---
title: Bitcoin User Network (BUN)
url: https://www.emergentmind.com/topics/bitcoin-user-network-bun
type: topic
---

# Bitcoin User Network (BUN)

The Bitcoin User Network (BUN) is the directed, time-resolved graph whose nodes are addressed-clusters—representing pseudonymous “users” as inferred under established address-linkage heuristics—and whose edges encode all on-chain payment relationships. At its core, the BUN operationalizes the underlying money-flow architecture abstracted from the raw blockchain and supports an array of quantitative analyses of wealth concentration, structural centralization, community formation, and vulnerability. Research over the period 2009–2025 reveals that although the Bitcoin protocol is maximally decentralized in its consensus mechanism, the emergent BUN exhibits persistent, sometimes intensifying, mesoscale centralization, manifest in heavy-tailed centralities, a dense strongly-connected core, and a resilient yet risk-prone backbone determined by super-hub nodes such as exchanges.

## 1. Network Construction and Node Definition

A user in the BUN is operationally defined as a cluster of addresses, identified primarily via the multi-input clustering heuristic: addresses are grouped under a single “user” if they have ever appeared together as inputs to the same transaction. This cluster representation is often augmented by a change-address heuristic, wherein (typically) the smallest output of a transaction is attributed to the sender, though variations exist in precise implementation [1711.11499], [2512.00437], [2307.14409], [2005.00114].

Formally, at any time $t$, the BUN is a directed graph $G^{(t)} = (V^{(t)}, E^{(t)})$ where $V^{(t)}$ is the set of user entities (address clusters), and $E^{(t)} \subseteq V^{(t)} \times V^{(t)}$ records the transaction links observed in a time window. Edge weights can represent either aggregate transaction count, summed BTC value, or binary presence/absence depending on analysis goals. Adjacent methodologies use temporal segmentation (daily or weekly snapshots) and map raw transaction data to the BUN through aggregation and address pre-processing pipelines [1805.04460], [2512.00437], [1804.08044], [1912.08101]. Table 1 summarizes essential construction principles.

| Heuristic           | Description                                            | Reference         |
|---------------------|-------------------------------------------------------|-------------------|
| Multi-input         | Cluster all addresses in a transaction’s input set     | [1711.11499]      |
| Change-address      | Assign change output to sender if heuristically safe  | [2307.14409]      |
| Community detection | Hierarchical aggregation of weak linkage signals      | [1710.08158]      |

## 2. Structural Characterization: Centralities, Communities, and Core-Periphery

Topologically, the BUN is characterized by sparse connectivity ($d(t) \sim N^{-1}(t)$), heavy-tailed (power-law or truncated power-law) degree distributions, and low clustering coefficients ($C < 0.01$ at scale) [1711.11499], [2005.00114], [2307.14409]. Typical fitted degree exponents are $\gamma \approx 1.8-2.5$ for out-degree, and similar or slightly larger for in-degree, depending on the temporal segment and clustering specifics [1711.11499], [2306.06108].

Mesoscopically, the BUN admits a persistent core-periphery and bow-tie stratification. The core, operationally the largest strongly connected component (LSCC), encompasses 10–40% of users over the years, acting as a backbone for mutual fund circulation among exchanges, large services, and market-makers [2307.14409], [2512.00437], [2106.11446]. Surrounding the core is a periphery of IN nodes (net suppliers), OUT nodes (net consumers), and tendrils, mirroring the classic bow-tie structure of the Web [2106.11446], [2307.14409].

Community structure manifests as clusters of strongly interlinked addresses, often corresponding to mining pools, exchanges, or “coin-churning” entities; these are detected as plateaus in eigenvectors associated with low-decay eigenvalues ($\gamma = -2\ln|\lambda| \ll 1$) of the Google matrix [1711.11499]. Modularity-optimized partitions are generally statistically fragile in the BUN after accounting for core-periphery structure [2005.00114].

## 3. Centralization, Assortativity, and Inequality Metrics

The BUN displays persistent structural centralization, most quantitatively captured by centrality score Ginis and directed assortativity coefficients. Direction-sensitive PageRank and HITS (both authority and hub scores) encode node prominence; in empirical snapshots, Gini coefficients for PageRank reach 0.55, while HITS hub/authority Ginis often exceed 0.90, indicating extreme concentration—far sharper than expected from degree alone [2512.00437], [1711.11499].

Directed assortativities $r_{\alpha,\beta}$ (for $\alpha, \beta \in \{\mathrm{in},\mathrm{out}\}$) remain stably negative ($-0.1$ to $-0.2$), reflecting disassortative mixing: super-hubs transact mainly with periphery nodes rather than with one another [2512.00437], [2307.14409], [2203.09026]. Rich-club coefficients further confirm that highly connected users do not preferentially link among themselves, in contrast to classical social networks.

Raw-flow Gini indices for transaction volume are in the range $0.92 < g < 0.95$, strongly indicating that a minute fraction of users receive (and send) the overwhelming majority of all bitcoins in circulation [1711.11499]. When computed via random-surfer centralities (PageRank, CheiRank), gini values of $\sim 0.50$ persist, indicating that even under maximal damping, ranking-induced inequality remains substantial.

## 4. Temporal Evolution and Links to Price Dynamics

Over the period from the genesis block to late 2025, the BUN’s order-of-magnitude scaling in total users ($|V|$ grows from $10^3$ to $10^7$—and over $10^8$ addresses—by 2025) is accompanied by pronounced sparsification (density decays as $N^{-1}$) and linear expansion in edge count [2005.00114], [1907.03577]. Mesoscopic features—a growing and then receding LSCC, as well as fluctuations in core size and reciprocity—track closely the major macroeconomic cycles and bubbles in Bitcoin’s market price [2307.14409], [1907.03577], [1805.04460].

Higher moments of the out-degree distribution (std, skewness, kurtosis) are Granger-causal for (future) price dynamics in certain epochs—especially pre-2014—with increased heterogeneity preceding drawdowns and core swelling coinciding with price bubbles [1805.04460], [1907.03577]. 
Z-score peaks in core-periphery link counts and reciprocated motifs are tightly synchronized with bubble onsets. Post-2016, the core contracts and IN-periphery expansions accelerates, indicating a shift toward predominantly one-way flow regimes at large scale [2307.14409]. Despite the notorious hypervolatility of BTC prices (minute-scale volatility $\downarrow$ from 0.307 in 2020 to 0.077 in 2025), no systematic short-term coupling between price shocks and mesoscopic rewiring under weekly aggregation is detected [2512.00437].

## 5. Community Detection, Anonymity, and Entity Re-identification

Multiple works demonstrate that through weak-signal community detection (e.g., Louvain on a “hint” network of address clusters), substantial portions of Bitcoin’s user structure can be reconstructed, undermining naïve assumptions about pseudonymity [1710.08158]. Precision-recall tradeoffs in real-world cluster identification show adjusted NMI values exceeding 0.65 on standardized benchmarks [1710.08158]. Bayesian methods leveraging network propagation times allow mapping user clusters to originator IPs, further tying network structure to exogenous identity signals [1612.06747]. 

Visualization tools such as BitConduite allow rapid, article-scale, and entity-oriented exploration of the BUN: users (entities) are clustered by activity metrics (transaction frequency, durations, value, in/out degree) and partitioned via $k$-means in feature space, providing actionable insights into user typologies (e.g., distinguishing between “one-timers,” “high-activity exchanges,” and miners over halving events) [1912.08101].

## 6. Systemic Risk, Fraud Detection, and Practical Implications

Superhubs, notably large exchanges (e.g., Mt Gox in early datasets), are systemic risk concentrations: the removal or failure of a top hub can disconnect up to 20% of users from the network’s largest component during bubbles [1805.04460]. Star-like triadic motifs are overrepresented around such superhubs during bubbles, serving as precursors to stress and potential early-warning signals. The BUN’s topology—rich in isolated communities, scale-free interlinkage, and persistent core—can be exploited for malicious activity (fraud, Sybil attacks, money laundering), but also provides robust statistical signatures for algorithmic anomaly detection [2203.09026], [2306.06108].

Feature-based supervised models trained on BUN-induced entities (with node-level feature aggregation) achieve F1 scores above 0.8 in illicit-activity detection; centrality measures (degree, PageRank) and transaction motifs are principal features for anti-money-laundering and forensic workflows [2306.06108]. The observed structural centralization and its implications—growing concentration of wealth and connectivity—raise enduring questions for resilience, regulatory oversight, and the decentralization narrative [2512.00437].

## 7. Concluding Synthesis: Stabilization, Centralization, and Identity

The current BUN, as of late 2025, is a mature yet asymmetric, core–periphery network with high concentration of both transactional wealth and structural influence. Although the protocol is decentralized and open, empirically the BUN is marked by a dense core, persistent negative degree-assortativity, and Gini coefficients reflecting activity and wealth condensation among a small set of users that function as systemically critical infrastructure. 

All established clustering and network-inference methods highlight that Bitcoin’s supposed anonymity is fragile. Address–user heuristics, community detection, and external signals (IP associations, timing, transaction patterns) collectively render the BUN a fertile substrate for economic, forensic, and systemic risk analysis, and an unambiguous example of how decentralized protocols can self-organize into highly centralized interaction backbones at scale [1711.11499], [2512.00437], [2307.14409].

Source: https://www.emergentmind.com/topics/bitcoin-user-network-bun