How to Tell If Your Bitcoin Wallet Is Traceable
"Bitcoin isn't anonymous" is common knowledge by now. What gets explained less often is how a wallet actually ends up tied to its owner, and what you can do about it going forward.
The short answer: almost every Bitcoin wallet is traceable to some degree, because every transaction is public. What matters is whether your addresses can be tied to you, and that usually happens in three ways: withdrawing from or depositing to an exchange that knows your identity, reusing addresses, and spending coins from different sources together. All three show up in your wallet's own transaction history, so you can review them without sharing your private key with anyone.
Most privacy guides repeat the same line and stop there. Fine, it's true: Bitcoin is a public, permanent ledger, and pseudonymity only holds until someone connects your addresses to your identity. What they rarely explain is which patterns actually create that connection, and that's what the rest of this guide covers.
The three signals that actually flag a link
- Direct label match. One of your addresses matches an address we've manually verified as belonging to a known exchange — five exchanges confirmed so far, over 300 addresses checked one by one, not scraped blindly from a public list.
- Behavior heuristic. No label needed: patterns like reusing the same address across multiple exchange withdrawals, or moving funds with zero rest period after receiving them, are statistically strong tells on their own.
- Counterparty scale. A counterparty with thousands of transactions doesn't behave like a personal wallet, whoever it is. We flag this at a deliberately lower weight, without claiming to know which service it belongs to.
The part most tools hide: the actual formula
This is where most paid chain-analysis products stop being useful to an individual user — they give you a risk score and keep the methodology proprietary. We do the opposite on purpose. Every flag in a report shows the literal calculation: base weight, detection confidence, and a multiplier, multiplied out to the final number. "Base weight 10 × 70% confidence × 0.6 multiplier = 4.2 points" is an actual line from a real report, not a simplified example.
What "we don't know" actually means here
A design choice we care about more than any single feature: the tool never collapses "we couldn't check this" into "this is clean." If a counterparty's history is too large to query safely, or the analysis hits its 60-second safety budget before finishing, that gets reported as a named gap, in a section separate from confirmed links — and if your own wallet's trace didn't fully complete, the report is flagged as partial before showing any results at all. A partial report with zero links found looks identical to a clean wallet unless you say so explicitly, so we say so explicitly.
What to actually do with a flagged result
A direct exchange link means: stop reusing that address for anything else, full stop. Reuse means: check whether your wallet generates a fresh address per receipt (most modern ones do by default — worth confirming rather than assuming). A toxic consolidation means the transaction that caused it is already permanent, but the fix going forward is coin control: manually choosing which UTXOs you spend together instead of letting your wallet pick automatically.
No promise we can't back up
Address-only checks reveal nothing that isn't already public. An xpub is different: it derives your entire wallet at once, and while it can never move funds, it's still sensitive data worth thinking twice about. Our code doesn't store or log it anywhere in the application (verified by reading the code, not assumed), but we haven't yet been able to verify every intermediate layer of the server the same way. If you'd rather not take that on trust, share individual addresses instead of an xpub with any online service. It's the same discipline we apply to the NodeWitness Cycle Score, where an unverified promise doesn't get published as a verified one.
Your past transactions stay public for good. What you can still control is how many new links you add, one address and one transaction at a time.
More in Privacy and self-custody
Last updated: October 28, 2026