AMLConsensus · course
Programme · Lesson 10.1
Section 10 · Lesson 10.1

Checking in Bitcoin: UTXO, Clustering, Peel Chain

Bitcoin is built on a fundamentally different model from the "account" model of Ethereum or a bank. There are no balances here — there are unspent outputs (UTXO). At first glance this complicates reading the history, but in reality it is the UTXO model that hands analysts their most powerful deanonymisation techniques. Let's unpack the model, the clustering methods and the typical laundering schemes in BTC.

The UTXO model: why it's convenient for tracing

In Bitcoin an address has no "balance" as a record in a database. Instead there is a set of UTXO (Unspent Transaction Output) — like separate "banknotes" of various denominations lying in a wallet. Your balance is simply the sum of all the UTXO you can spend with your key.

When you send bitcoins, you do not "debit an amount," you spend whole UTXO in their entirety and create new ones. Want to send 0.3 BTC but you have a UTXO of 0.5 BTC? The transaction spends that whole output and creates two new ones: 0.3 BTC to the recipient and ~0.2 BTC — the change — back to your address (minus the fee).

Input
UTXO 0.5 BTC
Output 1
0.3 to recipient
Output 2
0.2 change to self

Why is this convenient for an analyst? Because every transaction explicitly states which exact "coins" came from where and went where. It's as if every banknote had a serial number and a full log of hand-to-hand transfers. The trail is not diluted across a shared balance — it runs through specific outputs. This is the foundation of precise tracing in Bitcoin.

Why this matters. The UTXO model reveals far more than the sender imagines. The very fact that you combined several UTXO in one transaction gives away that all those addresses are yours. This is what the main deanonymisation method is built on.

Clustering addresses by common-input

The key heuristic of blockchain analysis is called common-input-ownership. The logic is simple: to spend several UTXO in one transaction, you have to sign it with the private keys of all those outputs. So with high probability all the input addresses belong to a single owner.

An analyst takes a transaction, sees that 5 different addresses went into it — and merges them into one cluster (a single entity). Then they find other transactions where those addresses appear with new ones — the cluster grows. That is how "entities" emerge from thousands of scattered addresses: a specific exchange, a specific user wallet, a specific service. This is exactly why, behind the addresses of Binance, Garantex or a major mixer, analysts see unified clusters of millions of addresses.

The second heuristic is identifying the change address. Of a transaction's two outputs, one usually belongs to the recipient and the other is the change to the sender. The analyst works out the change from indirect clues: a new unused address, a "round" payment amount versus an "unround" change, a match of the address type with the inputs. Having identified the change, the analyst continues the trail precisely along the sender's wallet.

What a user's wallet gives away

Typical schemes in BTC

Understanding UTXO and clustering, it's easy to recognise the characteristic laundering patterns and how analytics sees them.

  1. Peel chain ("peeling"). From a large UTXO, a small amount is "peeled off" for cash-out (an exchange/desk) at each step of a chain of transactions, while the main part moves on to a new address as change.Outwardly — a long chain where the main flow stretches through dozens of addresses. Classic layering.
  2. CoinJoin and mixing. Many users combine inputs and outputs of equal denominations in one transaction, breaking the input-output link.Common-input is deliberately "poisoned" here, but the very fact of participating in a CoinJoin is a risk signal for exchanges.
  3. Splitting across many addresses (smurfing). An amount is broken into dozens of small transfers below the thresholds of attention.
  4. Consolidation for cash-out. The reverse technique: many small "laundered" UTXO are brought together for withdrawal — and again give away a cluster.
Attention. Many exchanges treat your coins passing through a CoinJoin or a known mixer as elevated risk in itself — even if the original funds were clean. Legitimate privacy and a "bad" source look alike to the algorithm.

Explorers: mempool.space and blockchair

For a manual check of a BTC address or transaction, free public explorers are enough. Two working tools:

mempool.space

Its strength is the visualisation of the mempool (the queue of unconfirmed transactions) and of fees. Useful when you need to understand the status of a "stuck" transaction, estimate a fee, look at the inputs/outputs of a specific transaction and its confirmations. It clearly shows the UTXO structure of a transaction.

blockchair.com

A powerful aggregator-explorer with advanced search and filters across many networks. Convenient for analysing an address: full transaction history, amounts, related outputs, data export. Good for a quick overview of "how much passed through, from where, to where."

It's important to understand the limit of a manual check: explorers show the raw blockchain data — transactions, amounts, addresses. They do not label addresses as "exchange," "mixer," "sanctions" and do not compute a risk score. For that you need analytics with attribution databases (entity clustering, labels, taint analysis) — what specialised AML services do. A manual explorer answers the question "what happened on the chain," while an AML engine answers "how dangerous is it."

A practical algorithm for checking a BTC address manually

  1. Open the address in blockchair/mempool.space.Assess the age, the number of transactions, the total turnover.
  2. Look at the sources of the incoming funds.Where the coins came from, how many "hops" to large known clusters.
  3. Assess the pattern.Does it look like a peel chain, consolidation, participation in a CoinJoin.
  4. Run it through an AML checker for attribution and a risk score.Manual inspection gives the structure, an AML service gives the labels and the risk assessment.

Bitcoin remains the most traceable major network precisely because of UTXO. The paradox: what was conceived as privacy through one-time addresses turned into an ideal environment for clustering. In the next lesson we move to a network with the opposite reputation — TRON — and unpack why USDT-TRC20 became the favourite tool for cashing out.

This material is educational and does not constitute legal advice.