Taint: accounting for stolen value

The mixing problem

Suppose a thief holds a stolen 1.0 BTC output and a legitimately-acquired 3.0 BTC output, and spends both in one transaction paying two parties 2.0 BTC each. Which recipient got the stolen coin? The question has no physical answer — the transaction pooled 4.0 BTC of value and carved it into new outputs. Any answer is a convention, chosen and defended by the analyst. What separates forensics from hand-waving is stating the convention up front and applying it consistently.

The accounting rules

Three conventions dominate. Poison: any output touched by taint, in any amount, is fully dirty. Maximally cautious for screening (exchanges use poison-like logic to refuse risky deposits), but it over-counts — a few merges deep, half the chain is "stolen," which proves nothing about anyone. FIFO: first value in is first value out, a rule with real legal pedigree (Clayton's rule from 19th-century banking disputes). It produces exact answers, but those answers depend entirely on ordering — swap two inputs and the "stolen" output changes, which is an uncomfortable property for evidence.

The haircut, or proportional, rule distributes taint pro-rata: if 25% of a transaction's input value was stolen, every output is 25% stolen. It is order-independent, conservative (taint can only dilute, never concentrate beyond the facts), and produces the same number no matter who computes it. Those properties are why value-weighted attribution is the defensible default for making claims about specific wallets — and it is the convention vout.io uses and displays.

A worked example

Now recurse: each tainted output that gets spent repeats the calculation at the next transaction, compounding the shares. After any number of hops the total never exceeds what was stolen, and every intermediate figure can be recomputed by an adversary from public data — which is precisely what makes the final claim, "this wallet holds x.xxxxx BTC traceable to this theft," worth putting in front of an exchange or a court.

Now run the same arithmetic on a real transaction. Paste a txid, tick the inputs that were stolen, and watch the proportional share distribute across the outputs — one live hop of exactly the computation a full trace repeats thousands of times.

Confidence tiers and dust

Not all hops deserve equal confidence, and honest reporting says so. A transaction with a single input has nothing to mix — attribution through it is direct. A handful of merged inputs is genuine but diluted — proportional. Dozens of inputs is the signature of consolidation or deliberate mixing, where per-output attribution is ambiguous even if the arithmetic still computes. Presenting these tiers separately is the difference between an audit trail and a scary-looking picture.

Finally, taint diffuses. Split enough times, a trail's share shrinks toward dust — amounts that cost more to move than they're worth. Pruning those trails isn't giving up; it's recognizing that the remaining value is economically dead. The meaningful money concentrates on remarkably few paths — which is why a theft that fans out to thousands of outputs can still resolve to a handful of wallets holding nearly everything.