Crypto Security & Privacy How Timing Analysis Exposes Intermediary Wallets Owen Gaines Owen Gaines is a professional poker player and author who has played an estimated ten million hands and written four poker strategy books. October 30, 2026 An intermediary wallet is an address that receives funds and forwards them to a final destination, such as a poker cashier. Many players add one, or several, between an exchange and a deposit address on the assumption that the extra hop breaks the link between them. On public blockchains like Bitcoin and Ethereum, it usually does not. Timing analysis, one of the oldest and simplest chain analysis techniques, reconnects the path by matching when funds arrive and when they leave. Understanding why matters for realistic privacy expectations. Cryptocurrency transactions are pseudonymous, not anonymous: addresses carry no names, but every transfer, amount and timestamp is permanently public. Intermediaries add fees, extra transactions and operational security risk, while the privacy they appear to offer is mostly illusory. This guide explains how timing analysis works, which signals reinforce it, and what actually improves transaction privacy for crypto poker players. What Intermediary Wallets Actually Do A typical pattern looks like this: a player withdraws from an exchange to a fresh wallet, then forwards the balance to a poker deposit address. On-chain, that creates two transactions, A to B and B to C. Nothing in the protocol hides that B received a specific amount from A and sent nearly the same amount to C shortly afterward. The intermediary changes the graph but not the information in it. Every address, value and block timestamp remains visible to anyone running a node or using a block explorer. Analysts do not need to identify B; they only need to recognize that B behaved like a pass-through. The sections below explain how that recognition works and why stacking more hops rarely changes the outcome. How Timing Analysis Links Transactions Timing analysis compares when value enters an address with when it leaves. Funds that arrive and depart within a short window, typically minutes to hours, with an outgoing amount close to the incoming amount minus a network fee, strongly suggest a pass-through. The shorter the holding time and the closer the amounts, the higher the confidence. Block timestamps make this straightforward. On Bitcoin, blocks average about 10 minutes apart; on Ethereum, a new block arrives every 12 seconds. Both provide fine-grained ordering that analysts can align across hops. Network-Level Timing Timing also leaks below the blockchain. When a wallet broadcasts a transaction, nodes that observe it first can estimate where it originated. Wallets that rely on third-party servers also reveal which addresses they query and when. Neither appears on-chain, but both feed the same timing correlation. Signal What Analysts Observe Why It Links Addresses Holding time Minutes to hours between receive and send Short dwell time indicates a pass-through address Amount similarity Outgoing value equals incoming minus fee Unique amounts act as fingerprints across hops Address lifecycle Address used once, then emptied Single-use relay behavior is distinctive Broadcast timing First node to relay a transaction Can approximate the sender’s network location No single signal proves ownership. Analysts combine them probabilistically, and confidence rises quickly when several align. What This Means for Player Privacy For most players, the practical consequence is that intermediary wallets add cost without adding meaningful privacy. Each extra hop costs a network fee and adds an address to secure. If the intermediary is a hot wallet on a phone or browser, it also adds an attack surface for funds that would otherwise move directly. Regulated exchanges and many payment processors run commercial chain analysis on incoming and outgoing transactions. A path that looks like deliberate obfuscation can attract more attention, not less, and may trigger additional verification or delayed processing. That is a compliance reality, not a judgment about the player. Common Mistakes Players Make Believing a fresh address breaks the link to an exchange withdrawal, when the funding transaction remains public and traceable Forwarding exact amounts through several wallets, creating a distinctive chain of near-identical values Reusing the same intermediary for multiple deposits, which clusters all of them into one identifiable pattern Assuming privacy and anonymity are the same, and taking on extra fees and key-management risk for protection that does not exist Heuristics That Reinforce Timing Signals Common-Input Ownership On Bitcoin, when a transaction spends several inputs, analysts assume one entity controlled them all. Consolidating funds in an intermediary wallet therefore links every source address to the same owner. Change Detection Most Bitcoin transactions produce a change output back to the sender. Analysts identify it using script type, round-number payments and wallet fingerprints, then follow the change as the sender’s continuing balance. Account-Model Transparency Ethereum and other account-based chains reuse a single address for all activity by default. There is no change output to obscure, so every in and out of an intermediary account sits in one public ledger entry, making timing correlation even more direct than on Bitcoin. Tracing a Two-Hop Deposit Path This example shows how an analyst reconstructs a common pattern. A player withdraws BTC from an exchange and routes it through one intermediary before depositing to a poker cashier. Hop 1: exchange withdrawal to a new address, confirmed in a given block Dwell time: the intermediary holds the funds for roughly 30-60 minutes Hop 2: a single output to the cashier address, equal to the received amount minus a network fee Context: the exchange knows the withdrawal destination; the cashier knows the deposit source The Technical Process The analyst starts from either end. The amount leaving the intermediary matches the amount entering it, minus a fee consistent with the observed fee rate. The intermediary has no other history. Within one hour, a single address received and fully forwarded a unique amount. The two hops collapse into one logical transfer. The Outcome The intermediary provided no separation, cost an extra fee, and created a pattern that looks more deliberate than a direct deposit. A direct transfer would have revealed the same relationship with less cost and less risk. How Professionals Approach Transaction Privacy Experienced players start from a realistic threat model. Their goal is usually to keep balances and activity from being casually visible to strangers, not to hide from regulated counterparties they have already verified with. Technical Risk Management They avoid address reuse, never post deposit or withdrawal addresses publicly, and keep poker activity in a separate wallet from long-term holdings so that one exposed address does not reveal everything. System Optimization They run their own node or use privacy-respecting wallet backends to avoid leaking address queries, use coin control to avoid merging unrelated funds, and deposit directly through the ACR Poker software cashier rather than adding hops that cost fees without adding privacy. Privacy rules and reporting obligations vary by jurisdiction. Technical Evolution in Chain Analysis and Privacy Chain analysis keeps improving as datasets grow and machine learning models combine timing, amount and behavioral signals at scale. At the same time, protocol-level privacy work, such as improved transaction relay and wallet fingerprint reduction, aims to limit metadata leaks. The durable lesson is that privacy comes from protocol design and disciplined wallet hygiene, not from adding intermediate addresses. Players who understand what is public can make informed choices about what they expose. Frequently Asked Questions What is timing analysis in blockchain tracing? Timing analysis compares when funds arrive at an address with when they leave. If an address receives a specific amount and forwards nearly the same amount shortly afterward, analysts treat it as a pass-through and link the sender to the final recipient. Combined with amount matching and other heuristics, it can reconnect multi-hop transaction paths with high confidence. Does sending crypto through an extra wallet make it anonymous? No. Public blockchains record every address, amount and timestamp permanently. An intermediary wallet adds a hop to the transaction graph but does not remove information from it. Analysts identify pass-through behavior from dwell time and matching amounts, so the extra wallet typically adds fees and security risk without providing meaningful anonymity. Is Bitcoin anonymous? Bitcoin is pseudonymous, not anonymous. Addresses are not tied to names on-chain, but all transactions are public and permanent. Once any address is linked to an identity, for example through a verified exchange, chain analysis can often follow funds forward and backward using timing, amount and input-clustering heuristics across many hops. Why might a deposit routed through several wallets get reviewed? Exchanges and payment processors commonly screen transactions with chain analysis tools. Paths with multiple short-lived hops and matching amounts can resemble deliberate obfuscation, which may trigger additional verification. That is a standard compliance process. Direct transfers from a verified source are simpler, cheaper and less likely to raise questions during review. What actually improves transaction privacy for poker players? Realistic steps include avoiding address reuse, never sharing deposit addresses publicly, separating poker funds from long-term holdings, using coin control to avoid merging unrelated funds, and running your own node or a privacy-respecting wallet backend. These limit casual exposure without adding hops that cost fees and create distinctive, traceable patterns on-chain.