Round-Amount Heuristic

Round-Amount Heuristic is a change-detection shortcut used in blockchain analysis. People tend to send payments in tidy figures — 0.05 BTC, a flat dollar amount, or a round number of satoshis — while the change a wallet returns is whatever is left over after fees and is therefore an arbitrary, jagged value with many decimal places. When a transaction has one round output and one ragged output, an analyst guesses the round one is the real payment and the ragged one is change going back to the sender.

Why it works, and when it fails

Correctly tagging the change output lets a surveillance firm attribute that new address to the sender's wallet, extending their cluster across the transaction graph. The heuristic is probabilistic, not certain: it breaks down when both outputs are round, when a payment is itself an odd amount (such as a fiat-denominated invoice converted to BTC at a market rate), or when a wallet deliberately randomizes amounts. Exchange withdrawals often subtract a fee from a round figure, producing a ragged payment; batched payouts have many outputs and no simple payment-plus-change shape at all. But on the average two-output transaction it is a cheap and surprisingly effective signal, which is why every serious chain-analysis pipeline includes it.

One signal in a stack

Round amounts rarely stand alone. Analysts combine them with script-type analysis (if one output matches the sender's input script type and the other does not, the matching one is likely change), with output ordering quirks of specific wallet software, and with the common-input-ownership assumption that powers wallet clustering. Each heuristic is individually defeasible; stacked together they raise confidence. That stacking is also the defender's opportunity — break enough of the individual signals and the composite guess degrades to noise. The change side of this story is covered in detail under change output and change address.

Defeating the heuristic

Privacy-aware wallets undercut round-amount analysis by avoiding obviously round sends, by matching output script types so neither output stands out, and by using protocols like PayJoin that alter the apparent amounts entirely — a PayJoin output includes the receiver's contributed input, so the visible values correspond to no real payment amount. Sending fiat-pegged or randomized values makes it ambiguous which output is the payment. Deliberate coin control helps too: selecting inputs that minimize or eliminate change denies the analyst a change output to find. As with all chain-analysis countermeasures, the defender's goal is not to make detection impossible but to make the analyst's guess unreliable enough that acting on it produces false positives.

Why miners and self-custodians should care

Anyone paid in bitcoin — a solo miner sweeping a coinbase reward, a shop accepting on-chain payments, a saver practicing self-custody — leaves amount patterns on a public ledger that will be readable forever. The round-amount heuristic is a good first lesson in thinking adversarially about that ledger: surveillance is built from many small, individually weak inferences, and privacy is preserved the same way, through many small, individually cheap habits. Know what your transactions look like from the outside, and the heuristics lose most of their bite.

A short hygiene list turns theory into practice. Never reuse addresses, so each inference stays an island rather than joining a cluster. When consolidating small outputs — a habit miners fall into after sweeping pool payouts — remember that consolidation is itself a loud on-chain statement linking everything it touches, so do it deliberately and infrequently. Use a wallet that displays which output is change instead of hiding it, because you cannot manage what your tools won't show you. And when receiving, prefer invoices in odd sat amounts over round ones; you protect your payers as well as yourself. Privacy on a transparent ledger is a practice, not a product.