a fistful of bitcoins: characterizing payments among men ...smeiklejohn/files/imc13-slides.pdf ·...

135
Sarah Meiklejohn (UC San Diego) Marjori Pomarole (UC San Diego) Grant Jordan (UC San Diego) Kirill Levchenko (UC San Diego) Damon McCoy (George Mason University) Geoff Voelker (UC San Diego) Stefan Savage (UC San Diego) A Fistful of Bitcoins: Characterizing Payments Among Men with No Names 1

Upload: others

Post on 16-Jul-2020

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Sarah Meiklejohn (UC San Diego)Marjori Pomarole (UC San Diego)Grant Jordan (UC San Diego)Kirill Levchenko (UC San Diego)Damon McCoy (George Mason University)Geoff Voelker (UC San Diego)Stefan Savage (UC San Diego)

A Fistful of Bitcoins: Characterizing Payments Among Men with No Names

1

Page 2: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

What is Bitcoin?

2

Page 3: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

What is Bitcoin?

The first successful, widely adopted form of e-cash

2

Page 4: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

What is Bitcoin?

The first successful, widely adopted form of e-cash

Introduced in 2008 by “Satoshi Nakamoto”

2

Page 5: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

What is Bitcoin?

The first successful, widely adopted form of e-cash

Introduced in 2008 by “Satoshi Nakamoto”

Potential for anonymity via use of pseudonyms

2

Page 6: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

What is Bitcoin?

The first successful, widely adopted form of e-cash

Introduced in 2008 by “Satoshi Nakamoto”

Potential for anonymity via use of pseudonyms

Completely decentralized and unregulated*

2

Page 7: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

What is Bitcoin?

The first successful, widely adopted form of e-cash

Introduced in 2008 by “Satoshi Nakamoto”

Potential for anonymity via use of pseudonyms

Completely decentralized and unregulated*

Every transaction is publicly visible

2

Page 8: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

3

Page 9: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

3

Page 10: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

3

Page 11: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

3

Page 12: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

3

Page 13: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

3

Page 14: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

4

Jan’09 July’11 Feb’13

250

0

100

Page 15: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Why study Bitcoin? It’s fascinating!

4

Jan’09 July’11 Feb’13

250

0

100

current market capitalization of > $2B!

Page 16: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

Page 17: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

What are people using Bitcoin for?

Page 18: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 19: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

Link pseudonyms to single user using two clustering heuristics

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 20: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

Link pseudonyms to single user using two clustering heuristics

Cluster

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 21: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

Link pseudonyms to single user using two clustering heuristics

Name users via “re-identification attack” to learn real-world identity

Cluster

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 22: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

Link pseudonyms to single user using two clustering heuristics

Name users via “re-identification attack” to learn real-world identity

Cluster

Transactus

them

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 23: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Our paper

5

Link pseudonyms to single user using two clustering heuristics

Name users via “re-identification attack” to learn real-world identity

Combine these techniques to de-anonymize flows of bitcoins

Cluster

Transactus

them

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 24: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

6

Page 25: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

How does Bitcoin work?

6

Page 26: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

How does Bitcoin work? Analysis

6

Page 27: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

How does Bitcoin work? Analysis

Results

6

Page 28: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

How does Bitcoin work? Analysis

Results Conclusions

6

Page 29: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

How does Bitcoin work? Analysis

Results Conclusions

How does Bitcoin work?Public keysTransactions

Blocks

6

Page 30: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Components of Bitcoin

7

Page 31: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Components of Bitcoin

The global transaction ledger is called the block chain

7

Page 32: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Components of Bitcoin

The global transaction ledger is called the block chain

A block is a collection of transactions

7

Page 33: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Components of Bitcoin

The global transaction ledger is called the block chain

A block is a collection of transactions

A transaction is a collection of ECDSA signatures specifying transfer of bitcoins from one pseudonym to another (or multiple)

7

Page 34: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Components of Bitcoin

The global transaction ledger is called the block chain

A block is a collection of transactions

A transaction is a collection of ECDSA signatures specifying transfer of bitcoins from one pseudonym to another (or multiple)

A pseudonym is the hash of an ECDSA public key; owner possesses the corresponding secret key

7

Page 35: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How do bitcoins get spent?

8

Page 36: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Transactions form a chain

How do bitcoins get spent?

8

Page 37: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Transactions form a chain

How do bitcoins get spent?

8

Page 38: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Transactions form a chain

How do bitcoins get spent?

8

Page 39: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Transactions form a chain

How do bitcoins get spent?

8

Page 40: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Transactions form a chain

To spend the bitcoins, user signs the hash of the previous transaction and the public key of the intended recipient

How do bitcoins get spent?

8

Page 41: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Transactions form a chain

To spend the bitcoins, user signs the hash of the previous transaction and the public key of the intended recipient

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once

How do bitcoins get spent?

8

Page 42: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

Cryptographic background Analysis

Results Conclusions

How does Bitcoin work?Analysis

Clustering addressesNaming clusters

9

Page 43: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How to identify users?

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

Page 44: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How to identify users?

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

Page 45: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How to identify users?

Cluster

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

Page 46: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How to identify users?

Cluster

Collapse into a more manageable graph of clusters of public keys representing distinct entities

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

Page 47: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How to identify users?

Cluster

Transactus

them

Collapse into a more manageable graph of clusters of public keys representing distinct entities

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

Page 48: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

How to identify users?

Cluster

Transactus

them

Collapse into a more manageable graph of clusters of public keys representing distinct entities

Collect ground truth data by participating in transactions

10

Users can use arbitrarily many public keys (pseudonyms); as a result the Bitcoin graph is complicated and has 12 million public keys

Page 49: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering by inputs

11

Page 50: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering by inputs

11

Page 51: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering by inputs

Heuristic #1: the same user controls these addresses

11

Page 52: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 1: enough?

12

Page 53: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 1: enough?

12

This works because sender must know secret key for each input

Page 54: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 1: enough?

12

This works because sender must know secret key for each input

This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself

Page 55: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 1: enough?

12

This works because sender must know secret key for each input

This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself

Already yields a fairly robust graph: 5.5 million distinct clusters

Page 56: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 1: enough?

12

This works because sender must know secret key for each input

This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself

Already yields a fairly robust graph: 5.5 million distinct clusters

Our goal is to track flows of bitcoins

Page 57: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 1: enough?

12

This works because sender must know secret key for each input

This is established: has been used before [RH13,RS13,A+13] and even acknowledged by Satoshi himself

Already yields a fairly robust graph: 5.5 million distinct clusters

Our goal is to track flows of bitcoins

Lots of flow remains in these clusters because of change addresses

Page 58: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Change addresses

13

Page 59: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Change addresses

13

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once

Page 60: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Change addresses

13

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once

Change address: used to collect excess bitcoins

Page 61: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Change addresses

13

Each transaction must reference a previous transaction, so all bitcoins received must be spent all at once

Change address: used to collect excess bitcoins

In the standard client, change addresses are used at most twice: to receive and to spend

pk

Page 62: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering by change

14

Page 63: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering by change

14

Page 64: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering by change

Heuristic #2: the same user also controls this address

14

Page 65: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Heuristic 2

15

Page 66: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

To identify change addresses, look for “one-time” output address

Heuristic 2

15

pk

Page 67: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

To identify change addresses, look for “one-time” output address

If there is exactly one such address, label it the change address

Heuristic 2

15

pk

Page 68: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

To identify change addresses, look for “one-time” output address

If there is exactly one such address, label it the change address

This isn’t conservative enough!

Heuristic 2

15

pk

Page 69: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

To identify change addresses, look for “one-time” output address

If there is exactly one such address, label it the change address

This isn’t conservative enough!

• Wait a week before identifying address

Heuristic 2

15

pk

Page 70: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

To identify change addresses, look for “one-time” output address

If there is exactly one such address, label it the change address

This isn’t conservative enough!

• Wait a week before identifying address

• Ignore “self-change” addresses

Heuristic 2

15

pk

Page 71: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

To identify change addresses, look for “one-time” output address

If there is exactly one such address, label it the change address

This isn’t conservative enough!

• Wait a week before identifying address

• Ignore “self-change” addresses

• Manually inspect some remaining addresses

Heuristic 2

15

pk

Page 72: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Page 73: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

Page 74: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

Page 75: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges • Vendors

Page 76: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

• Mining pools

• Vendors

Page 77: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

• Mining pools

• Vendors

• Gambling sites

Page 78: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

• Mining pools

• Wallet services

• Vendors

• Gambling sites

Page 79: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

• Mining pools

• Wallet services

• Vendors

• Gambling sites

• Mix services

Page 80: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

• Mining pools

• Wallet services

Scraped published tags

• Vendors

• Gambling sites

• Mix services

Page 81: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Data collection

16

Engaged in transactions with:

• Exchanges

• Mining pools

• Wallet services

Scraped published tags

Found addresses discussed on forums

• Vendors

• Gambling sites

• Mix services

Page 82: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Exchanges

17

Page 83: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Vendors

18

Page 84: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Published tags

19

Page 85: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Trolling Bitcoin forums

20

Page 86: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Trolling Bitcoin forums

20

Page 87: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Trolling Bitcoin forums

20

Page 88: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

21

Page 89: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

Transactus

them

21

Page 90: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

Transactus

them

21

Page 91: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

ClusterTransactus

them

21

Page 92: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

ClusterTransactus

them

21

Page 93: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

ClusterTransactus

them

Bootstrap

21

Page 94: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

ClusterTransactus

them

Bootstrap

21

Page 95: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Putting it all together

ClusterTransactus

them

Bootstrap

21

Interacted with 31 MtGox addresses, tagged 518,723!

Participated in 344 transactions and tagged 1.3M public keys

Page 96: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

Cryptographic background Analysis

Results Conclusions

How does Bitcoin work?

ResultsOverall statistics

Tracking cluster activity

22

Page 97: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering using our heuristics

23

Page 98: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering using our heuristics

bicycle wheel withgambling at center

23

Page 99: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Clustering using our heuristics

bicycle wheel withgambling at center

strongly connected componentwith most of our named users

23

Page 100: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

24

Page 101: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

24

Page 102: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

24

Page 103: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

Page 104: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

Page 105: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

Page 106: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

change address

Page 107: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

meaningfulrecipient change address

Page 108: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

Page 109: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

24

...

...

Page 110: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Following bitcoins

Can see when bitcoins meaningfully cross cluster boundaries

Allows us to systematically follow “peeling chains”

Identifying recipients potentially de-anonymizes user

24

...

...

Page 111: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins

25

Page 112: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins

25

Page 113: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins0

100

200

300

400

500

Date

Bala

nce

(in th

ousa

nds)

2010−12−29 2011−08−05 2012−03−12 2012−10−18

1DkyBEKtvendorssilk road

25

Page 114: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Tracking illicitly-obtained bitcoins0

100

200

300

400

500

Date

Bala

nce

(in th

ousa

nds)

2010−12−29 2011−08−05 2012−03−12 2012−10−18

1DkyBEKtvendorssilk road

5% of all generated bitcoins!

25

Page 115: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Date

Perc

enta

ge o

f tot

al b

alan

ce

0

2

4

6

8

10

12

14

2010−12−29 2011−08−05 2012−03−12 2012−10−18

exchangesminingwalletsgamblingvendorsfixedinvestment

Tracking illicitly-obtained bitcoins0

100

200

300

400

500

Date

Bala

nce

(in th

ousa

nds)

2010−12−29 2011−08−05 2012−03−12 2012−10−18

1DkyBEKtvendorssilk road

25

Page 116: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Date

Perc

enta

ge o

f tot

al b

alan

ce

0

2

4

6

8

10

12

14

2010−12−29 2011−08−05 2012−03−12 2012−10−18

exchangesminingwalletsgamblingvendorsfixedinvestment

Tracking illicitly-obtained bitcoins0

100

200

300

400

500

Date

Bala

nce

(in th

ousa

nds)

2010−12−29 2011−08−05 2012−03−12 2012−10−18

1DkyBEKtvendorssilk road

Dissipated bitcoins did not flowat scale to any known services

25

Page 117: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

26

Page 118: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

26

Page 119: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

But we saw peels to known exchanges

26

Page 120: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

27

Page 121: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Again, saw many peels to known exchanges

27

Page 122: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Again, saw many peels to known exchanges

27

2857 BTC (87%) hadn’t moved

Page 123: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Again, saw many peels to known exchanges

Exchanges know the real-world identity of the account owner

27

2857 BTC (87%) hadn’t moved

Page 124: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking illicitly-obtained bitcoins

By following peeling chains, we tracked money from known thefts and from one infamous address associated with Silk Road

Again, saw many peels to known exchanges

Exchanges know the real-world identity of the account owner

Hypothesis: if you subpoena the exchange, you can identify the thief27

2857 BTC (87%) hadn’t moved

Page 125: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Tracking bitcoins in the real world

28

Page 126: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Contacted by Andy Greenberg of Forbes to test hypothesis

Tracking bitcoins in the real world

28

Page 127: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Contacted by Andy Greenberg of Forbes to test hypothesis

Got Coinbase addresses; asked to identify drug purchases

Tracking bitcoins in the real world

28

Page 128: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Contacted by Andy Greenberg of Forbes to test hypothesis

Got Coinbase addresses; asked to identify drug purchases

Tracking bitcoins in the real world

28

Page 129: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Contacted by Andy Greenberg of Forbes to test hypothesis

Got Coinbase addresses; asked to identify drug purchases

Tracking bitcoins in the real world

28

Page 130: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Outline

Cryptographic background Analysis

Results Conclusions

How does Bitcoin work?

Conclusions

29

Page 131: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Conclusions

30

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 132: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs

Conclusions

30

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 133: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs

Our analysis provides a real-world way to track flows of bitcoins

Conclusions

30

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 134: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs

Our analysis provides a real-world way to track flows of bitcoins

Seems hard to launder significant quantities of money

Conclusions

30

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?

Page 135: A Fistful of Bitcoins: Characterizing Payments Among Men ...smeiklejohn/files/imc13-slides.pdf · of bitcoins from one pseudonym to another (or multiple) 7. Components of Bitcoin

Bitcoin is used mostly for gambling, currency exchange, to a (much) lesser extent buying drugs

Our analysis provides a real-world way to track flows of bitcoins

Seems hard to launder significant quantities of money

Conclusions

Thanks! Any questions?

30

What are people using Bitcoin for?

How much anonymity does Bitcoin really provide?