How Reliable Is the Multi-Input Heuristic for Bitcoin Address Clustering in Law Enforcement Contexts?
cs.CR
Submitted: 2026-07-08
Updated: 2026-09-03
License: http://creativecommons.org/licenses/by-nc-nd/4.0/
The gist: Address clustering is an important technique in blockchain forensics, widely employed by law enforcement to trace illicit crypto asset flows.
Terminology
Abstract
Address clustering is an important technique in blockchain forensics, widely employed by law enforcement to trace illicit crypto asset flows. The multi-input heuristic (MIH), which clusters addresses potentially associated with the same entity, is the most widely used. Yet, despite its broad adoption, the MIH has rarely been evaluated against reliable ground truth data. We implement a reusable evaluation framework covering nine established metrics and apply it to ground truth address-to-entity mappings obtained directly from European crypto asset service providers under legally mandated reporting obligations. When evaluation is restricted to reported addresses, the MIH appears strong at dataset level: we observe no mergers between reported services and recover same-service address pairs with recall 0.71. However, this result is driven by one large service and ignores unlabeled addresses absorbed into full clusters. Metrics that assess the full clusters show substantially lower precision and recall (0.36 and 0.44), meaning that services are often only partially recovered or embedded in larger clusters. Entity-level results further reveal near-complete failures for some services. When MIH-based clusters are used to support criminal suspicion, preliminary seizure of crypto assets to secure later forfeiture/ confiscation, or as evidence in trial proceedings, prosecutors and judges must account for the heuristic's metric-dependent and entity-dependent reliability.
Sources
- The Challenges of Investigating Cryptocurrencies and Blockchain Related Crime
- Assessing the Efficacy of Heuristic-Based Address Clustering for Bitcoin
- Heuristics for Detecting CoinJoin Transactions on the Bitcoin Blockchain
- Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics
- Bitcoin Transaction Graph Analysis
- Characterizing and Detecting Money Laundering Activities on the Bitcoin Network
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs