Section 2 · Lesson 2.2
Two accounting models: UTXO versus accounts
Bitcoin and Ethereum are built on fundamentally different principles, and this directly affects how you read a history and how you trace "dirty" funds. Understanding the difference is what separates an amateur from an analyst.
1. UTXO — "banknotes in a wallet" (Bitcoin)
In Bitcoin there is no concept of a "balance." There is a set of unspent outputs — UTXOs (Unspent Transaction Outputs), like separate banknotes of various denominations. When you pay, the transaction "spends" some notes in full and creates new ones: to the recipient, and change back to yourself.
Inputs
UTXO 0.5 BTC + 0.3 BTC
→
To recipient
0.7 BTC
Change to self
0.1 BTC (−fee)
Why this is convenient for tracing. The movement of specific "banknotes" is visible literally. And if a single input combines UTXOs from several addresses, they are almost certainly controlled by one owner (the common-input-ownership heuristic). This is how analysts cluster addresses into single wallets.
2. The account model — a "bank account" (Ethereum, TRON, BSC)
In Ethereum and most modern networks, an address has a single balance that transactions increase or decrease — like a bank account. There are no separate "banknotes."
The key consequence. In an account, funds get mixed together. If 90 "clean" coins and 10 "dirty" ones arrive at an address, you can no longer say which ones left afterward. So here proportional analysis applies (what share of the incoming funds was risky) — and that is the very basis of risk scoring (Section 4).
3. How the difference affects your check
- In BitcoinLook at the specific paths of coins and at address clusters. The peel-chain scheme (Section 7) originates here. Explorers: mempool.space, blockchair.
- In Ethereum/EVMLook at the shares of incoming exposure and at counterparty labels. One address = one page with the whole history. Explorers: Etherscan, Blockscout.
- Tokens are a separate layerIn account networks, USDT/USDC/DAI live "on top of" the base coin as records in smart contracts. Their movements are viewed on a separate tab (Lesson 2.5).
4. Smart contracts change the picture
In account networks an address comes in two types: EOA — an ordinary person's wallet, and Contract — a smart contract (an exchange, a DEX, a token, a bridge). A transfer "to a contract" is most often an interaction with a service (a swap, staking), not a payment to a person. The explorer marks the address type directly — it's the first thing an analyst looks at on opening a page.
Practical takeaway. Before interpreting transfers, determine the network type (UTXO or account) and the address type (EOA or contract). Otherwise it's easy to mistake an ordinary DEX interaction for a "suspicious fan-out of transfers."
Lesson summary
- Bitcoin (UTXO): funds are like banknotes; specific paths are visible; addresses cluster by common input.
- Ethereum/EVM (accounts): a single balance; funds get mixed; proportional risk analysis applies.
- Tokens live on top of the account model — a separate layer to check.
- Always determine the network type and the address type (EOA/contract) before interpreting.
This material is for educational purposes.