Scan backwards through the chain

[dipunm]

I recently installed and played with this against my own server and node.

It had some useful info like if something looks like it came from an exchange, but it felt limiting.

I wonder if that is due to how deep the algo goes, how many turns does it search backwards?
Eg. If coins go from Exchange to address to address to address, is it still linked?

Can it try to group utxos by seeing if there are any direct links?

I'm honestly not sure what the purpose of this tool is right now, but it would be cool as a tool to evaluate your own wallets and discover links.

[LORDBABUINO]

Hi @dipunm, thanks for installing Stealth and sharing this feedback — real user experience is exactly what we need to make the tool better.

You're mostly right about the limitation. Most heuristics only look one hop back (the direct funding tx), though detect_cluster_merge does trace 2 hops to detect when UTXOs from different funding chains get merged. The exchange origin detector specifically only checks if the tx you received from looks like an exchange batch withdrawal — it doesn't trace backwards to find exchanges further up the chain, which is what you noticed. So your Exchange → address → address → address scenario wouldn't be flagged today.

Multi-hop taint propagation is on our roadmap — the idea is to trace funds backwards through multiple transactions, with the "taint" diluting at each hop (if you receive 0.5 BTC from an exchange and mix it with 0.5 BTC of clean funds, the output carries ~50% taint, not 100%). That would answer exactly your question.

On grouping UTXOs by direct links: CIOH already does this partially — when you spend multiple of your addresses together in one tx, they're linked as owned by you. But extending that to cluster UTXOs across multiple transactions (transitive linkage) is a good addition.

On the purpose of the tool: Stealth is meant to be a privacy audit — you point it at your own wallet and it tells you where your on-chain activity is leaking information, using the same heuristics blockchain surveillance firms use. The goal is to close the gap between what companies like Chainalysis can see about you and what you can see about yourself. Your use case (evaluating your own wallets and discovering links) is exactly what we're building for. We'll work on making this clearer in the README.