Our contribution to the ENSEMBLE project, summarized: an address clustering method that investigators can recompute and question instead of trust.
An investigative lead and a piece of evidence are not the same thing. Address clustering belongs to the first category, yet it continues to appear in forensic reports as though it belonged to the second.
ENSEMBLE is an EU research project on collaborative cybercrime investigation, and Iknaio contributes cryptoasset analytics to it. Our work over the past months followed a single thread: a technique that generates leads is useful only if an investigator can see how far each lead reaches. In practice, this requires three things, which we describe in this post: stating why clustering cannot carry evidentiary weight, releasing the engine that computes it so that anyone can recompute the result, and building a tool that names the relationship behind every hit instead of condensing it into a score.
Address clustering is a heuristic
Address clustering groups addresses that are likely controlled by the same actor. The most widely used method is the multi-input heuristic: whenever a transaction spends from several input addresses at once, the corresponding keys were presumably held by the same actor at that moment. Applied across the entire chain, this rule partitions the address space into clusters.
The term “heuristic” carries a shared understanding in academic writing, namely that the method approximates and produces both false positives and false negatives. On the way from research papers into operational forensics tools that understanding was lost, and clusters began to be read as facts.The measurements do not support that reading. In How Reliable Is the Multi-Input Heuristic for Bitcoin Address Clustering in Law Enforcement Contexts? (Müller, Elsner, Niedermayer,Haslhofer, Goger, Kühl, Rückert, 2026), we evaluated the multi-input heuristic against ground-truth address-to-entity mappings obtained directly from European crypto-asset service providers under legally mandated reporting obligations. Full-cluster precision and recall are 0.36 and 0.44, respectively, and for some services the heuristic fails almost completely. Reliability varies to that degree between entities, which means that no single error rate describes the method. Courts accept DNA analysis because its error rates are known and quantified; a method whose error rate cannot be established in general can generate leads, but it cannot carry the weight of evidence.
This misreading has practical consequences. A prosecutor’s office receives a report stating that an exchange customer sent Bitcoin to an address belonging to a cluster associated with Child Sexual Abuse Material (CSAM). The address itself carries no evidence of CSAM use. Cluster co-membership has been treated as individual attribution, and a person became a suspect through an algorithmic association that nobody outside the tool vendor can verify.
An exchange withdrawal into a cluster of thousands of addresses, where the address in question shares membership with CSAM-exposed addresses but carries no direct evidence
Therefore, Iknaio Pathfinder builds traces address by address and keeps clustering out of the evidence layer. Every hop is a concrete transaction between specific addresses, with amount and date, which anyone (including the defence) can verify against the public ledger. Clustering still runs in the background, where it propagates attribution tags and connects related cases; cluster boundaries never appear in the trace from which a report is built. We set out the full argument in Address Clustering Is Not Evidence.
A Pathfinder trace from a scam-tagged address to an exchange: every hop is a concrete transaction, and no cluster boundaries appear
An engine that can be run independently
Reproducibility is the requirement that commercial tools most often fail. Given a damage figure that rests on clustering performed by a proprietary system, no independent third party can recompute it, and the figure therefore does not survive cross-examination.
We consequently lifted the clustering step out of our production pipeline, where it was buried inside a Spark job. It is now available as a stand-alone package, graphsense-clustering on PyPI, implemented in Rust with Python bindings.
The algorithm is not exotic, and that is part of the argument. Every input address is a node, every multi-input transaction connects its input addresses to each other, and the clusters are exactly the connected components of the resulting graph; a Union-Find structure computes them in a single pass over the transactions.
Running this over the full Bitcoin history requires a laptop. On an Intel i7-1365U with 32 GB of RAM, the 1.4 billion transactions in the chain reduce to 231.4 million multi-input transactions, which cover 970.3 million distinct input addresses. The clustering pass over those addresses takes 72 seconds and yields 117.2 million clusters. Once the reduced address lists exist, mapping the addresses to ids and resolving them back afterwards brings the entire run to ca. 20 minutes.
The largest cluster spans 40.8 million addresses and belongs to Coinbase. The second largest, with 24.8 million addresses, is the Wasabi supercluster produced by CoinJoin transactions; a single collaborative transaction pattern therefore accounts for a large part of the output. The four pipeline steps and the code are described in Multi-input clustering all of Bitcoin on a laptop.
Naming the relationship behind a hit
Transparency about the method does not by itself tell an investigator what one specific hit is worth; that is a separate problem.
The CSAM Checker is an add-on to the Iknaio platform, available to our institutional customers. The investigator enters one address, the checker determines which networks that address exists on, and it then checks each of them against addresses tagged as CSAM-related. Every hit is reported together with the relationship that produced it, ordered here from the most direct to the least direct:
- DIRECT: the address itself is tagged
- SAME CLUSTER: another address in the same cluster is tagged
- INCOMING ADDRESS NEIGHBOR: a direct neighbor that sent funds to the address is tagged
- OUTGOING ADDRESS NEIGHBOR: a direct neighbor that received funds from the address is tagged
- INCOMING CLUSTER NEIGHBOR: an address in a cluster that sent funds to this cluster is tagged
- OUTGOING CLUSTER NEIGHBOR: an address in a cluster that received funds from this cluster is tagged
No result is condensed into a risk score. A direct hit is a statement about the address in front of the investigator, whereas an outgoing cluster neighbor hit is a statement about the company that address keeps, one hop away and at cluster level on both ends. Both belong on screen, labeled, so that the investigator decides what each one is worth.
Every tag also names its source and links back to the underlying evidence. One of our attribution providers is CFLW: when their Dark Web Monitor finds a cryptoasset address on a site offering CSAM, the address reaches us with the corroborating material (e.g., a screenshot of the page on which it appeared). An investigator can therefore check the basis of a tag, not merely its existence.
Three of the six relationships rest on clustering, which is deliberate. Clustering is a lead generator, and lead generation is the purpose of this tool; excluding it would mean missing relevant leads. Printing the relationship on every row is what prevents a same-cluster hit from being read as a direct one.
The CSAM Checker in Pathfinder: one address checked across every network it exists on, with the relationship named on each row
Implications for investigative practice
For investigators, the procedure is short: treat every hit as a lead, read the relationship on the row to determine how far that lead reaches on its own, corroborate independently before any of it enters a report, and present only what a third party can recompute from the public ledger.
For compliance teams, the same labels prevent a same-cluster hit from escalating as though the address itself were tagged. Cluster size and ownership matter as much as the relationship here. A hit inside a small cluster under one actor’s control is one finding, whereas the same hit inside a custodial cluster is another, because an exchange administers millions of addresses on behalf of its customers, so the tagged address and the submitted one may share nothing beyond a common custodian.
Outlook
None of the three parts works in isolation. An open engine without the evidentiary caveat invites the same misreading in a new form, and a caveat without a reproducible engine leaves the defence with nothing to check.
Within ENSEMBLE, this is what we mean by investigation technology that holds up: not a tool that answers, but methods and data that an investigator understands well enough to defend. The same shift applies well beyond criminal proceedings. Financial supervisors consume attribution through commercial black boxes whose coverage they cannot verify, and they are better served by building on data they control. In a recent study, we reconstructed the on-chain activity of all crypto-asset service providers registered in Austria from a regulatory registry, without using any commercial attribution tool.
Overall, understanding the data and the methods matters more than any individual tool.
Written by Dr. Bernhard Haslhofer from IKNAIO
