UTXO Merging and Change: When Clustering Fails

Two heuristics, and only one is close to proof

Every chain-analytics score starts with two rules older than the vendors themselves. Common-input ownership says that if one transaction spends outputs from addresses A, B and C, a single signer held all three keys at that moment; that is close to proof, and the exceptions are known (CoinJoin, payjoin, shared custody). Change detection is the weaker half: one output usually returns to the payer, and guessing which one is a probability, never a fact. The guess leans on script-type matching, round payment amounts, value ordering, address reuse and timing. I wanted to know how well that guess works on today's chain, so I read every transaction in Bitcoin block 973,933 (2026-10-31 05:32:52 UTC) instead of sampling it. (privacy coins vs mixers)

A census of one block, not a sample

That block carried 3,533 transactions, 3,532 non-coinbase, in 998,284 vB, and paid 0.0182 BTC in fees at a median 1.205 sat/vB (p10 0.12, p90 3.7). The mempool held 54,439 transactions and 21.49 MvB, and every recommended tier sat at 1 sat/vB — a quiet Saturday, which matters later. Of the 3,532 payments, 659 (18.66%) spent two or more inputs, and those multi-input transactions moved 14.2% of the block's value. Input counts stayed small: median 2, p90 9, maximum 906. The first rule fired 288 times (43.7% of multi-input transactions) with every input from the same address, and 371 times with inputs from different addresses — a wallet spreading change around, or several people's coins; the heuristic cannot tell, and neither can you. (how Monero fees work)

Change was uniquely identifiable in 40.7% of transactions

Type matching — the output whose script type matches an input type and whose address never appeared among the inputs — produced exactly one candidate in 1,438 of 3,532 transactions (40.7%), two or more in 633 (17.9%) and none in 1,461 (41.4%). Restrict to the classic payment shape, two outputs, and the picture tightens: 752 of 2,200 had a single candidate, 406 (18.5%) were genuinely ambiguous, 1,042 had none. The round-number fallback is weaker than folklore says: among those 752, only 22 (2.9%) had an output that was a clean multiple of 100,000 sats and 72 (9.6%) a multiple of 10,000. Value ordering is a coin flip too — the change output was the larger one in 292 cases (38.8%). On a quiet block, structure alone gets the change right roughly four times in ten.

Merging costs 68 vB per input, measured

Consolidation is the other half. The block contained 50 transactions with ten or more inputs and at most two outputs. The largest spent 906 P2WPKH inputs into one output: 61,537.8 vB, 61,538 sat at 1.0 sat/vB, which is 67.9 vB per input, or $47.56 at BTC $77,292. Smaller cases track theory: 32 inputs took 2,209.5 vB (69.0 each), ten inputs 671.5 vB (67.2), and the formula 10.5 + 68n + 31 predicts 1,401.5 vB for 20 inputs. Legacy inputs are the exception — a 39-input P2PKH merge took 5,798 vB (148.7 per input), three 100-input ones sat at 14,791–14,798 vB, and 7 of the 50 merges were all-legacy against 27 all-P2WPKH. At today's 1 sat/vB, folding 20 UTXOs together costs 1,402 sat ($1.08); the same merge in a 20 sat/vB week costs $21.66, and at 50 sat/vB, $54.16.

The break-even is a bet on future fees, not a discount (how Monero fees work)

Do the arithmetic honestly. Merging N inputs now costs about 68N + 41.5 vB. Spending those N inputs later without merging costs the same 68N + 41.5 vB; spending one merged output later costs 68 + 41.5 vB. So consolidation only wins if the fee later exceeds today's fee by (68N + 41.5) / (68(N−1)): 17.9% for ten inputs, 8.5% for twenty, 3.3% for fifty. Two conditions hide inside that fraction. You must actually co-spend those coins later — if you spend them one at a time, merging is a pure loss, because you paid 68 vB per input for nothing. And the privacy cost is not in the fraction at all: the merge publishes, permanently, that one entity controls every input. When all those UTXOs came from repeat withdrawals at the same exchange, that is old news. When one came from a KYC exchange and another from a P2P trade, you just wrote the join into the ledger forever. (how Monero fees work)

Your swap deposit address is fresh; its funding is not

This is where swaps intersect with UTXOs. VeilSwap issues a new deposit address for every order and requires a refund address (the API answers 400 missing_refund_address without one), so the address itself carries no history. The funding transaction does. Whatever UTXOs your wallet selects for that deposit become, in public, the set of clusters that paid this order, and an analyst reading the deposit address inherits all of them. On the TRC20 corridor there is no change and no coin selection: one TRON address has one permanent history, so all that is left is which address you fund from. After the swap the destination chain decides — XMR exposes no inputs, outputs or amounts, which is why the corridor matters more than the wallet. Today's quotes, for scale (as of writing, check the live page): 100 USDT-TRC20 bought 0.14781859 XMR, or 676.50 USD per XMR against a 595.92 spot; 1 XMR sold for 575.97 USDT; 0.05 BTC bought 6.3958399 XMR, or 127.92 XMR per BTC, 1.4% under spot. (recovering misdirected funds)

What to do, in order

None of this needs new software. Use a fresh receive address and a fresh refund address for every order — reuse is the cheapest link to break and the one people forget. Before paying, switch on coin control and select only UTXOs of one provenance; a wallet that auto-selects will happily put your salary and your mining payout in the same transaction. Consolidate only inside one provenance, only when the mempool is near 1 sat/vB, and only when the set is large enough for the 3–8% break-even to be plausible. Never consolidate right before a swap, and never consolidate for privacy — it does the opposite. Avoid round amounts where you can, because they are one of the few fallbacks left once structure fails. And when the source chain cannot hide you, pick the corridor whose destination chain can: 100 USDT-TRC20 to XMR cost 13.5% over spot today purely from fixed per-order cost, which is the price of a small ticket, not of privacy. (recovering misdirected funds)

Two rules, one strong and one weak. Common-input ownership has survived a decade of attempts to break it and still sits close to proof; change detection is still a four-in-ten guess on an ordinary block, and the round-number shortcut that tutorials keep recommending fires less than 3% of the time. You cannot opt out of the first rule. You can only decide which coins are allowed to appear together — and that decision is made in your wallet, before the swap page even loads.