Last Updated: February 2026

When Ethereum’s Dencun upgrade went live in March 2024, it triggered a gas fee collapse that dropped average transaction costs from $24 to under $1 within months. By February 2026, base fees sit at 0.1 gwei – a 95% decline from early 2024 levels. That collapse did not just change what users pay. It changed what investigators can see. With gas fees no longer dominated by congestion-driven bidding wars, the forensic signals embedded in how wallets choose their gas parameters have become clearer and more distinctive than ever.

Every Ethereum transaction carries gas data that reveals more about the sender than most users realize. The priority fee a wallet sets indicates urgency. The gas limit chosen fingerprints the transaction type. The ratio between maximum fee and actual fee paid reveals how conservatively the sender estimates costs. And the pattern across hundreds of transactions – the statistical distribution of a wallet’s gas choices over time – can distinguish a human from a bot, an exchange hot wallet from a personal wallet, and in documented cases, link the deposit and withdrawal sides of a mixer transaction that was supposed to be anonymous.

At Crypto Trace Labs, gas pattern analysis is a standard component of our Ethereum forensic investigations. This guide explains the specific signals that gas data produces, how those signals classify wallet behavior, and where real cases have demonstrated the technique in practice.

What Investigators Need to Know

• Priority fee choices directly reveal sender urgency – near-zero tips indicate patience, while 50+ gwei tips indicate panic, front-running, or MEV extraction
• Gas limit values fingerprint transaction types – a simple ETH transfer uses exactly 21,000 gas, a Uniswap swap uses 100,000-150,000, and complex DeFi interactions use 200,000+
• Normalized gas price profiles can deanonymize mixer users – research demonstrated that the mean and variance of a wallet’s gas prices serve as quasi-identifiers linking deposit and withdrawal addresses
• MEV bots produce statistically distinct gas patterns – machine-precise priority fees, zero variance between identical operations, and willingness to spend up to 90% of expected profit on gas
• Gas analysis was used in the Tornado Cash trial – investigators applied “gas ratio analysis” to trace deposits, though the methodology’s error rates remain contested

How Do Gas Fee Components Create Forensic Signals?

Since EIP-1559 restructured Ethereum’s fee market in August 2021, every transaction carries three gas parameters that each produce distinct forensic intelligence. The base fee is set algorithmically by the network based on block utilization – it increases when blocks are more than 50% full and decreases when they are less. Because the base fee is identical for all transactions in a block, it reveals nothing about individual sender behavior. But temporal patterns in base fee fluctuations serve as a network-wide event detector – unexplained spikes often signal an active exploit, liquidation cascade, or high-value NFT mint.

The priority fee (tip) is where individual behavior emerges. This is the amount a sender voluntarily pays to validators for faster inclusion, and it varies enormously by wallet type. Human users typically accept their wallet software’s default suggestion of 1-3 gwei. Exchanges use moderate, consistent priority fees across their hot wallet operations. MEV bots calculate priority fees as a precise function of expected profit, sometimes bidding hundreds of gwei when competing for a sandwich attack opportunity worth thousands of dollars.

The maxFeePerGas parameter – the absolute ceiling a sender is willing to pay – adds another dimension. The gap between maxFeePerGas and the actual fee paid reveals risk tolerance. A wallet that consistently sets maxFeePerGas at 5x the current base fee is building in heavy safety margins (typical of automated systems designed to never fail). A wallet that sets it barely above the current base fee is either highly sophisticated in fee estimation or willing to risk transaction failure. Different wallet software sets these parameters differently, creating fingerprints that persist across transactions.

What Do Gas Price Patterns Reveal About Wallet Types?

Research published at the ACM Web Conference in 2024 confirmed that gas price and gas limit are among the most influential features for detecting financial bots on Ethereum. The study classified seven categories of bots and achieved 83% accuracy distinguishing automated wallets from human-operated ones using behavioral features that prominently included gas parameters.

Human wallets show high variance in gas choices because humans make inconsistent decisions. They accept wallet defaults most of the time, occasionally override with manual settings when a transaction feels urgent, and rarely optimize. The statistical distribution of a human wallet’s gas prices clusters around wallet-suggested tiers (slow, average, fast) with irregular outliers.

Bot wallets show near-zero variance for identical operation types. An arbitrage bot executing the same swap across hundreds of transactions will set nearly identical gas limits and calculate priority fees algorithmically based on expected profit margins. The consistency itself is the signal – no human maintains that level of precision across thousands of transactions. MEV bots specifically are willing to spend up to 90% of their expected revenue on gas fees, a behavior that no rational human user would exhibit.

Exchange hot wallets fall between the two extremes. They use programmatic gas settings but with more conservative parameters than MEV bots. Exchange withdrawal transactions show characteristic batching patterns with consistent gas limits, moderate priority fees, and predictable timing that correlates with the exchange’s internal processing schedule. Crypto Trace Labs uses these gas signatures alongside address clustering to identify exchange infrastructure in investigations where the exchange has not been publicly labeled.

An earlier study titled “Blockchain is Watching You” (Beres et al., 2020) demonstrated that normalized gas price profiles serve as quasi-identifiers for Ethereum users. By computing the mean, median, and standard deviation of a wallet’s gas prices normalized against daily network averages, researchers created behavioral fingerprints that could link wallets belonging to the same entity – even when the entity used different addresses for different activities.

How Did One MEV Bot Spend $175 Million in Gas Fees?

The MEV sandwich bot known as jaredfromsubway.eth is the most documented case of gas-based behavioral profiling in blockchain forensics. Between February 2023 and June 2024, the bot spent 76,916 ETH (approximately $175 million at time of execution) on gas fees alone, making it one of the largest individual gas consumers in Ethereum’s history.

The bot’s gas pattern was immediately identifiable. On its peak day in April 2023, jaredfromsubway.eth consumed 7% of all Ethereum gas fees, spending over 210 ETH ($810,000) on gas in 24 hours while netting approximately $950,000 in sandwich attack profits. The gas signature was distinctive: pairs of transactions in every block where the first (front-run) used a high priority fee to ensure execution before the victim’s swap, and the second (back-run) used a precisely calculated lower fee to execute immediately after. Over its lifetime, the bot executed more than 238,000 sandwich attacks against over 106,000 victims, generating at least $22 million in net profit.

The forensic significance extends beyond identifying the bot itself. The bot’s gas spending was so large that it visibly distorted Ethereum’s fee market – driving average transaction costs from approximately $1 to over $10 during peak memecoin trading periods. This distortion became evidence in broader investigations into MEV’s impact on retail users and informed regulatory discussions about on-chain market manipulation. When the operator launched a successor contract (“Jared 2.0”) in August 2024, investigators identified it within days by matching the gas spending patterns and contract interaction signatures to the original bot’s behavioral profile.

In a related case, two MIT-educated brothers were charged by the DOJ in May 2024 for exploiting a vulnerability in MEV-boost infrastructure to steal $25 million in 12 seconds. Their attack required creating 16 Ethereum validators and using bait transactions to study how three specific MEV bots responded to gas price signals – essentially reverse-engineering the bots’ gas-based decision logic to manipulate them. The trial ended in a mistrial in November 2025, but the case established that gas pattern analysis is central to both executing and investigating MEV-related crime.

How Do Investigators Use Gas Patterns to Identify Mixer Users?

Gas pattern analysis played a documented role in the investigation and prosecution of Tornado Cash, the Ethereum mixing protocol sanctioned by OFAC in August 2022 after Chainalysis determined that North Korea’s Lazarus Group had laundered over $455 million through the service.

The technique works because mixer users cannot fully control the gas fingerprint their wallet leaves. Even when a user deposits into Tornado Cash from one address and withdraws from a fresh address, both addresses share the same wallet software, the same gas estimation habits, and the same behavioral patterns. Researchers demonstrated that normalized gas price profiles – the statistical distribution of gas choices relative to network conditions – could link deposit and withdrawal addresses that were supposed to be unlinkable.

During the Roman Storm trial in 2025, an investigator at AnChain.AI used a “gas ratio analysis” methodology to trace cryptocurrency deposits into Tornado Cash. Defense experts challenged the methodology for having unknown error rates, highlighting that gas-based deanonymization remains a contested forensic technique. Storm was ultimately convicted on money transmitting charges, though the jury deadlocked on the more serious money laundering and sanctions charges.

For investigators at Crypto Trace Labs, gas pattern analysis is one signal among many in transaction graph investigations involving mixers. It is most effective when combined with timing analysis, deposit amount patterns, and withdrawal destination behavior. No single gas metric is sufficient for attribution, but the combination of gas price distribution, gas limit choices, and priority fee behavior creates a multi-dimensional fingerprint that strengthens the overall investigative picture.

What Do Gas Limit Fingerprints Reveal About Transaction Types?

Different smart contract operations consume predictable amounts of gas, creating signatures that identify transaction types even without decoding the calldata. A simple ETH transfer always uses exactly 21,000 gas. An ERC-20 token transfer requires 45,000 to 65,000 gas depending on the contract implementation. A Uniswap swap consumes 100,000 to 150,000 gas. Complex DeFi interactions with protocols like Aave or Compound require 200,000 to 500,000+ gas.

Investigators use these signatures to classify a wallet’s activity profile without needing to decode every transaction’s function call. A wallet whose gas consumption clusters around 21,000 and 45,000-65,000 is primarily transferring ETH and tokens – likely a personal wallet or payment processor. A wallet consistently consuming 100,000-150,000 gas per transaction is actively trading on decentralized exchanges. A wallet with gas usage above 200,000 is interacting with complex DeFi protocols or deploying contracts.

The gas limit a wallet sets (versus the gas actually consumed) provides additional intelligence. Wallets that set gas limits exactly matching expected consumption are running optimized software with precise gas estimation – characteristic of bots and institutional infrastructure. Wallets that set gas limits with large buffers (2-3x expected consumption) are using standard wallet software with conservative defaults – characteristic of individual users. This distinction supports the bot-versus-human classification that blockchain forensic analysis uses to prioritize investigation targets.

Frequently Asked Questions

Can gas patterns alone identify who owns a wallet?

Gas patterns cannot identify a specific individual, but they narrow the field significantly. Gas-based behavioral profiling classifies wallets by type (bot, human, exchange, mixer user), estimates the wallet software being used, and in some cases links multiple addresses to the same entity through shared gas price distributions. This classification feeds into broader attribution workflows that combine gas analysis with clustering, timing, and exchange data.

How did EIP-1559 change gas forensics?

EIP-1559 separated the gas fee into a network-determined base fee and a user-chosen priority fee. This separation created a cleaner forensic signal because the priority fee directly reflects individual sender behavior without being confounded by network congestion. Before EIP-1559, a high gas price could mean either urgency or congestion. After EIP-1559, a high priority fee specifically indicates the sender’s willingness to pay for speed.

Do MEV bots still affect gas prices in 2026?

Yes, though the dynamics have shifted. On Ethereum mainnet, ultra-low base fees mean MEV competition primarily manifests in priority fee bidding rather than gas price inflation. On Layer 2 networks like Base and Optimism, MEV-related spam bots consume over 50% of gas capacity. The jaredfromsubway.eth successor bot (“Jared 2.0”) continues operating, and new MEV strategies continue to emerge as the ecosystem evolves.

Can gas analysis detect Tornado Cash usage?

Academic research demonstrated that gas price profiles can link Tornado Cash deposit and withdrawal addresses through statistical similarity in gas choosing behavior. This technique was applied during the Tornado Cash investigation and trial, though its error rates were challenged by defense experts. Gas analysis is most effective as a supporting signal alongside cross-chain tracking and timing correlation.

What happened to gas fees after EIP-4844?

EIP-4844 (Dencun upgrade, March 2024) introduced blob transactions that reduced Layer 2 data posting costs by 10 to 100x. This migration of activity to L2s contributed to Ethereum mainnet gas fees dropping from approximately 72 gwei in early 2024 to under 3 gwei by mid-2025 and 0.1 gwei by February 2026. Lower fees mean each transaction costs less to execute but also mean the forensic differences between wallet types become more visible, as congestion-driven noise no longer obscures behavioral signals.

What tools do investigators use for gas pattern analysis?

Etherscan’s gas tracker provides real-time and historical gas data per transaction. Dune Analytics enables custom SQL queries against decoded Ethereum transaction data including gas fields. EigenPhi and Zeromev specialize in MEV detection and gas consumption analysis. Ultrasound.money tracks ETH burn rates that correlate with network activity events. Commercial platforms like Chainalysis Reactor and Elliptic Investigator incorporate gas-based behavioral classification into their clustering engines.

Is Your Platform Vulnerable to Gas-Based Exploitation?

If your DeFi protocol relies on gas price oracles for pricing decisions, it may be vulnerable to manipulation through flash loan attacks and block stuffing. If your exchange processes high-volume withdrawals without monitoring gas pattern anomalies, you may be missing signals that indicate automated exploitation or fraudulent withdrawal patterns. The Fomo3D block stuffing attack, the $25 million MEV-boost exploit, and the ongoing impact of sandwich bots all demonstrate that gas mechanics are an active attack surface.

Crypto Trace Labs conducts gas pattern forensic analysis for exchange fraud investigations, MEV exploitation cases, and DeFi security assessments. Our forensic team – including analysts like D. Hargreaves – holds ACAMS certifications, MLRO qualifications across UK, US, and European jurisdictions, and Chartered status at Fellow Grade. Our founders held VP and Director positions at Blockchain.com, Kraken, and Coinbase.

Contact Crypto Trace Labs for a gas pattern security assessment or to discuss an active investigation involving Ethereum transaction analysis.

About the Author

This guide was prepared by the blockchain forensics team at Crypto Trace Labs. Our founding members held VP and Director-level positions at Blockchain.com, Kraken, and Coinbase, bringing over 10 years of combined experience in cryptocurrency operations, on-chain analysis, and forensic investigation. Our team holds ACAMS certifications, MLRO qualifications across UK, US, and European jurisdictions, and Chartered status at Fellow Grade. We have analyzed vanity address exploitation patterns in hundreds of investigations and provided expert witness testimony on blockchain attribution methodologies in court proceedings.

This content is for informational purposes only and does not constitute legal, financial, or compliance advice. Crypto asset recovery outcomes depend on specific circumstances, regulatory cooperation, and technical factors. Consult qualified professionals regarding your situation.