Bitcoin Address Lookup: Check Any BTC Address on a Block Explorer
Every Bitcoin address is a public file you can read in about thirty seconds with the right tool. Paste it into a block explorer and the network gives you the entire history: balance, total ever received, every transaction in or out, the first day it was used, the last, and a list of currently spendable coins. None of this requires permission or even an account. The Bitcoin ledger is the closest thing to a fully searchable public bank statement we have. This guide walks through how to look up an address, the four address formats you will encounter, what the screen actually shows, which explorers to use, what clustering reveals, how to check an address against OFAC and scam databases, and the practical five-step workflow I run before sending Bitcoin to anyone new.
What a Bitcoin address lookup actually is
A Bitcoin address lookup is a query against the Bitcoin blockchain that returns everything the network knows about one address. You hand it the address. The block explorer hands back balance, total received, total sent, transaction count, first and last seen block, and the list of unspent transaction outputs. Run it from a phone, a desktop, a Tor browser, or your own self-hosted node — the data is the same. There is only one Bitcoin ledger. The same workflow doubles as a wallet lookup, since every Bitcoin wallet is, at the protocol level, just a bag of addresses you can monitor one by one.
The four Bitcoin address types you will see
Four formats. Each address you find online belongs to one of them, and the prefix tells you which.
| Type | Prefix | Encoding | BIP | Activation date |
|---|---|---|---|---|
| P2PKH (Legacy) | `1...` | Base58Check | Original | Jan 3, 2009 (Genesis block) |
| P2SH | `3...` | Base58Check | BIP 16 | Apr 1, 2012 |
| Bech32 SegWit v0 | `bc1q...` | Bech32 | BIP 173 | Aug 24, 2017 |
| Taproot (P2TR) | `bc1p...` | Bech32m | BIP 341 | Nov 14, 2021 (block 709,632) |
The canonical Legacy example is Satoshi's first: `1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa`. Holds the 50 BTC Genesis coinbase. Untouched since January 3, 2009. P2SH (`3...`) showed up in April 2012 with BIP 16; it made multi-sig practical for the first time. Bech32 SegWit (`bc1q...`) cut transaction sizes after the August 2017 soft fork and now drives north of 80% of on-chain volume. Taproot (`bc1p...`) arrived November 2021 using Bech32m, sits around 55% of node support, but real outputs stay in single digits outside Ordinals spikes.
Quick practical note. Base58 strings are case-sensitive. Bech32 strings are not, and they carry a checksum that flags almost any typo. When the explorer rejects an address, blame a stray font swap (`0` vs `O`, `1` vs `l`) or a missing character. Not the network.
What a block explorer shows: balance, transactions, UTXOs
Open any modern Bitcoin block explorer, paste a valid address, and you will see roughly the same set of fields. Knowing what each one means is the difference between a casual glance and a useful read.
Balance is the sum of unspent transaction outputs assigned to that address right now. It is not the same as total received. Total received is the lifetime sum of every Bitcoin ever credited to the address. Total sent is the lifetime sum of every Bitcoin ever debited. Balance equals total received minus total sent, by definition.
Transaction count is the number of confirmed transactions involving the address. A high count, in the thousands or tens of thousands, usually indicates an exchange hot wallet or a payment processor address. A low count, sometimes just one or two, is typical of personal cold storage. First seen and last seen show the block height and timestamp where activity began and ended. The list of unspent transaction outputs gives the exact amount of each coin sitting at the address, which matters for fee estimation and for understanding how a wallet would spend.
Mempool data is the live, unconfirmed layer. Mempool.space displays pending inbound and outbound transactions in real time, often before the rest of the explorer ecosystem updates. Some explorers also attach labels and flags — exchange names, OFAC sanctions, Chainabuse scam reports — that are not part of the protocol itself, but layered analytics from companies like Chainalysis, Arkham, and TRM Labs.
If you only need to check Bitcoin address balance and recent activity, almost every explorer also exposes a clean wallet balance view that combines all the address-level data into a single panel. Run a balance checker query on a busy exchange hot wallet and you will see the same fields, just with millions of transactions stacked up over years.
The best block explorers for Bitcoin address lookup
Not every explorer is built the same way, and the right choice depends on what you care about: privacy, depth, speed, or programmatic access.
| Explorer | Focus | API free tier | Privacy notes |
|---|---|---|---|
| Mempool.space | Bitcoin-only, mempool/fee market, Lightning, AGPL open source | Public REST, no key for basic queries | Tor mirror, no ads, no trackers |
| Blockstream.info | Bitcoin + Liquid + Lightning, no JavaScript required | Esplora API, public | Tor onion, tracking-free |
| Blockchain.com | Multi-chain (BTC, ETH, BCH), wallet+exchange tied | Limited free queries | Embedded analytics and ads |
| BlockCypher | API-first, BTC/LTC/Doge/ETH | 3 req/s, 100 req/hour, 2,000 req/day | Paid plans from $119/month |
| OXT.me | Advanced clustering and UTXO graph | Web only | Bitcoin-only |
| Btcscan.org | Esplora fork, minimalist | Public | Tor mirror |
Mempool.space is my default for almost everything. It runs on AGPL-licensed open source code, you can self-host it on a Raspberry Pi, there are no trackers, and the mempool visualization is unique in the industry. Blockstream.info is the right pick when JavaScript is off or when you need Lightning Network detail. Blockchain.com is the legacy choice and works fine for casual lookups, but the page carries ads and analytics scripts. BlockCypher is a developer platform first — the free tier covers casual scripting, while the $119-per-month plan unlocks higher throughput.
For serious cluster analysis, OXT.me has a free interactive UTXO graph that no general-purpose explorer matches. For minimalists, Btcscan.org strips the interface down to the essentials and runs as a clone of the Esplora reference implementation. All of the explorers above are free to use through their public website front-ends, with no signup required, and they will let you monitor any address indefinitely. A few mobile-first tracker apps in this category, including BlockChair's portfolio view and the BTC.com mobile suite, build a thin UI on top of the same underlying data.
Address clustering: what your lookup actually reveals
A naive lookup of one address shows the activity of one address. A serious lookup reveals an entire wallet, because addresses cluster.
The foundational work here is Sarah Meiklejohn's 2013 paper "A Fistful of Bitcoins," presented at the Internet Measurement Conference that year. Her team collapsed 12 million Bitcoin public keys down to 3.3 million wallet clusters, leaning on two heuristics. First: common-input ownership. When multiple addresses turn up as inputs to one transaction, the Bitcoin protocol requires whoever spent them to control all of them. They almost always belong to a single wallet. Second: change-address detection. The team flagged freshly-created outputs receiving the leftover coins as change. That single trick identified 3.5 million change addresses with a false-positive rate of roughly 0.17%.
Chainalysis Reactor and TRM Labs Forensics use refined versions of these heuristics plus behavioral and temporal signals. The practical result is that a single address, in many cases, is the visible tip of a much larger wallet cluster, and clustering software can stitch the cluster back to an exchange, an OTC desk, or a service that knows the customer's name.
Privacy tools that resist clustering have had a rough year. Samourai Wallet founders Keonne Rodriguez and William Lonergan Hill were arrested by the US Department of Justice on April 24, 2024, on a $2 billion money-laundering indictment that cited $100 million in alleged proceeds. The Whirlpool CoinJoin service shut down with them. Wasabi Wallet's parent company zkSNACKs announced on May 2, 2024 that it would discontinue CoinJoin coordination on June 1, 2024, and blocked US users a few days earlier. Trezor followed. As of mid-2026, mainstream Bitcoin privacy in the US is a much narrower space than it was two years ago.
OFAC sanctions and scam-address checks
A lookup also tells you if a counterparty is on a sanctions list or in a scam database. Worth thirty seconds every time you face a new address.
OFAC, the US Treasury's Office of Foreign Assets Control, runs the SDN list. Specific Bitcoin and Ethereum addresses now sit on it. Tornado Cash addresses landed there August 8, 2022, then got delisted March 21, 2025 after the Fifth Circuit ruled against Treasury on November 26, 2024. Ilya Lichtenstein pleaded guilty to laundering proceeds from the Bitfinex hack, drew a five-year sentence on November 14, 2024, and was released early on January 2, 2026. Garantex addresses showed up on the SDN list in 2025. You can search the SDN list as plain text on treasury.gov, and every serious compliance service mirrors it.
Three other tools cover the consumer side. Chainabuse.com pools user-submitted scam reports against specific addresses. A clean record is a reasonable, if imperfect, signal. Chainalysis Address Screening is the enterprise version of the same thing. BitcoinAbuse, the older community database, got absorbed into Chainabuse back in 2022. None of these catch every scam — fresh addresses always run a step ahead — but any hit is a hard stop.
Chainalysis, TRM Labs, and the forensic stack
The forensic layer above public explorers is dominated by two companies. Chainalysis, valued at $8.6 billion after its Series F in 2022, reportedly does around $87 million in revenue with about 773 employees. Its clients include the US Treasury, the IRS Criminal Investigation Division, and the FBI. TRM Labs hit a $1 billion valuation in February 2026 on a $70 million Series C and serves a similar mix of federal agencies, exchanges, and stablecoin issuers.
These companies do not run the Bitcoin network or alter the underlying data. They build labels on top of it. Their 2026 reporting puts global illicit on-chain volume for 2025 at roughly $154 billion, up about 162% year over year, with stablecoins accounting for 84% of that figure. Bitcoin's share has been falling for years as criminals migrate to chains and assets with better privacy and lower fees. A full Chainalysis Reactor report on a single wallet cluster can stretch to hundreds of pages.
For a non-enterprise user, the practical takeaway is that you do not need a Chainalysis subscription to track your crypto sensibly. A public explorer plus the OFAC and Chainabuse lookups described above will catch the obvious red flags. The enterprise stack matters when you need to defend a regulator filing or build a case in court.
The takeaway for an ordinary address lookup is that public explorers show the data and forensic platforms show the inferences. The first is enough for most people. The second is what regulators, exchanges, and serious investigators add on top.
A 5-step practical Bitcoin address lookup workflow
When someone sends me a Bitcoin address to pay, my workflow runs in five steps and takes under three minutes. It is the same workflow I would use to audit any address a friend or counterparty wanted to verify, and it relies only on free public tools.
One. Paste the address into Mempool.space and confirm it parses as a valid Bitcoin address with the right prefix. If the explorer throws an error, fix the typo before going any further.
Two. Check balance and transaction count. A brand new address with no history is fine for a personal counterparty but a yellow flag for a business that claims years of operation. A high transaction count usually signals an exchange or processor and is normal there.
Three. Check first and last seen. If the most recent activity is years old and the counterparty insists this is their main working wallet, that mismatch deserves a real explanation before any money moves.
Four. Cross-reference the address against Chainabuse and the OFAC SDN list. A hit on either is a hard stop, no exceptions.
Five. Decide. If anything in steps one through four still feels off, send a tiny test amount first and confirm the recipient acknowledges receipt before you send the full payment.
