What is a change address?¶

A change address is an address that receives the unspent remainder from certain cryptocurrency transactions.

Avoid the dangerous assumption¶

The dangerous assumption is that every output from a transaction is a payment to a separate recipient.

On blockchains that use unspent transaction outputs, a wallet may spend a previous output that is larger than the intended payment.

The transaction can send the required amount to the recipient and return the remainder to an address controlled by the sender.

That returned amount is commonly called change.

Identifying change can help trace continued control of funds and group related addresses.

But change-address identification is often analytical rather than certain.

Wallet software may use new addresses automatically.

Some transactions have several recipients, use unusual wallet behaviour or involve collaborative transaction structures.

A mistaken change assumption can send the trace down the wrong path and incorrectly enlarge a suspected wallet cluster.

Preserve the full transaction, all inputs and outputs, amounts, fees, addresses, block details and the method used to identify possible change.

Do not assume the largest or smallest output is automatically change.

Look at wallet behaviour, address reuse, later spending and known technical patterns.

Where seized-wallet or provider records exist, use them to corroborate the conclusion.

When reporting, describe an address as suspected or probable change unless direct evidence establishes wallet control.

Keep the recipient payment and possible return output separate.

Operational takeaway¶

Treat change-address identification as an analytical inference and corroborate it through transaction structure, later spending, wallet data or provider records before relying on it for attribution.