Cryptocurrency Forensics 2025: Full Guide Change Address Identification Techniques Full course on Udemy: Cryptocurrency Forensics and Investigations Get an expert on: cryptocurrency-forensics.com Why Change Addresses Exist • In Bitcoin, the entire input amount must be spent. • If the sender sends less than the full amount, the leftover ("change") is returned to a new address controlled by the sender. • This “return” is sent to a change address within the same wallet. Change Amount Formula Amount Sent – Amount Received – Transaction Fee = Change Amount How to Identify a Change Address Same Address Reused If an address is used both as input and output, it's likely the change address (though rare with modern wallets). Address Format Consistency Same prefix (1, 3, or bc1) for input and one output? May indicate same wallet → change address. Round vs. Irregular Amounts Rounded amounts (e.g., 1 BTC) usually go to recipients. Odd amounts often indicate change. Multiple Inputs In multi-input transactions, the smaller output is usually the change. Future Activity If the output address is used in a later transaction by the sender, it's likely the change address. UTXO 1 UTXO 2 Transaction Metadata Analyze SegWit prefixes, version numbers, or wallet structure hints in transaction details. Combine Clues Use multiple signals (address reuse, formatting, amounts, behavior) for more accurate results. Bonus Hint No change address? → Often means the sender used a different wallet, not full balance spend.