UTXO Explained: Addresses, Clustering and Entity Labels
Lesson 2 of 10 · Intermediate
The UTXO model in plain language
Unlike a bank account, Bitcoin has no "balance." What exists on-chain is unspent transaction outputs, or UTXOs. Think of each UTXO as a banknote of a specific value locked to a lock (an address).
When you pay, your wallet spends one or more of these notes in full and creates new outputs: one for the recipient and usually one as change that returns to a fresh address of your own. The difference between the sum of inputs and outputs is the miner's fee.
Hypothetical example: you hold one UTXO of 0.5 bitcoin and want to send 0.2. The transaction consumes the whole 0.5, gives 0.2 to the recipient, returns about 0.2999 to your change address, and the rest is the fee. An outside observer sees two outputs and has to guess which is the payment and which is the change.
Your wallet "balance" is really the sum of UTXOs spread across your various addresses. Networks such as Ethereum and Tron use an account model instead: each address has a balance, which is easier to follow, but smart contracts and contract wallets add their own complexity.
Why one person means dozens of addresses
The number of addresses does not equal the number of people, and this is the basis of many misreadings:
- HD wallets generate a fresh address for each receipt to protect privacy; an ordinary user may have hundreds of addresses after a few years.
- Change addresses are created with each payment.
- Exchanges give each user a separate deposit address and hold balances in many hot and cold wallets.
- Many people hold several wallets: one for storage and one for everyday use.
The reverse is also true: one exchange address may hold the coins of millions of users. That is why an indicator such as "active addresses" must be read with caution; a single exchange batch transaction can create hundreds of outputs, and waves like on-chain data inscriptions can push the number up with no change in real users.
Clustering: how addresses become 'entities'
Analytics firms group addresses into clusters using several rules of thumb (heuristics) and then put labels on each cluster:
- Common input ownership: if several inputs are spent in one transaction, one party probably holds the keys to all of them. This is the strongest tool, but it breaks down completely in multi-party transactions such as CoinJoin.
- Change detection: an output that goes to a completely fresh address, has no round number or uses the same script type as the inputs is probably change. This is only a probability.
- Deposit address behaviour: exchange deposit addresses are usually swept into the exchange's hot wallet after a while, and that pattern links them together.
- External sources: addresses that companies publish themselves for proof of reserves, court documents, sanctions lists that name addresses, test deposits by analysts and information reported by users.
An entity is a cluster plus a label. Every "exchange," "miner," "custodian" or "whale" indicator is built on this structure. So the quality of any indicator depends on the quality of the clustering underneath; if the cluster is wrong, even the most precise formula gives the wrong result. When two tools show different numbers for the same thing, the difference is usually in this layer, not in the mathematics of the indicator.
Labelling errors and their effect on indicators
- Wrong merging: a CoinJoin or multi-party transaction can pour strangers' coins into one cluster and create an imaginary "whale."
- Wrong splitting: when an exchange launches a new wallet that has not yet been labelled, a transfer into it looks like users withdrawing.
- Stale labels: an address that once belonged to an exchange may have been sold or retired.
- Confusing exchange and custodian: a company may be both an exchange and a custody provider; a transfer between those two arms is neither a buy nor a sell.
- Different coverage between tools: each provider has its own clusters, so "exchange reserves" on two different sites can show different numbers.
These errors are not theoretical. According to CryptoDaily, Coin Metrics in September 2026 revised ETF wallet data for 19 months, a clear example of labels being corrected constantly even at reputable firms.
A checkable example: Tether freezes on-chain
On account-model networks, some events are recorded directly with no guesswork. The Tether (USDT) contract has a blacklist function, and when the issuer freezes an address, that appears on-chain as an event. According to BlockSec, in 2025 about 4,163 addresses holding close to $1.26 billion were added to Tether's blacklist, and about 84% of them were on Tron.
The teaching point is this: "frozen" is a fact you can verify on-chain, but "why" and "who owns it" still depend on outside information. Keep this separation between raw data and interpretation in every on-chain indicator.
Common mistakes
- Counting addresses or active addresses as the number of real users.
- Assuming without exception that all inputs of a transaction belong to one person, even in a CoinJoin.
- Mistaking a change output for a payment to someone else.
- Trusting one label without comparing it across two tools.
- Copying an address from your transaction history in an explorer, which is the main route of address-poisoning scams.
What do volume and data say here?
In this lesson "data" means the transaction itself, and the best exercise is to inspect one yourself in an explorer:
- Open a Bitcoin transaction in a public explorer and count the inputs and outputs.
- Guess which output is change: a fresh address? an odd amount? the same address type as the inputs?
- Compare the recipient address in two labelling tools. If the labels differ, treat both as "probable."
The same logic will matter later for exchange-flow and whale indicators: behind every large number there are one or more real transactions that you can open yourself to see whether they match the published story.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
What is a UTXO in Bitcoin?
An unspent output of a transaction, like a banknote of a specific value locked to an address. A wallet balance is the sum of these UTXOs.
Why does my wallet give a new address every time?
For privacy. HD wallets derive many addresses from one recovery phrase, all of which belong to you, and older addresses remain valid.
How accurate are exchange labels on on-chain sites?
For large exchanges they are usually fairly good but not complete. New wallets, custody arrangements and data revisions cause errors, so treat a label as a probability, not a certain fact.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.