A Fistful of Bitcoins: Characterizing Payments Among Men with No - - PowerPoint PPT Presentation

▶
a fistful of bitcoins characterizing payments among men
SMART_READER_LITE
LIVE PREVIEW

A Fistful of Bitcoins: Characterizing Payments Among Men with No - - PowerPoint PPT Presentation

Mar 27, 2023 136 likes •1.5k views

A Fistful of Bitcoins: Characterizing Payments Among Men with No Names Sarah Meiklejohn (UC San Diego) Marjori Pomarole (UC San Diego) Grant Jordan (UC San Diego) Kirill Levchenko (UC San Diego) Damon McCoy (George Mason University) Geoff

slide-1
SLIDE 1

Sarah Meiklejohn (UC San Diego) Marjori Pomarole (UC San Diego) Grant Jordan (UC San Diego) Kirill Levchenko (UC San Diego) Damon McCoy (George Mason University) Geoff Voelker (UC San Diego) Stefan Savage (UC San Diego)

A Fistful of Bitcoins: Characterizing Payments Among Men with No Names

1

slide-2
SLIDE 2

What is Bitcoin?

2

slide-3
SLIDE 3

What is Bitcoin?

The first successful, widely adopted form of e-cash

2

slide-4
SLIDE 4

What is Bitcoin?

The first successful, widely adopted form of e-cash Introduced in 2008 by “Satoshi Nakamoto”

2

slide-5
SLIDE 5

What is Bitcoin?

The first successful, widely adopted form of e-cash Introduced in 2008 by “Satoshi Nakamoto” Potential for anonymity via use of pseudonyms

2

slide-6
SLIDE 6

What is Bitcoin?

The first successful, widely adopted form of e-cash Introduced in 2008 by “Satoshi Nakamoto” Potential for anonymity via use of pseudonyms Completely decentralized and unregulated*

2

slide-7
SLIDE 7

What is Bitcoin?

The first successful, widely adopted form of e-cash Introduced in 2008 by “Satoshi Nakamoto” Potential for anonymity via use of pseudonyms Completely decentralized and unregulated* Every transaction is publicly visible

2

slide-8
SLIDE 8

Why study Bitcoin? It’s fascinating!

3

slide-9
SLIDE 9

Why study Bitcoin? It’s fascinating!

3

slide-10
SLIDE 10

Why study Bitcoin? It’s fascinating!

3

slide-11
SLIDE 11

Why study Bitcoin? It’s fascinating!

3

slide-12
SLIDE 12

Why study Bitcoin? It’s fascinating!

3

slide-13
SLIDE 13

Why study Bitcoin? It’s fascinating!

3

slide-14
SLIDE 14

Why study Bitcoin? It’s fascinating!

4

Jan’09 July’11 Feb’13 250 100

slide-15
SLIDE 15

Why study Bitcoin? It’s fascinating!

4

Jan’09 July’11 Feb’13 250 100

current market capitalization of > $2B!

slide-16
SLIDE 16

Our paper

5

slide-17
SLIDE 17

Our paper

5

What are people using Bitcoin for?

slide-18
SLIDE 18

Our paper

5

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-19
SLIDE 19

Our paper

5

Link pseudonyms to single user using two clustering heuristics What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-20
SLIDE 20

Our paper

5

Link pseudonyms to single user using two clustering heuristics

Cluster

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-21
SLIDE 21

Our paper

5

Link pseudonyms to single user using two clustering heuristics Name users via “re-identification attack” to learn real-world identity

Cluster

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-22
SLIDE 22

Our paper

5

Link pseudonyms to single user using two clustering heuristics Name users via “re-identification attack” to learn real-world identity

Cluster Transact

us them What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-23
SLIDE 23

Our paper

5

Link pseudonyms to single user using two clustering heuristics Name users via “re-identification attack” to learn real-world identity Combine these techniques to de-anonymize flows of bitcoins

Cluster Transact

us them What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-24
SLIDE 24

Outline

6

slide-25
SLIDE 25

Outline

How does Bitcoin work?

6

slide-26
SLIDE 26

Outline

How does Bitcoin work? Analysis

6

slide-27
SLIDE 27

Outline

How does Bitcoin work? Analysis Results

6

slide-28
SLIDE 28

Outline

How does Bitcoin work? Analysis Results Conclusions

6

slide-29
SLIDE 29

Outline

How does Bitcoin work? Analysis Results Conclusions How does Bitcoin work?

Public keys Transactions Blocks

6

slide-30
SLIDE 30

Components of Bitcoin

7

slide-31
SLIDE 31

Components of Bitcoin

The global transaction ledger is called the block chain

7

slide-32
SLIDE 32

Components of Bitcoin

The global transaction ledger is called the block chain A block is a collection of transactions

7

slide-33
SLIDE 33

Components of Bitcoin

The global transaction ledger is called the block chain A block is a collection of transactions A transaction is a collection of ECDSA signatures specifying transfer

  • f bitcoins from one pseudonym to another (or multiple)

7

slide-34
SLIDE 34

Components of Bitcoin

The global transaction ledger is called the block chain A block is a collection of transactions A transaction is a collection of ECDSA signatures specifying transfer

  • f bitcoins from one pseudonym to another (or multiple)

A pseudonym is the hash of an ECDSA public key; owner possesses the corresponding secret key

7

slide-35
SLIDE 35

How do bitcoins get spent?

8

slide-36
SLIDE 36

Transactions form a chain

How do bitcoins get spent?

8

slide-37
SLIDE 37

Transactions form a chain

How do bitcoins get spent?

8

slide-38
SLIDE 38

Transactions form a chain

How do bitcoins get spent?

8

slide-39
SLIDE 39

Transactions form a chain

How do bitcoins get spent?

8

slide-40
SLIDE 40

Transactions form a chain To spend the bitcoins, user signs the hash of the previous transaction and the public key of the intended recipient

How do bitcoins get spent?

8

slide-41
SLIDE 41

Transactions form a chain To spend the bitcoins, user signs the hash of the previous transaction and the public key of the intended recipient Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once

How do bitcoins get spent?

8

slide-42
SLIDE 42

Outline

Cryptographic background Analysis Results Conclusions How does Bitcoin work? Analysis

Clustering addresses Naming clusters

9

slide-43
SLIDE 43

How to identify users?

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

slide-44
SLIDE 44

How to identify users?

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

slide-45
SLIDE 45

How to identify users? Cluster

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

slide-46
SLIDE 46

How to identify users? Cluster

Collapse into a more manageable graph of clusters of public keys representing distinct entities

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

slide-47
SLIDE 47

How to identify users? Cluster Transact

us them Collapse into a more manageable graph of clusters of public keys representing distinct entities

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

slide-48
SLIDE 48

How to identify users? Cluster Transact

us them Collapse into a more manageable graph of clusters of public keys representing distinct entities Collect ground truth data by participating in transactions

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

slide-49
SLIDE 49

Clustering by inputs

11

slide-50
SLIDE 50

Clustering by inputs

11

slide-51
SLIDE 51

Clustering by inputs Heuristic #1: the same user controls these addresses

11

slide-52
SLIDE 52

Heuristic 1: enough?

12

slide-53
SLIDE 53

Heuristic 1: enough?

12

This works because sender must know secret key for each input

slide-54
SLIDE 54

Heuristic 1: enough?

12

This works because sender must know secret key for each input This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself

slide-55
SLIDE 55

Heuristic 1: enough?

12

This works because sender must know secret key for each input This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself Already yields a fairly robust graph: 5.5 million distinct clusters

slide-56
SLIDE 56

Heuristic 1: enough?

12

This works because sender must know secret key for each input This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself Already yields a fairly robust graph: 5.5 million distinct clusters Our goal is to track flows of bitcoins

slide-57
SLIDE 57

Heuristic 1: enough?

12

This works because sender must know secret key for each input This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself Already yields a fairly robust graph: 5.5 million distinct clusters Our goal is to track flows of bitcoins Lots of flow remains in these clusters because of change addresses

slide-58
SLIDE 58

Change addresses

13

slide-59
SLIDE 59

Change addresses

13

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once

slide-60
SLIDE 60

Change addresses

13

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once Change address: used to collect excess bitcoins

slide-61
SLIDE 61

Change addresses

13

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once Change address: used to collect excess bitcoins In the standard client, change addresses are used at most twice: to receive and to spend

pk

slide-62
SLIDE 62

Clustering by change

14

slide-63
SLIDE 63

Clustering by change

14

slide-64
SLIDE 64

Clustering by change Heuristic #2: the same user also controls this address

14

slide-65
SLIDE 65

Heuristic 2

15

slide-66
SLIDE 66

To identify change addresses, look for “one-time” output address

Heuristic 2

15

pk

slide-67
SLIDE 67

To identify change addresses, look for “one-time” output address If there is exactly one such address, label it the change address

Heuristic 2

15

pk

slide-68
SLIDE 68

To identify change addresses, look for “one-time” output address If there is exactly one such address, label it the change address This isn’t conservative enough!

Heuristic 2

15

pk

slide-69
SLIDE 69

To identify change addresses, look for “one-time” output address If there is exactly one such address, label it the change address This isn’t conservative enough!

  • Wait a week before identifying address

Heuristic 2

15

pk

slide-70
SLIDE 70

To identify change addresses, look for “one-time” output address If there is exactly one such address, label it the change address This isn’t conservative enough!

  • Wait a week before identifying address
  • Ignore “self-change” addresses

Heuristic 2

15

pk

slide-71
SLIDE 71

To identify change addresses, look for “one-time” output address If there is exactly one such address, label it the change address This isn’t conservative enough!

  • Wait a week before identifying address
  • Ignore “self-change” addresses
  • Manually inspect some remaining addresses

Heuristic 2

15

pk

slide-72
SLIDE 72

Data collection

16

slide-73
SLIDE 73

Data collection

16

Engaged in transactions with:

slide-74
SLIDE 74

Data collection

16

Engaged in transactions with:

  • Exchanges
slide-75
SLIDE 75

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Vendors
slide-76
SLIDE 76

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Mining pools
  • Vendors
slide-77
SLIDE 77

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Mining pools
  • Vendors
  • Gambling sites
slide-78
SLIDE 78

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Mining pools
  • Wallet services
  • Vendors
  • Gambling sites
slide-79
SLIDE 79

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Mining pools
  • Wallet services
  • Vendors
  • Gambling sites
  • Mix services
slide-80
SLIDE 80

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Mining pools
  • Wallet services

Scraped published tags

  • Vendors
  • Gambling sites
  • Mix services
slide-81
SLIDE 81

Data collection

16

Engaged in transactions with:

  • Exchanges
  • Mining pools
  • Wallet services

Scraped published tags Found addresses discussed on forums

  • Vendors
  • Gambling sites
  • Mix services
slide-82
SLIDE 82

Exchanges

17

slide-83
SLIDE 83

Vendors

18

slide-84
SLIDE 84

Published tags

19

slide-85
SLIDE 85

Trolling Bitcoin forums

20

slide-86
SLIDE 86

Trolling Bitcoin forums

20

slide-87
SLIDE 87

Trolling Bitcoin forums

20

slide-88
SLIDE 88

Putting it all together

21

slide-89
SLIDE 89

Putting it all together Transact

us them

21

slide-90
SLIDE 90

Putting it all together Transact

us them

21

slide-91
SLIDE 91

Putting it all together Cluster Transact

us them

21

slide-92
SLIDE 92

Putting it all together Cluster Transact

us them

21

slide-93
SLIDE 93

Putting it all together Cluster Transact

us them

Bootstrap

21

slide-94
SLIDE 94

Putting it all together Cluster Transact

us them

Bootstrap

21

slide-95
SLIDE 95

Putting it all together Cluster Transact

us them

Bootstrap

21

Interacted with 31 MtGox addresses, tagged 518,723! Participated in 344 transactions and tagged 1.3M public keys

slide-96
SLIDE 96

Outline

Cryptographic background Analysis Results Conclusions How does Bitcoin work? Results

Overall statistics Tracking cluster activity

22

slide-97
SLIDE 97

Clustering using our heuristics

23

slide-98
SLIDE 98

Clustering using our heuristics

bicycle wheel with gambling at center

23

slide-99
SLIDE 99

Clustering using our heuristics

bicycle wheel with gambling at center strongly connected component with most of our named users

23

slide-100
SLIDE 100

Following bitcoins

24

slide-101
SLIDE 101

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

24

slide-102
SLIDE 102

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

24

slide-103
SLIDE 103

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

slide-104
SLIDE 104

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

slide-105
SLIDE 105

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

slide-106
SLIDE 106

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

change address

slide-107
SLIDE 107

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

meaningful recipient change address

slide-108
SLIDE 108

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

slide-109
SLIDE 109

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains”

24

... ...

slide-110
SLIDE 110

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries Allows us to systematically follow “peeling chains” Identifying recipients potentially de-anonymizes user

24

... ...

slide-111
SLIDE 111

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins

25

slide-112
SLIDE 112

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins

25

slide-113
SLIDE 113

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins

100 200 300 400 500 Date Balance (in thousands) 2010−12−29 2011−08−05 2012−03−12 2012−10−18 1DkyBEKt vendors silk road

25

slide-114
SLIDE 114

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins

100 200 300 400 500 Date Balance (in thousands) 2010−12−29 2011−08−05 2012−03−12 2012−10−18 1DkyBEKt vendors silk road

5% of all generated bitcoins!

25

slide-115
SLIDE 115

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Date Percentage of total balance 2 4 6 8 10 12 14 2010−12−29 2011−08−05 2012−03−12 2012−10−18 exchanges mining wallets gambling vendors fixed investment

Tracking illicitly-obtained bitcoins

100 200 300 400 500 Date Balance (in thousands) 2010−12−29 2011−08−05 2012−03−12 2012−10−18 1DkyBEKt vendors silk road

25

slide-116
SLIDE 116

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Date Percentage of total balance 2 4 6 8 10 12 14 2010−12−29 2011−08−05 2012−03−12 2012−10−18 exchanges mining wallets gambling vendors fixed investment

Tracking illicitly-obtained bitcoins

100 200 300 400 500 Date Balance (in thousands) 2010−12−29 2011−08−05 2012−03−12 2012−10−18 1DkyBEKt vendors silk road

Dissipated bitcoins did not flow at scale to any known services

25

slide-117
SLIDE 117

Tracking illicitly-obtained bitcoins

26

slide-118
SLIDE 118

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

26

slide-119
SLIDE 119

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road But we saw peels to known exchanges

26

slide-120
SLIDE 120

Tracking illicitly-obtained bitcoins

27

slide-121
SLIDE 121

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road Again, saw many peels to known exchanges

27

slide-122
SLIDE 122

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road Again, saw many peels to known exchanges

27

2857 BTC (87%) hadn’t moved

slide-123
SLIDE 123

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road Again, saw many peels to known exchanges Exchanges know the real-world identity of the account owner

27

2857 BTC (87%) hadn’t moved

slide-124
SLIDE 124

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road Again, saw many peels to known exchanges Exchanges know the real-world identity of the account owner Hypothesis: if you subpoena the exchange, you can identify the thief

27

2857 BTC (87%) hadn’t moved

slide-125
SLIDE 125

Tracking bitcoins in the real world

28

slide-126
SLIDE 126

Contacted by Andy Greenberg of Forbes to test hypothesis

Tracking bitcoins in the real world

28

slide-127
SLIDE 127

Contacted by Andy Greenberg of Forbes to test hypothesis Got Coinbase addresses; asked to identify drug purchases

Tracking bitcoins in the real world

28

slide-128
SLIDE 128

Contacted by Andy Greenberg of Forbes to test hypothesis Got Coinbase addresses; asked to identify drug purchases

Tracking bitcoins in the real world

28

slide-129
SLIDE 129

Contacted by Andy Greenberg of Forbes to test hypothesis Got Coinbase addresses; asked to identify drug purchases

Tracking bitcoins in the real world

28

slide-130
SLIDE 130

Outline

Cryptographic background Analysis Results Conclusions How does Bitcoin work? Conclusions

29

slide-131
SLIDE 131

Conclusions

30

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-132
SLIDE 132

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs

Conclusions

30

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-133
SLIDE 133

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs Our analysis provides a real-world way to track flows of bitcoins

Conclusions

30

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-134
SLIDE 134

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs Our analysis provides a real-world way to track flows of bitcoins Seems hard to launder significant quantities of money

Conclusions

30

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?

slide-135
SLIDE 135

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs Our analysis provides a real-world way to track flows of bitcoins Seems hard to launder significant quantities of money

Conclusions

Thanks! Any questions?

30

What are people using Bitcoin for? How much anonymity does Bitcoin really provide?