AZ / Glossary

Glossary

Every term used across the guide — the same definitions the inline popovers show, in one indexed page. Each entry links, so you can cite a definition directly.

Address Address clustering AML Chain hopping Change output Coinbase transaction CoinJoin Cold wallet Common-input-ownership heuristic Confirmation Custodial Dust Exchange deposit address FIFO Haircut Hot / omnibus wallet KYC Lightning Network Mempool Mixer / tumbler Monero Non-custodial OTC desk PayJoin Peel chain Poison taint Privacy coin Private key Satoshi Script Seed phrase Taint Transaction ID UTXO vin vout

Address#: A destination for bitcoin, derived from a public key or script. Addresses receive outputs; they don't hold balances themselves — a wallet's balance is the sum of unspent outputs locked to its addresses.
Address clustering#: Grouping many addresses under one presumed owner using heuristics (like co-spending) and known labels. Clustering is inference, not cryptographic fact — it can be wrong.
AML#: Anti-Money-Laundering: the laws and compliance programs that obligate exchanges and financial institutions to detect, report, and sometimes freeze illicit funds.
Chain hopping#: Swapping stolen funds across blockchains or assets (BTC → ETH → stablecoins → Monero) to break the trail. Each hop through a swap service moves evidence off the public chain and into that service's private records.
Change output#: When you spend a UTXO worth more than the payment, the excess returns to you as a new output — like change from a cash purchase. Usually sent to a fresh address, which is why traces must decide which output is 'change' and which is the real payment.
Coinbase transaction#: The first transaction in each block, minting new bitcoin plus fees to the miner. Coinbase outputs are the origin points of every coin's lineage — every UTXO traces back to one.
CoinJoin#: A collaborative transaction where many participants contribute inputs and receive equal-valued outputs, making it ambiguous which input funded which output. Weakens ownership heuristics without any party taking custody.
Cold wallet#: Keys kept offline (hardware device, air-gapped machine). Exchanges sweep most customer funds to cold wallets; large cold-wallet addresses are often publicly identified.
Common-input-ownership heuristic#: The assumption that all inputs of a transaction are controlled by the same party, since signing requires each input's key. Usually true — but deliberately broken by CoinJoin and PayJoin.
Confirmation#: A transaction is 'confirmed' once mined into a block; each subsequent block adds another confirmation and makes reversal exponentially harder. Confirmed history is permanent evidence.
Custodial#: A service that holds keys (and therefore funds) on your behalf — exchanges, most 'wallets' with account logins. The opposite of self-custody. Custodians can freeze funds; that cuts both ways.
Dust#: An output so small it costs more in fees to spend than it's worth (classically 546 sats). In tracing, taint that diffuses down to dust is economically dead — trails are pruned there.
Exchange deposit address#: A unique address an exchange assigns to a customer for receiving funds. Deposits are swept into pooled hot wallets, so a payment to a known deposit address is the last public on-chain evidence tying funds to that account.
FIFO#: First-in-first-out taint accounting: the first value into an address is treated as the first value out. Used in some legal traditions (Clayton's rule) but produces order-dependent, sometimes arbitrary attributions.
Haircut (proportional) taint#: A taint accounting rule: when tainted and clean inputs merge, every output inherits taint in proportion to the tainted share of total input value. Conservative and order-independent, which makes it defensible.
Hot / omnibus wallet#: An exchange's online operational wallet holding pooled customer funds. Once deposits are swept in, individual ownership exists only in the exchange's internal ledger — public on-chain continuity ends there.
KYC#: Know-Your-Customer: identity verification that regulated exchanges must perform. KYC records are what turn an exchange account, and its deposit addresses, into a real-world identity — via legal process.
Lightning Network#: Bitcoin's off-chain payment network. Only channel opens and closes appear on-chain; the payments in between are not publicly recorded, so funds moved through Lightning are largely untraceable on the public ledger.
Mempool#: The set of broadcast-but-unconfirmed transactions each node holds. Watching the mempool can give minutes of advance warning that a tainted UTXO is on the move.
Mixer / tumbler#: A service that takes custody of coins from many users and returns different coins, deliberately severing the on-chain link. Centralized mixers keep internal records that can be seized; several have been sanctioned or shut down.
Monero (XMR)#: A privacy coin whose ring signatures, stealth addresses, and confidential amounts hide sender, receiver, and value by default. A swap of stolen BTC into Monero is, on-chain, effectively the end of the public trail.
Non-custodial#: You hold your own keys; no third party can move or freeze the funds. Non-custodial wallets are why on-chain funds can't be frozen directly — there is no operator to compel.
OTC desk#: Over-the-counter trading desk brokering large trades off public order books. A regulated fiat off-ramp — and therefore a potential interception point — but with widely varying KYC rigor.
PayJoin#: A payment format where sender and receiver both contribute inputs to one transaction, deliberately poisoning the common-input-ownership heuristic while looking like an ordinary payment.
Peel chain#: A laundering pattern: a large UTXO repeatedly 'peels off' a small payment and passes the remainder to a fresh change address, hop after hop. Long peel chains look complex but are highly traceable.
Poison taint#: The strictest taint rule: any output descended from stolen funds, in any amount, is 100% tainted. Simple, but it over-counts — after a few merges nearly everything touches taint, which is why value-weighted rules exist.
Privacy coin#: A cryptocurrency that hides transaction details (sender, receiver, amount) at the protocol level — Monero being the leading example. Public-ledger tracing techniques largely do not apply.
Private key#: The secret that authorizes spending from an address. Whoever holds the key controls the funds — seizing keys is how law enforcement actually recovers stolen bitcoin.
Satoshi (sat)#: The smallest unit of bitcoin: 1 BTC = 100,000,000 sats. Taint accounting is done in sats to stay exact.
Script (scriptPubKey)#: The locking program attached to every output that defines who can spend it. Most scripts encode a standard address; non-standard scripts (like early pay-to-pubkey) have no address form, which some explorers can't follow.
Seed phrase#: The 12–24 words that derive every key in a wallet. Anyone who has it has the funds. No legitimate service — tracing, recovery, or otherwise — ever needs it.
Taint#: The measurable share of a wallet's funds that descends from a specific source, such as a theft. Taint is an accounting claim computed from public data — reproducible by anyone, but dependent on the chosen accounting rule.
Transaction ID (txid)#: The unique 64-hex-character hash identifying a Bitcoin transaction. A txid plus an output index (vout) identifies one specific coin — the atomic unit of tracing.
UTXO#: Unspent Transaction Output — Bitcoin's actual unit of money. Every coin is an output created by one transaction and destroyed (spent) by exactly one later transaction. Wallets don't hold balances; they hold UTXOs.
vin (input)#: A transaction input. Each vin points at exactly one prior output (a txid + vout index) and provides the signature that unlocks it. The vin→prior-vout reference is the cryptographic link every trace follows.
vout (output)#: A transaction output, indexed from 0. Each vout carries a value in sats and a locking script (usually an address). Outputs are where the money actually lives — hence this site's name.