I understand in Ethereum you can trace it because wallet address never changes. But in Bitcoin you can change your address, no? Thanks.
How can Bitcoin transactions be traced if you can change your address?
In Bitcoin you don't change your address. You create new receiving addresses.
This is normally done so that a new address is created for each new transaction with the intention to increase privacy.
However in each transaction there are inputs and outputs and if a transaction has one input and two outputs, if you can infer which output is change, you know that there is some connection between the input address and the output address. You may be able to then trace that connection further back through a series of transactions. This is approximately like tracing possession of a coin passing through a series of people or businesses in a series of transactions.
This becomes more difficult if transactions have much more than one input and much more than two outputs.
Transactions may have certain characteristics such as address-types, size, timing and so on that may make it possible to make inferences. Transactions with differing characteristics could be inferred as being different parties, those with similar characteristics might be potentially associated with a single party of interest.
For example, if you see a large transaction with hundreds of inputs and one high-value output occur every Friday at 19:00 UTC, you might suspect it was a large exchange moving funds into cold storage as part of it's regular operational procedures. The timing might suggest a specific timezone.
We know that organisations such as the FBI perform blockchain analysis to trace illegal activity. The details of their methods are not published, so far as I know.
Let me give you two examples:
- You want to send 3BTC to address 1abc... . Your wallet uses for this transaction input address 1def... with balance 2BTC and input address 1ghj... with balance 2 BTC. On the output side you see address 1abc... with 3 BTC and 1pqr... with 1 BTC. Then it's very likely (not sure) for third parties that 1pqr is the change address belonging to the same entity as 1def... and 1ghj. This is because otherwise one input address would have been enough to do the transaction. For your next transaction 1pqr is spend together with 1stu... as common input. Even if you didn't re-use an address it's now likely that 1def..., 1ghj..., 1pqr... and 1stu are controlled by the same person. We linked addresses although they weren't re-used.
- Tracing through a mixer transaction (e.g. wasabi): You have address 3abc.. and 3def... in your wallet and both addresses are likely known belonging to the same person (derived by analytical techniques like in 1.). Now you send 3abc through a mixer and your new address is 3ghj... . If now or later 3ghj ends in the same wallet as 3def and will be co-spend together then the mixer transaction privacy is revealed for 3abc. One of my peers recently traced a wasabi transcation and was able to link 22% of the output addresses to their inputs with this method.