Visualizing Bitcoin blocks as a graph using KeyLines

13th September, 2019

Part 1: visualizing blocks of transactions

This blog is the first of two posts looking at how our network visualization toolkits can help you make sense of Bitcoin transactions. We’ll use Bitcoin data throughout, but the concepts could also be applied to other cryptocurrencies.

Whether it’s Bitcoin’s value fluctuations, million-dollar hacks, the launch of new currencies or stories of regulators grappling with a brave new world, barely a week passes without cryptocurrencies hitting the headlines.

While governments and banks still dislike the concept of digital currencies, there’s a huge business opportunity. Compared to traditional fiat currencies, decentralized cryptocurrencies offer a secure, low-cost way to transfer funds anywhere in the world. They’re widely regarded as the future of finance, so it’s no wonder people want to learn more.

What is Bitcoin?

There are whole websites devoted to the inner workings of Bitcoin. For this post, we’ll keep it simple.

Bitcoin is a digital currency that uses the blockchain to manage and secure transactions. Unlike traditional currencies, Bitcoin is not backed by an institution, like a government or bank. Instead, its value is based on its users’ trust in the system.

Bitcoin coins are mined and can be sent between users’ wallets as transactions that have input addresses and output addresses. Transactions are contained within blocks. A user can have many wallets, and wallets can have many addresses, and addresses can be generated on demand.

Bitcoin network visualization
Understanding the structure of Bitcoin

To maintain trust within a global financial network of anonymous strangers, every transaction is broadcast to every node in the network. In fact, every Bitcoin wallet contains a record of every single transaction in the history of data, which allows validation of future transactions.

Broadcasting those transactions globally can result in disagreement across the network which could undermine the whole currency, so Bitcoin uses a blockchain solution to maintain and protect the correct order of transactions.

We can see the value of network visualization. Bitcoin is connected by design, and all the data is in the public realm. The cryptographic references used to represent the wallets, transactions, blocks, addresses, and everything else are easy for computers to read, but not humans. Visualization identifies transaction patterns and helps people make sense of the endlessly-growing network.

Let’s look at some of the techniques we can use to understand Bitcoin transactions. In all of the following examples, we used data from’s API.

Bitcoin network visualization

Here’s a recent block, visualized with KeyLines.

Bitcoin network visualization - visualizing a Bitcoin block
There are typically around 2500 transactions in a single block, although this number varies

In our model, transactions are represented by grey nodes with a double arrow icon. Inputs to these transactions are shown in orange, and outputs in teal. We’ve scaled nodes by their value. The time bar shows the count of transactions over time.

Although this view looks pretty, it gives little insight into the data.

Bitcoin transactions are public but anonymized. To protect that anonymity, users commonly generate a fresh address for every transaction, but not always. For reasons of convenience, indifference to anonymity or unawareness, around half of the addresses in a typical block are reused.

That means we can group transaction inputs and outputs by address with the guarantee that all nodes in a group are controlled by the same user, to reveal some more interesting patterns:

Visualizing Bitcoin transactions within a block with inputs and outputs grouped by address
Visualizing Bitcoin transactions within a block with inputs and outputs grouped by address

Identifying automated Bitcoin transactions

Here, a single address is sending Bitcoins to lots of other unique address pairs. Each of these transactions has exactly one input (orange) and three outputs (teal), with one of these outputs returning (potentially as change) to the sending address.

Bitcoin network visualization - An automated system? This address is creating frequent, regular transactions of the same value
An automated system? This address is creating frequent, regular transactions of the same value

The next pattern shows rapidly-spent outputs. For each transaction in this chain, a small amount of the input is siphoned off to a different address, and the remainder is used as input to the next transaction in the chain. All of these transactions happened in a 5-minute window.

Paying the outputs from one transaction into the next in a series of quick-fire transactions
Paying the outputs from one transaction into the next in a series of quick-fire transactions

These charts show unusual patterns that could be completely innocent. Armed with more data and heuristics, however, an analyst could discover something more interesting.

Identifying manual Bitcoin transactions

Zooming in to a different area in the block, we can see a new collection of patterns which probably indicate the transactions were manual rather than automated.

These simpler patterns indicate ordinary manual transactions
These simpler patterns indicate ordinary manual transactions

What makes us believe these transactions are not automated? There are certain characteristics that suggest (but do not guarantee) these transactions were manually orchestrated:

  • Disconnected transactions; these transactions do not share any addresses with other transactions in the block they are in
  • Exactly two unique addresses, suggesting that the transaction was between two parties
  • Output to an address that was also an input, suggesting that this is a ‘change’ output, which is typical when transacting with another party
  • Infrequent and irregular timings

Visualizing all transactions in a single block might seem uninteresting. After all, a block (mostly) contains transactions from a small time window, with no structure beyond that.

However, as we’ve seen, taking a time-bound set of transactions and visualizing it in a single chart can be a useful detection technique for uncovering patterns and anomalies that require investigation. It’s widely used by fraud analysts.

Try it for yourself

In part two, we’ll explore individual Bitcoin transactions, and see how our network visualization toolkits can help users investigate specific activity.

In the meantime, if you’d like to learn more about network visualization or try visualizing your own cryptocurrency data, request a free trial of KeyLines and ReGraph – our network visualization toolkits.

More from our blog

Visit our blog