A transaction pattern is simply an overall model or structure of a typical transaction, which can be found on the blockchain, and whose likely interpretation is known. When studying patterns, we focus on a single transaction and analyze it at a high level.

In other words, we will only examine the number of UTXOs in inputs and the number of UTXOs in outputs, without delving into the more specific details or environment of the transaction. Based on the observed pattern, we can interpret the nature of the transaction. We will then examine the characteristics of its structure and derive an interpretation.

In this section, we examine the main transaction models encountered in chain analysis together. For each model, I'll provide the likely interpretation of this structure, along with a concrete example.

Let's start with a very common pattern, as it's the one that emerges in most Bitcoin payments. The simple payment model is characterized by the consumption of one or more UTXOs as inputs and the production of 2 UTXOs as outputs. This model, therefore, looks like this:

When we spot this transaction structure on the blockchain, we can already draw an interpretation. As its name suggests, this model indicates that we are in the presence of a sending or payment transaction. The user has consumed their own UTXO in inputs to satisfy the outputs of a payment UTXO and a change UTXO (money returned to the same user).

We therefore know that the observed user is probably no longer in possession of one of the two output UTXOs (the payment UTXO), but is still in possession of the other UTXO (the change UTXO).

For the moment, we can't specify which output represents which UTXO, as this is not the purpose of the pattern study. We'll get there by relying on the heuristics we'll study in the following sections. At this stage, our objective is limited to identifying the nature of the transaction in question, which in this case is a simple send.

For example, here is a Bitcoin transaction that adopts the simple send pattern:

b6cc79f45fd2d7669ff94db5cb14c45f1f879ea0ba4c6e3d16ad53a18c34b769

Source: Mempool.space

After this first example, you should have a better understanding of what it means to study a "transaction model". We examine a transaction by focusing solely on its structure, without considering its environment or the specific details of the transaction. In this first step, we're only looking at the big picture.

Now that you understand what a pattern is, let's move on to the other existing models.

This second model is characterized by the consumption of a single UTXO as input and the production of a single UTXO as output.

The interpretation of this model is that we are in the presence of a self-transfer. The user has transferred his bitcoins to himself, to another address belonging to him. Since there is no change in the transaction, it's highly unlikely that we're in the presence of a payment. Indeed, when a payment is made, it is almost impossible for the payer to have a UTXO corresponding exactly to the amount required by the seller, plus the transaction fee. In general, the payer is therefore obliged to produce a change output.

We then know that the observed user is probably still in possession of this UTXO. In the context of a chain analysis, if we know that the UTXO used as input to the transaction belongs to Alice, we can assume that the UTXO used as output also belongs to her. What will become interesting later on is to identify transaction-internal heuristics that could reinforce this assumption (we'll examine these heuristics in Chapter 3.3).

For example, here is a Bitcoin transaction that adopts the sweep pattern:

35f1072a0fda5ae106efb4fda871ab40e1f8023c6c47f396441ad4b995ea693d

Source: Mempool.space

Beware, however, that this type of pattern can also reveal a self-transfer to the account of a cryptocurrency exchange platform. It will be the study of known addresses and the context of the transaction that will tell us whether it's a swipe to a self-custody wallet or a withdrawal to a platform. Indeed, the addresses of exchange platforms are often easily identifiable.

Let's revisit Alice's example: if the scan leads to an address known to a platform (such as Binance, for example), this may indicate that the bitcoins have been transferred out of Alice's direct possession, likely with the intention of selling or storing them on this platform. On the other hand, if the destination address is unknown, it's reasonable to assume that it's simply another wallet still belonging to Alice. However, this type of study falls more into the category of heuristics than patterns.

This model is characterized by the consumption of several UTXOs at the input and the production of a single UTXO at the output.

The interpretation of this pattern is that we are in the presence of consolidation. This is a common practice among Bitcoin users, aimed at merging several UTXOs in anticipation of a possible increase in transaction fees. By performing this operation during a period when fees are low, it is possible to save on future fees. We'll discuss this practice further in Chapter 4.3.

We can deduce that the user behind this transaction model was likely in possession of all the UTXOs in the input and remains in possession of the UTXO in the output. So it's probably an auto-transfer.

Similar to the sweep, this type of pattern can also indicate a self-transfer to an exchange platform's account. It will be the study of known addresses and the context of the transaction that will tell us whether it's a consolidation to a self-custody wallet or a withdrawal to a platform.

For example, here is a Bitcoin transaction that adopts the consolidation pattern:

77c16914211e237a9bd51a7ce0b1a7368631caed515fe51b081d220590589e94

Source: Mempool.space

In a chain analysis, this model can reveal a great deal of information. For example, if we know that one of the inputs belongs to Alice, we can assume that all the other inputs and the output of this transaction also belong to her. This assumption would then enable tracing back up the chain of previous transactions to identify and analyze other transactions likely to be associated with Alice.

This model is characterized by the consumption of a few UTXOs as inputs (often just one) and the production of many UTXOs as outputs.

The interpretation of this model is that we are in the presence of grouped spending. It's a practice that likely reveals a significant economic activity, such as an exchange platform. Grouped spending enables these entities to save costs by combining their expenses in a single transaction.

We can deduce from this model that the UTXO in input comes from a company with a high level of economic activity, and that the UTXOs in output will disperse. Many will belong to the company's customers who have withdrawn bitcoins from the platform. Others may go to partner companies. Finally, there will certainly be one or more changes that will be sent back to the issuing company.

For example, here's a Bitcoin transaction that adopts the bundled spend pattern (presumably, it's a transaction issued by the Bybit platform):

8a7288758b6e5d550897beedd13c70bcbaba8709af01a7dbcc1f574b89176b43

Source: Mempool.space

Among transaction patterns, we can also identify those that reveal the use of a specific protocol. For example, Whirlpool coinjoins (discussed in part 5) will have an easily identifiable structure that differentiates them from other, more conventional transactions.

Analysis of this pattern suggests that we are likely to be in the presence of a collaborative transaction. It is also possible to observe a coinjoin. If this latter hypothesis proves correct, then the number of exits could provide us with a rough estimate of the number of participants in the coinjoin.

For example, here is a Bitcoin transaction that adopts the coinjoin collaborative transaction pattern:

00601af905bede31086d9b1b79ee8399bd60c97e9c5bba197bdebeee028b9bea

Source: Mempool.space

There are many other protocols with their own specific structures. For example, there are Wabisabi transactions, Stamps transactions, and Runes transactions.

Thanks to these transaction patterns, we can already interpret a certain amount of information about a given transaction. But transaction structure is not the only source of information for analysis. We can also study its details. These internal details are what I like to call "internal heuristics", and we'll be looking at them in the next chapter.