How AML Screening Reads Bitcoin: UTXO, Clusters and Tainted Coins

On Ethereum and TRON an address is an account with a balance. Bitcoin has no accounts: it has transactions, each with inputs and outputs. An output that nobody has spent yet (a UTXO) is the coin. The balance of an address is simply the sum of such outputs tied to it. An output cannot be spent in part: a transaction consumes it whole and returns the remainder as a new output, the change, usually to a fresh address of the same wallet.

This is the key difference for screening. One address is almost never the whole wallet: a modern wallet generates a new address for every incoming payment and every change output, so the history of one person is scattered across dozens or hundreds of addresses. A report on a single address shows a fragment; to see the whole, analytics groups addresses into clusters.

The second trait is that every coin has a lineage. An output was created by a transaction whose inputs were outputs of earlier transactions, and so on back to the moment a miner created the coin. This graph is public and immutable, so history in Bitcoin is not a metaphor: it can be walked backwards step by step, and that walk is exactly what the risk score is computed from.

Blockchain analytics does not know who owns an address, but it can show that several addresses belong to the same owner. Two techniques do most of the work.

• Common inputs. If a transaction spends outputs from several addresses, only someone holding the keys to all of them could have signed it. All input addresses land in one cluster. This is how most wallets reveal themselves at their first sizeable spend.
• Change detection. Among the outputs of a transaction, analytics looks for the one that went back to the sender: a fresh address, an odd amount, the same address type as the inputs. The change address joins the cluster of the sender, and the chain continues.

External knowledge is layered on top: addresses that exchanges, exchangers and services disclosed themselves, addresses from criminal cases and sanctions lists, data from test deposits. That is how a cluster gets a label: Exchange, Mixer, Darknet market, Ransomware, Sanctions. When an AMLKYC report says an address is linked to a high-risk exchange or to the darknet, it is talking about the cluster the address belongs to or the clusters its coins have touched.

The method has limits. Change detection fails when a wallet deliberately breaks the pattern, and common-input analysis is defeated by CoinJoin, covered below. That is why different data providers score the same address differently, and why no single score is a verdict: it is a signal to be read together with the rest.

A coin that leaves a labelled cluster does not become clean by changing address. Analytics follows it through the graph: whose transactions it passed through, in what proportions it mixed with other outputs, where it settled. Risk is not copied one to one along the way; it dilutes and fades. The further down the chain and the smaller the share, the weaker the signal.

• Peel chain. A large sum is spent piece by piece: at every step a small output goes out, and the rest returns as change to a new address. A classic way of cashing out stolen funds through exchangers; on the graph it shows up as a long chain of single spends.
• Mixing. A mixer takes coins from many users, shuffles them and pays out different outputs. The lineage of the coin breaks there, but passing through a mixer is a label in itself. For exchanges it is one of the heaviest signals, and a sanctioned mixer turns any contact into critical risk.
• CoinJoin. Several people assemble one transaction with equal outputs, and the common-input heuristic stops working: the inputs belong to different owners. It is a legitimate privacy tool, but to AML systems it is indistinguishable from an attempt to cover tracks, and CoinJoin outputs often carry elevated risk.
• Consolidation. A wallet that sweeps many small outputs into one merges their histories: a single tainted coin in the set colours the whole combined output.

Hence the rule that is broken most often: there is no such thing as 100% clean bitcoin. Almost any coin that has circulated for a few years has touched a labelled cluster somewhere. The question is not whether a link exists but how close, how large and of what kind it is. That is exactly what the risk score expresses.

The report turns the graph into a few readable values, and each has its place in the reading.

• Risk score from 0 to 100. 0 to 30 is low, 31 to 60 medium, 61 to 100 high. A Bitcoin address with a long history almost never scores zero, and that is normal. High means an exchange may block a transfer from the address.
• Detected signals. Labels of the cluster and its counterparties: theft, ransom, darknet, mixer, gambling, sanctions, high-risk exchange, dusting. Each has a severity. A separate warning appears if the address features in a known incident.
• Sources structure and flow map. The shares of the categories the funds came from and went to, with counterparties and their share of the turnover. For Bitcoin this is the main section: it tells a diluted link to a mixer in the distant past from a fresh direct deposit out of a darknet market.
• Address data. Balance, number of transactions, volumes, first and last activity, share retained on the balance. These are figures for one address, not for the cluster.

How to get the report, what else it contains and how to share it is covered on the AML Risk Score page.

• Several inputs and outputs. A Bitcoin transaction can have many senders and many recipients. For a hash, the search page lists all party addresses and asks which one to check. Pick the one you are dealing with, not the change address.
• Change is not a second recipient. If a transaction has two outputs, one of them almost certainly went back to the sender. Checking it separately is pointless: it is the same cluster.
• Address reuse. An address that has received payments for years is linked to everyone who paid it, and its score reflects their histories. For an exchange deposit address that is normal; for a private wallet it is a reason to ask whose it is.
• An unconfirmed transfer can be replaced. While a transaction waits in the mempool, the sender may issue another one with the same inputs and a higher fee (replace-by-fee), and the first one disappears. Handing over goods against an unconfirmed payment is a classic fraud scenario; wait for the confirmed status.
• The address format does not make a coin cleaner. Legacy (1…), P2SH (3…), Bech32 (bc1q…) and Taproot (bc1p…) are different ways of writing an address, not levels of trust. Risk lives in the history of the outputs, not in the prefix.
• Dusting. A tiny output from a labelled address to yours is a way to tie your cluster to a foreign one once you spend it together with other outputs. The report marks it as a dusting attack; such an output is best never spent.

1. Low score and no signals: standard due diligence is enough. Save the report; it records the state of the address on the date of the check.
2. Medium score: open the sources and the flow map. An old diluted link to a mixer and a fresh direct deposit from the darknet produce similar numbers but mean different things.
3. High score or labels of theft, sanctions or ransom: do not accept the transfer until the counterparty explains the origin of the funds, or better, walk away from the deal. If the coins have already arrived, do not mix them with your other outputs and keep the PDF report for a dispute with the exchange.
4. Repeat the check before every deal with the same counterparty: the history of an address changes with every transaction, and database labels change as investigations progress.