Wallet attribution: how screening tools decide who is behind a crypto address
Wallet attribution is the step that turns an address on a blockchain into a claim about who controls it, and every crypto screening alert depends on it. This guide explains how addresses, wallets, clusters and attributions differ, how attributions are built, where address clustering fails, and how to test a label before acting on it.
What is wallet attribution?
Wallet attribution is the association of a crypto address, or a group of addresses, with identifying information about a real-world actor, such as a sanctioned person, an exchange or a darknet market. It is an analytical inference built from documents, clustering heuristics and off-chain data, and its reliability depends entirely on the evidence behind it.
This article is part of our series on on-chain sanctions screening, which recommends recording observed activity, attribution and the compliance disposition as separate layers. NYDFS's 2022 guidance on blockchain analytics notes that wallet addresses are typically pseudonymous and that tools may not be able to identify underlying owners, including ultimate beneficial owners, without off-chain verification using customer data. Every name a blockchain analytics tool shows next to an address is the product of attribution.
What is the difference between an address, a wallet, a cluster and an attribution?
An address is an identifier that can receive a transfer. A wallet is the software or other mechanism that holds addresses, private keys and balances. A cluster is a set of addresses inferred to share a controller. An attribution links an address or cluster to an identified actor. Only the address is directly visible on-chain.
| Term | Meaning | Source | Common mistake |
|---|---|---|---|
| Address | An alphanumeric identifier representing a potential destination for a digital currency transfer | OFAC FAQ 559 (2021) | Treating it as a customer identifier |
| Wallet | A software application or other mechanism that holds, stores and transfers digital currency, keeping the user's addresses, private keys and balance | OFAC FAQ 559 (2021) | Assuming one wallet equals one address or one legal person |
| Cluster | Addresses inferred through heuristics to be controlled by the same entity | Fröwis et al. (2020), section 2.1 | Treating an inference as an observed fact |
| Attribution | An association between an address or cluster and identifying information about an actor | Fröwis et al. (2020), section 2.2 | Reading a label as a finding about the customer |
Some analytics interfaces use "wallet" or "entity" to name a cluster. Check which sense a tool intends before relying on its output.
How do screening tools build a wallet attribution?
Wallet attribution is built from three kinds of evidence: documentary association, such as an address published in an official sanctions designation; clustering, which extends a known label to addresses inferred to share a controller; and off-chain corroboration from customer records or counterparty information. Each source carries a different level of confidence and different failure modes.
| Evidence type | Example | Main limitation |
|---|---|---|
| Official designation | OFAC lists digital currency addresses as identifiers on SDN entries, as in its September 9, 2026 action | OFAC FAQ 562 says the listings are not likely to be exhaustive |
| Other documentary sources | An address published on an organization's website or in public reporting | Reliability depends on the source and how the address was collected |
| Clustering | The multi-input heuristic on Bitcoin | Heuristic errors spread a label to addresses the actor does not control |
| Off-chain corroboration | Customer records, counterparty VASP responses, travel rule data | Depends on the accuracy and cooperation of the party supplying it |
An official listing and an analytics label are different categories of evidence; our guide to sanctions lists covers what an official entry contains. OFAC FAQ 562 (2018) expects a firm that identifies an address it believes is owned by or associated with an SDN to block the relevant digital currency and report it, so a credible attribution can matter as much as a listing. NYDFS adds that attributing an address to an institution does not by itself identify the institution's underlying customer or beneficial owner.
How does crypto address clustering work, and where does it fail?
Crypto address clustering groups addresses that heuristics suggest share a controller. On Bitcoin, the main rule is the multi-input, or common-input, heuristic: addresses spent together as inputs to one transaction are presumed to have one owner. Change heuristics add the output believed to return value to the sender. Both rules are presumptions and can be wrong.
A 2020 paper by Fröwis, Gottschalk, Haslhofer, Rückert and Pesch in Forensic Science International: Digital Investigation (preprint linked) reviews address clustering heuristics and warns that "Wrong clustering results can lead to missed- or even false convictions." The best-known failure is CoinJoin, a transaction that deliberately combines inputs from many users. The authors found that naive multi-input clustering is significantly biased by CoinJoin transactions, because it merges addresses belonging to unrelated participants.
Change heuristics fail differently. They guess which output of a transaction is change, and a wrong guess pulls a payee into the payer's cluster. Because clusters grow by linking, one bad merge can attach a label to many addresses at once. We recommend asking any analytics provider which heuristics it applies, how it detects and excludes CoinJoin activity, and how it reviews sudden changes in cluster size.
What does an attribution label actually mean?
An attribution label records that an address or cluster was associated with an actor or category, but it rarely says how. A "ransomware" tag, for example, may mark the attacker's address, a victim's payment address or an address that is only somehow related, so the label's role and source need checking before it drives a decision.
Fröwis et al. make this point in section 2.2 and add that false, unreliable or intentionally misplaced tags can associate unrelated actors. Institution labels carry their own limit: a label naming an exchange tells an analyst which VASP to approach, and NYDFS is clear that it does not identify the exchange's customer. That distinction matters most when reading exposure results, as our guide to direct vs indirect crypto exposure explains.
A sound practice is to record, for every label relied on, the role it asserts (owner, victim, service, counterparty), its source, the date it was added and the date it was last verified.
Does wallet clustering work the same way on Ethereum?
No. Ethereum uses an account balance model, and a standard transaction has a single sender and a single recipient. Friedhelm Victor's 2020 research found no existing heuristics that apply directly to that model, because those built on multiple inputs or outputs cannot be used for single-input, single-output transactions. Ethereum clustering relies on different methods.
Victor's paper, presented at Financial Cryptography 2020, proposes three Ethereum-specific heuristics: deposit address reuse, airdrop multi-participation and self-authorization. For compliance teams, the practical point is that confidence in a Bitcoin cluster says nothing about an Ethereum cluster from the same provider. Ask which methods apply to each network a result covers.
How should a compliance team test attribution confidence?
Test attribution with two separate questions: why is the original address associated with the entity, and why was that association extended to the other addresses in the cluster? The first tests label confidence; the second tests cluster confidence. A strong answer to one does not cover the other, and the case record should show both.
- Identify the anchor. Which address carries the original attribution, and what supports it: an official entry, a published address or other evidence.
- Record the label's meaning: its role, source, date added and date last verified.
- Examine the cluster: the heuristics used, whether CoinJoin activity was excluded, and the cluster's size and history.
- Corroborate off-chain with customer information and counterparty VASP responses.
- Preserve provenance: transaction identifiers, a snapshot of the data and labels used, and the tool and method version, so the result can be reproduced.
The last step follows Fröwis et al., whose treatment of provenance, chain of custody, reliability and verifiability (sections 2.3 and 4) is a useful benchmark for case records. Our crypto screening result checklist builds these questions into a review routine. Whether an attribution is strong enough to trigger a legal obligation is a question for counsel on the facts.
Sources
- OFAC FAQ 559 (2021)
- OFAC FAQ 562 (2018)
- OFAC recent actions, September 9, 2026
- NYDFS: Guidance on Use of Blockchain Analytics (2022)
- Fröwis et al.: Safeguarding the evidential value of forensic cryptocurrency investigations (2020, preprint)
- Victor: Address clustering heuristics for Ethereum (2020)
FAQ
What is wallet attribution in crypto compliance?
Wallet attribution is the association of a crypto address, or a cluster of addresses, with a real-world actor such as a sanctioned person, an exchange or a darknet market. Blockchain records show addresses, timing and value, but not names, so attribution is always an inference. It is built from official designations and other documents, clustering heuristics and off-chain information such as customer records. Its reliability depends on that evidence, which is why compliance teams should record where each attribution came from and when it was last verified.
How does the common-input heuristic cluster Bitcoin addresses?
The common-input heuristic, also called the multi-input heuristic, presumes that addresses spent together as inputs to a single Bitcoin transaction are controlled by the same entity, because spending normally requires the private keys for each input. Analytics tools apply the rule repeatedly to build clusters. It fails when inputs come from different people, most notably in CoinJoin transactions, which combine many users' inputs on purpose. Research published in 2020 found that naive multi-input clustering is significantly biased by CoinJoin.
Can a blockchain analytics label be wrong?
Yes. A label can rest on an unreliable source, be extended to the wrong addresses by a clustering error, or describe a relationship other than ownership. Academic research on forensic cryptocurrency investigations notes that a "ransomware" tag may not make clear whether an address belongs to the attacker, a victim or someone otherwise related, and that false or intentionally misplaced tags can associate unrelated actors. Treat a label as evidence to be weighed, and record its source and meaning before relying on it.
Is an address labeled "sanctioned" by an analytics tool the same as an OFAC-listed address?
Not necessarily. An OFAC-listed address appears as an identifier in an official SDN entry. An analytics label may extend that designation to other addresses through clustering, or rest on other evidence the provider has gathered. Both can matter, because OFAC expects firms to block and report digital currency they believe is owned by or associated with an SDN, listed or not. The case record should distinguish an exact listed-address match from an analytical attribution and state the evidence for each.
Know what stands behind every label you rely on.
Book a demo to discuss how your team evidences sanctions screening decisions and keeps the reasoning on record.
Book a demo