Linked wallets
Other addresses that probably belong together with the scanned wallet. Each one comes with a confidence from 0 to 1, a word for it (Likely, Possible or Weak, see How a scan works) and the reasons behind it.
Why it matters
Section titled “Why it matters”Keeping wallets apart is the most common way to stay private onchain: one for trading, one for savings, one with a public name. Once two of them can be linked, the separation is gone, and what is known about one applies to the other.
| Rule | Fires when | Severity | Confidence |
|---|---|---|---|
back_and_forth | A personal wallet both sent to and received from this address, at least 3 transfers in total. Exchanges, contracts and services are left out. | high from confidence 0.6, else medium | 0.35 + 0.08 × min(in, out) + 0.02 × (in + out), at most 0.85 |
funded_by_you | A wallet this address paid has a short history (under 50 transactions, so all of it is read), and its very first incoming funds came from this address. Up to 5 recipients are checked. | high | 0.6; 0.3 (Weak) for a wallet that never sent a transaction itself, such as a gift, a payment or a cold wallet |
shared_deposit | Another wallet pays into the same exchange deposit address as this one. Gas top-ups from the exchange, contracts, token contracts, services, look-alikes and fake tokens are left out. Each deposit address keeps its own confidence. | high; medium when the deposit address has more than 6 senders | listed deposit address 0.8, detected 0.7; with more than 6 senders 0.35 and 0.3 |
A personal wallet here is one that signed a transaction to this address, or that this address sent plain coins to (a transfer without contract data).
A service is never a link. A wallet that sends to or funds thousands of people says nothing about who you are. These never count as a shared funder, a back and forth partner, a sender into the same deposit address or a recurring counterparty:
- exchanges: the explorer's tags and the bundled exchange list;
- contracts: bridges, routers, aggregators, airdrop and faucet contracts, tokens, marketplaces and multisigs, as the explorer reports per address;
- 9,532 known service wallets from the open datasetdawsbot/eth-labels (MIT): bots, bundlers, deployers, bridge relayers, operators, market makers, payment processors and payout wallets;
- anything the explorer tags publicly, such as a relayer's name tag;
- busy wallets: a wallet that sent 2,000 or more transactions on the chain where you dealt with it (its own count, read from that chain's RPC) is a service or a bot, even when no list names it. A funder that sent 200 or more transactions in the 6 days around the funding, or funded more than 40 other wallets in that window, is busy too;
- wallets that never send: a back and forth partner, a sender into the same deposit address or another wallet your funder paid must have signed at least one transaction on that chain. One that never did can only appear through a forged token transfer, or it only received (a gift, an address from a tutorial). A fresh wallet you funded that never sent anything is a weak link at most;
- look-alikes: addresses made to look like yours or like a wallet you deal with. They are listed as warnings instead.
Only real transfers count. A token contract can write any transfer it likes into any history, so "you sent 500 USDT to X" may never have happened. A token transfer you did not sign counts only when the token is real: priced on the explorer, held by 10,000 or more addresses, or one of the major tokens the engine lists by contract address. An incoming token also counts when you sent that same token yourself. A symbol proves nothing: anyone can deploy a token called USDT.
Example for back_and_forth: two transfers each way gives 0.35 + 0.16 + 0.08 = 0.59, so the
finding is medium. Three out and two in gives 0.61, which makes it high.
Wallets that share this wallet’s funder (the wallet whose coins paid for its first transaction) are found by funding source reuse and join the list of linked wallets at 0.75 times that finding’s confidence.
An address made to look like one of yours is never a linked wallet. It is listed as a warning instead.
How confidences combine
Section titled “How confidences combine”One wallet can be linked for more than one reason. When a second, different reason points at the
same wallet, the confidences combine as 1 - (1 - a) × (1 - b), at most 0.95. Two reasons at 0.6
give 0.84. The same reason found twice is not counted twice: the higher value is kept.
The confidence never reaches 1. A link built from public data always has an innocent explanation.
Limits
Section titled “Limits”- Repeated payments between friends, colleagues or a business and its customer look the same as transfers between one person’s wallets.
- The scan reads the newest transactions of each chain and only a few other wallets per scan, so it can miss links. A wallet with no linked wallets is not proven to stand alone.
- Deposit addresses are recognised from the bundled label list, or detected when they forward at least 60% of what they send to exchange wallets. An unknown exchange is not recognised.
How to reduce it
Section titled “How to reduce it”- Do not send funds directly between wallets you want to keep apart, in either direction.
- Do not fund a new wallet from one you want to keep it apart from.
- Use a separate exchange account for each wallet you keep apart. Two wallets that pay into one deposit address are tied to one account.
- An existing link cannot be undone. To get a separate wallet back, start a new one and fund it from a source that has nothing to do with your other wallets.