Addresses and wallets
An address is a destination that anyone can create, for free, without telling anybody. Everything else said about one, including who owns it and what it is for, was added later by somebody making an inference.
A blockchain address is a destination. Funds can be sent to it, and whoever holds the matching private key, the secret that authorises spending, can move them on.
Anyone can create one. It costs nothing, takes a fraction of a second and leaves no record anywhere until the address is first used. A single person can hold millions.
A wallet is not an address
A wallet is software that manages private keys. Most wallets generate a fresh address for every incoming payment, so one wallet routinely sits behind hundreds or thousands of addresses.
This matters when someone tells you a customer has one address. They have one address that you know about.
Custody is not risk. A custodial address is not riskier than a self-custodied one.
Three kinds of control
- Self-custody
The customer holds the keys. Funds move when they decide, and nobody else can stop it.
- Custodial
A business holds the keys on the customer’s behalf, an exchange account being the usual case. The address on the chain belongs to the business, and many customers sit behind it.
- Smart contract
Code holds the funds and releases them under rules written in advance. There may be no person who can move them at all.
A deposit to a custodial address tells you the funds reached that business. It does not tell you which of their customers received it, and usually only the business can say.
Where the labels come from
When a screening tool tells you an address belongs to a particular exchange, or to a darknet market, that label is attribution. Somebody concluded it from evidence and published it: a vendor, a researcher, a law-enforcement release.
Attribution comes from places of different strength. A seizure notice naming an address is close to certain. A cluster inferred from spending patterns is a well-founded guess. A label copied between vendors may have started as either, and by the time you see it the difference has usually been lost.
Clustering
Chainalysis, TRM Labs, Elliptic and the other analytics firms group addresses they believe share an owner. The oldest and strongest heuristic is common input ownership: when several addresses are spent together in one transaction, whoever signed it held the keys to all of them. From there the inference spreads. An address that receives change from that transaction probably belongs to the same owner. An address that only ever sends to the cluster is probably funding it. Each step is weaker than the one before, and a cluster of several million addresses may rest on a chain of inferences going back years.
The heuristic is reliable enough to build on and it is still a heuristic. CoinJoin and similar protocols exist specifically to break it, and some ordinary wallet software breaks it by accident. Two vendors clustering the same chain will disagree in places, because each chooses its own heuristics and its own threshold for calling a cluster.
What you can say
| You can state this | You cannot state this |
|---|---|
| Funds moved from address A to address B on this date | Person X paid person Y |
| Address B is attributed to a named exchange by this vendor | Address B belongs to that exchange |
| These addresses are clustered together by this vendor | These addresses share one owner |
| The customer declared this address as theirs | The customer controls this address |
The left column is what the chain and your records show. The right column is what the left column suggests. Both belong in an investigation, and only the left belongs in a sentence stated as fact.
Related
What KYT is
Know your transaction screens onchain activity against categories of concern. It tells you about the money an address has touched, and nothing at all about the person holding it.
How customers connect to cases
A case shows a customer's name beside an address only when that customer has declared the address. Screening works either way.
How the Explorer draws a case
The case as a graph of wallets and the transfers between them, with a second view for how close it sits to something a vendor has categorised.
Last checked against the product on .