Key Takeaways
- What it is: The technical and ethical boundaries of interpreting pseudonymous, obfuscated, or privacy-preserving blockchain activity.
- How it is built: Privacy systems may use shielded transactions, ring signatures, stealth addresses, coin mixing, confidential amounts, or off-chain coordination to reduce observable links.
- Core expression: Observable activity ≠ complete activity; attribution confidence should decline when protocol design intentionally conceals sender, recipient, amount, or transaction graph.
- Best use: Analysts should state what the ledger reveals, what is inferred, and what cannot be established.
- Main limitation: False attribution can harm users; heuristics may be invalidated by protocol upgrades; privacy behavior is not proof of wrongdoing; off-chain and cross-chain steps can break continuity.
- Practical rule: Before publishing an attribution, separate observed facts from inferred ones, confirm the clustering heuristic still holds after any relevant protocol upgrade, and never treat privacy-seeking behavior alone as evidence of wrongdoing.
Who This Guide Is For
On-chain analysis works because transaction graphs are linkable. Privacy technology exists to break that linkability, and where it is used the analysis does not degrade gracefully; specific inferences become unavailable entirely.
Read this page to know which techniques remove which inferences, and how privacy usage distorts metrics for everyone else rather than only for its users. That second effect is the one most analysts miss.
Educational content. Not individualized financial advice. Nothing here is guidance on evading lawful obligations.
What Does This Metric Measure?
This page covers the boundary of the discipline: the set of questions that become unanswerable when participants use privacy-preserving techniques, and the knock-on effect on aggregate metrics.
The framing that matters is that privacy is not binary. Different technologies remove different specific properties from the transaction record, and knowing which property is gone tells you exactly which metrics stop working. A system that hides amounts breaks value-denominated metrics while leaving activity counts intact. A system that hides linkage breaks clustering while leaving amounts visible.
The four properties analysis depends on
| Property | What it enables | Metrics that need it |
|---|---|---|
| Amount visibility | Summing value | Transfer volume, realized cap, all value metrics |
| Address linkage | Following funds between parties | Flows, entity balances, clustering |
| Coin lineage | Tracing an output to its origin | Coin age, cost basis, SOPR, HODL waves |
| Participant distinctness | Counting who acted | Active addresses, retention, cohorts |
How Is This Metric Constructed?
Collaborative transactions
A CoinJoin combines inputs from many independent parties into one transaction with equal-value outputs, so an observer cannot tell which output belongs to which input. Amounts remain visible and the transaction is public. What is destroyed is linkage, and specifically the common-input heuristic, which now reads all participants as one entity.
Address rotation and stealth addresses
Generating a fresh address per payment is standard wallet behavior rather than a privacy tool as such, and stealth address schemes extend it so that a payer derives a new one-time address for a recipient without interaction. Amounts and linkage between the specific addresses remain visible; what is broken is participant distinctness, since one recipient appears as many.
Shielded pools
Zero-knowledge constructions allow a transaction to be validated as correct without revealing sender, recipient, or amount. Inside such a pool, all four properties are absent simultaneously. The observable facts are the size of the pool and the transactions entering and leaving it, which is why shielded-pool analysis focuses on the boundary rather than the interior.
Confidential amounts
Some designs hide values while leaving the transaction graph visible. Linkage analysis still works, and every value-denominated metric stops working. This asymmetry is worth noting because it shows how selectively these systems remove capability.
Cross-chain movement
Not a privacy technology, but analytically similar in effect. Funds bridged to another chain leave the observable set unless the analyst follows them, and bridge accounting is frequently ambiguous enough that the trail is lost in practice rather than in principle.
Formula and Measurement Logic
The relevant expression is coverage: what fraction of the activity you are measuring is actually observable.
Effective coverage = observable activity ÷ total activity
The denominator is not measurable, which is the whole difficulty. Privacy usage, off-chain custodial settlement, and cross-chain movement all reduce coverage, and none of them announce themselves. A metric computed over a shrinking observable share can trend downward purely because coverage fell.
| Technique | Amounts | Linkage | Lineage | Distinctness |
|---|---|---|---|---|
| Collaborative transaction | Visible | Broken | Broken | Distorted |
| Address rotation | Visible | Visible | Visible | Broken |
| Shielded pool | Hidden | Hidden | Hidden | Hidden |
| Confidential amounts | Hidden | Visible | Visible | Visible |
| Custodial settlement | Hidden | Hidden | Hidden | Hidden |
Reading across a row tells you which metric families survive. Custodial settlement appears in this table deliberately: it removes more from view than any cryptographic technique and is far more prevalent.
How Should This Metric Be Interpreted?
The effect analysts most often miss is that privacy usage does not only make its users invisible. It actively corrupts metrics about everyone else.
A collaborative transaction merges its participants into one cluster under the common-input heuristic. That cluster now contains addresses belonging to people who never used the tool, because they transacted with someone who did. Entity-level metrics for those bystanders are wrong, and nothing in the data flags it.
Coin-age metrics suffer a related distortion. A collaborative transaction spends old outputs and creates new ones, so the coins appear to be freshly created. Coin-age and dormancy metrics register this as old supply moving, which is technically true and analytically misleading, since the beneficial owner did not change and no economic decision was made.
Reading a series where privacy usage is growing
Distinguish a declining metric from declining coverage. If privacy adoption is rising over the period, an apparent decline in observable activity is partly or wholly a coverage effect. The check is whether the volume entering privacy-preserving constructions grew by a comparable amount, which is usually observable at the boundary even when the interior is not.
The uncomfortable general point is that on-chain analysis is at its most confident precisely where privacy adoption is lowest, and privacy adoption is not randomly distributed across participants.
Step-by-Step Workflow
- Establish what share of the activity in scope could be using privacy techniques.
- Identify which of the four properties each relevant technique removes.
- Check whether the metric you are using depends on a removed property.
- Screen for collaborative transactions before trusting any cluster.
- Exclude collaborative-transaction outputs from coin-age metrics or flag them.
- Measure flows at the boundary of shielded constructions rather than attempting the interior.
- Check whether an apparent decline is a coverage decline by testing whether privacy usage grew.
- State coverage limitations alongside the result rather than as a closing caveat.
Worked Hypothetical Scenario
An analyst reports that dormancy spiked and long-held coins are moving, based on a day when a large quantity of multi-year-old outputs were spent.
Inspecting the transactions shows a characteristic structure: many inputs, and outputs in a small number of repeated equal denominations.
| Feature | Observed | Implication |
|---|---|---|
| Input count | Many, from unrelated prior histories | Consistent with a collaborative transaction |
| Output denominations | Repeated equal values | Strongly indicative; ordinary payments are irregular |
| Destination concentration | Outputs dispersed, none reaching exchanges | No evidence of selling |
| Exchange reserves that day | Unchanged | Coins did not reach a venue |
Three consequences follow, and only the first is usually noticed.
First, dormancy spiked because old outputs were spent, which is arithmetically correct and economically meaningless: nobody sold and beneficial ownership did not change.
Second, the coins now appear newly created, so every coin-age metric will treat them as young supply from this point forward. The distortion persists indefinitely rather than lasting one day.
Third, and most damaging, the common-input heuristic has merged every participant into a single cluster. Entity-level metrics for all of them, including participants who were simply paid by someone using the tool, are now wrong, and no subsequent processing separates them.
The defensible report is that a collaborative transaction spent old outputs, that coin-age metrics for this date should be excluded, and that clustering for the addresses involved is unreliable going forward.
What Can Make the Interpretation Wrong?
- Treating privacy as a niche concern. Its largest analytical effect falls on bystanders whose clusters get contaminated, not on its users.
- Coin-age distortion from collaborative transactions. Old outputs are spent and new ones created with no economic event, and the distortion is permanent rather than momentary.
- Confusing declining metrics with declining coverage. Rising privacy adoption reduces observable activity independently of real activity.
- Assuming visible means representative. Privacy adoption is not randomly distributed, so the observable subset is systematically biased.
- Attempting to analyze shielded interiors. The observable facts are at the boundary; interior claims are unsupported.
- Forgetting custodial settlement. It removes more from view than any cryptographic technique and is far more common.
- Treating address rotation as evasion. It is default wallet behavior and standard practice, and reading it as intent is wrong.
- Cross-chain movement read as disappearance. Bridged funds leave the observable set without ceasing to exist.
Cross-Network and Provider Comparison
How much analysis is possible varies by design intent, and on some chains the correct answer is very little by construction.
Chains with transparent ledgers and optional privacy tooling, which describes most major assets, retain most analytical capability with localized contamination around privacy usage. The contamination is concentrated rather than uniform, which means it can be identified and excluded if you screen for it.
Chains built around shielded transactions by default remove the linkage the discipline requires. Analysis there is limited to boundary observations: supply, issuance, and flows into and out of the shielded set. Attempting entity or flow analysis on the interior is not a matter of insufficient tooling.
Account chains face a different limit. Contract-held pooled funds represent many beneficial owners behind one address, which is not privacy technology at all but has an equivalent analytical effect: the beneficial ownership is genuinely not in the data. On a mature DeFi chain this can cover a substantial share of supply.
The general rule is that coverage, not ledger model, determines how much weight an on-chain conclusion can bear, and coverage should be estimated rather than assumed.
Advanced Analytical Methods
Collaborative-transaction screening
Detecting characteristic structures, particularly repeated equal-value outputs with many inputs, and excluding them from clustering and coin-age calculations removes the largest source of contamination. Detection is imperfect and vastly better than nothing.
Boundary accounting for shielded pools
Measuring value entering and leaving a shielded construction gives a supply-side picture without any claim about the interior. This is the appropriate scope and is often sufficient.
Coverage estimation
Estimating what share of activity is observable, using privacy-tool volume, custodial concentration, and bridge outflows, converts an unstated assumption into a stated bound on any conclusion.
Cohort exclusion
Flagging outputs with a collaborative-transaction ancestry and excluding them from age-based cohorts prevents the permanent distortion those transactions introduce into coin-age series.
Sensitivity to coverage assumptions
Recomputing a conclusion under alternative assumptions about the unobservable share shows whether it survives. Conclusions that hold only at high assumed coverage should be published with that condition attached.
Practical Checklist
- I estimated what share of the relevant activity is observable.
- I identified which properties the relevant techniques remove.
- I confirmed my metric does not depend on a removed property.
- I screened for collaborative transactions before trusting clusters.
- I excluded or flagged collaborative-transaction outputs in coin-age metrics.
- I measured shielded constructions at the boundary only.
- I tested whether an apparent decline was a coverage decline.
- I accounted for custodial settlement, not only cryptographic privacy.
- I stated coverage limits alongside the result.
Frequently Asked Questions
Does privacy technology only affect analysis of its own users?
No, and this is the effect most often missed. A collaborative transaction merges its participants into one cluster under the common-input heuristic, and that cluster then contains addresses belonging to people who never used the tool but transacted with someone who did. Entity metrics for those bystanders become wrong with nothing in the data flagging it.
How do collaborative transactions distort coin-age metrics?
They spend old outputs and create new ones, so the coins appear freshly created. Dormancy and coin-age metrics register this as old supply moving, which is arithmetically true and economically meaningless since beneficial ownership did not change. The distortion persists indefinitely rather than lasting one day.
Which metrics survive which privacy techniques?
It depends on which property is removed. Confidential-amount designs hide values while leaving the transaction graph visible, so linkage analysis still works and value metrics stop. Collaborative transactions hide linkage while leaving amounts visible, so the reverse applies. Shielded pools remove all four properties at once.
Can shielded pool activity be analyzed?
Only at the boundary. The observable facts are the size of the pool and the value entering and leaving it, which supports supply-side statements. Claims about who transacted with whom inside the pool are unsupported, and this is the system meeting its design goal rather than a tooling gap.
Is address rotation a privacy technique?
It is default wallet behavior. Hierarchical deterministic wallets derive a new receiving address per payment without the user being aware, and privacy guidance recommends it. Reading address rotation as deliberate evasion is wrong, though it does break participant distinctness and biases retention and active address metrics.
What removes more activity from view than cryptographic privacy?
Custodial settlement. Trades executed inside an exchange internal ledger never touch the chain at all, hiding amounts, linkage, lineage, and participant identity simultaneously. It is far more prevalent than any privacy technology and is routinely left out of discussions about analytical coverage.
How should a declining metric be distinguished from declining coverage?
Test whether privacy usage, custodial concentration, or bridge outflows grew over the same period. If the volume entering privacy-preserving constructions rose by a comparable amount, the apparent decline in observable activity is partly or wholly a coverage effect rather than a real one.
What is a view key, and what does it allow?
On some shielded protocols, a view key permits its holder to see transactions associated with an account without granting the ability to spend. It exists so that a user can disclose activity selectively, for instance to an auditor or a counterparty, while keeping it private from everyone else. For analysis this means shielded activity is not uniformly invisible: it is invisible to the public and visible to whoever has been given a key. Aggregate research cannot rely on that, since disclosure is at the holder's discretion.
Does a layer-two network reduce what on-chain analysis can see?
It changes what is visible rather than concealing it deliberately. Activity occurring on a second layer is settled to the base chain in compressed or aggregated form, so individual transactions may not appear at base-layer resolution and the detail lives in that layer's own data, which requires separate tooling and may have thinner public coverage. A metric measured only on the base chain therefore shows declining activity as usage migrates upward, which is a coverage effect rather than a decline in use.
References
These sources support data structures and methods, not the hypothetical conclusions. Provider formulas, chain rules, and APIs can change, confirm current documentation before publication.
- Bitcoin Developer Guide: Block Chain: Bitcoin ledger, blocks, proof of work, and transaction history.
- Bitcoin Developer Guide: Transactions: UTXO transaction construction and spending.
- Ethereum.org: Technical Introduction: Accounts, execution, proof of stake, and smart contracts.
- Ethereum.org: Transactions: Ethereum transaction fields and execution.
- Coin Metrics: Network Data Glossary: Cross-network address, account, ledger, and UTXO definitions.
- Coin Metrics: Getting Started With Data: Network, market, index, and reference data.
- Dune: Data Explorer and Raw Tables: Blocks, transactions, logs, traces, and decoded data.
- Dune: Address Labels: Address labeling and entity context.