Chain Analysis Companies — How They Track Bitcoin and How to Resist

How Chain Analysis Works

Chain analysis is a multi-billion dollar industry built on tracking Bitcoin transactions. Understanding how these companies work is the first step to protecting your financial privacy.

The Major Players

• Chainalysis: The largest, with contracts across hundreds of government agencies worldwide
• Elliptic: UK-based, strong in Europe and Asia
• CipherTrace (Mastercard): Acquired by Mastercard
• Crystal Blockchain: Growing presence in compliance

Core Techniques

1. Common Input Ownership Heuristic

If a transaction has multiple inputs, they likely belong to the same entity. This is the foundational heuristic: inputs that spend together are owned together. PayJoin breaks this heuristic.

2. Change Detection

When you spend 0.3 BTC from a 1 BTC UTXO, 0.7 BTC goes back to you as change. Analysis firms identify the change output using:

• Address type matching (change uses same format as inputs)
• Round number analysis (payment amounts are often round)
• Script type analysis

3. KYC Anchoring

When you buy Bitcoin on a KYC exchange, your identity is linked to withdrawal addresses. Chain analysis traces from these known addresses outward. This is their most powerful technique — and why KYC is the biggest privacy enemy.

4. Temporal Analysis

Transaction timing, combined with IP data from their own network nodes, helps correlate transactions with identities.

5. Dust Attacks

Sending tiny amounts to known addresses and tracking when the dust is spent (revealing address clusters).

How to Resist

Technique	Defense
Input clustering	Use CoinJoin, PayJoin, or coin control
Change detection	Spend exact amounts when possible; use send-to-self CoinJoin
KYC anchoring	Acquire Bitcoin through P2P methods (Bisq, RoboSats)
Temporal analysis	Use Tor; don't broadcast transactions from your own node in timing-sensitive situations
Dust attacks	Use coin control; don't spend dust UTXOs

The Bigger Picture

Chain analysis companies sell their services to governments as "fighting crime." And some of their work does catch criminals. But the same tools enable mass financial surveillance of ordinary people. When every Bitcoin transaction is traced, the pseudonymous promise of Bitcoin evaporates.

The Sri Lankan Context

Sri Lanka's financial surveillance capabilities are growing. While the CBSL hasn't specifically deployed chain analysis (as far as we know), global trends suggest it's coming. Protecting your financial privacy now is proactive, not paranoid.

The Arms Race

Privacy tools and chain analysis are in a constant arms race:

• CoinJoin improved, so analysis firms built CoinJoin detection
• PayJoin makes CoinJoin undetectable, so analysis must rely more on KYC anchoring
• P2P exchanges reduce KYC anchoring, forcing reliance on network-level surveillance
• Tor prevents network-level tracking

Privacy is not a one-time setup — it's an ongoing practice. The chain analysis industry invests billions in surveillance. We need to invest time in understanding and using the tools available to us.

Complete privacy toolkit and guides at our learning center.