Address clustering is a blockchain analysis method that groups cryptocurrency addresses when transaction patterns suggest they may be controlled by the same person or organization. Analysts may examine shared inputs, repeated transfer behavior, timing, and how funds flow between addresses. A cluster is an inference, not proof of common ownership.
In cyber security investigations, clustering can help trace stolen funds, identify related wallets, and give exchanges or other service providers indicators to screen or investigate. Attackers may split, combine, or move assets across services and blockchains, complicating the analysis. Defenders should treat clusters as leads and corroborate them with other evidence, since a transaction link does not establish who controlled a wallet or why a transfer occurred.