1 Introduction↩︎

Clustering crypto asset addresses associated with the same real-world entity is a well-established deanonymization technique in blockchain forensics. The underlying intuition is straightforward: once a single address is linked to a known entity, this attribution is often implicitly extended to all addresses within the same cluster [1]. Among clustering methods, the multi-input heuristic (MIH), which assumes that all input addresses of a transaction are controlled by the same entity, is the most widely adopted. It is routinely employed either as a standalone clustering rule or as a core component within larger heuristic pipelines [2]–[17]. However, despite this widespread adoption in both research and practice, the heuristic has not been rigorously validated against recent real-world ground truth data that is independent of heuristic assumptions.

In criminal proceedings around the world, clustering results can, for example, form a criminal suspicion against the owner of the address in question to request address information from cryptocurrency exchanges. They can also be used as the sole basis for a preliminary seizure to secure the subsequent judicial forfeiture (U.S.)/confiscation (Ger.) of the seized crypto assets, or as additional evidence in court to prove the defendant’s guilt. Although these results are usually only used as supplementary evidence and not as the sole basis for procedural measures, prosecutors and judges still need to know how reliable the underlying clustering method (such as the MIH) is for the following reasons:

In order to proceed further with the legal process (i.e., to be able to take certain investigative measures, file charges, or determine guilt at trial), prosecutors (and later judges) require legally defined levels of suspicion or (judicial) persuasion. All of these levels have two elements in common: a factual basis and a probability forecast that the suspect (later the defendant) has committed a (this) prosecutable crime. The degree of the criminal suspicion or persuasion required for both elements depends on the stage of the proceeding and the extent to which the following procedural measures affect the individual’s fundamental rights. To generate certain levels of criminal suspicion or persuasion based on clustering results, the reliability of underlying clustering methods (such as the MIH) influences whether the results provide the required factual basis and also shapes the respective probability forecast. Thus, from a legal perspective, the reliability of the MIH is a decisive factor when the clustering results based on this method should (additionally) lead to certain procedural measures or judicial decisions.

However, previous research has identified various metrics for the MIH that correspond to different performance levels. From a legal perspective, it is therefore particularly important to first define which of these metrics are relevant to prosecutors and judges and then (using a ground-truth dataset) to determine the values of the selected metrics.

To date, only three studies provide systematic MIH evaluations [18]–[20]. However, their ground truth sources are either limited in scope and tied to outdated historical contexts [18], [19], or generated through simulation [20], each introducing assumptions that may not reflect contemporary blockchain usage. This limitation stems largely from the scarcity of reliable ground truth data [7]. Furthermore, existing evaluations report heterogeneous metrics, including pairwise scores, per-wallet scores, normalized mutual information (NMI), adjusted NMI (aNMI), and average error rate (AER). This heterogeneity yields a fragmented picture of MIH performance and leaves unclear how reported numbers should be interpreted, particularly in law enforcement settings where the costs of false positives and false negatives can be asymmetric.

The goal of this study is to evaluate the MIH against reliable ground truth data. To this end, we use pseudonymized address-to-entity mappings of European crypto asset service providers whose controlled blockchain addresses are subject to statutory reporting obligations. To our knowledge, this constitutes a globally unique dataset for MIH evaluation. Building on this foundation, we pursue three research objectives. First, we investigate which evaluation methods have been applied to assess the performance of the MIH and how they differ in terms of procedures and output metrics (RO1). Second, we implement an evaluation framework and examine what performance state-of-the-art evaluation methods report for the MIH when applied to the same real-world ground truth data (RO2). Third, we outline the legal relevance for a reliability measurement of the MIH in three selected use cases where MIH-based clustering results are used as an investigative tool in criminal proceedings under German and U.S. criminal procedure law. (RO3). This paper makes three contributions:

1. We unify existing MIH evaluations by reimplementing the preprocessing pipelines and all nine metrics reported across [18]–[20]. This enables direct comparison under consistent definitions. Our evaluation framework, including the implementations of all metrics and the preprocessing, is publicly available and can be applied to other datasets and clustering heuristics.¹

2. By applying our evaluation framework, we provide the first systematic evaluation of the MIH on verified ground truth data. We find that reported performance varies depending on the metric and aggregation level. We find a substantial gap between pairwise and per-wallet metrics: pairwise precision is perfect (\(1.0\)) with moderate recall (\(0.71\)) and F1 (\(0.83\)), per-wallet performance is substantially lower (precision \(0.36\), recall \(0.44\), F1 \(0.27\)), and global clustering agreement is limited (NMI \(0.41\), aNMI \(0.36\); AER \(0.51\)). Entity-level analysis further reveals heterogeneity across entities, and a leave-one-out sensitivity analysis shows that a single large entity can dominate dataset-level scores.

3. We interpret our findings through the lens of USand German legal frameworks and discuss challenges when MIH-based clustering results are used as evidence, as grounds for suspicion, or as the basis for asset seizure.

Overall, our findings show that MIH performance is highly sensitive to both the chosen metric family and the aggregation level (whether performance is measured on dataset-level as average over all entities or on entity-level for each entity separately) at which results are reported. Dataset-level scores can appear reassuring even when MIH fails almost completely for individual services, while other services may still be clustered very reliably. Pairwise metrics in particular can mask severe cluster contamination when evaluated only on labeled subsets. This has two direct implications. For research, it motivates more transparent and standardized reporting practices that include entity-level results (or distributions across entities) rather than dataset-level averages alone. For law enforcement practice, it reinforces that MIH-based clustering should be treated as an investigative lead rather than an absolutley reliable attribution mechanism. When clustering is used as the basis for criminal investigation measures, the service-dependent failure modes and the asymmetric risks of false positives must therefore be taken into account.

2 Background & Related Work↩︎

This section introduces the key terminology used throughout the paper (2.1), situates our work within the broader landscape of blockchain forensics (2.2), and reviews prior evaluations of the MIH, highlighting their data and metric choices and the resulting limitations for comparability (2.3).

2.1 Terminology↩︎

In this paper, we focus on the crypto currency Bitcoin. Bitcoin transactions transfer value between addresses, which are pseudonymous identifiers derived from public keys. Each transaction consumes one or more unspent transaction outputs (UTXOs) as inputs and creates one or more new outputs, each assigned to an address. A wallet is software or hardware that manages a collection of private keys and thereby controls the corresponding addresses. The term entity refers to the real-world actor (whether an individual, organization, or exchange) that ultimately controls one or more wallets and their associated addresses.

In this paper, we use the term service to denote entities that provide public-facing functionality on the blockchain (such as exchanges, payment processors, or gambling platforms); in our ground truth dataset, each service is represented by the set of addresses it controls. In regulatory contexts, many such services are classified as crypto-asset service providers (CASPs), i.e., organizations that professionally offer crypto-asset services such as custody, trading, or exchange.

2.2 Blockchain Forensics↩︎

Research in blockchain forensics covers a broad range of analytical tasks built on top of blockchain data. A first line of work uses network and graph analysis to derive structural patterns and cluster behavioral motifs, for example to characterize typical transaction behavior of specific entity types [3], [5], [21], [22]. A second strand focuses on address-level classification, such as distinguishing change from non-change addresses or inferring the type of entity an address belongs to [12], [23], [24]. Moving from addresses to transactions, several studies classify transactions themselves (e.g., illicit vs.non-illicit or CoinJoin vs.non-CoinJoin) [25]–[29]. On top of this, a growing body of work seeks to classify entities or services (for example exchanges, gambling sites, or darknet markets) based on features aggregated over their on-chain activity [30]–[33].

A key prerequisite for entity-level analysis is address clustering. Clustering is often used as a preprocessing step to derive entity-level features (such as the number of addresses controlled or transactions performed) that downstream classifiers operate on [32]. Address clustering is therefore central not only for deanonymization, but also as an enabling component in many of the tasks above. The MIH is the most widely used clustering heuristic in this context, employed either standalone or in combination with other heuristics [2], [4], [6]–[11], [13]–[15], [17]–[20]. Despite its central role, MIH is rarely evaluated in isolation.

From a legal and governance perspective, prior work highlights the risks of relying on heuristic-based analytics without robust validation and the need for systematic evaluation of crypto-forensics tools [1], [34]. [1] propose a framework for more effective investigations that safeguards evidential value and fundamental rights, but empirical evaluations of concrete tools and heuristics remain scarce. Recent work by [17] evaluates the clustering performance of a specific commercial tool on three illicit services. They state that false positives were extremely rare for the examined tool. However, their evaluation treats a specific commercial tool as a black box without assessing the underlying clustering methods or their combination, which remain proprietary and undisclosed. This limits the ability to draw conclusions about the reliability of MIH itself.

This need for transparent validation is reinforced by [35], who shows that MIH can fail in scenarios that intentionally violate its core assumption. He proposes an out-of-sample stress test by transforming real Tornado Cash transactions on Ethereum into Bitcoin-style transactions with CoinJoin-like multi-party inputs. While this does not constitute Bitcoin ground truth, it illustrates the risk of large false-positive clusters under realistic multi-party spending behavior and motivates systematic validation of MIH on real-world Bitcoin ground truth.

2.3 Prior MIH Evaluations↩︎

To date, only three studies have systematically evaluated the standalone MIH [18]–[20]. Each relies on distinct ground truth sources and evaluation metrics, which complicates comparison and underscores the need for a unified assessment on recent real-world data.

[19] constructs a ground truth dataset of 37585 Bitcoin wallets by exploiting a vulnerability in BitcoinJ’s BIP37 Bloom-filter implementation. Bloom-filter match-sets are used as approximations of wallet address sets, which are then cleaned and split into “legacy” and “modern” wallets depending on the wallet version and associated false-positive behavior. While this yields a comparatively large dataset, it is restricted to a specific simplified payment verification implementation, a short outdated time window, and a protocol vulnerability that has since been patched, limiting its relevance for today’s broader and more diverse wallet ecosystem.

[18] rely on a legacy public transaction dataset introduced by [2] comprising 16086073 transactions and 12056684 distinct addresses, and a manually curated ground truth of 776 labeled addresses grouped into 90 users obtained through interactions with various services. This labeled set is small, biased toward cooperative services, and confined to activity around 2013, so it may not reflect contemporary transaction patterns or the adoption of modern privacy techniques.

[20] use a different approach and evaluate MIH on synthetic data. They first extract empirical distributions from a full snapshot of the Bitcoin blockchain up to block height 687774 (16 June 2021), comprising roughly 649 million transactions, and then parameterize a transaction simulator that generates a small synthetic network of 300 nodes with complete, simulator-provided ground truth (11796 transactions and 29005 addresses). This design enables controlled experiments but operates at limited scale and cannot fully capture the complexity, heterogeneity, and evolving behavior of real-world users.

Beyond the limitations of simulated, narrow, and outdated datasets, these three works also rely on different evaluation metrics. [18] report pairwise scores and information-theoretic measures (NMI, aNMI);  [19] focuses on per-wallet precision and recall; [20] report AERs. As summarized in 1, no single study covers the full set of nine metrics, which complicates interpretation of MIH performance across settings.

In summary, despite its widespread adoption, the MIH has not been rigorously validated against recent real-world ground truth that is independent of heuristic assumptions. Furthermore, heterogeneous metrics across existing evaluations yield a fragmented picture of MIH performance, leaving unclear how results should be interpreted in law enforcement settings. We address these gaps by reimplementing all nine metrics and applying them to ground truth obtained directly from crypto assets service providers under legal mandate, and discuss implications for both research and law enforcement practice.

3 Data and Methods↩︎

This section presents our ground truth dataset (3.1), formalizes the MIH as used in this paper (3.2), and defines the cluster evaluation metrics applied in the remainder of this study (3.3).

3.1 Ground Truth Dataset↩︎

Our evaluation relies on pseudonymized address-to-entity mappings obtained from European crypto asset service providers under statutory reporting obligations. Under the applicable regulatory framework, these service providers are legally required to report blockchain addresses under their control to competent financial authorities. This provides a high degree of trustworthiness and completeness, distinguishing our dataset from prior work that relied on voluntary disclosures, simulation, or protocol vulnerabilities.

Specifically, the dataset contains pseudonymized Bitcoin addresses reported by seven services, with a cutoff date of 23 June 2023 (corresponding to Bitcoin block height 795357). To protect both reporting entities and individual address holders, all service identifiers and addresses have been pseudonymized. Each service is represented solely by the set of addresses it controls without disclosure of actual identities. Let \(R=\{R_1,\ldots,R_7\}\) denote these ground truth clusters. The relative size distribution of these clusters is shown in 1. The support distribution is imbalanced. Service 1 dominates the labeled address set, service 3 has moderate support, services 2 and 5 have low support, and services 4, 6, and 7 are represented by very few addresses. Service 6 constitutes a degenerate singleton case, as it contains only one labeled address. Consequently, its metric values may distort dataset-level averages.

To construct the transaction corpus, we extracted all Bitcoin transactions from a full node up to block height 795357, corresponding to the cutoff date. Let \(\mathcal{T}\) denote this set of transactions. For each transaction \(t \in \mathcal{T}\), let \(I(t)\) denote the set of input addresses consumed by \(t\). The induced address domain is \(\mathcal{A} = \bigcup_{t \in \mathcal{T}} I(t)\), i.e., the set of all addresses that ever appear as transaction inputs.

In total, our corpus comprises \(|\mathcal{T}| = \num{854144149}\) transactions with a mean of \(\frac{1}{|\mathcal{T}|} \sum_{t \in \mathcal{T}} |I(t)| = 2.22\) inputs per transaction, covering \(|\mathcal{A}| = \num{1105300685}\) distinct input addresses. Following prior work [18]–[20], we do not apply filters to remove potential CoinJoin or mixing transactions, and all subsequent computations use this unfiltered corpus. This keeps our setup directly comparable to the existing evaluations discussed in 2.3. Note that CoinJoin or mixing transactions violate the assumption of the MIH, and the picture may change when filters are applied.

3.2 Multi-Input Heuristic↩︎

The MIH rests on the assumption that all input addresses of a standard Bitcoin transaction are controlled by the same entity. Whenever two addresses appear together as inputs in a transaction, they are treated as belonging to the same entity. Repeating this reasoning transitively across chains of shared inputs yields the computed clusters \(H=\{H_1,\dots,H_k\}\). 2 illustrates this process: addresses that appear together as inputs are merged, and subsequent transactions can merge previously separate clusters through transitivity.

In our setting, the MIH is applied to the full transaction corpus \(\mathcal{T}\) described above. For each transaction \(t\in\mathcal{T}\), we consider its set of input addresses \(I(t)\). Two addresses are linked if they appear together in at least one input set \(I(t)\). The MIH then repeatedly merges all addresses that are directly or transitively connected in this way. The result is a partition of the observed input-address domain \(\mathcal{A}\) into disjoint clusters \(H_1,\dots,H_k\), where each cluster is interpreted as the set of addresses that the heuristic attributes to one entity. 3 shows the size distribution of the 466792735 computed clusters. The distribution is skewed, with most clusters containing few addresses and a small number of clusters aggregating large portions of the address space.

3.3 Cluster Evaluation Metrics↩︎

We evaluate the MIH by comparing the reported ground truth entities with the clusters produced from the full transaction corpus. Because labels are available only for the addresses reported by the seven services, the evaluation uses two complementary views. Metrics that require a known ground truth relation for every compared address, such as pairwise precision, recall, F1-score, NMI, and aNMI, are computed on the labeled subset only. Metrics that describe the clusters reached from labeled entities or the recovery of those entities, such as per-wallet precision, recall, F1-score, and AER, relate the labeled entities to the full MIH clusters. This metric selection combines measures used in prior evaluations of address clustering [18]–[20]. We add the per-wallet F1-score (see 1). In addition, we report AER and the per-wallet metrics both at dataset level and at entity level. This is important in our setting because the ground truth entities are highly imbalanced, so dataset-level means alone can hide entity-specific behavior. For the formal definitions below, let \(R=\{R_1,\ldots,R_r\}\) denote the ground truth entities and \(H=\{H_1,\ldots,H_k\}\) the computed clusters produced by the MIH. We write \(S=\bigcup_{i=1}^{r} R_i\) for the set of all labeled addresses and, when needed, restrict the computed clustering to this domain by intersecting each computed cluster with \(S\), yielding \(H^{S}=\{H_j\cap S \mid H_j\in H,\;H_j\cap S\neq\varnothing\}\).

3.3.0.1 Pairwise precision, recall, and F1-score.

Pairwise metrics treat clustering as a binary decision over unordered pairs of addresses: two addresses are either placed in the same cluster or in different clusters. Intuitively, this evaluates whether the MIH makes the correct link / no-link decision for labeled address pairs. Pairwise precision measures how often address pairs that the MIH places in the same cluster truly belong to the same ground truth entity. Pairwise recall measures how many of the true within-entity address pairs are recovered by the MIH. The pairwise F1-score summarizes this trade-off as the harmonic mean of precision and recall. Because ground truth labels are available only for a subset of addresses, we compute the pairwise metrics on the labeled domain \(S=\bigcup_{i=1}^{r} R_i\) and compare the ground truth partition \(R\) with the restricted computed partition \(H^{S}\). This follows [18] and ensures that every counted pair has a well-defined ground truth relation. In other words, unlabeled addresses do not contribute to the pairwise counts. The required true-positive, false-positive, and false-negative counts are obtained from the overlap structure between \(R\) and \(H^{S}\), so pairwise metrics evaluate only labeled address pairs and do not reflect contamination by unlabeled addresses in the full MIH clusters. The resulting precision, recall, and F1-score are then computed in the standard way.

3.3.0.2 Per-wallet precision, recall and F1-score.

Following [19], we additionally evaluate clustering quality with per-wallet metrics. In this terminology, a wallet corresponds to one ground truth entity in our pseudonymized service data. For each labeled seed address \(a\in R_i\), let \(H(a)\) be the computed MIH cluster containing \(a\). Per-wallet precision asks what fraction of the other addresses in \(H(a)\) are also labeled as belonging to \(R_i\), while per-wallet recall asks what fraction of the other labeled addresses in \(R_i\) are recovered in \(H(a)\). Thus, the seed address itself does not make a cluster look correct by construction. Only additional recovered addresses contribute to the score.

In contrast to the pairwise metrics, which are computed only on the labeled domain \(S\) and evaluate link/ no-link decisions for pairs of labeled addresses, the per-wallet metrics evaluate the full computed clusters \(H_j\), including unlabeled addresses. As a result, per-wallet precision can be substantially lower than pairwise precision when MIH clusters absorb many unlabeled addresses. The per-wallet recall also differs conceptually from pairwise recall. Pairwise recall measures how many true same-entity address pairs are recovered globally on the labeled domain, whereas per-wallet recall measures, from the perspective of a single starting address, how much of that entity’s address set is recovered in the cluster it reaches. Per-wallet recall is therefore more sensitive to fragmentation of an entity across multiple clusters and, after macro-averaging, gives each entity equal weight instead of being dominated by large entities with many address pairs.

Intuitively, per-wallet precision measures how pure the computed cluster is when an investigator starts from one address of an entity. It captures the typical extent to which reached clusters are contaminated with unrelated addresses. Per-wallet recall measures how much of an entity’s known address set is recovered when an investigator starts from one address of that entity. Depending on the entity, it can be entirely normal that recall is below one, since not every address belonging to the same entity is necessarily connected through co-spending behavior. In such cases, the heuristic cannot be expected to recover the full entity cluster. The per-wallet F1-score summarizes the trade-off between these two quantities as the harmonic mean of precision and recall at the entity level. For dataset-level reporting, we macro-average the entity-level per-wallet precision, recall, and F1-scores separately. Thus, the dataset-level per-wallet F1-score is the average of the entity-level F1-scores, not the harmonic mean of the dataset-level precision and recall values.

3.3.0.3 Normalized mutual information and adjusted normalized mutual information score.

We evaluate agreement between the ground truth partition and the MIH clustering using information-theoretic scores. Intuitively, NMI measures how much the cluster assignment under one partition reduces uncertainty about the assignment under the other partition, capturing overall alignment rather than performance for a specific entity [36], [37]. The adjusted variant (aNMI) additionally corrects for agreement expected by chance, following the adjustment proposed by [37] (which is also the definition used by [18]). As in the pairwise setting, we restrict the evaluation to the labeled domain. We then compute NMI and aNMI between the ground truth cluster and the restricted computed cluster. Concretely, we report the geometrically normalized NMI and its chance-corrected counterpart aNMI.

3.3.0.4 Average error rate.

The AER as used by [20] summarizes, in an asymmetric and one-to-best fashion, how well each ground truth entity is captured by the computed clustering. Intuitively, AER asks the following question: for a given ground truth entity, which single MIH cluster matches it best, and what fraction of the entity’s addresses does this best-matching cluster recover? The per-entity error is then one minus this recovery fraction, and AER is the average of these per-entity errors over all entities. In contrast to the pairwise and per-wallet metrics, AER does not evaluate all overlaps between the ground truth and the computed clustering. Instead, it considers only the single best-matching cluster for each entity. As a result, AER primarily reflects coverage, i.e., how much of an entity is captured at all, and is comparatively insensitive to contamination by additional foreign addresses in that cluster (false positives). In addition to the dataset-level AER, we also report the corresponding entity-level values to expose heterogeneity across services.

4 Results↩︎

In the following sections, we present the performance of the MIH measured in nine different metrics.

4.1 Performance on Dataset-Level↩︎

2 summarizes the performance of the MIH on our dataset alongside results reported in prior work. Overall, the pairwise scores we obtain are close to the literature: our pairwise F1-score (\(0.83\)) is comparable to [18] (0.86), with a slightly lower pairwise recall (\(0.71\) vs.\(0.77\)) but higher pairwise precision (\(1.00\) vs.\(0.98\)). This indicates that, on the labeled domain \(S\) used for pairwise evaluation, the heuristic very rarely merges addresses from different ground truth entities (high pairwise precision), while still recovering a substantial fraction of true within-entity pairs (moderate pairwise recall). This is intuitive as we do not expect the small services to co-spend with each other. We emphasize that pairwise metrics are computed after restricting both partitions to \(S\); as a consequence, high precision reflects the absence of cross-entity mergers among labeled addresses, while mergers into large clusters via unlabeled addresses are not penalized by this metric.

In contrast, the per-wallet scores are markedly lower than those reported for earlier time periods. Relative to [19], per-wallet precision and recall decline from legacy wallets (\(0.91\)/\(0.80\)) to modern wallets (recall \(0.69\)) and further to our setting (\(0.36\)/\(0.44\)). The dataset-level per-wallet F1-score (\(0.27\)) is the macro-average of the entity-level F1-scores reported in 3, and therefore does not equal the harmonic mean of the dataset-level precision and recall values. Two factors likely contribute. First, our observation window spans more than a decade, during which wallet behavior and clusterability evolved (e.g., increased unspent transaction output (UTXO) management across accounts, consolidation practices, and wider use of privacy-enhancing features). This could lead to a higher number of FP. Second, per-wallet precision excludes the seed itself, penalizing clusters that fail to recover additional same-entity addresses. These design choices make the per-wallet calculation more sensitive to partial discovery than the pairwise calculation.

Information-theoretic measures show a similar pattern. Both NMI (\(0.41\)) and aNMI (\(0.36\)) are lower than the values reported by [18] (\(0.89\) and \(0.65\), respectively). Because NMI/aNMI summarize alignment of the partitions’ co-membership structure (including cluster-size distributions), this drop is consistent with the per-wallet picture: the clusters predicted by the MIH align less tightly with ground truth.

Finally, the AER is smaller in our data (\(0.51\)) than in [20] (\(0.63\)). AER is asymmetric and “one-to-best”: it rewards the fraction of each ground truth entity captured by its best-matching computed cluster, without penalizing extraneous addresses in that computed cluster. Hence AER can improve even when per-wallet precision degrades, provided that the best cluster for each entity covers a nontrivial share of that entity. Interpreting AER together with per-wallet precision/recall gives a more nuanced view: MIH still retrieves sizable cores of many entities (lower AER), but does so with substantial over- or under-coverage when the clusters are not restricted to the labelled set (low per-wallet precision and recall).

Taken together, the dataset-level results paint a mixed picture that depends strongly on how unlabeled addresses enter the evaluation: pairwise scores on the labeled domain suggest that MIH rarely merges labeled entities, while the lower per-wallet scores indicate that, in the full clusters, services are often either only partially recovered or embedded in large clusters that include many additional (unlabeled) addresses.

4.2 Performance on Entity-Level↩︎

While dataset-level metrics provide a compact summary, they conceal substantial heterogeneity across services. 3 reports per-service per-wallet precision, recall, F1-score, and AER. Overall, the MIH performs well for one large service but exhibits pronounced failures for several others, with performance varying by orders of magnitude across entities.

Service 1 dominates the ground truth in terms of support (high) and shows comparatively strong performance: per-wallet precision is high (\(0.950\)) and recall is substantial (\(0.730\)), yielding an F1-score of \(0.825\) and a relatively low AER of \(0.153\). For this service, the MIH recovers a large fraction of addresses while keeping the best-matching cluster comparatively clean. Given its size, service 1 also has a strong influence on any dataset-level averages.

In contrast, services 2 and 3 illustrate near-complete failure modes. Service 2 (support low) has low recall (\(0.004\)) and a correspondingly low F1-score (\(0.008\)), together with a very high AER (\(0.978\)), implying that even the best-matching MIH cluster captures only a negligible fraction of the service. Service 3, despite being the second-largest entity in the ground truth (support moderate), achieves essentially zero recall and F1 and an AER close to one (\(0.999\)), meaning that MIH fails to recover the entity beyond a vanishingly small overlap. Service 5 (support low) shows intermediate behavior: precision is moderate (\(0.256\)), but recall remains low (\(0.042\)), resulting in a low F1-score (\(0.072\)) and a high AER (\(0.796\)). This suggests that the MIH identifies only a small subset of the service’s addresses and that this subset is not large enough to yield meaningful reconstruction at the entity-level.

Finally, the smallest services (support very low) highlight edge cases. For services with very few labeled addresses, recall can be comparatively high even when precision is low, because capturing a single address already accounts for a large share of the entity. Service 4 (support very low) attains recall \(0.333\) but precision \(0.000\), resulting in F1 \(0.000\) and AER \(0.667\). Service 6 (support very low) has recall \(1.000\) but precision \(0.000\), which yields F1 \(0.000\) while AER is \(0.000\). This combination reflects an edge case of the evaluation: because AER and recall primarily measure whether the labeled service addresses are covered, they can be perfect for a very small service, while per-wallet precision and F1 remain zero when the reached cluster does not recover additional same-service addresses beyond the starting point. Service 7 (support very low) achieves perfect scores across all metrics (precision/recall/F1 all \(1.000\), AER \(0.000\)), illustrating that MIH can align perfectly with ground truth in small, favorable cases.

Taken together, the entity-level results show that MIH performance is highly entity-dependent: strong reconstruction for a dominant service co-exists with near-zero recovery for others, including one moderate-sized service (service 3). This further reinforces that entity-level reporting is essential for interpreting clustering quality and that dataset-level metrics alone can mask severe failures on specific investigative targets.

4.3 Sensitivity of Pairwise Metrics to Service Composition↩︎

Pairwise precision, recall, and F1-score are defined globally over all labeled address pairs in the evaluation domain \(S\). In particular, while within-service pairs contribute to true positives and false negatives, false positives arise from cross-service pairs and therefore cannot be attributed to one ground-truth service in a straightforward way. To better understand how much individual services contribute to the dataset-level pairwise scores, we recompute the pairwise precision, recall, and F1-score in a leave-one-out fashion. For each service in turn, we remove all of its ground truth addresses from the labeled domain \(S\) (and thus from the restricted computed partition \(H^{S}\)) and then recompute the pairwise metrics on the remaining services. The case “None” corresponds to the full labeled set \(S\) with all seven services included. 4 reports the resulting scores. Overall precision remains \(1.000\) in all settings, reflecting that the MIH almost never merges labeled addresses from different services. In contrast, recall and F1-score are sensitive to the inclusion or exclusion of specific services.

Excluding service 1 causes pairwise recall to collapse from \(0.707\) to \(0.000\), and the F1-score drops from \(0.828\) to \(0.000\). This shows that essentially all correctly recovered same-entity pairs in the labeled domain originate from service 1. Once this service is removed, MIH recovers virtually no within-service pairs for the remaining entities. Conversely, excluding service 3 slightly increases recall (from \(0.707\) to \(0.729\)) and F1-score (from \(0.828\) to \(0.844\)), indicating that service 3 contributes disproportionately many false negatives in the pairwise evaluation. Removing any of the other services has no measurable effect on the reported pairwise scores.

These findings confirm that dataset-level pairwise metrics can be dominated by a single high-support service, and that the presence of poorly clustered entities can depress global recall via false negatives. Reporting only aggregated pairwise scores can therefore mask extreme heterogeneity across services, reinforcing the need to complement dataset-level reporting with entity-level performance measures.

5 Discussion↩︎

This paper provides the first systematic evaluation of the MIH on a real-world ground truth of seven Bitcoin services, using a unified implementation of nine metrics taken from prior work. At the dataset-level, MIH attains pairwise scores comparable to earlier studies, with very high pairwise precision and moderate recall, but substantially lower information-theoretic agreement (NMI, aNMI) and per-wallet performance than previously reported. At the entity-level, performance is highly heterogeneous: for some services MIH recovers large, relatively clean cores, while for others it almost completely fails to reconstruct the ground truth entity. Together, these results show that the perceived quality of MIH clustering depends strongly on the chosen metric and aggregation level, and that treating MIH output as ground truth is not warranted.

5.1 Implications for Research↩︎

5.1.0.1 Legal perspective on metrics.

From a legal perspective, the underlying notions of true/false positives and true/false negatives play different roles. True positives (correctly clustered addresses of the same service) support investigative leads. False negatives (same-service addresses placed in different clusters or left unclustered) correspond to missed links and may reduce investigative efficiency. Since they leave offenders unidentified, they are particularly critical, as victims of the affected crimes may be left to bear the resulting damages. False positives (addresses incorrectly grouped with a service) are also critical: they risk attributing illicit activity to unrelated users and thus raise concerns about proportionality and due process [1], [34]. True negatives (correctly separated addresses) are numerically dominant in large graphs but largely irrelevant for decision-making.

Against this background, different metrics emphasize different legal risk profiles. Pairwise precision and recall summarize how well the method gets co-membership decisions right for address pairs on the labeled domain only. However, pairwise precision can remain high even when large clusters contain many unrelated addresses, as long as labeled cross-entity pairs are rare. Per-wallet precision and recall, in contrast, operate at the entity-level: per-wallet precision indicates how “contaminated” the cluster around a service is (false positives), whereas per-wallet recall reflects how much of the entity is recovered (false negatives). NMI and aNMI capture global alignment of the partitions, but are difficult to interpret in operational or legal terms. AER, finally, is optimistic with respect to over-coverage because it rewards how much of each entity is covered by its best cluster without penalizing additional addresses in that cluster. We therefore argue for the development and standardization of a law enforcement-oriented clustering metric that more directly reflects the evidentiary and proportionality requirements for justifying investigative measures based on MIH outputs, as existing metrics only partially capture these needs.

5.1.0.2 Dataset-level and entity-level.

Our results highlight that dataset-level averages can be deeply misleading when used in isolation. The dataset-level metrics suggest a mixed but moderately capable heuristic on the labeled domain. However, the per-service breakdown reveals that these averages are dominated by a small subset of large services for which MIH works reasonably well, while it fails almost completely for others. At the same time, very low-support services can produce edge cases in which individual metrics appear extreme because only very few labeled addresses determine the score. The leave-one-out sensitivity analysis further quantifies this and shows that a single large, well-clustered service can mask poor performance elsewhere, and that poorly clustered services can depress global scores.

For research, this implies that future evaluations of clustering heuristics should routinely report entity-level distributions (e.g., per-entity precision/recall/AER, or at least summary statistics across entities), in addition to dataset-level scores. For practice, especially in an investigative context, it suggests that MIH output should not be treated as uniformly reliable across services. Instead, analysts should be made aware that the quality of clusters can vary dramatically between entities, and that high dataset-level scores do not guarantee acceptable performance for any particular target. This reinforces calls from the legal literature to treat heuristic-based analytics as investigative leads rather than definitive evidence, and to document their limitations transparently [1], [34].

5.1.0.3 Generalizability.

Our study focuses on seven services for which high-quality ground truth is available. Even within this relatively homogeneous group of service-type entities, performance varies. This variability is likely to be even greater for other kinds of entities (e.g., individuals, small businesses, or sophisticated entities employing privacy-enhancing techniques). Moreover, for comparability of the results, we deliberately adhere to the preprocessing of earlier work and do not filter out CoinJoin or mixing-like transactions. In contemporary Bitcoin usage, such patterns, as well as increasingly complex UTXO management and consolidation strategies, are common. As a result, the MIH may perform differently (and often worse) for entities that make heavy use of these practices than for the services in our dataset. The key implication for generalizability is that even if MIH appears “good enough” for some well-behaved services, this does not justify assuming similar performance in other settings or time periods. Evaluations should be repeated as usage patterns evolve and extended to a broader range of entities. Practitioners should avoid extrapolating from limited ground truth to the full address space, and instead treat the kind of evaluation we present here as a lower bound on the validation needed.

5.2 Implications for Law Enforcement↩︎

In the field of cryptocurrency, where crime does not stop at national borders, an international perspective on the requirements of different legal systems, whether adversarial or inquisitorial, is essential. Therefore, we compare the US criminal procedure, which represents the Anglo-American adversarial system, with the German criminal procedure, which is an example of the continental European inquisitorial system. Although there are differences in legal reasoning, prosecutors and judges must consider reliability criteria in order to establish a certain degree of suspicion or (judicial) persuasion in both.

All levels of legal suspicion or persuasion described below have two things in common. First, they require a factual basis. Second, based on this factual basis, a probability forecast must be created that either the suspect committed the prosecuted offense or the discovered assets originated from a criminal offense committed (by any suspect). From the perspective of prosecutors and (later) judges, the reliability of the underlying clustering method is directly relevant for establishing the required factual basis and respective probability forecast [1].

This section examines three use cases in which clustering results are relevant in criminal proceedings, highlighting the underlying impact of the clustering method in each context. The following considerations apply to all possible clustering methods. However, for the legal-technical proposals, we will focus specifically on the MIH, because we only measured the performance for this heuristic.

5.2.1 First use case: Request for information from cryptocurrency exchanges↩︎

When prosecutors discover a possible committed offence that was processed via blockchain, they use clustering to narrow suspicion to a particular address. Address clustering makes possibly incriminated addresses visible and therefore provides an initial approach to identify the perpetrator or the participant.

Under German law, the request for address information from centralized cryptocurrency exchanges [1], [38]–[40] is an intervention pursuant to the German Code of Criminal Procedure (GER-CCP), Section 161 and Section 163 and therefore requires legal justification by a “simple” [1] or “primary” suspicion against the holder of the address in question, according to (GER-CCP), Section 152 (2). This degree of suspicion requires specific indications (factual basis) that a suspect (the holder of the address) has possibly committed a prosecutable offence (low probability forecast). Prosecutors usually form this degree of suspicion based on a combination of address clustering results and additional information outside the blockchain [41], such as correspondence with the victim, bank account details, or suspicious behavior on social media. Thus, the reliability of the underlying clustering method (such as the MIH) influences whether clustering results can provide additional clues that the address holder is the possible perpetrator or participant of the offense being prosecuted. Its reliability also influences whether the probability forecast can be made. However, as the threshold for establishing this level of suspicion is low and further information is usually available, the reliability of clustering methods is less important in this procedural state overall.

Under US law, address information can often already be obtained under the low requirements of a (grand jury) subpoena [34], [38], [39], [41], [42], because according to the “third-party doctrine”, no one has a legitimate interest in the confidentiality of information voluntarily disclosed to third parties [United States v. Gratkowski, 2020]. Because requests to cryptocurrency exchanges can be obtained through a subpoena, clustering results (or the address data obtained as a result) become particularly important for establishing a “probable cause” to carry out subsequent searches and seizures at the suspect’s premises [34]. The “probable cause” is a higher degree of suspicion and is prescribed by the US Constitution, 4th Amdt. to obtain a search or seizure warrant. Pursuant to this standard, law enforcement agencies must demonstrate that there is a connection between the requested evidence and the underlying offence, and that, based on the preliminary results of the investigation (factual basis), there are reasonable grounds to believe (probability forecast) that the requested evidence can be found at a specific location [43], [44]. This requires a detailed presentation of the relevant evidence already available (e.g., a cryptocurrency analysis). The justification for this presumption of discoverability must be made on a case-by-case basis [45], [Illinois v. Gates, 1983].”Investigative experience” alone is not sufficient under US law or under German law.

5.2.2 Second use case: Preliminary seizure of crypto assets↩︎

“Forfeiture” (US) or “confiscation” (Ger.) of assets is a procedural measure to deprive the suspect of the acquired goods. In both systems, this process is intended to ensure that those who commit crimes do not derive financial benefit from their actions [41], [46], [47], [Kaley v. United States, 2014]. The subcategories, “civil forfeiture” (US) and “extended confiscation” (Ger.; GER-CC (German Criminal Code), Section 73a), enable the forfeiture/confiscation of additionally identified criminal assets in both systems (thus in different ways)  [48]. Their distinctive feature is that these procedural mechanisms also cover criminal assets that originally were not part of the investigation nor the crime being prosecuted. Unlike in German law, civil (judicial) forfeiture or “non-conviction-based-forfeiture” [48] is only permitted in certain cases in the US [43], [49] (such as money laundering 18 U.S.C. Section 981 or child sexual abuse material 18 U.S.C. Section 2254). Another difference to German law is that civil forfeiture is not part of the criminal process but is pursued in a separate proceeding directed against the potentially incriminating assets themselves (action in rem)  [41], [43], [49]–[51].

The reliability of the clustering method used becomes relevant in the context of the preliminary seizure of cryptocurrency assets, i.e., in the procedural stage that ensures the later judicial forfeiture/ confiscation: Once investigations have been narrowed to a single set of crypto addresses, investigators may observe subsequent transactions that involve additional suspicious (“tagged”) addresses. Under the reasonable assumption that these transferred crypto assets may also be linked to a previously unidentified criminal offence, they may be seized on a preliminary basis to enable a later “civil forfeiture” (US) or “extended confiscation” (Ger.). Under US law, the preliminary (civil) seizure of these assets underlies the low requirement that only the connection between the forfeitable [43] asset (located at the place to be searched) and a criminal offence must be established by the earlier described “probable cause” [43], [44], [51]. While in Germany, prosecutors must raise the also already mentioned “simple suspicion” that these assets are linked to any criminal offence [52], [53] to execute the preliminary seizure in accordance with GER-CCP, Sections 111b et sqq. Because there are often no other indicators available at this stage, the required “probable cause” (US)/“simple suspicion” (Ger.) might be based solely on the clustering results.

The preliminary seizure, therefore, marks another (but much more critical) use case in which the clustering results can even form the single basis for the required level of suspicion, and in which the reliability of the underlying clustering method must be considered by prosecutors to form the necessary degree of suspicion.

5.2.3 Third use case: Evidence in trial↩︎

In an adversarial system, such as in the US, the parties are responsible for presenting all relevant evidence that supports their defence at court [54]. By contrast, in an inquisitorial system, such as in Germany, the judge bears responsibility for introducing, examining and evaluating all the evidence pertinent to the case [54]. Clustering results often play an indirect role in trial because they usually form the basis for earlier investigative measures, such as warrants or seizures, that lead to evidence relevant for trial proceedings.

One of the rare examples where clustering results were used directly in trial, marks United States v. Sterlingov, 2024, in which the US District Court for the District of Columbia accepted an expert testimony of a blockchain analysis company as evidence. In this case, to be admitted as evidence in court, clustering results were reviewed based on the reliability criteria of the “Daubert Standard” which was established through US case law and is also partially included in the Federal Rules of Evidence, No. 702. It embodies an IT-Forensic Standard to measure the admissibility of digital evidence [Daubert v. Merrell Dow Pharmaceuticals, Inc., 1993]. According to this, parties are required to demonstrate in court whether an expert’s reported method that provided the evidence can be tested, whether it has undergone peer review, what is known about any existing error rate and whether the method is widely accepted within a relevant scientific community (Daubert-Hearing) [Daubert v. Merrell Dow Pharmaceuticals, Inc., 1993]. Consequently, the reliability of the clustering method (s. “known error rate”) is directly relevant for determining whether the parties meet the “Daubert Standard” and, whether the presented clustering results will be accepted as evidence in court. Therefore, it must be proven by “preponderance of the evidence” that the clustering results are in fact based on reliable methods. This means that, according to the evidence presented by the parties (factual basis), it must more likely than not (probability forecast) that the clustering results are also the product of a reliable clustering method (s. also Federal Rules of Evidence. No. 702 (c)).

In Germany there is also an example where the evaluation of evidence in court was based primarily on the results of a blockchain analysis. (s. [Local Court of Aschaffenburg, judgment of November 09, 2023, case no. 307 Cs 115 Js 6602/23]). But, unlike US law, German criminal procedure law is based on the principle of judicial free assessment of evidence rather than strict rules for measuring its admissibility (GER-CCP, Section 261) [34], [55]–[58]. However, since judges must also base their evaluation of evidence on objective facts [57], [59], [60], commonly accepted scientific rules of experience, scientific experience based on scientifically proven probability values and other rules of experience become relevant in this context  [56], [58], [61]–[63]. Therefore, the reliability of the underlying clustering heuristic (such as the MIH) is also important for the judicial assessment under German law. If a reliability measure of a clustering heuristic could be determined, it would fall into the category of scientific experience, based on scientifically proven probability values [58]. Depending on its quality, judges would then be bound by this probability value in court  [58]. However, if it is not possible to specify a general reliability measure for the MIH it would only represent other (non-certified) rules of experience [58], which carry limited weight in the judicial assessment of evidence.

However, the reliability of the underlying clustering method also influences the weight of the clustering results as evidence for the final judicial decision in trial. If, after the Daubert-Hearing, (MIH-based) clustering results can be used as digital evidence in court in the US, the underlying clustering heuristic can also influence the final judicial decision as to whether the defendant committed the alleged offence “beyond a reasonable doubt”. This judicial standard of proof is required for a criminal conviction and demands substantial and conclusive evidence (factual basis) for each element of the alleged crime based on the evidence presented by the prosecution [In re Winship, 1970], i.e. that there is no logical explanation for the event other than the defendant’s guilt (near certainty; very high probability forecast) [Patterson v. New York, 1977]. Similarly, under German law, a criminal conviction may only be handed down if the judge is convinced, based on the evidence considered at trial (factual basis), that the defendant committed the alleged offence (very high probability forecast) [61].

5.2.4 Resume and legal-technical proposals↩︎

It was demonstrated that address clustering methods (such as the MIH) influence the factual basis and the probability forecast that underlie different degrees of suspicion and persuasion in criminal procedures. Therefore, from the perspective of prosecutors and judges who assess whether a sufficient factual basis and a sufficient probability forecast can be solely or additionally supported by clustering results, it is important to have an indication of the reliability of the underlying clustering method.

At least for the MIH, we attempt to determine the reliability of the underlying assumptions in practice. It has become apparent that, to date, a wide variety of metrics has been used to measure the performance of the MIH in scientific research. Additionally, we demonstrated that the performance of the MIH for the dataset average differs from its performance for individual entities. From a legal perspective, this is challenging because no general reliability measurement can be derived from these results.

We suggest that the legal and technical discussion should begin by agreeing on performance metrics that can serve as reliability benchmarks for address clustering methods in criminal proceedings. For the MIH, we recommend using “per-wallet precision” and “per-wallet recall” rather than relying on pairwise metrics, since real-world investigations often concern unlabeled addresses. We further suggest reporting both dataset-level averages and entity-level results to assess whether performance is homogeneous across entities or driven by strong variation. Per-wallet precision is particularly relevant because it indicates the extent to which the MIH produces false-positive matches, while per-wallet recall indicates the extent to which the MIH fails to recover true matches.

Since legal probability forecasts for certain degrees of suspicion or persuasion cannot be translated into precise mathematical performance requirements, it is then up to prosecutors or judges to decide on a case-by-case basis whether a particular performance value for the MIH is sufficient or not to establish a certain level of suspicion or persuasion on MIH-based clustering results.

However, as long as there is no consensus on this, the following best practices should be followed when applying address clustering methods (such as the MIH) in a legal context: In addition to address clustering and investigations based on address-level, other methods should be employed to verify the clustering results. This approach has already been demonstrated in United States v. Sterlingov [United States v. Sterlingov, 2024], where different methods were used to verify the reliability of clustering results. But this also includes the use of additional clustering heuristics alongside MIH and additional information about the found addresses—if available. To perform a verification, the methodological details of the clustering heuristics used must first be disclosed. Also, address clustering and investigations at the address-level should be conducted and interpreted in collaboration with qualified technical experts who are aware of the technical features of the blockchain and the clustering heuristics used. This involves the interpretation of clustering results as well as the analysis of the activities associated with the observed addresses.

5.3 Limitations & Future Work↩︎

Our study has several limitations that open avenues for future work. First, the ground truth, while independent of heuristic assumptions, covers only seven services. One of our main results is that even these services differ, and other entities (e.g., in size, business model, or compliance obligations) might as well. Expanding the set of ground truth entities is an important next step. Only then should concrete recommendations for action be derived from these findings for law enforcement activities. Applying our framework to additional ground truth datasets would test whether the metric-dependent and entity-dependent patterns observed here generalize beyond this specific set of services.

Second, we evaluate a single, standalone heuristic (MIH), whereas real-world analytics platforms often combine multiple heuristics, machine learning models, and off-chain information. Our results thus provide a baseline for what MIH alone can achieve, not an end-to-end assessment of commercial tools. Future work should extend our results to evaluate combinations of heuristics and to study how additional information (e.g., service tags or temporal patterns) affects both performance and legal risk. The evaluation framework provided with this work can be used to assess the performance of other heuristics and tools on comparable ground truth datasets.

Third, our analysis is based on a static snapshot of the blockchain and ground truth. In practice, investigations unfold over time and may be affected by delays between on-chain activity and ground truth availability, as well as by changes in wallet software and user behavior. A standardized evaluation procedure should therefore be repeated regularly on updated ground truth datasets to verify whether address clustering heuristics and tools continue to perform reliably under changing blockchain usage patterns. The framework provided with this work can serve as a basis for such recurring evaluations by keeping the metric definitions and preprocessing steps comparable across time.

Finally, while the scope of this work is to reproduce and compare the metrics and reported numbers used in prior MIH evaluations, it is not to propose a new metric. However, our results indicate that existing metrics for the MIH only partially align with the requirements that law enforcement agencies face when justifying investigative measures based on heuristic outputs. An important direction for future work is therefore to agree on and consistently apply certain selected performance metrics in order to assess the reliability of MIH (and other address clustering methods).

6 Conclusion↩︎

The MIH is a foundational building block of Bitcoin address clustering and is widely used in research and in operational blockchain analytics. Yet, despite its central role and real-world consequences, MIH has only rarely been evaluated on ground truth, and existing evaluations are difficult to compare due to heterogeneous datasets and metrics. In this paper, we address this gap by reimplementing the preprocessing pipelines and nine evaluation metrics used in the three prior systematic MIH evaluations and applying them to a real-world ground truth dataset of seven services obtained independently of heuristic assumptions.

Our results show that MIH performance depends on the chosen metric and aggregation level. Dataset-level pairwise scores can appear strong while masking substantial failures for individual entities, and entity-level results reveal pronounced heterogeneity across services. We further demonstrate that pairwise metrics can be dominated by large services. Together, these findings caution against treating MIH-derived clusters as uniform or self-evident ground truth and highlight the need for evaluation practices that routinely report entity-level performance alongside global summaries.

From a law enforcement perspective, the costs of mainly false positives, as well as false negatives, make metric choice particularly consequential. To date, various calculation methods and reliability values for the MIH have been reported. However, there is currently no standardized consensus on which of these measurements are relevant for legal decision-making in the context of criminal proceedings. An important direction for future work is therefore the development and standardization of a law enforcement-oriented evaluation procedure that can complement technical performance reporting and better support justified, accountable use of heuristic-based blockchain analytics.

References↩︎

---

1. https://anonymous.4open.science/r/mih-toolkit↩︎