Change-Address Heuristic
Definition
The inference that one output from a Bitcoin transaction (usually the smaller one, to a fresh address) is change returning to the sender. Identifying the change address allows the tracer to continue following the sender's funds after the transaction.
- Applies to
- Bitcoin transaction tracing
- Signal used
- Smaller output, often to a fresh address
- Purpose
- Identify which output returns to the sender
- Use case
- Continuing a fund trace after a transaction
Common questions
Is the change-address heuristic always reliable?+
No. It is a probabilistic inference, not a certainty, and sophisticated actors can defeat it deliberately by using wallets that randomise output order or amounts, or by using coin-mixing services designed specifically to break this pattern.
What happens if an investigator misidentifies the change output?+
The trace can follow the wrong branch of the transaction graph, attributing subsequent funds to the payee rather than the original sender, so tracers typically corroborate the heuristic with other clustering signals before relying on it alone.
Related terms
- Attribution Database
- A commercial or law-enforcement dataset that maps known addresses or address clusters to real-world entities: exchanges, darknet markets, ransomware operators, sanctioned individuals,...
- Co-Spend Heuristic
- The inference that when multiple Bitcoin inputs appear in one transaction, all those input addresses are controlled by the same entity, because...
- De-Anonymisation
- The process of linking a pseudonymous address or cluster to a real-world identity. Most commonly achieved through exchange KYC records, but also...
- Mixing (Tumbling)
- A service or protocol that accepts cryptocurrency inputs from multiple users and returns equivalent outputs in a way designed to break the...
- Peel Chain
- A transaction pattern where one large input is repeatedly split, sending most of the value one hop forward and a small remainder...