How chain analysis reads your wallet

Chain analysis is not surveillance in the usual sense. Nobody is watching you. It is a set of assumptions applied at scale to a public ledger, and each assumption is individually unremarkable — the kind of reasoning you would do yourself if handed the data.

Most people who care about privacy know two of them. The privacy guide walks through both: coins spent together share an owner, and the round output is the payment while the awkward one is change. Those two do an enormous amount of work.

They are not the whole toolkit. This page covers the rest — the change-detection tricks past the obvious one, the way your software signs its own name on every transaction, and the two newer defences that operate at the protocol level rather than relying on you to have good habits.

1The two you have already met

Briefly, so the rest has somewhere to stand.

• Common-input-ownership. If a transaction spends several coins, one entity controlled all of them. This is the single strongest signal in the field, and it is right the overwhelming majority of the time.
• Change identification by roundness. Pay someone 0.05 BTC from a 0.31 BTC coin and the outputs are a round number and a remainder. Payments are round; change is whatever is left.

An analyst who has identified your change can follow it into your next transaction, and the next, indefinitely. That is why change detection matters so much: it is what turns isolated transactions into a chain.

2The other ways change gets spotted

Roundness is the famous one. When it does not apply, several others usually do.

• Script-type matching. If a transaction spends from a native SegWit address and produces one native SegWit output and one legacy output, the matching one is almost certainly change — your wallet makes change in its own format, while you pay whatever the recipient asked for.
• Address reuse. If one output goes to an address that has been seen before and the other is fresh, the fresh one is the change. Reused addresses are almost never change, because wallets generate a new one every time.
• The unnecessary input. If a transaction includes more inputs than the payment required, the surplus was needed to cover a larger output — which tells the analyst which output was the large one.
• The self-transfer shape. A single input producing a single output, or two outputs that both look like change, is usually somebody moving their own coins rather than paying anyone.

3Your wallet has an accent

This is the layer most people have never considered, and it requires nothing from you to leak.

Bitcoin's rules leave several choices to whoever builds the transaction, and different wallet software makes those choices differently. The resulting pattern is consistent enough to identify which software produced a transaction — a technique usually called wallet fingerprinting.

• The locktime field. Some wallets set it to the current block height to discourage fee sniping; many leave it at zero. That choice alone splits the population.
• Transaction version number. Wallets differ, and they differ consistently.
• Input and output ordering. Some sort deterministically, some shuffle randomly, some preserve the order they built in.
• Replace-by-fee signalling. Whether the transaction is marked replaceable is a per-wallet default more than a per-user decision.
• Change output position. Always last, always first, or randomised — another consistent per-wallet habit.

The consequence is subtle but real. If your wallet's fingerprint appears on both sides of a transaction — on the spending side and on one of the outputs — that output is probably yours. Fingerprinting is a change-detection heuristic wearing a different hat, and no amount of careful coin selection affects it.

4Amounts and timing

• Amount correlation. A withdrawal of an unusual amount leaving an exchange and an arrival of nearly that amount elsewhere, minus a plausible fee, is a link even with no shared inputs.
• Timing. Transactions that consistently appear during one part of the day describe a time zone, and eventually a routine.
• Fee-rate habits. Always paying the same wallet's default at the same urgency setting is one more consistent signature.

5What coin control actually defeats

Now the practical question: which of these does careful spending address?

Coin control is genuinely the highest-value habit available, and this table is not an argument against it — it defeats the strongest heuristic in the field. But it is a habit-level defence, and several rows here are immune to habits. That is what the next two sections are for.

6Payjoin: making the strongest assumption false

Every defence so far tries to avoid triggering common-input-ownership. Payjoin does something more interesting: it makes the assumption produce a wrong answer.

In a payjoin, the person receiving the payment also contributes an input to it. The finished transaction spends coins belonging to two different people, so any analyst applying the strongest heuristic in the field concludes that one entity owned both — and is simply incorrect.

CoinJoin makes you one of many indistinguishable candidates. Payjoin lets an ordinary payment quietly poison the data instead.

It also breaks amount analysis, because the visible payment amount is no longer the amount that changed hands. And unlike a CoinJoin, a payjoin looks like a completely ordinary transaction — there is nothing conspicuous about having used one.

• The original design (BIP78) required the receiver to run a server and be online at the moment of payment, which restricted it in practice to merchants and enthusiasts.
• The newer variant (BIP77), merged in 2025, removes that requirement by routing through an untrusted directory service, so the receiver no longer needs their own always-on infrastructure.
• Support is arriving but not universal. Bull Bitcoin — a Canadian exchange and wallet — and Cake Wallet are among those shipping the newer version.
• Both sides must support it. This is the honest limitation: a payjoin needs a willing counterparty, so its usefulness depends on adoption rather than on your own diligence.

The wider benefit is worth noting. Every payjoin that occurs degrades the reliability of common-input-ownership for everyone, including people who never use it. It is one of the few privacy measures with a positive externality.

7Silent payments: a reusable address that is not reuse

Address reuse is one of the clearest signals on the list, and there is a long-standing situation that forces it: publishing a donation address, putting one in a profile, or giving a static address to somebody who pays you regularly. You cannot hand out a fresh address every time if the point is to publish one.

Silent payments (BIP352) resolve that. You publish one static address, and each sender derives a unique, unlinkable on-chain output from it. Every payment lands somewhere different, nothing on the chain connects them, and there is no address reuse to detect — while you only ever published one string.

• The cost is scanning. Your wallet must check incoming blocks to find payments meant for you, which is more work than watching a list of known addresses. This is the main reason adoption has been gradual.
• Support is uneven and growing. Through 2026 the underlying cryptography landed in the standard library, and wallets including Sparrow, Nunchuk, Cake Wallet, and Silentium have shipped varying degrees of support — receiving typically arriving before sending.
• It solves publication, not everything. Silent payments fix the static-address problem specifically. They do not affect common-input-ownership, change detection, or fingerprinting.

8What none of this fixes

• The past is permanent. Every link already published stays published. All of this changes your future only.
• Identity attaches off-chain. A verified exchange account ties your name to specific coins, and no on-chain technique reaches backwards through that.
• Your wallet's server sees your queries regardless of how the transactions look. That is a separate problem with a separate fix.
• Amounts are always visible. Bitcoin's outputs are public values. Every technique here obscures ownership, not quantity.

The short version

Analysts combine roughly eight inferences, not one: shared inputs, several independent ways of spotting change, the fingerprint your wallet software leaves on every transaction, and correlations of amount and time. Coin control defeats the strongest of them and is worth doing for that reason alone, but several are immune to spending habits. Payjoin attacks the biggest heuristic directly by making it produce false answers, and silent payments remove the need to ever reuse a published address.