Bitcoin is built on a fundamentally different model from the "account" model of Ethereum or a bank. There are no balances here — there are unspent outputs (UTXO). At first glance this complicates reading the history, but in reality it is the UTXO model that hands analysts their most powerful deanonymisation techniques. Let's unpack the model, the clustering methods and the typical laundering schemes in BTC.
In Bitcoin an address has no "balance" as a record in a database. Instead there is a set of UTXO (Unspent Transaction Output) — like separate "banknotes" of various denominations lying in a wallet. Your balance is simply the sum of all the UTXO you can spend with your key.
When you send bitcoins, you do not "debit an amount," you spend whole UTXO in their entirety and create new ones. Want to send 0.3 BTC but you have a UTXO of 0.5 BTC? The transaction spends that whole output and creates two new ones: 0.3 BTC to the recipient and ~0.2 BTC — the change — back to your address (minus the fee).
Why is this convenient for an analyst? Because every transaction explicitly states which exact "coins" came from where and went where. It's as if every banknote had a serial number and a full log of hand-to-hand transfers. The trail is not diluted across a shared balance — it runs through specific outputs. This is the foundation of precise tracing in Bitcoin.
The key heuristic of blockchain analysis is called common-input-ownership. The logic is simple: to spend several UTXO in one transaction, you have to sign it with the private keys of all those outputs. So with high probability all the input addresses belong to a single owner.
An analyst takes a transaction, sees that 5 different addresses went into it — and merges them into one cluster (a single entity). Then they find other transactions where those addresses appear with new ones — the cluster grows. That is how "entities" emerge from thousands of scattered addresses: a specific exchange, a specific user wallet, a specific service. This is exactly why, behind the addresses of Binance, Garantex or a major mixer, analysts see unified clusters of millions of addresses.
The second heuristic is identifying the change address. Of a transaction's two outputs, one usually belongs to the recipient and the other is the change to the sender. The analyst works out the change from indirect clues: a new unused address, a "round" payment amount versus an "unround" change, a match of the address type with the inputs. Having identified the change, the analyst continues the trail precisely along the sender's wallet.
Understanding UTXO and clustering, it's easy to recognise the characteristic laundering patterns and how analytics sees them.
For a manual check of a BTC address or transaction, free public explorers are enough. Two working tools:
Its strength is the visualisation of the mempool (the queue of unconfirmed transactions) and of fees. Useful when you need to understand the status of a "stuck" transaction, estimate a fee, look at the inputs/outputs of a specific transaction and its confirmations. It clearly shows the UTXO structure of a transaction.
A powerful aggregator-explorer with advanced search and filters across many networks. Convenient for analysing an address: full transaction history, amounts, related outputs, data export. Good for a quick overview of "how much passed through, from where, to where."
It's important to understand the limit of a manual check: explorers show the raw blockchain data — transactions, amounts, addresses. They do not label addresses as "exchange," "mixer," "sanctions" and do not compute a risk score. For that you need analytics with attribution databases (entity clustering, labels, taint analysis) — what specialised AML services do. A manual explorer answers the question "what happened on the chain," while an AML engine answers "how dangerous is it."
Bitcoin remains the most traceable major network precisely because of UTXO. The paradox: what was conceived as privacy through one-time addresses turned into an ideal environment for clustering. In the next lesson we move to a network with the opposite reputation — TRON — and unpack why USDT-TRC20 became the favourite tool for cashing out.
This material is educational and does not constitute legal advice.