Bitcoin transactions: a digital discovery of illicit activity on the blockchain

Abstract

Purpose The purpose of this paper is to determine if Bitcoin transactions could be de-anonymised by analysing the Bitcoin blockchain and transactions conducted through the blockchain. In addition, graph analysis and the use of modern social media technology were examined to determine how they may help reveal the identity of Bitcoin users. A review of machine learning techniques and heuristics was carried out to learn how certain behaviours from the Bitcoin network could be augmented with social media technology and other data to identify illicit transactions. Design/methodology/approach A number of experiments were conducted and time was spend observing the network to ascertain how Bitcoin transactions work, how the Bitcoin protocol operates over the network and what Bitcoin artefacts can be examined from a digital forensics perspective. Packet sniffing software, Wireshark, was used to see whether the identity of a user is revealed when they set up a wallet via an online wallet service. In addition, a block parser was used to analyse the Bitcoin client synchronisation and reveal information on the behaviour of a Bitcoin node when it joins the network and synchronises to the latest blockchain. The final experiment involved setting up and witnessing a transaction using the Bitcoin Client API. These experiments and observations were then used to design a proof of concept and functional software architecture for searching, indexing and analyzing publicly available data flowing from the blockchain and other big data sources. Findings Using heuristics and graph analysis techniques show us that it is possible to build up a picture of behaviour of Bitcoin addresses and transactions, then utilise existing typologies of illicit behaviour to collect, process and exploit potential red flag indicators. Augmenting Bitcoin data, big data and social media may be used to reveal potentially illicit financial transaction going through the Bitcoin blockchain and machine learning applied to the data sets to rank and cluster suspicious transactions. Originality/value The development of a functional software architecture that, in theory, could be used to detect suspicious illicit transactions on the Bitcoin network.

Investigating and Analyzing Bitcoin Blockchain Protocol using Wireshark

“…There are few notable differences between bitcoin mainnet and testnet which are summarized in table 3. For capturing Bitcoin packets, we used network protocol analyzer called Wireshark [9,10].Wireshark allowed us to visualize messages exchanged between peers and thus served as an invaluable tool to deeply investigate about the Bitcoin protocol contents. We used [11] website to recieve some free coins and then transfer some coins back to it and record the whole process for investigation with Wireshark.…”

A review of money laundering literature: the state of research in key areas

“…To address the problem of anonymity and untraceable nature of cryptocurrency transactions, Turner and Irwin (2018) made an attempt to de-anonymise Bitcoin transactions using a variety of software tools. The authors found that while it was possible to follow a transaction across the blockchain, the anonymity feature inherent in the system was not overcome.…”

“…Since then researchers have investigated both machine-learning and traditional statistical approaches to detect money laundering (Irwin et al, 2012, Bidabad, 2017, Chang et al, 2008, Deng et al, 2009, Drezewski et al, 2012, Colladon and Remondi, 2017, Gilmour, 2017, Ju and Zheng, 2009, Ngai et al, 2011, Perols, 2011, Regan et al, 2017, Savage et al, 2016, Savage, 2017, Turner and Irwin, 2018, Unger et al, 2011, Wang et al, 2007, Zdanowicz, 2004a, Zdanowicz, 2009, Zhang et al, 2003, Gao, 2009). Zhang et al authors on using the system on real-world data found it was able to detect suspicious activity with a low rate of false positives.…”

Analysis Techniques for Illicit Bitcoin Transactions

“…To de-anonymize users on the Bitcoin network, Turner and Irwin (2018) look at the openness of the Bitcoin system and some of the defining features seen within the anatomy of a Bitcoin transaction coupled with extensive data collection from packet sniffing software. Using network traffic analyzer tools, such as Wireshark, can capture Bitcoin protocol traffic by listening on the network to port 8333 and building a profile of transaction flow between IP addresses and Bitcoin addresses over time.…”

“…Due to the peer-to-peer propagation of transactions any observation of an IP address where a transaction is intercepted may not be the original creator of the transaction. This further removes any ability to reveal identity via Bitcoin address usage analysis on the network (Turner and Irwin, 2018). Furthermore, Irwin and Turner (2018), highlight the lack of reliability in this analysis approach and the inhibitors of revealing any illicit transaction.…”