A wallet that has never sent or received a single risky transaction can still fail a screen, because analysts group it with every other address its owner controls before they score anything.
Most people picture wallet risk as a one-address lookup: paste the string, get a score. That is not how it works underneath. Exchanges, chain-analysis vendors, and even OFAC's own tooling first solve a harder problem - which addresses belong to the same owner - before a single sanctions list gets checked. That grouping step is called clustering, and it is why a brand-new address can inherit a bad history it never personally built.
What Does It Mean for Two Addresses to Be "Clustered"?
Clustering groups multiple blockchain addresses that behavioral evidence says are controlled by one entity, without ever learning that entity's name. Nobody signs a form that says "these three wallets are mine." Analysts infer it from how the addresses move funds.
The output is a graph, not a list. Chainalysis, TRM Labs, Elliptic, and smaller vendors like AMLbot and KuCoin's own analytics team all publish variations on the same idea: an address is rarely evaluated alone. It is evaluated as part of a cluster, and the cluster's worst-known link sets the floor for every member's risk score.
Clustering merges separate addresses into one entity using behavior, like a shared deposit address, before any risk score gets assigned to them.
How Does the Common-Input Heuristic Group Bitcoin Addresses?
On Bitcoin and other UTXO chains, the workhorse technique is the common-input-ownership heuristic, sometimes called the co-spend rule. When a transaction spends from several input addresses at once, whoever built that transaction had to hold the private keys for all of them. So those inputs get merged into one cluster.
This is not a new idea. The academic paper "Resurrecting Address Clustering in Bitcoin" documents how reliably the heuristic still holds even after a decade of wallets trying to route around it with coin selection tricks. Add change-address detection and wallet-fingerprinting on top, and a service that spreads its holdings across thousands of addresses still collapses back into one entity.
How Do Analysts Cluster Ethereum and Other EVM Wallets?
Ethereum and the other chains Plastron screens - Arbitrum, Base, Optimism, Polygon, BNB Chain, and Avalanche - do not use the UTXO model, so the common-input trick does not apply. The signals are different, but the goal is the same: link addresses without a name attached.
Three behaviors do most of the work. Deposit-address reuse is the biggest one - if two source addresses both fund the same exchange deposit address, they are treated as one depositor. Airdrop-claim patterns are the second: claiming from the same eligibility snapshot, in the same batch, from a fresh wallet funded by a known address, reads as one actor running several accounts. Token-approval sequences are the third - granting the same spender contract identical allowance amounts across "unrelated" wallets is a fingerprint few people think to vary.
Why Did a Never-Used Wallet Trace Back to a $3.6 Billion Case?
Clustering is not a theory. On February 8, 2022, the Department of Justice announced the arrest of Ilya Lichtenstein and Heather Morgan for conspiring to launder cryptocurrency stolen in the 2016 Bitfinex hack - 119,754 bitcoin at the time of the theft. Investigators recovered more than 94,000 of those bitcoin, worth roughly $3.6 billion, by following the funds through years of transfers and dozens of intermediate wallets.
None of those intermediate addresses were "the hacker's wallet" in any obvious sense. Each one was a fresh, unlabeled address the moment it received funds. What tied the chain together was the same clustering logic covered above, run patiently across six years of transaction history. This is the same clustering step that sits underneath how a vendor like Chainalysis tracks a wallet long before any real-world identity gets attached to the graph.
Can You Check Whether Your Own Addresses Are Clustered?
You can approximate it by hand. Open a block explorer like Etherscan, pull every counterparty on an address's transaction history, then repeat that for each counterparty, several hops deep, looking for a mixer contract or a name from a sanctions list. It works. It also takes hours for one address and tells you nothing about the other six chains a wallet might touch.
Screen the address with Plastron instead, and the same exposure check - sanctions, mixer contact, and stolen-funds proximity across Ethereum and six EVM chains - runs in one pass, free, with no login required for the direct-label result.
Plastron's own labeled corpus makes the point about what clustering actually catches: of 3,901 addresses currently on file, 3,354 are tagged as scam-related and only 780 sit on an OFAC sanctions list. A clean OFAC check and a clean cluster check are answering two different questions, and most wallet panics come from confusing them.
FAQ
Does clustering reveal my real name?
No. Clustering only groups addresses that behavior says share an owner. A real name gets attached separately, almost always through a KYC exchange the cluster eventually touches.
Can I break a cluster by moving to a new wallet?
Not on its own. A fresh address is unclustered only until it transacts with anything already in your cluster - a deposit address, an old wallet, a linked exchange account - at which point it merges right back in.
Do privacy coins avoid clustering entirely?
Monero's design blocks the common-input heuristic by default, which is a real difference from Bitcoin and Ethereum. It is also the reason exchanges increasingly delist it rather than try to screen it.
Is clustering the same thing as a sanctions check?
No. A sanctions check matches one address against a published list. Clustering decides which addresses to check together in the first place, and it can flag exposure a plain list lookup would miss entirely.
Does clustering work the same way on Bitcoin and Ethereum?
No. Bitcoin clustering leans on the common-input-ownership heuristic because of the UTXO model. Ethereum and other account-based chains rely on deposit-reuse, airdrop-claim, and token-approval patterns instead.
Disclaimer: This article is for educational and informational purposes only and is not legal, financial, tax, or compliance advice. Crypto carries risk; you act on this information at your own risk. Always do your own research and consult a qualified professional before making decisions. Views are the author's own and do not constitute financial, legal, or investment advice.
About Plastron
Plastron is a free, non-custodial wallet screening tool. It checks Ethereum and six EVM chains for AML and KYT risk — sanctions exposure, mixer contact, and stolen-funds proximity — and returns a risk report in seconds. It reads public on-chain data only: it never takes custody of funds and never asks for private keys.
