elliptic<\/strong><\/p>\n

\n

Founded in London in 2013, Elliptic\u2014now a provider of blockchain analytics\u2014once served as a cold wallet for storing private keys to Bitcoin addresses, before pivoting to anti-money-laundering services for crypto-exchanges and financial firms.<\/p>\n

Elliptic also developed software used by law enforcement to track terrorist financing in bitcoin. The firm works with the FBI and CIA and is known for investigations into criminal activity on the dark web.<\/p>\n

As the company explains, web scraping of \u201cclean\u201d sites and the dark web, plus monitoring court-filing registries, can surface references to crypto addresses, which are then analysed and, in the dark web, probed for interaction or emulated.<\/p>\n

To identify real owners of wallets on the dark web, Elliptic applies machine-learning algorithms: the software focuses on addresses known to be used on a given platform, then uses that technology to identify other addresses and transactions on the same marketplace. For law enforcement, the findings are rendered graphically in a transaction explorer.<\/p>\n

Details of the London startup\u2019s work with the FBI and CIA are not public. It is known, however, that the company played a significant role in cases against a darknet drug dealer from Portsmouth, sentenced to 16 years for selling ecstasy for bitcoin, and a businessman who tried to import firearm parts into Britain after buying them on the dark web for bitcoin. In July 2018 Elliptic specialists also said that officers of Russia\u2019s military intelligence (the GRU), accused of meddling in America\u2019s 2016 presidential campaign, conducted bitcoin transactions and laundered funds via the BTC-e exchange.<\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Bitcoin addresses are alphanumeric and pseudonymous, but every transaction is recorded openly, making activity traceable. Block explorers let anyone view balances, TXIDs and flows, while privacy tools such as CoinJoin provide only partial cover. For deeper, faster work, firms including Chainalysis, Bitfury\u2019s Crystal and Elliptic sell analytics that link addresses, visualise flows and flag risks for exchanges and law enforcement.<\/p>\n","protected":false},"author":1,"featured_media":37253,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"2","_short_excerpt_text":"Bitcoin is pseudonymous, not anonymous: block explorers and commercial analytics can trace transactions and link addresses.","creation_source":"human_written","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[2113],"tags":[2120,2116,2115,88,274,1535,1256],"class_list":["post-37252","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptorium","tag-101-anonymity","tag-101-bitcoin","tag-101-technical-foundations","tag-bitfury","tag-chainalysis","tag-elliptic","tag-privacy-and-personal-data"],"aioseo_notices":[],"amp_enabled":true,"views":"46","promo_type":"1","layout_type":"1","short_excerpt":"Bitcoin is pseudonymous, not anonymous: block explorers and commercial analytics can trace transactions and link addresses.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/37252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=37252"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/37252\/revisions"}],"predecessor-version":[{"id":37254,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/37252\/revisions\/37254"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/37253"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=37252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=37252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=37252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}