How Wallet Analysis Works
3 min read · Last updated
Wallet analysis answers a narrower question than tracing: which addresses are controlled by the same entity, and what does their behaviour reveal.
It is the bridge between anonymous ledger entries and identifiable operational patterns.
- 1Address set
- 2Clustering heuristics
- 3Behavioural profile
- 4Service attribution
- 5Confidence rating
Clustering heuristics
The common-input heuristic groups addresses that jointly fund a transaction. Change-address detection extends the cluster. On account-based chains, deposit-forwarding and contract patterns serve a similar role.
- ›Common input ownership
- ›Change-output identification
- ›Deposit-address forwarding behaviour
- ›Repeated automation timing
Behavioural profiling
Entities behave characteristically. Exchange hot wallets batch withdrawals on a schedule; laundering scripts disperse funds within seconds; individual users transact irregularly.
Timing analysis
Consistent activity windows can indicate an operator's working hours and, loosely, a time zone. This is supporting evidence, never proof of identity.
Attribution
Clusters are matched to known services through published address sets, documented deposits and observed interaction patterns. Attribution to a service is far more reliable than attribution to a person.
Reporting confidence
Each conclusion carries a stated confidence and the heuristic behind it, so a reviewer can weigh it independently.
Case intake is confidential and handled by email at cybersec@securida.info.
Frequently asked questions
- Can clustering be wrong?
- Yes. Coinjoins, shared custody and payment batching all break naive heuristics, which is why confidence levels are reported.
- Does wallet analysis reveal names?
- Rarely on its own. It identifies controlling entities and services; identity usually comes from records held by those services.
- Cyber Intelligence
- Blockchain Investigations
- Digital Forensics
The SEQRIA Research Team is the investigative research unit of SEQRIA, specialising in cyber intelligence, blockchain investigations and digital forensics.
Its work focuses on digital asset investigations, blockchain transaction analysis, cyber incident investigations and technical evidence collection. Published material is reviewed internally before release.
About the research teamRelated briefings
Request Confidential Consultation
SEQRIA provides technical investigation, forensic analysis and recovery assistance. Outcomes are never guaranteed. Case intake is confidential and handled by email.
cybersec@securida.info