A while ago I posted the James Zhong / popcorn tin story here. The part that stuck with me wasn't the tin. It was that one transaction linked a Silk Road address to a wallet with his real name on it, and that was enough. Nine years of silence undone by a single clustering heuristic.

So I did the uncomfortable thing and ran it on myself.

Setup: I've held BTC since 2022. Bought on Coinbase and Kraken, moved to a hardware wallet, felt safe. I've never used a mixer, never done anything shady. I assumed "I withdrew to cold storage" meant "the exchange can't see what I do now."

What the trace showed:

• My hardware wallet is 2 hops from my Coinbase withdrawal. Two. Every satoshi in it is trivially attributable to my KYC'd identity.
• When I paid a friend back last year, my wallet combined two UTXOs to cover it. That's the common-input-ownership heuristic. It merged my "savings" and my "spending" into one cluster. Same mistake Zhong made, just with lower stakes.
• He now has a change output that any analytics firm can link back to my exchange account, and I sent him that link when I paid him.
• There's a 546-sat dust output sitting in my wallet I never noticed. If I ever spend it alongside real coins, whoever sent it confirms the cluster.

None of this is illegal or even unusual. That's the point. Chainalysis, Elliptic, and every exchange compliance desk run exactly these heuristics on everyone by default. "I have nothing to hide" doesn't help when the question is "which of these 40 addresses are the same person," and the answer is written on the chain forever.

Screenshot is the trace ( the exchange node is labeled). The red/orange path is the hop count back to KYC.

Things I'm changing:

1. Never combine UTXOs from different sources in one transaction. Coin control isn't optional.
2. One address per counterparty, always. No reuse.
3. Freeze unknown dust in the wallet so it's never accidentally spent.
4. Consider whether exchange coins and "private" coins should even live in the same wallet.

Genuinely curious: has anyone here checked their own hop distance to KYC? I'd assumed I was the careful one and I was wrong.