Wallet Clustering: How Analysts Group Your Addresses Together

Every time someone tells me their wallets are "totally separate," I ask one question: separate to whom? Because separation isn't a property of your wallets. It's a property of what an observer can and can't connect. And the people connecting them are better at it than most farmers realize.

Wallet clustering is the name for that work. It's the discipline of taking a pile of addresses and figuring out which ones belong to the same hand. Chainalysis does it. Nansen does it. Arkham built a whole product around it. And increasingly, airdrop teams rent it. So it's worth understanding how it actually works, not as paranoia, but as a map of what you're up against.

The mental model: it's a graph

Forget "wallets" for a second and think in dots and lines. Every address is a dot. Every transaction between addresses is a line. Do this for a whole chain and you get an enormous graph, hundreds of millions of dots, all connected by the money that flowed between them.

Clustering is pattern-finding on that graph. An analyst isn't reading your wallets one by one. They're looking at the shape of connections and asking which clumps of dots move like they share a brain. Once you see it as graph analysis, the individual heuristics stop feeling like magic and start feeling like the obvious questions anyone would ask.

Heuristic 1: common input and funding

The oldest and strongest. If several addresses all received their first funds from the same source, that's a line drawn straight through all of them.

The reason this one is so heavy is that it's permanent. You can change your browser tomorrow. You cannot un-send the transaction that funded twenty wallets from one exchange withdrawal. It sits on-chain, timestamped, forever. This is exactly why I keep hammering on funding wallets safely, it's the link you can never take back.

There's a related classic from Bitcoin analysis called common input ownership: if multiple addresses are used as inputs to a single transaction, they're almost certainly one owner, because you need all their keys to sign it. Account-based chains like Ethereum work differently, but the funding version of the idea carries over cleanly.

Heuristic 2: the fan-out and fan-in

Analysts love two shapes.

Fan-out: one address sends to many. That's the classic funding pattern, a source distributing to a batch of fresh wallets. Even with an intermediary hop in between, a single wallet that receives once and then sprays funds to thirty addresses is a giant blinking arrow.

Fan-in: many addresses send to one. That's the withdrawal or consolidation pattern. People farm across fifty wallets and then, at the end, sweep everything back to one address to cash out. That final sweep undoes all the separation they maintained for months. I've seen careful operations blow themselves up on the last transaction because they got impatient.

Heuristic 3: behavioral fingerprints

This is where it gets subtle. Even without a direct money link, wallets that behave identically cluster.

Identical amounts across wallets. Same protocols in the same order. Transactions that fire in tight time windows. Gas settings that never vary. Each of these is weak alone, but analysts stack them. Ten wallets that each did bridge, swap, stake, mint in that order, within the same hour, funded around the same time? No single one of those proves anything. Together they're a confession, and the timing side of it is a strong enough signal on its own to hang a cluster on.

The underlying principle is the one that runs through all of this: humans are inconsistent and scripts are consistent. Clustering is, at its core, a consistency detector.

Heuristic 4: the off-chain layer

Here's what people forget. Clustering doesn't stop at the chain. When you interacted with those dApps, you also handed over browser and network data.

If twenty wallets all connected from the same IP, or all produced the same browser fingerprint, an analyst with access to that data can cluster them without touching a single transaction. Someone who worked on detection for an L2 once told me off-chain clustering caught more Sybils than the on-chain graph did. Can't verify the exact claim, but it fits everything else. Which is the whole reason isolated browser profiles matter as much as clean funding does. On-chain hygiene with a shared fingerprint is half a defense.

Where clustering fails

It's not omniscient, and pretending it is leads to bad decisions too.

Heuristics are probabilistic. Shared exchange deposit addresses can wrongly merge strangers. Mixers and bridges inject noise. False positives are real, which is partly why big airdrops that lean hard on clustering also generate appeals and controversy, they catch innocent people in the net alongside the farmers.

But don't take comfort in that. At scale, analysts tolerate error. They're not trying to prove you specifically in court. They're filtering a pattern, and if your set fits the pattern, being technically a false positive won't get your allocation back.

Turning the lens around

The useful move is to cluster yourself before anyone else does. Take your addresses and run them through the same heuristics: is there shared funding, repeated timing, a fan-in at the end, a common fingerprint? This is exactly what Sybil analysis tooling automates, and it's a lot cheaper to find your own links now than to discover them the day a snapshot zeroes you.

Clustering isn't going away. If anything the tools keep getting cheaper and better. The people who survive it aren't the ones who think they're uncluster-able. They're the ones who assume every wallet is being watched as part of a graph, and who make sure the graph doesn't draw a line back to a single hand.