Ethereum Address Attribution: The Complete Investigator Playbook

Ethereum transactions are public. Every swap, every contract call, every token approval is permanently recorded and readable by anyone. That is the design. What that transparency does not give you is the real-world entity behind the wallet. A string like 0x7f3a is not an entity.

Closing that gap is the work of blockchain investigation. It is not one technique. It is a sequence of methods, each with a ceiling, applied in order. Investigators who close cases quickly know exactly where each layer ends and what to reach for next.

This is that playbook.

The short version

• Start with free on-chain data and ENS to build a behavioural profile.
• Cluster addresses by behaviour, then trace to a KYC exchange where possible.
• Mixers break the on-chain trail. Association is not attribution.
• When the trail goes cold, off-chain device-based attribution resolves the actor across fresh wallets, rotation, and VPNs.

Where do you start when you have an Ethereum address?

The first move is always free data. Pull the full transaction history from Etherscan or a comparable explorer. What you are building immediately is a behavioural profile: wallet age, transaction frequency, protocols used, the size distribution of transactions, and the network of counterparty addresses.

These signals matter more than most investigators credit in the early stages. A wallet that is six months old, has interacted with three lending protocols and two DEXs, and sends in round numbers looks very different from one that is three days old, has never touched a DeFi protocol, and received a single large transfer from a flagged exchange deposit address.

Check ENS next. A meaningful share of Ethereum users attach human-readable names to their wallets, and the protocol has passed two million registered .eth names. If an address resolves to an ENS domain, that name very often traces to a social handle, a GitHub account, or a forum profile, and from there to a real entity. It is one of the highest-yield early steps in any Ethereum investigation, and it gets skipped more often than it should.

How does wallet clustering work on Ethereum?

Clustering is the process of grouping addresses that are probably controlled by the same entity. On Bitcoin, the common-input-ownership heuristic does most of the work. Ethereum’s account model requires different approaches, but the principle is the same: find the behavioural signatures that tie addresses to each other.

On Ethereum, the most reliable clustering signals include wallets that receive dust from the same source in consistent patterns, addresses that fund each other in ways that suggest coordinated control, and wallets that interact with the same contract sequence in the same order within similar time windows. Peer-reviewed research has catalogued and tested these heuristics, including deposit-address reuse and token-approval patterns.

Used together, these traits narrow the attribution search. Against careful operators, they still reach a ceiling. The investigators who close those cases treat that ceiling as the point at which the next layer takes over, not the end of the case.

How do centralised exchange records factor in?

The single most reliable attribution step in many Ethereum investigations is tracing funds to a centralised exchange that holds KYC records. Exchanges are legal entities, subject to KYC and travel-rule obligations in regulated markets, and they respond to lawful requests for account-level information. If you can trace target funds to a deposit address at a known exchange, that exchange becomes a source of verified entity data.

This is why exchange attribution is the most valuable form of entity tagging in blockchain analytics. Both Chainalysis Reactor and TRM Labs Forensics maintain extensive databases of exchange deposit addresses precisely because hitting one collapses the pseudonymity.

Sophisticated actors know this. The specific purpose of mixers, chain-hopping, and OTC desk routing is to break the on-chain path before it reaches a KYC checkpoint. When that evasion is successful, exchange attribution returns nothing. A different layer is required.

What does mixer use tell you, and what does it not?

Interaction with Tornado Cash or a similar mixing protocol creates a deliberate break between deposit and withdrawal wallets. For years the standard response was to treat both sides as tainted by association. The legal ground under that assumption shifted in 2025. In March 2025 the US Treasury removed Tornado Cash from the OFAC sanctions list, after the Fifth Circuit held that the protocol’s immutable smart contracts are not “property” that can be sanctioned under existing statute. That did not make mixers neutral. Criminal cases against individual operators continued past the delisting, and exchange and VASP risk frameworks still treat mixer exposure as a high-risk signal. The practical point for an investigator is to keep the legal posture current and to separate two things that are easy to conflate.

Association is not attribution. Knowing a wallet touched a mixer tells you something about intent to obscure. It does not tell you which real-world entity controls the wallet. For a case built to the standard a prosecutor will accept, that distinction is the whole game.

The structural problem is what comes after the withdrawal. The investigator is looking at a fresh wallet with no on-chain history. No entity attribution exists on-chain. The trail, on-chain, stops.

This is the precise point where off-chain attribution becomes the next move.

What is off-chain attribution and how does it apply to Ethereum?

‍

A separate category of attribution does not depend on on-chain links between wallets. What matters for an Ethereum investigation is that it persists even as actors change wallets, and it remains effective even when users attempt to mask their activity through commercial VPN infrastructure.

A user who creates ten fresh withdrawal wallets after a mixer interaction and never moves funds between them has, on-chain, ten unconnected entities. Off-chain, they may be one. Where the on-chain trail is silent, the off-chain attribution layer can establish whether the same actor is behind all ten.

Addressable Investigations built its Spectra platform as this layer. Spectra sits above the on-chain forensics stack and surfaces off-chain attribution that persists even as actors change wallets. It delivers region-level attribution that remains effective even when users attempt to mask their activity through commercial VPN infrastructure, and it produces leads and digital evidence: time-stamped records structured for use in warrants and court proceedings.

This is not theoretical. Token recovery teams are using the off-chain layer to convert dead-end mixer cases into frozen funds:

“Across several investigations in the past three months, we hit a dead end at Tornado Cash and the on-chain trail simply stopped. Spectra identified connections between wallets on both sides of the mixer that no other tool could surface. That attribution gave us the evidence we needed to freeze the stolen funds.”

Head of Crypto Forensics, Token Recovery Firm

On-chain forensics handles fund tracing. Off-chain attribution handles entity resolution. The two are complementary. The Ethereum cases that close are the ones running both.

What off-chain sources complete the picture?

OSINT is the final convergence layer. Social handles that share the same ENS name. GitHub repositories tied to the same public key. Forum posts where the writing style, vocabulary, or  time-zone-corrected posting pattern matches the on-chain activity window. Breach records linking an email address to an exchange account to a wallet.

None of these alone would satisfy a court. Together with on-chain clustering, exchange attribution, and off-chain attribution, each independent OSINT signal adds another line of evidence pointing at the same entity. Convergence is the standard. A single definitive link rarely exists. Several independent signals pointing at the same entity usually does the job.

What separates investigators who close Ethereum cases from those who do not?

Attributing an Ethereum address is a discipline, not a feature. The crypto-investigators who close cases fastest are not the ones with the best single tool. They are the ones who understand which layer to use at each stage, and what to reach for when one layer runs dry.

For the broader category context, see Crypto Investigation Software in 2026: What the Category Actually Covers and Where On-Chain Tools Stop. For the on-chain forensics stack specifically, see Blockchain Forensics Tools Used by Law Enforcement: The Stack, and the Layer Above It. (Publish these two cluster pages and link them here when live.)

For entity resolution that goes beyond on-chain forensics, see how Addressable Investigations applies off-chain attribution to criminal investigations and token recovery.