On-Chain Traceability: What Everyone Can See
Addresses, history, links to your exchange account: what a public blockchain reveals about you, and how to limit leaks legally.
The essentials
This guide is general information. It does not constitute legal or investment advice.
Pseudonymous doesn't mean anonymous
When you create a wallet, you get an address: a long string of characters, with no first or last name. That's why crypto is often called "anonymous." This is inaccurate.
Public blockchains are pseudonymous: your address is a pseudonym. Like a forum username, it protects you as long as nobody knows who is behind it. But once the link is made, everything you did under that pseudonym is exposed.
And on a blockchain, "everything" is a lot:
- the address's current balance;
- all incoming and outgoing transactions, with amounts and dates;
- the addresses you have dealt with;
- the tokens, NFTs and applications used.
Anyone can view this data for free with a block explorer (see reading a block explorer). And it never gets erased.
How addresses get linked together
A person often owns many addresses. Analysts use heuristics, meaning rules of thumb, to group the addresses probably controlled by the same person. This is called clustering.
On Bitcoin
Bitcoin works with "coins" called UTXOs (unspent transaction outputs). Several classic heuristics, described on the Bitcoin wiki, make it possible to link addresses:
- Common input ownership: when a transaction spends several coins at once, they are assumed to all belong to the same owner. This is often true.
- Change detection: when you pay, the surplus comes back to a new address of yours (the "change"). If an observer guesses which of the outputs is the change, they can follow your funds.
- Round amounts: a payment often corresponds to a round amount (in bitcoin or in euros); the other output is then probably the change.
- Software fingerprint: each wallet builds its transactions in its own way (address types, fees, etc.), which leaves a recognizable signature.
On Ethereum and similar networks
The model is different: an address is an account that is reused constantly. Your whole history is therefore naturally grouped in one place. Links between accounts are made, for example, when:
- one account funds another with gas fees (the fuel needed for transactions);
- several accounts interact with the same applications at the same time;
- funds flow from one to the other, even in small amounts.
Address reuse
On every chain, reusing the same address mechanically links all the transactions involved. The Bitcoin wiki reminds us that an address works like a pseudonym: reusing it is proof that those operations come from the same person.
The key link: exchanges and KYC
The link between an address and an identity most often happens when you go through a regulated platform.
To open an account on an exchange in Europe, you go through a KYC ("Know Your Customer," identity verification) procedure: ID document, proof of address, sometimes the origin of funds. See the guide KYC and identity verification.
After that, every withdrawal to your personal wallet creates a link between your identity and the destination address. Every deposit from your wallet creates one too. The platform knows it, and may be required to pass this information on to the authorities within a legal framework.
The European "travel rule"
Since December 30, 2024, European Regulation (EU) 2023/1113, often called the travel rule, has applied to crypto-asset service providers. Its principle: information about the sender and the recipient accompanies every transfer, as with a bank transfer.
In practice, according to the text:
- the sender's platform transmits in particular their name, their blockchain address, their account number and identification details;
- the recipient's information also accompanies the transfer;
- there is no minimum threshold: even a small transfer is covered;
- for a transfer of more than €1,000 to or from a self-hosted wallet (one you control yourself), the platform must verify that this address actually belongs to you.
This is why some platforms ask you to prove ownership of your wallet, for example by signing a message or making a small test transfer.
Blockchain analytics companies
Specialized companies, such as Chainalysis, Elliptic or TRM Labs, have industrialized blockchain analysis. Their method relies on two steps:
- clustering, which groups the addresses of a single entity using the heuristics described above;
- attribution, which links these groups to real actors (exchanges, services, criminal groups, individuals), based on open sources, partnerships and research.
Their customers are mainly exchanges, financial institutions and authorities. Platforms use them to assign a risk score to deposits: funds coming from a sanctioned address, an illegal marketplace or a scam can lead to a deposit being blocked or to additional questions.
Even an honest user can be affected: if you receive funds from someone whose history is "high-risk," your deposit may be scrutinized.
When you dox yourself
Doxxing is the revealing of the real identity behind a pseudonym. Many users do it without realizing:
- ENS names and equivalents. A name like
firstname.ethset as your address's "primary name" creates, according to the ENS documentation, a public two-way link between the name and the address. Applications display it everywhere. - Profile-picture NFTs. An NFT used as a profile picture on a social network points to the address that holds it.
- Public posts. Sharing a transaction screenshot, posting your address to receive a donation or an airdrop, or bragging about a gain on social media ties your account to the address.
- Delivery addresses and payments. Paying a merchant in crypto reveals the originating address to them, and therefore potentially your whole history.
Beyond privacy, it's also a security issue: publicly displaying a large balance can make you a target for targeted scams or extortion attempts.
A concrete example
Claire buys ETH on a European exchange, with KYC. She withdraws it to her personal wallet, address A. To keep things simple, she uses A for everything: NFT purchases, DeFi, receiving payments from her freelance clients.
One day, she registers claire-design.eth as the primary name for address A, and displays it in her social media bio to receive tips.
Result: anyone can now see her balance, her NFTs, her DeFi positions, the amounts her clients paid and her activity dates. The exchange, for its part, has known since the first withdrawal that A belongs to her.
A more careful setup would have separated the uses: a "public" address for tips with a low balance, and another for savings, never associated with her name.
Privacy best practices (legal ones)
Protecting your privacy is legitimate and perfectly legal, as long as you aren't trying to hide the origin of funds or evade your (reporting) obligations. A few simple habits:
- Separate uses: one address for savings, one for DeFi and NFT interactions, one for anything public.
- Avoid address reuse on Bitcoin: most modern wallets generate a new receiving address each time.
- Think before associating a name (ENS or other) with an address that holds your main funds.
- Don't publish screenshots of transactions, addresses and balances.
- Watch out for funding links: funding a new wallet from your main address links the two.
- Keep your supporting documents: purchase history, exchange statements. Privacy from the public doesn't prevent you from being in good standing with the tax authorities; on the contrary, being able to justify the origin of your funds avoids blockages.
To go further on Bitcoin, the guide CoinJoin and privacy on Bitcoin covers fine-grained UTXO management and the legal framework for mixing tools.
Mistakes to avoid
- Believing that having no name makes you invisible. A single link to your identity is enough to expose an entire history.
- Thinking a new wallet erases the past. If it's funded from the old one, the link is visible.
- Doing everything with a single address. Convenient, but it exposes the whole of your activity and your wealth.
- Publishing your main address to receive an airdrop, a donation or a payment.
- Accepting funds of unknown origin and then depositing them straight onto an exchange: the deposit may be blocked for review.
- Confusing discretion with concealment. Trying to hide the origin of funds or to get around a platform's checks may be illegal; discretion toward the public is not.
Key takeaways
- Public blockchains are pseudonymous, not anonymous: an address's entire history is visible to everyone, forever.
- Simple heuristics (common inputs, change, address reuse) make it possible to group a person's addresses.
- Exchange KYC and the European travel rule tie your identity to the addresses you use with them.
- Blockchain analytics firms assign risk scores that can affect your deposits.
- ENS names, profile-picture NFTs and public posts are frequent sources of self-doxxing.
- Separating your addresses and staying discreet in public legally protects your privacy and your security.