What is a change address?¶

On unspent-output blockchains, a change address receives value left after an input funds the intended payment and fee. It may remain under sender-wallet control, but identifying change is often analytical rather than certain.

One transaction can have payment and return outputs¶

Wallet software may automatically send the remainder to a new address. Multiple recipients, collaborative transactions and unusual wallet behaviour can defeat simple assumptions such as “largest” or “smallest” output being change.

A wrong classification can misdirect the trace and incorrectly expand an address cluster.

Test the inferred return path¶

Preserve all inputs, outputs, amounts, fees, addresses and block details, plus the method and confidence used. Later spending, address reuse, known wallet patterns, seized-wallet data or provider records may corroborate control.

Describe suspected or probable change unless direct evidence establishes the wallet link, and keep recipient value separate from the possible return output.