Wallet clustering and address attribution

On a public blockchain, every transfer is permanent and visible. The funds moved – but so did the evidence.

Wallet clustering and address attribution are the core analytical methods used to identify who controls a set of blockchain addresses, and to follow stolen value from the moment it leaves a victim's wallet to the point where it must interact with the real world. When applied rigorously, these techniques convert an anonymous transaction hash into a recoverable target: an account at a centralised exchange, a payment to an identifiable counterparty, or a pattern of behaviour that links pseudonymous activity to a known individual or entity. Recovery is never guaranteed, but the analytical foundation is sound, and the trail is longer than most victims expect.

This analysis explains how clustering and attribution work, where they break down, how courts have engaged with the output, and what the tracing evidence must show before a freezing order or disclosure application can succeed. As of early 2026, the methods are established practice in cross-border crypto recovery – but they remain contested in some forums, and the gap between a good trace and a court-ready exhibit is wider than blockchain-analytics marketing suggests.

What wallet clustering actually does – and what it cannot do

Wallet clustering groups multiple blockchain addresses that the available evidence suggests are controlled by the same private-key holder. The underlying logic is that blockchain protocols leave structural fingerprints. The most widely recognised is the common-input-ownership heuristic: when several addresses are used simultaneously as inputs to a single transaction, the protocol requires that the sender holds all of the relevant private keys. That is a technical fact, not an inference. A single entity must have authorised the move. From that fact, analysts can begin to aggregate addresses into clusters.

Additional signals reinforce or extend the cluster. Change-address patterns, timing correlations, dust-trace responses, and behavioural consistency across multiple transactions all contribute. The cumulative weight of several consistent signals is stronger than any single marker. Analysts describe this as convergent evidence – the same principle a financial investigator uses when tracing proceeds through layered bank accounts.

But clustering has hard limits. A well-disciplined actor using coin-join protocols, privacy coins, or carefully partitioned wallets will produce fewer exploitable signals. Mixing services – deliberately designed to break the common-input heuristic – fragment the trail and force the analyst to rely on probabilistic methods rather than deterministic ones. Courts in common-law jurisdictions have accepted probabilistic attribution in appropriate cases, but the standard of evidence required for interim relief differs from that required at trial. Knowing the limits of the method is as important as understanding its power.

What clustering does not do is identify a person. It identifies a cluster of addresses. The attribution step – connecting the cluster to a named individual or institution – is a separate analytical layer, and it depends on off-chain evidence. That is where the recovery path either advances or stalls.

How address attribution connects on-chain data to a real-world identity

Attribution is the process of tying an address cluster to an identifiable actor. The most direct route is through a known-entity deposit: a transfer from the cluster to an address publicly associated with a regulated virtual-asset service provider (VASP) or centralised exchange. Regulated platforms are required, in most jurisdictions, to collect identity information from depositing customers. That information is only accessible through legal process – a disclosure order against the VASP – but the on-chain evidence establishes the predicate for the application.

In our experience, the first identifiable VASP deposit is the single most actionable event in a crypto tracing matter. It converts an abstract transaction graph into a disclosure target. Every hour of delay after that deposit increases the chance that the account is drained, closed, or the funds moved again through a second exchange in a different jurisdiction.

Other attribution methods build the picture without a direct VASP link. Transaction timing correlated with known events – a social media post, a server log, an IP address captured by a phishing infrastructure – can establish that the cluster operator was active in a particular time zone or even at a specific terminal. Repeated use of a single deposit address across multiple platforms is a common operational-security failure that narrows the field of suspects substantially. Blockchain-analytics tools aggregate these signals and assign confidence levels, but the analyst must interrogate those confidence levels, not simply adopt them.

The gap between a high-confidence cluster and a named defendant is sometimes bridgeable through the Norwich Pharmal order, which compels a third party – the VASP, a payment processor, or in some cases a corresponding bank – to disclose identifying information. A Norwich Pharmal application is typically made without notice to the respondent, to avoid tipping off the subject of the investigation. The applicant must satisfy the court that a wrong has been done, that there is a good arguable case the respondent holds information that would identify the wrongdoer, and that the order is in the interests of justice. The on-chain tracing evidence is usually the foundation of that showing.

Where does the trace break down – and can it be recovered?

Three categories of disruption account for most tracing failures. Understanding each helps a practitioner decide, quickly, whether the matter is worth pursuing or whether the trail has cooled beyond the point of practical recovery.

The first is mixer or tumbler use. Mixing services pool inputs from multiple users and return equivalent outputs, severing the deterministic link between source and destination. The trail does not disappear, but it becomes probabilistic. Analysts can sometimes follow value forward through a mixer by tracking the timing, denomination, and behavioural pattern of outputs. Whether that probabilistic evidence satisfies the standard for a freezing application is a forum-specific question. Some courts have accepted it; others require a tighter nexus.

The second is cross-chain bridging. Assets moved from one blockchain to another through a bridge protocol require the analyst to work across two separate transaction graphs, often with different data structures and different VASP landscapes. The chain of custody can be maintained, but it requires explicit documentation of each bridging event – and that documentation must appear in the tracing exhibit, not just in the analyst's notes.

The third is rapid off-ramp through peer-to-peer trading or unregulated platforms. Where proceeds are cashed out through informal exchangers or over-the-counter desks without identity verification, the off-chain link to a named individual is absent. The tracing may terminate at an address the analyst is confident belongs to the wrongdoer, without the VASP-deposit nexus needed to compel disclosure. In those situations, the residual options are a proprietary injunction against "persons unknown" – preserving the position while further intelligence is gathered – and parallel investigative work to find a secondary link.

Tracing exercises rarely follow a single clean path. We have traced funds that appeared to go cold at a mixer and subsequently found a residual off-ramp the mixer operator had used for their own liquidity. Patience and iterative re-analysis matter.

How courts treat clustering and attribution evidence

Courts in common-law jurisdictions have, in appropriate cases, accepted blockchain-analytics evidence as the basis for freezing orders over digital assets and disclosure orders against VASPs. The analytical output is treated as expert evidence: the methodology must be explained, the assumptions must be stated, and the confidence levels must be qualified. Judges are not blockchain specialists. The tracing exhibit must translate the technical analysis into a form a court can evaluate against a legal standard.

At the interim stage, the threshold is a good arguable case, not proof. A well-constructed cluster with a demonstrated VASP link, combined with a clear account of the methodology, has consistently been sufficient for that threshold in forums with developed crypto-recovery practice. The freezing order over digital assets prevents the defendant from dealing with specific wallet addresses or exchange accounts identified in the tracing exhibit. The order does not, by itself, transfer the funds – it preserves them while the underlying proceedings advance.

The contested terrain is attribution confidence. A cluster that reaches a 90% confidence level in the analytics tool has, within that tool's model, a meaningful probability of being wrong. Courts are beginning to ask how those confidence levels are derived and how the analyst has addressed the alternative hypothesis. The practitioner who understands the model's assumptions – and can explain why the alternative hypothesis is implausible on the specific facts – is better placed than one who simply prints the analytics output.

A parallel question is expert independence. In some forums, the court expects the expert witness who prepared the tracing exhibit to be independent of the party instructing them. Where the analyst is embedded in the recovery team, a separate independent expert review may be necessary before the evidence can be deployed. This is a procedural consideration that affects the timeline and the cost estimate, and it should be flagged at the outset.

Civil-law jurisdictions present additional complexity. The analytical output is the same, but the process for presenting it differs. In some systems, the expert is court-appointed rather than party-instructed. In others, the evidentiary threshold for interim measures is higher, or the mechanism for compelling VASP disclosure differs from the common-law disclosure order. Cross-border crypto recovery frequently involves using a common-law forum to obtain disclosure or a freezing order and then presenting the resulting evidence in the jurisdiction where the VASP is registered or the defendant holds assets.

Is there a viable recovery path once the trail is established?

A completed attribution – cluster identified, VASP deposit located, subject named – does not automatically produce a recovery. It produces a target. The question then becomes: which forum can act, how quickly, and at what cost?

Where the VASP is regulated in a jurisdiction with a functioning disclosure-and-freeze regime, the path is relatively direct. A disclosure order against the VASP yields account-holder details. A freezing order over the account – or a direct application to the platform to hold the funds on notice – follows. Stablecoin issuers operating under regulated frameworks can, on appropriate legal process, freeze specific token balances without waiting for a court order to be served on an exchange. That mechanism can preserve value within hours of an application, provided the issuer is cooperative and the legal trigger is met.

Where the VASP is in a less cooperative jurisdiction, the options narrow but do not close. A freezing order from a well-regarded common-law forum can sometimes be recognised and enforced in the VASP's home jurisdiction – particularly where that jurisdiction has adopted the New York Convention or has a bilateral enforcement regime with the forum. The New York Convention, it should be noted, applies to arbitral awards rather than court judgments, but enforcement of judgments across borders is possible under separate treaty regimes or at common law in many jurisdictions. The route is longer; the outcome more uncertain.

For matters involving stablecoins issued on transparent public networks, the issuer's ability to freeze a specific balance is a faster route than a court-served freezing order in some cases. But it requires the issuer's cooperation, and it is only available where the stablecoin's technical architecture supports a freeze function. That is not universal.

Consider a matter we encountered in a Gulf state during the spring of 2025. Funds in the low seven figures had moved on-chain within hours of a fraud. Our tracing work identified a cluster of wallets that funnelled proceeds through a mixer and then onto two VASP platforms – one registered in a common-law jurisdiction, one registered elsewhere. The common-law disclosure order yielded account-holder details within weeks. The recognition application in the second jurisdiction added several additional weeks. The combined recovery, through a negotiated settlement after the accounts were frozen, was partial. That is the honest picture: the trace works; enforcement timelines and jurisdictional friction still determine the final outcome.

The steps above represent the typical analytical and legal sequence. Every matter turns on its own facts – how quickly the tracing is commenced, where the funds rested, and which forums can be engaged. If you are assessing whether a specific matter is worth pursuing, a confidential case review is the fastest way to a realistic answer. To request one, contact info@axiomtracel.com.

The myth that crypto is untraceable – and the limit of transparency alone

The most persistent misconception we encounter is the assumption that once funds leave a victim's wallet, they are gone for good. That is wrong, and it is wrong in a specific way. Public blockchains are radically transparent: every transaction is recorded, indexed, and permanently accessible. The question is not whether the movement can be seen – it can – but whether it can be attributed to a real-world actor who can be compelled to return value or whose assets can be frozen.

The counterpart myth is equally dangerous: that transparency alone is sufficient for recovery. It is not. A traced and attributed target still requires legal process to freeze, and legal process still requires enforcement. The bridge between the on-chain evidence and an actual recovery runs through courts, VASPs, and sometimes multiple jurisdictions. Each of those requires time and resources. Victims who understand this are better placed to make a cost-benefit decision about whether to pursue recovery.

What transparency does provide is a persistent evidentiary trail. Unlike funds moved through the correspondent-banking system – where records may be purged, institutions may be uncooperative, and trail documentation depends on the goodwill of intermediaries – the on-chain record remains. The position today is better than it was two years ago: courts have become more familiar with blockchain evidence, VASPs in regulated jurisdictions have clearer obligations to respond to legal process, and the analytics tools have improved in coverage and in the quality of their confidence-scoring models.

This does not mean every theft is recoverable. It means the window for recovery is longer than intuition suggests, and the limiting factor is usually the speed of the legal response, not the permanence of the blockchain data.

Cross-border coordination – working across multiple VASPs and forums simultaneously

Most substantial crypto frauds do not rest in one jurisdiction. The attacker moves funds through multiple addresses, sometimes across multiple chains, and typically lands at more than one VASP. That means the recovery effort is simultaneously a legal operation and a coordination problem.

In our experience, the order in which forums are engaged matters as much as the quality of the tracing. The first disclosure order typically yields the most useful identity data – either the subject's own details or a lead to a second account. Acting on that data quickly, before the subject can close accounts or withdraw remaining balances, requires that the applications in multiple forums be prepared in parallel, not sequentially. We regularly advise on the sequencing of concurrent applications across several jurisdictions.

Currency in the recovery context is not only about the on-chain position. It is about VASP account balances and stablecoin positions that may change within the window between the tracing completion and the service of the freezing order. A target who learns of proceedings through a gagging order's inadvertent breach – or through an exchange's notification obligation that was not anticipated – can drain an account in minutes. The application for a no-notification or gagging order, preventing the VASP from telling the account holder about the disclosure request, is a standard precaution in competent crypto-recovery practice.

The cross-border dimension also affects the enforcement of any judgment or award that ultimately follows. Recognition and enforcement in a second jurisdiction requires a judgment or award that the enforcing court will accept. Some common-law courts will recognise a freezing order from another common-law forum as part of a mutual cooperation regime. Others require fresh proceedings. Allied counsel in each relevant jurisdiction must be briefed at the outset, not after the first order is obtained, so that enforcement is not delayed by a procedural mismatch.

Before the FAQ, a note on assessing viability. The most common reason recovery efforts fail is not the quality of the tracing – it is that the decision to act was made too slowly, or the cost-benefit analysis was not carried out until the trail had moved on. Our asset tracing service is designed to give that assessment quickly, so that resource is deployed where it can produce a result. For broader context on crypto recovery methodology, see our crypto asset recovery insight section.

Distinguishing a real recovery engagement from a second fraud

Crypto theft victims are a target demographic for recovery scams. The second fraud is structurally similar to the first: a credible-sounding approach, a claim of proprietary tracing technology or insider exchange access, an upfront fee, and then either nothing or a repeat of the cycle. We address this directly because the market confusion is real and it harms victims who might otherwise pursue a legitimate recovery.

A genuine recovery engagement does not promise a specific outcome or a percentage of recovered funds as its commercial model. It does not ask for access credentials to the victim's own wallets. It does not rely on unverifiable claims of special access to exchange ledgers or law enforcement intelligence. The value a legitimate practitioner adds is investigative skill, legal process, and coordination with admitted counsel who can obtain and enforce orders. That is slower and more expensive than a flat-fee promise; it is also the only thing that works.

If you are assessing a proposed recovery engagement – whether from Axiom Trace or anyone else – the question to ask is: what legal process will be used, in which forum, and who is the admitted local counsel? If those questions cannot be answered with specifics, the engagement is not a recovery service. For context on what a genuine engagement looks like, see our guide on fake wallet recovery services and what is realistic.

We have traced funds in matters where the victim had already paid a recovery scam operator and received nothing. In those cases, the original loss was compounded. That is avoidable, but only if the question of legitimacy is asked before the fee is paid.

Related analysis

• Crypto asset recovery – insight and analysis: the full collection of on-chain tracing, VASP enforcement, and digital asset freezing analysis from Axiom Trace.
• Asset tracing service: how Axiom Trace approaches follow-the-money investigation across blockchain and traditional financial channels.
• Recovering crypto lost to a fake wallet recovery service: what is realistic, and how to avoid a second fraud.

Frequently asked questions

Q: Can stolen crypto really be traced and frozen?

A: Yes, in many cases – though "traced" and "frozen" are different steps. Public blockchains are transparent: on-chain movements leave a permanent record that can be followed to a cash-out point at a virtual-asset service provider. Freezing requires legal process – typically a disclosure order and then a freezing order over identified accounts. Both steps are achievable in forums with developed crypto-recovery practice, but neither is automatic, and outcomes depend on the specific facts of each matter.

Q: How quickly do I need to act after a crypto theft?

A: Speed is material. The on-chain trail does not disappear – that record is permanent – but exchange account balances can be drained within hours if the subject learns that proceedings are underway. The most time-sensitive window is between identifying a virtual-asset service provider deposit and obtaining a disclosure and freezing application before the account is emptied. In our experience, matters where action is taken within days of the theft preserve substantially more optionality than those where weeks pass before the first inquiry.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate recovery engagement relies on legal process: disclosure orders, freezing orders, and coordination with admitted local counsel in the relevant jurisdiction. It does not promise a specific recovery percentage, does not require access to the victim's own wallets or seed phrases, and does not charge an upfront flat fee in exchange for a guaranteed outcome. If a proposed engagement cannot explain what legal process will be used and in which forum, it is not a recovery service. Recovery scams are a known and serious secondary risk for crypto theft victims; the question of legitimacy should be asked before any fee changes hands.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In practice, that means we have managed on-chain tracing exercises that led to successful freezing applications in multiple forums simultaneously, and we have advised victims in the first hours after a loss on whether the trail is still warm enough to pursue. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.