Visualizing Bitcoin blocks as a graph using KeyLines

Part 1: Visual Bitcoin analysis

This blog is the first of two posts looking at how our network visualization toolkits can help you make sense of Bitcoin transactions. We’ll use Bitcoin data throughout, but the concepts of visual Bitcoin analysis could also be applied to other cryptocurrencies.

Whether it’s Bitcoin’s value fluctuations, million-dollar hacks, the launch of new currencies or stories of regulators grappling with a brave new world, barely a week passes without cryptocurrencies hitting the headlines.

While governments and banks still dislike the concept of digital currencies, there’s a huge business opportunity. Compared to traditional fiat currencies, decentralized cryptocurrencies offer a secure, low-cost way to transfer funds anywhere in the world. They’re widely regarded as the future of finance, so it’s no wonder people want to learn more.

What is Bitcoin?

There are whole websites devoted to the inner workings of Bitcoin. For this post, we’ll keep it simple.

Bitcoin is a digital currency that uses the blockchain to manage and secure transactions. Unlike traditional currencies, Bitcoin is not backed by an institution, like a government or bank. Instead, its value is based on its users’ trust in the system.

Bitcoin coins are mined and can be sent between users’ wallets as transactions that have input addresses and output addresses. Transactions are contained within blocks. A user can have many wallets, and wallets can have many addresses, and addresses can be generated on demand.

Bitcoin network visualization
Understanding the structure of Bitcoin

To maintain trust within a global financial network of anonymous strangers, every transaction is broadcast to every node in the network. In fact, every Bitcoin wallet contains a record of every single transaction in the history of data, which allows validation of future transactions.

Broadcasting those transactions globally can result in disagreement across the network which could undermine the whole currency, so Bitcoin uses a blockchain solution to maintain and protect the correct order of transactions.

We can see the value of network visualization. Bitcoin is connected by design, and all the data is in the public realm. The cryptographic references used to represent the wallets, transactions, blocks, addresses, and everything else are easy for computers to read, but not humans. Visual Bitcoin analysis helps people identify transaction patterns and make sense of the endlessly-growing network.

Let’s look at some of the techniques we can use to visualize and understand Bitcoin transactions. In all of the following examples, we used data from’s API.

Why visualize blockchains?

Read about blockchain use cases

Bitcoin network visualization

Here’s a recent block, visualized with KeyLines.

Bitcoin network visualization - visualizing a Bitcoin block
There are typically around 2500 transactions in a single block, although this number varies

In our model, transactions are represented by grey nodes with a double arrow icon. Inputs to these transactions are shown in orange, and outputs in teal. We’ve scaled nodes by their value. The time bar shows the count of transactions over time.

Although this view looks pretty, it gives little insight into the data.

Bitcoin transactions are public but anonymized. To protect that anonymity, users commonly generate a fresh address for every transaction, but not always. For reasons of convenience, indifference to anonymity or unawareness, around half of the addresses in a typical block are reused.

That means we can group transaction inputs and outputs by address with the guarantee that all nodes in a group are controlled by the same user, to reveal some more interesting patterns:

Visual Bitcoin analysis of transactions within a block, with inputs and outputs grouped by address
Visual Bitcoin analysis of transactions within a block, with inputs and outputs grouped by address

Identifying automated Bitcoin transactions

Here, a single address is sending bitcoins to lots of other unique address pairs. Each of these transactions has exactly one input (orange) and three outputs (teal), with one of these outputs returning (potentially as change) to the sending address.

Visual Bitcoin analysis - An automated system? This address is creating frequent, regular transactions of the same value
An automated system? This address is creating frequent, regular transactions of the same value

The next pattern shows rapidly-spent outputs. For each transaction in this chain, a small amount of the input is siphoned off to a different address, and the remainder is used as input to the next transaction in the chain. All of these transactions happened in a 5-minute window.

Paying the outputs from one transaction into the next in a series of quick-fire transactions
Paying the outputs from one transaction into the next in a series of quick-fire transactions

These charts show unusual patterns that could be completely innocent. Armed with more data and heuristics, however, an analyst could discover something more interesting.

Identifying manual Bitcoin transactions

Zooming in to a different area in the block, we can see a new collection of patterns which probably indicate the transactions were manual rather than automated.

These simpler patterns indicate ordinary manual transactions
These simpler patterns indicate ordinary manual transactions

What makes us believe these transactions are not automated? There are certain characteristics that suggest (but do not guarantee) these transactions were manually orchestrated:

  • Disconnected transactions; these transactions do not share any addresses with other transactions in the block they are in
  • Exactly two unique addresses, suggesting that the transaction was between two parties
  • Output to an address that was also an input, suggesting that this is a ‘change’ output, which is typical when transacting with another party
  • Infrequent and irregular timings

Visualizing all transactions in a single block might seem uninteresting. After all, a block (mostly) contains transactions from a small time window, with no structure beyond that.

However, as we’ve seen, taking a time-bound set of transactions and visualizing it in a single chart can be a useful detection technique for uncovering patterns and anomalies that require investigation. It’s widely used by fraud analysts.

Try it for yourself

In part two, we’ll visualize individual Bitcoin transactions, and see how our network visualization toolkits can help users investigate specific activity. You’ll find more inspiration for visual Bitcoin analysis in our blog post on building a live Bitcoin timeline & graph visualization.

In the meantime, if you’d like to learn more about network visualization or try visualizing your own cryptocurrency data, request a free trial of KeyLines and ReGraph – our network visualization toolkits.

How can we help you?

Request trial

Ready to start?

Request a free trial

Learn more

Want to learn more?

Read our white papers


Looking for success stories?

Browse our case studies

Registered in England and Wales with Company Number 07625370 | VAT Number 113 1740 61
6-8 Hills Road, Cambridge, CB2 1JP. All material © Cambridge Intelligence 2024.
Read our Privacy Policy.