How Wallet Tracking Works

Wallet tracking is the practice of observing a blockchain address and the activity recorded against it. The distinction matters from the outset: what an analyst watches is an address, not a person. A public ledger records keys and movements, never names.

An address may belong to an individual, a company, a piece of software, an exchange holding funds for thousands of customers, or a contract nobody directly controls. Treating an address as a known person is the first and most consequential error in this work.

Starting with an address

Analysis begins with one address that is already relevant — named in an incident, published by a service, appearing in a disclosure, or surfacing during earlier work.

From there the ledger supplies its complete history: every transaction sent or received, in order, with amounts and timestamps. That history is the raw material. It is complete and independently verifiable, and it says nothing about who assembled it.

Incoming and outgoing transactions

Every transfer touching an address has a direction, and direction shapes everything that follows.

Inbound transfers show what the address received and from where — how value arrived, whether as earnings, a withdrawal from a service, or funds forwarded from elsewhere.

Outbound transfers show what the address sent and to whom. Each one was authorised by someone holding the private key.

Direction matters because it determines which way the work travels. Inbound activity points backwards toward origin; outbound activity points forwards toward destination. Losing track of it produces a sequence that reads convincingly and describes something that never happened.

Counterparties

A counterparty is the address on the other side of a transfer. Building a picture of an address means building a picture of who it transacts with, how often, and in what amounts.

Some counterparties appear once and never again. Others recur — and recurrence is informative. A repeated relationship, a regular withdrawal pattern or a consistent funding source says more about how an address is used than any single transaction does.

Following multiple hops

Value rarely stops at the first counterparty. It moves onward, sometimes splitting across several addresses and recombining later.

Tracing across multiple hops is its own discipline with its own failure modes, covered separately in How Blockchain Investigators Follow the Flow of Funds.

Exchanges and known services

When an address interacts with an attributed exchange, bridge or other documented service, that interaction adds genuine context. It shows funds reached a custodial venue, crossed to another chain, or entered a protocol.

It does not identify anyone. A deposit establishes that value arrived at an address associated with that service — nothing further. Who held the account, and what happened to the funds afterwards, exists only in that service's own records.

Wallet clustering

Clustering applies heuristics to group addresses that appear to share control. On Bitcoin the common-input heuristic is the best established: inputs spent together in one transaction were plausibly controlled by the same spender.

These heuristics are useful, and they are not proof. Collaborative transactions break the assumption deliberately, and custodial services routinely spend on behalf of many unrelated users.

A cluster is a hypothesis about control. It is not a statement of identity or ownership.

What wallet tracking can reveal

Working from the ledger alone, an analyst can establish:

• Complete transaction history, in verifiable order
• Current and historical on-chain balances
• Inbound and outbound activity, with amounts
• Counterparties, and which relationships recur
• Timing patterns — activity, dormancy and bursts
• Token holdings and transfers alongside native assets
• Interactions with identifiable on-chain services

What wallet tracking cannot prove

The same data does not establish:

• Real-world identity — the chain contains none
• Intent — why a transfer was made
• Beneficial ownership — who ultimately benefits
• Common ownership — that two addresses share one owner
• Control at a moment — who physically held the key

Each of these requires evidence from outside the blockchain, carrying its own reliability and its own capacity to be wrong.

Separating evidence from interpretation

Reliable wallet analysis keeps four things apart: transaction evidence, which the chain records; context, which describes what the activity resembles; attribution, which comes from sources beyond the chain; and confidence, which states how firmly each conclusion is held.

A blockchain can show precisely where value moved. What that movement means always requires context — and stating clearly which is which is the whole of the discipline.