Bitcoin User Network (BUN)

• Bitcoin User Network (BUN) is a directed, time-resolved graph where nodes represent pseudonymous user clusters derived from address-linkage heuristics.
• It reveals structural centralization through a dense core of super-hubs, heavy-tailed degree distributions, and distinct community patterns.
• The analysis of BUN informs systemic risk assessment, fraud detection, and insights into the evolution of Bitcoin's market dynamics.

The Bitcoin User Network (BUN) is the directed, time-resolved graph whose nodes are addressed-clusters—representing pseudonymous “users” as inferred under established address-linkage heuristics—and whose edges encode all on-chain payment relationships. At its core, the BUN operationalizes the underlying money-flow architecture abstracted from the raw blockchain and supports an array of quantitative analyses of wealth concentration, structural centralization, community formation, and vulnerability. Research over the period 2009–2025 reveals that although the Bitcoin protocol is maximally decentralized in its consensus mechanism, the emergent BUN exhibits persistent, sometimes intensifying, mesoscale centralization, manifest in heavy-tailed centralities, a dense strongly-connected core, and a resilient yet risk-prone backbone determined by super-hub nodes such as exchanges.

1. Network Construction and Node Definition

A user in the BUN is operationally defined as a cluster of addresses, identified primarily via the multi-input clustering heuristic: addresses are grouped under a single “user” if they have ever appeared together as inputs to the same transaction. This cluster representation is often augmented by a change-address heuristic, wherein (typically) the smallest output of a transaction is attributed to the sender, though variations exist in precise implementation (Ermann et al., 2017, Nonaka et al., 29 Nov 2025, Vallarano et al., 2023, Vallarano et al., 2020).

Formally, at any time $t$, the BUN is a directed graph $G^{(t)} = (V^{(t)}, E^{(t)})$ where $V^{(t)}$ is the set of user entities (address clusters), and $E^{(t)} \subseteq V^{(t)} \times V^{(t)}$ records the transaction links observed in a time window. Edge weights can represent either aggregate transaction count, summed BTC value, or binary presence/absence depending on analysis goals. Adjacent methodologies use temporal segmentation (daily or weekly snapshots) and map raw transaction data to the BUN through aggregation and address pre-processing pipelines (Bovet et al., 2018, Nonaka et al., 29 Nov 2025, Ebrahimi et al., 2018, Kinkeldey et al., 2019). Table 1 summarizes essential construction principles.

Heuristic	Description	Reference
Multi-input	Cluster all addresses in a transaction’s input set	(Ermann et al., 2017)
Change-address	Assign change output to sender if heuristically safe	(Vallarano et al., 2023)
Community detection	Hierarchical aggregation of weak linkage signals	(Cazabet et al., 2017)

2. Structural Characterization: Centralities, Communities, and Core-Periphery

Topologically, the BUN is characterized by sparse connectivity ($d(t) \sim N^{-1}(t)$), heavy-tailed (power-law or truncated power-law) degree distributions, and low clustering coefficients ($C < 0.01$ at scale) (Ermann et al., 2017, Vallarano et al., 2020, Vallarano et al., 2023). Typical fitted degree exponents are $\gamma \approx 1.8-2.5$ for out-degree, and similar or slightly larger for in-degree, depending on the temporal segment and clustering specifics (Ermann et al., 2017, Elmougy et al., 2023).

Mesoscopically, the BUN admits a persistent core-periphery and bow-tie stratification. The core, operationally the largest strongly connected component (LSCC), encompasses 10–40% of users over the years, acting as a backbone for mutual fund circulation among exchanges, large services, and market-makers (Vallarano et al., 2023, Nonaka et al., 29 Nov 2025, Fujiwara et al., 2021). Surrounding the core is a periphery of IN nodes (net suppliers), OUT nodes (net consumers), and tendrils, mirroring the classic bow-tie structure of the Web (Fujiwara et al., 2021, Vallarano et al., 2023).

Community structure manifests as clusters of strongly interlinked addresses, often corresponding to mining pools, exchanges, or “coin-churning” entities; these are detected as plateaus in eigenvectors associated with low-decay eigenvalues ($\gamma = -2\ln|\lambda| \ll 1$) of the Google matrix (Ermann et al., 2017). Modularity-optimized partitions are generally statistically fragile in the BUN after accounting for core-periphery structure (Vallarano et al., 2020).

3. Centralization, Assortativity, and Inequality Metrics

The BUN displays persistent structural centralization, most quantitatively captured by centrality score Ginis and directed assortativity coefficients. Direction-sensitive PageRank and HITS (both authority and hub scores) encode node prominence; in empirical snapshots, Gini coefficients for PageRank reach 0.55, while HITS hub/authority Ginis often exceed 0.90, indicating extreme concentration—far sharper than expected from degree alone (Nonaka et al., 29 Nov 2025, Ermann et al., 2017).

Directed assortativities $r_{\alpha,\beta}$ (for $\alpha, \beta \in \{\mathrm{in},\mathrm{out}\}$) remain stably negative ($-0.1$ to $-0.2$), reflecting disassortative mixing: super-hubs transact mainly with periphery nodes rather than with one another (Nonaka et al., 29 Nov 2025, Vallarano et al., 2023, Tao et al., 2022). Rich-club coefficients further confirm that highly connected users do not preferentially link among themselves, in contrast to classical social networks.

Raw-flow Gini indices for transaction volume are in the range $0.92 < g < 0.95$, strongly indicating that a minute fraction of users receive (and send) the overwhelming majority of all bitcoins in circulation (Ermann et al., 2017). When computed via random-surfer centralities (PageRank, CheiRank), gini values of $\sim 0.50$ persist, indicating that even under maximal damping, ranking-induced inequality remains substantial.

4. Temporal Evolution and Links to Price Dynamics

Over the period from the genesis block to late 2025, the BUN’s order-of-magnitude scaling in total users ($|V|$ grows from $10^3$ to $10^7$—and over $10^8$ addresses—by 2025) is accompanied by pronounced sparsification (density decays as $N^{-1}$) and linear expansion in edge count (Vallarano et al., 2020, Bovet et al., 2019). Mesoscopic features—a growing and then receding LSCC, as well as fluctuations in core size and reciprocity—track closely the major macroeconomic cycles and bubbles in Bitcoin’s market price (Vallarano et al., 2023, Bovet et al., 2019, Bovet et al., 2018).

Higher moments of the out-degree distribution (std, skewness, kurtosis) are Granger-causal for (future) price dynamics in certain epochs—especially pre-2014—with increased heterogeneity preceding drawdowns and core swelling coinciding with price bubbles (Bovet et al., 2018, Bovet et al., 2019). Z-score peaks in core-periphery link counts and reciprocated motifs are tightly synchronized with bubble onsets. Post-2016, the core contracts and IN-periphery expansions accelerates, indicating a shift toward predominantly one-way flow regimes at large scale (Vallarano et al., 2023). Despite the notorious hypervolatility of BTC prices (minute-scale volatility $\downarrow$ from 0.307 in 2020 to 0.077 in 2025), no systematic short-term coupling between price shocks and mesoscopic rewiring under weekly aggregation is detected (Nonaka et al., 29 Nov 2025).

5. Community Detection, Anonymity, and Entity Re-identification

Multiple works demonstrate that through weak-signal community detection (e.g., Louvain on a “hint” network of address clusters), substantial portions of Bitcoin’s user structure can be reconstructed, undermining naïve assumptions about pseudonymity (Cazabet et al., 2017). Precision-recall tradeoffs in real-world cluster identification show adjusted NMI values exceeding 0.65 on standardized benchmarks (Cazabet et al., 2017). Bayesian methods leveraging network propagation times allow mapping user clusters to originator IPs, further tying network structure to exogenous identity signals (Juhász et al., 2016).

Visualization tools such as BitConduite allow rapid, article-scale, and entity-oriented exploration of the BUN: users (entities) are clustered by activity metrics (transaction frequency, durations, value, in/out degree) and partitioned via $k$-means in feature space, providing actionable insights into user typologies (e.g., distinguishing between “one-timers,” “high-activity exchanges,” and miners over halving events) (Kinkeldey et al., 2019).

6. Systemic Risk, Fraud Detection, and Practical Implications

Superhubs, notably large exchanges (e.g., Mt Gox in early datasets), are systemic risk concentrations: the removal or failure of a top hub can disconnect up to 20% of users from the network’s largest component during bubbles (Bovet et al., 2018). Star-like triadic motifs are overrepresented around such superhubs during bubbles, serving as precursors to stress and potential early-warning signals. The BUN’s topology—rich in isolated communities, scale-free interlinkage, and persistent core—can be exploited for malicious activity (fraud, Sybil attacks, money laundering), but also provides robust statistical signatures for algorithmic anomaly detection (Tao et al., 2022, Elmougy et al., 2023).

Feature-based supervised models trained on BUN-induced entities (with node-level feature aggregation) achieve F1 scores above 0.8 in illicit-activity detection; centrality measures (degree, PageRank) and transaction motifs are principal features for anti-money-laundering and forensic workflows (Elmougy et al., 2023). The observed structural centralization and its implications—growing concentration of wealth and connectivity—raise enduring questions for resilience, regulatory oversight, and the decentralization narrative (Nonaka et al., 29 Nov 2025).

7. Concluding Synthesis: Stabilization, Centralization, and Identity

The current BUN, as of late 2025, is a mature yet asymmetric, core–periphery network with high concentration of both transactional wealth and structural influence. Although the protocol is decentralized and open, empirically the BUN is marked by a dense core, persistent negative degree-assortativity, and Gini coefficients reflecting activity and wealth condensation among a small set of users that function as systemically critical infrastructure.

All established clustering and network-inference methods highlight that Bitcoin’s supposed anonymity is fragile. Address–user heuristics, community detection, and external signals (IP associations, timing, transaction patterns) collectively render the BUN a fertile substrate for economic, forensic, and systemic risk analysis, and an unambiguous example of how decentralized protocols can self-organize into highly centralized interaction backbones at scale (Ermann et al., 2017, Nonaka et al., 29 Nov 2025, Vallarano et al., 2023).