260
How a 27-Year-Old Codebreaker Busted the Myth of Bitcoin’s Anonymity (www.wired.com)
submitted 2 years ago by to c/technology@lemmy.world
89 comments fedilink hide all child comments
 

"This is the story of the revelation in late 2013 that Bitcoin was, in fact, the opposite of untraceable—that its blockchain would actually allow researchers, tech companies, and law enforcement to trace and identify users with even more transparency than the existing financial system."

top 50 comments

sorted by: hot top controversial new old
[–] 168 points 2 years ago (30 children)

Anyone in the crypto space has known this for years.

Thats why privacy coins like Monero exist

  • permalink
  • fedilink
  • source
  • hideshow 30 child comments
    •
  • [–] 103 points 2 years ago (5 children)

    You're not wrong, but the first words are literally "Just over a decade ago". It's not a news article, it's the story of the research in 2013 which revealed bitcoin isn't anonymous.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 50 points 2 years ago (4 children)

    It wasn't a revelation in 2013 either. The ledger data has always been public information.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 22 points 2 years ago (2 children)

    But neither the addresses nor the people who had them where. It would be like saying that you can identify someone from an arp table because you can see the mac addresses.

    Unless you know specifically who own said address (even to the point that those can be spoofed) you just have a big pile of wet paper.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 14 points 2 years ago

    Plenty of ways to identify people from their spending habits.

    There are also plenty of ways to connect the address to the person. You can subpoena a legit vendor they've paid with that address, for example.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 2 years ago*

    Unless I'm mistaken, you still can't unless you are using an on/off-ramp with AML/KYC. You can track it back to a wallet, but until the person interacts with an entity that requires identification in order to buy/sell the crypto for actual useful currency, they're unidentifiable. I guess you'd prob want to use a VPN as well.

    At this point, the only real way to avoid that would be peer-to-peer transactions. Basically meeting someone in person and trading your crypto for physical cash.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 11 points 2 years ago

    Bitcoin was designed with the theory that the ledger would be public, but that various techniques would make it very hard to get anything useful out of that ledger other than the fact that a payment went through. These included change addresses so a single payment resulted in 2 transactions to 2 random-seeming addresses. This is described as a "key privacy feature of bitcoin". But, if you can identify which addresses are change addresses and which aren't, that privacy is compromised. That's one of the techniques she developed.

    Bitcoin transactions having multiple inputs and multiple outputs was also supposed to be a privacy feature, but it had the drawback of making it easier to cluster addresses as being related.

    Basically, the bitcoin devs / early bitcoin enthusiasts thought that despite having a public ledger, they could use security by obscurity as a privacy measure, but Sarah Meiklejohn figured out ways of unraveling that process so it was much easier to trace transactions and the owners of wallets.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 18 points 2 years ago (4 children)

    An article in Wired doesn't speak to the "crypto space", they speak to your aunt and uncle in Missouri who don't know about this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 12 points 2 years ago (3 children)

    This is the Technology sub on Lemmy, I cant imagine you believe im talking to people in Missouri

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
    • load more comments (1 reply)
  • [–] 12 points 2 years ago (3 children)

    Or pay cash... ultimate "privacy coin"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 7 points 2 years ago (2 children)

    true, but paying in cash is sort of difficult over the internet.

    You can send it via mail, but mail is slow and it could potentially be traced back to you.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (1 child)

    https://en.wikipedia.org/wiki/Hawala

    I think that such stuff can be a great layer of privacy and can be set up in a diaspora, in a church, in a community, by a rich guy alone.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [B] 4 points 2 years ago

    Here's the summary for the wikipedia article you mentioned in your comment:

    Hawala or hewala (Arabic: حِوالة ḥawāla, meaning transfer or sometimes trust), originating in India as havala (Hindi: हवाला), also known as havaleh in Persian, and xawala or xawilaad in Somali, is a popular and informal value transfer system based on the performance and honour of a huge network of money brokers (known as hawaladars). They operate outside of, or parallel to, traditional banking, financial channels and remittance systems. The system requires a minimum of two hawaladars that take care of the "transaction" without the movement of cash or telegraphic transfer. While hawaladars are spread throughout the world, they are primarily located in the Middle East, North Africa, the Horn of Africa and the Indian subcontinent. Hawala follows Islamic traditions but its use is not limited to Muslims.

    ^to^ ^opt^ ^out^^,^ ^pm^ ^me^ ^'optout'.^ ^article^ ^|^ ^about^

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 2 years ago (12 children)

    How does Monero work compared to the other big ones?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 26 points 2 years ago (8 children)

    Every time there is a transaction the sender's funds are mixed together with a bunch of other senders, and the recipients receive their money from this random pool, so there is no direct association between sender/receiver

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 11 points 2 years ago

    This is not quite correct. You do not have to involve anybody else in your transaction. What happens is the protocol takes a random selection of 15 other people who have spent money and adds them to a ring so that your transaction could be any one of 16 different outputs. But there is no mixing of funds involved.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 21 points 2 years ago (1 child)

    Monero is fucking genius actually, I recommend reading about the cryptography and mathematics behind it, it's actually incredible.

    Basically, they've created a way to make the entire thing opaque. Even the people sending the coin are unable to identify the person they're sending to.

    I don't hold any Monero, because I don't see it as a good investment (no way governemnts allow something that powerfully opaque to thrive), but I respect the technology.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 9 points 2 years ago

    I recommend reading about the cryptography and mathematics behind it

    Could most people understand it if they took the time or did the white paper require several niche latex packages to compile

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (2 replies)
    [–] 64 points 2 years ago (20 children)

    Transactions are public. But wallet ownership is not.

    That's why it's widely used in cybercrime. You can make a wallet and authorities may know which wallet receibe the money, but it may be imposible to link that wallet with an actual person.

  • permalink
  • fedilink
  • source
  • hideshow 20 child comments
    •
  • [–] 40 points 2 years ago* (3 children)

    but it may be imposible to link that wallet with an actual person.

    Impossible using the blockchain itself, but not as impossible when you add more traditional investigative techniques to the mix.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 10 points 2 years ago* (2 children)

    Provided that the exchanges are cooperating (voluntarily or by law).

    Why do you think NK and other "impenetrable" countries are so fond of it? It provides them with the means to monetize something otherwise pretty useless: their relative independence and the resulting potential for secrecy.

    They are turning into new-age Swiss banks, keeping anyone's private ledgers private. For a hefty sum.

    And one does not need a strong currency to achieve that: other cryptocurrencies are also perfectly usable.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    load more comments (2 replies)
  • [–] 7 points 2 years ago (1 child)

    And it becomes much, much easier to track down and remove anonymity the moment real currency transactions are made. Because of KYC requirements, the only way to stay anonymous with crypto is to keep your crypto transactions entirely outside of the real world. Once your digital anonymous currency interacts with real money you've not anchored your wallet to your identity.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    load more comments (1 reply)
    • [–] 59 points 2 years ago* (last edited 2 years ago) (3 children)

    This has to be the most convoluted way of saying someone clustered wallet addresses of a public blockchain. I'm sure there's much more to her work, but this beats so much around the bush.... I'm not going to speculate on the author's motivations for this article, I'll just say I wouldn't waste (more) time on it.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
    • [–] 55 points 2 years ago (3 children)

    Which part of public ledger they don't understand?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
    • [–] 30 points 2 years ago (1 child)

    I remember when Bitcoin first came out and one of the selling points of bitcoin was that literally anyone could trace the transfers using the wallet codes and what not no? I don't ever remember there being claims that it was untraceable at least as the selling point to the average consumer. There was even tools in like 2012 for tracking whether stuff internally in bitcoin was stolen or whatever...

    "While the taint analysis tool aims at measuring the “correlation” between two addresses, there is another notion of taint in the Bitcoin community which refers to the percentage of bitcoins, that come from a known theft or scam and have been blacklisted by popular exchange markets. For example, in 2012 the bitcoin exchange Mt.Gox froze accounts of customers, who owned bitcoins that could be directly related to such an incident [20]." https://maltemoeser.de/paper/money-laundering.pdf

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 14 points 2 years ago

    I think people confuse anonymity (similar to the made up names we use here, or character names in online games, and your wallet ID in a crypto coin) to privacy. Technically, if you receive all your funds in crypto, and you spend all the crypto directly (on goods and services that do not require you to give any PII) without it ever turning to fiat. Then yes, it is anonymous but not private. People can see that wallet hash x received funds from wallet hash y and send some of that to wallet hash z and will be able to confirm that for as long as a copy of the ledger exists somewhere.

    Really not sure a codebreaker needed to work this out. Anyone that spent a bit of time understanding how it worked would realise this right away. I have no doubt though, that many people had a total pikachu face when their barely concealed illegal activities were easily discovered.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 14 points 2 years ago (8 children)

    There should be more education on the difference between "privacy being available if you look for it" VS "privacy being ensured since the beginning and forever no matter what"

    Spoiler: the last one does not exists

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
    • [–] 10 points 2 years ago

    The main way criminals are caught is when they transfer their crypto to an exchange so they can convert it to cash. Law enforcement will subpoena the exange and ask “Hey, who exchanged 0.7886 bitcoin for cash on this date?” and they will get their identity. Using the public ledger, they will be able to trace the transactions done and show that this person sent money to an address advertised as belonging to a trafficking site, an illegal market, or recieved money from the bad wallet address.

    The address owner is anonymous until there is a source of data that ties information the wallet, and often transactions can be used to do that, just as any way to advertise a wallet belongs to you can, or any way to exchange crypto to cash can.

  • permalink
  • fedilink
  • source
    •
    [–] 6 points 2 years ago (7 children)

    I don't think this story is correct, just to chime in with everybody else. It was explicitly stated that bitcoin was a public ledger in the whitepaper.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 4 points 2 years ago (5 children)

    What part do you not consider correct?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 2 years ago

    There's a difference between "bitcoin is a public ledger" and "we can determine that Alice paid Bob 1 bitcoin".

    The bitcoin devs thought they could achieve the "public ledger" part while avoiding the second part. It turns out they couldn't.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments
    view more: next ›