Address clustering passes a court test: what it can't show

A federal appeals court in the United States has upheld the use of evidence produced with Chainalysis Reactor, a blockchain investigation tool, in the trial of the man convicted of running the Bitcoin Fog mixer. Chainalysis announced the ruling in a post dated 2026-10-13. This article looks at the method behind that evidence, address clustering, and at what a court ruling does and does not tell us about it.

What the ruling covers

The case is United States v. Sterlingov. Roman Sterlingov, a dual Swedish-Russian national, was found guilty of operating Bitcoin Fog, a mixer. A mixer is a service that pools coins from many users and pays them back out, so that the link between who sent and who received becomes harder to follow.

According to Chainalysis, investigators used Reactor to study transfers between Bitcoin Fog and several darknet markets. The analysis tied more than 900,000 Bitcoin addresses to the mixer. A trial court accepted the evidence in 2024. Sterlingov appealed, and in September the D.C. Circuit found no error in that decision.

The legal yardstick is the Daubert standard. It is the test US federal judges use to decide whether expert technical testimony is reliable enough to put before a jury. Among the factors judges may weigh: can the method be put to a test, has it gone through peer review, how often might it be wrong, and is it broadly accepted by specialists?

The method: turning addresses into clusters

A blockchain shows addresses, not people. One person or service can control thousands of addresses. Clustering is the work of grouping addresses that are probably controlled by the same entity, so that an analyst can follow an operator rather than a scatter of strings.

Chainalysis describes its approach as combining change address analysis with digital fingerprinting. On Bitcoin, a payment spends whole earlier outputs. If the inputs are worth more than the payment, the leftover goes back to the sender as change, usually to a fresh address. Spotting which output is the change lets an analyst add that new address to the sender's group. Fingerprinting looks for habits that repeat across transactions, such as similar patterns and behaviour, and groups addresses that share them.

Each link is an inference, not a label written on the chain. Once a cluster is built, a single known point, such as a deposit at a service that identifies its users, can attach a real-world name to every address in the group. That is why one wrong link can spread far.

Why a cautious method won favour

The appeals court treated Reactor's deliberately conservative attribution as a strength. An underinclusive method leaves out links that are merely possible and keeps only links it can defend. The trade-off is that some addresses that really belong to an operator will stay outside the cluster.

Testimony came from Luke Scholl, a specialist at the FBI, and Elizabeth Bisbee of Chainalysis. Neither could recall a Reactor attribution that was later proven wrong. Chainalysis also says it is the only blockchain analytics provider tested against Daubert as of October 2026, and it points to an independent academic evaluation from 2025 that it says favours its data.

Limits: what the ruling does not prove

A court accepting evidence is not the same as a measured accuracy figure. Sterlingov's appeal raised exactly this point: the tool had no peer review and no known error rate. The court was not persuaded, reasoning that a young, specialised field cannot always be expected to have peer-reviewed tools. For readers, the gap still matters.

• No published error rate: experts not recalling a wrong attribution is a track record, not a measured false-positive rate.
• Heuristics can break: privacy techniques that reuse or blur change outputs, or shared wallets used by many people, can make addresses look linked when they are not, or hide links that exist.
• Conservative means incomplete: an underinclusive cluster understates how many addresses an operator controls, so totals built on it are a floor, not a full count.
• The source is the vendor: the account of the ruling comes from Chainalysis itself, which has a commercial interest in how its tool is seen.

Chainalysis makes a related point. It warned that a mistaken attribution can steer a case off course, or push compliance and risk teams toward bad calls.

What to watch next

Attribution labels can shape investigations and compliance decisions. The firm cited its work on the $387 million Bitget hack when it said AI can speed up a sound method but cannot repair a weak one. In its words, "AI can accelerate a sound methodology, not fix a weak one."

Worth watching: whether other analytics providers face the same legal test, whether independent researchers publish error rates for clustering heuristics, and whether courts begin to ask for those numbers. When you read that an address belongs to a mixer, an exchange or a thief, ask which heuristics produced that label and how cautious they were.

Sources

• Chainalysis, 13 Oct 2026

Drafted by AI from the research and on-chain sources listed, then published automatically once checks confirmed the figures against those sources and found no copied text. Not reviewed by a person. Metrics are explained, never turned into price calls.