Output Linking

What Is Output Linking?

Output linking is a blockchain surveillance technique used to connect multiple transaction outputs to a single entity. When you send Bitcoin, your transaction typically produces two outputs: one paying the recipient and another returning leftover funds (change) to yourself. Output linking exploits the fact that the change output is structurally and statistically distinguishable from the payment output in most transactions.

Chain analysis firms combine output linking with the common input heuristic to build a comprehensive picture of an entity's transaction history. While the common input heuristic groups addresses that appear as inputs in the same transaction, output linking identifies which output is change and traces it forward, linking subsequent transactions back to the same wallet.

The technique is heuristic rather than cryptographic: it relies on statistical patterns in wallet behavior, not on breaking any encryption. This means it is probabilistic and can be defeated by privacy-aware wallet design.

How It Works

Output linking begins with a single transaction and attempts to determine which output is the payment and which is the change. Once the change output is identified, the analyst knows that address belongs to the sender. They can then follow subsequent transactions from that address, applying the same heuristics recursively to trace the sender's activity across the blockchain.

The process follows a general pattern:

1. Observe a transaction with two or more outputs
2. Apply heuristics to classify each output as payment or change
3. Attribute the change output to the sender's wallet
4. Follow the change output into future transactions
5. Repeat the process to build a chain of linked outputs across many transactions

Change Address Detection Heuristics

Several heuristics are used to identify change outputs. Analysts typically combine multiple signals to increase confidence in their classification.

The round-number heuristic assumes the payment amount is a round number (e.g., 0.01 BTC or 50,000 sats) while the change amount carries more decimal precision (e.g., 0.00847291 BTC). Most users send round amounts, so the irregular output is likely change. This heuristic is effective for simple payments but fails when both parties use precise amounts or when wallets deliberately round change values.

The address reuse heuristic flags outputs sent to addresses that have never appeared on-chain before. Modern HD wallets generate a fresh change address for every transaction, so the novel address is likely change while the previously seen address belongs to the recipient who has shared it before.

The script type heuristic examines the address format of each output. If a transaction's inputs use P2WPKH (native SegWit) addresses and one output matches that type while the other uses a different format, the matching output is likely change. Wallets tend to generate change addresses using the same script type as their inputs.

The output size heuristic compares output values to input values. Change is often the smaller output when the payment is larger, or the output whose value is less than any single input.

Combining Heuristics

No single heuristic is reliable on its own. Research has shown that combining multiple conditions significantly improves accuracy. A 2022 study published in IET Blockchain combined six heuristic conditions into an improved change detection algorithm that identified over 12% more one-time change addresses than previous methods while maintaining low false-positive rates.

The analysis pipeline used by chain analysis firms typically scores each output against multiple heuristics and assigns a confidence level:

// Simplified output linking logic
function classifyOutputs(tx) {
  const scores = tx.outputs.map(output => ({
    output,
    changeScore: 0
  }));

  // Round-number heuristic
  const roundOutput = scores.find(s =>
    isRoundNumber(s.output.value)
  );
  if (roundOutput) {
    scores.filter(s => s !== roundOutput)
      .forEach(s => s.changeScore += 1);
  }

  // Script-type heuristic
  const inputType = tx.inputs[0].scriptType;
  scores.forEach(s => {
    if (s.output.scriptType === inputType)
      s.changeScore += 1;
  });

  // Novel-address heuristic
  scores.forEach(s => {
    if (!hasAppearedBefore(s.output.address))
      s.changeScore += 1;
  });

  return scores.sort(
    (a, b) => b.changeScore - a.changeScore
  );
}

Use Cases

Law Enforcement Investigations

Law enforcement agencies use output linking to trace the flow of funds in criminal investigations. By identifying change outputs, investigators can follow a suspect's spending trail across dozens or hundreds of transactions, even when new addresses are used for each transaction. This technique was instrumental in tracing ransomware payments and darknet market transactions.

Compliance and Transaction Monitoring

Exchanges and financial institutions use output linking as part of KYC/AML compliance. When a customer deposits Bitcoin, the exchange can trace the history of those funds by following change outputs backward through the transaction graph. This helps identify whether funds originated from sanctioned addresses or known illicit sources.

Wallet Clustering

Output linking feeds into broader address clustering efforts. Once a change output is attributed to a sender, it can be combined with the common input heuristic to group even more addresses under the same entity. The two techniques reinforce each other: output linking identifies new addresses belonging to an entity, and the common input heuristic confirms the grouping when those addresses later appear as co-inputs.

Countermeasures

Because output linking relies on heuristic patterns rather than cryptographic weaknesses, users can defeat it by breaking those patterns.

CoinJoin

CoinJoin transactions combine inputs from multiple users into a single transaction with equal-valued outputs. When all outputs are the same amount, an analyst cannot determine which output belongs to which input owner. However, CoinJoin implementations that produce unequal change outputs can still leak information: the change amount may be linked back to the corresponding input set.

PayJoin

PayJoin (BIP 78) is a collaborative transaction protocol where both sender and receiver contribute inputs. This breaks the common input heuristic because not all inputs belong to the same entity. It also obscures change detection because the transaction structure no longer follows the standard "payment plus change" pattern. A key advantage of PayJoin over CoinJoin is that PayJoin transactions look identical to normal transactions, making them undetectable at scale.

Avoiding Address Reuse

Using a fresh address for every transaction is the most basic defense against output linking. When combined with an HD wallet that derives new addresses automatically, this prevents simple address-based tracking. However, it does not defeat change detection heuristics on its own: the analyst can still identify which fresh address is the change.

Matching Script Types

Wallets that ensure all outputs use the same script type as the inputs eliminate the script-type heuristic. If both the payment and the change use the same address format, this signal becomes useless to the analyst. As Taproot (P2TR) adoption grows, this heuristic weakens naturally because more wallets default to the same output type.

Coinless Transactions

Some wallets implement coin selection strategies that avoid producing change entirely. By selecting UTXOs whose combined value closely matches the payment plus fees, the wallet eliminates the change output. No change means no change detection.

Privacy Implications

Output linking poses a fundamental privacy challenge for Bitcoin users. Because Bitcoin's UTXO model records all transactions on a public ledger, spending patterns are visible to anyone with the analytical tools to interpret them. The technique enables surveillance firms to construct detailed financial profiles of users without their knowledge or consent.

For a deeper look at how transaction graph analysis undermines privacy and what defenses exist, see the research article on Bitcoin transaction graph privacy defenses. The broader landscape of Bitcoin privacy tools is covered in the Bitcoin privacy landscape overview.

Layer 2 protocols offer structural privacy advantages over on-chain transactions. On the Lightning Network, payments are routed through onion-routed channels that do not leave a public on-chain trail. Similarly, Spark moves transactions off-chain entirely, so there are no public outputs to link in the first place.

Risks and Considerations

False Positives

Output linking is inherently probabilistic. When heuristics misidentify the change output, every subsequent inference in the chain is wrong. A single false positive can cause an entire cluster of addresses to be incorrectly attributed to the wrong entity. Research from Princeton University found that existing heuristics had not been rigorously evaluated against ground-truth data, meaning their real-world accuracy may be lower than assumed.

Evolving Wallet Behavior

As wallets adopt privacy-preserving features (randomized output ordering, matched script types, fee smoothing), the heuristics that underpin output linking become less reliable. An analyst's model trained on historical wallet behavior may produce incorrect results on newer software versions.

Arms Race Dynamics

Output linking exists in a constant arms race between chain analysis firms developing more sophisticated heuristics and wallet developers building features to break them. Users relying on a single countermeasure (such as CoinJoin alone) may find that analysts develop techniques to partially de-anonymize those transactions over time. Effective privacy requires combining multiple techniques.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.