How wallets get linked

On Ethereum anyone can create a new address in a second, so one person often has several. Analytics firms and researchers tie those addresses together with a handful of heuristics: patterns that are common when one person controls more than one wallet. This page explains the main ones, why they work, and which Nymra rules rest on them.

A heuristic gives a likelihood, never proof. Every link Nymra reports carries a word and a percentage, for example “Likely 82%”. Nymra never says that two wallets have the same owner.

Confidence	Word	How to read it
70% to 100%	Likely	A strong signal, or several independent ones that agree.
45% to 69%	Possible	Worth knowing; other explanations are plausible.
below 45%	Weak	Shown for completeness. It barely moves the score.

1. Exchange deposit addresses

What it is. When you deposit to a centralized exchange, the exchange gives your account its own deposit address. Whatever arrives there is forwarded to the exchange’s main wallets.

Why it works. A deposit address belongs to one customer account, not to one wallet. Two wallets that pay into the same deposit address are paying into one account. In his study of Ethereum’s first four years, Victor clustered 17.9% of all active wallets this way and with two other heuristics, and found the deposit address heuristic the most effective of the three. Tutela uses the same heuristic and gives each link a confidence that falls as the amount or the time between deposit and forwarding grows.

In Nymra. deposit_address when you pay into one, and shared_deposit when another wallet pays into the same one.

2. Who paid for the first transaction

What it is. A new wallet needs native coins before it can send anything. Whoever sent the coins that paid for its first transaction is its funder. Coins that arrive where a wallet never sends, such as dust or an unasked gift, leave no trail of the wallet’s own.

Why it works. People fund a new wallet from a wallet they already have. A personal wallet that funds a few new wallets in one sitting leaves a visible group behind it.

In Nymra. shared_funder, same_funder_multichain and funded_by_you. An exchange, a contract or a busy service that funds many wallets is never treated as a link.

3. Transfers between wallets

What it is. Funds that move back and forth between two addresses, and the small circle of addresses a wallet keeps dealing with.

Why it works. People move funds between their own wallets far more often than strangers do, and the wallets they deal with again and again form a pattern. Tutela clusters addresses on their interaction history, and Béres and colleagues compare methods that learn such patterns from the transaction graph.

In Nymra. back_and_forth and top. Exchanges, contracts and known service wallets are left out, because everyone deals with them.

4. Habits

What it is. When a wallet is active during the day, how it sets its fees, and how it rounds its amounts.

Why it works. Habits are hard to change and easy to compare. Béres and colleagues show that the hours a wallet is active and the transaction fees it pays are quasi-identifiers: patterns shared by few users, which they used to link addresses, checked against known ENS names.

In Nymra. timezone, fixed_gas, round_amounts, fixed_timing and wallet_software. Habits are weak on their own, so this detector has one of the lowest caps.

5. One address on many chains

What it is. On EVM chains one key gives the same address everywhere, and a bridge moves funds from one chain to another.

Why it works. The same address is the same identity on every chain. A bridge transfer that arrives at the same address, minutes later and slightly smaller, can be matched on amount and time, the same kind of window the deposit address heuristic uses.

In Nymra. multichain_presence and bridge_match.

6. Names and labels

What it is. A primary ENS name, ENS records and public labels on an address.

Why it works. A name is the shortest path from a wallet to a person. Béres and colleagues use ENS names as the ground truth for who is who, which shows how directly a name identifies a wallet.

In Nymra. ens_reverse, ens_records, owned_names and public_label. A public name caps the score at the top of the exposed band.

Why a link is never proof

Every heuristic has innocent explanations: a friend you pay twice, a service that pays thousands of people, a shared office connection. That is why Nymra leaves services out, gives every link a confidence and the reasons behind it, and never names an owner.

This page explains linkability so you can judge your own exposure. For what you can do about each finding, see the “How to reduce it” part of its page. Nymra does not give advice on getting around any project’s eligibility checks, and does not recommend mixing services.

Research

• Friedhelm Victor. “Address Clustering Heuristics for Ethereum.” Financial Cryptography and Data Security (FC 2020). Preproceedings PDF. Three heuristics: exchange deposit address reuse, multiple participation in airdrops, and token authorizations. Nymra V1 uses the first.
• Ferenc Béres, István András Seres, András A. Benczúr and Mikerah Quintyne-Collins. “Blockchain is Watching You: Profiling and Deanonymizing Ethereum Users.” arXiv:2005.14051, 2020. Time-of-day activity, transaction fees and graph representation learning as ways to profile and link users.
• Mike Wu, Will McTighe, Kaili Wang, István A. Seres, Nick Bax, Manuel Puebla, Mariano Mendez, Federico Carrone, Tomás De Mattey, Herman O. Demaestri, Mariano Nicolini and Pedro Fontana. “Tutela: An Open-Source Tool for Assessing User-Privacy on Ethereum and Tornado Cash.” arXiv:2201.06811, 2022. Clusters Ethereum addresses with the deposit address heuristic and learned node embeddings, each link with a confidence.