BitIodine: Extracting Intelligence from the Bitcoin Network

Abstract

Abstract. Bitcoin, the famous peer-to-peer, decentralized electronic currency system, allows users to benefit from pseudonymity, by generating an arbitrary number of aliases (or addresses) to move funds. However, the complete history of all transactions ever performed, called "blockchain", is public and replicated on each node. The data it contains is difficult to analyze manually, but can yield a high number of relevant information. In this paper we present a modular framework, BitIodine, which parses the blockchain, clusters addresses that are likely to belong to a same user or group of users, classifies such users and labels them, and finally visualizes complex information extracted from the Bitcoin network. BitIodine labels users (semi-)automatically with information on their identity and actions which is automatically scraped from openly available information sources. BitIodine also supports manual investigation by finding paths and reverse paths between addresses or users. We tested BitIodine on several real-world use cases, identified an address likely to belong to the encrypted Silk Road cold wallet, or investigated the CryptoLocker ransomware and accurately quantified the number of ransoms paid, as well as information about the victims. We release an early prototype of BitIodine as a library for building more complex Bitcoin forensic analysis tools.

Listening to Whispers of Ripple: Linking Wallets and Deanonymizing Transactions in the Ripple Network

“…Given their differences, although ideas showed in Bitcoin heuristics available in the literature [45,46,63,64,75,77,81] can be minimally reused when it comes to studying Bitcoin payments within Ripple, they cannot be directly applied to the fullest extent to the Ripple network. In this work, we notice this ineffectiveness of the Bitcoin heuristics to Ripple, and work towards designing novel clustering heuristics that particularly consider the IOU credit network graph.…”

“…We have observed that most of these wallets were clustered to DividendRippler by the Heuristic 1. Interestingly, Bitcoin wallets deanonymized from our heuristic can be further linked to more Bitcoin wallets using the available Bitcoin deanonymization techniques [46,63,75,77,81]. We focus on privacy attacks on the Ripple network in this work, and leave those improved deanonymization attacks on the Bitcoin wallets as a future exercise.…”

“…Barber et al [46] observed that Bitcoin exposes its users to the possible linking of their Bitcoin wallets. Thus, recent works [63,75,77,81] have proposed simple heuristics to thwart anonymity in Bitcoin. In a somewhat different direction, other recent works [47,61] show the possibility of identifying ownership relationships between Bitcoin wallets and IP addresses.…”

“…Privacy studies on Bitcoin [45,46,63,64,75,77,81] have shown privacy issues on the Bitcoin system. However, the Ripple network and its Ripple ledger have not been thoroughly studied yet.…”

PathShuffle: Credit Mixing and Anonymous Payments for Ripple

“…attacks as already observed in Bitcoin [15,17,36,40,41,48,57]. A recent study [45] makes this privacy concern justifiable by showing that a significant portion of Ripple transactions today can be easily deanonymized such that everybody can determine who paid what to whom.…”