Skip to content
The methodOpen data
Back to the collection

An Empirical Analysis of Traceability in the Monero Blockchain

Malte Möser, Kyle Soska, Ethan Heilman

Show all 11 authors

Kevin Lee, Henry Heffan, Shashvat Srivastava, Kyle Hogan, Jason Hennessey, Andrew Miller, Arvind Narayanan, Nicolas Christin

2017 · arXiv

DatabasesSecurity & cryptographyEconomics
Read the paper
HN score
1
Mentions
7
Readers
6
Months
6
What’s in a score?

From the abstract

Monero is a privacy-centric cryptocurrency that allows users to obscure their transactions by including chaff coins, called "mixins," along with the actual coins they spend. In this paper, we empirically evaluate two weaknesses in Monero's mixin sampling strategy. First, about 62% of transaction inputs with one or more mixins are vulnerable to "chain-reaction" analysis -- that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such a way that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the "newest" input. We estimate that this heuristic can be used to guess the real input with 80% accuracy over all transactions with 1 or more mixins. Next, we turn to the Monero ecosystem and study the importance of mining pools and the former anonymous marketplace AlphaBay on the transaction volume. We find that after removing mining pool activity, there remains a large amount of potentially privacy-sensitive transactions that are affected by these weaknesses. We propose and evaluate two countermeasures that can improve the privacy of future transactions.

Metadata: arXiv. Abstracts retain their original authors’ rights.

In the conversation

Original HN comments, with labels from simple text rules. A label describes the whole comment and may miss context or irony. Read the discussion to make up your own mind. About the labels

7 selected excerpts · 7 total mentions

R0b0t1
Recommendation · rule
https://www.youtube.com/watch?v=YgtF7psIKWg&feature=youtu.be... https://tokyo2018.scalingbitcoin.org/transcript/tokyo2018/ho... https://arxiv.org/pdf/1704.04299/ Basically, the chaff transactions go to/from wallets actually owned by people. If you analyze enough of the chaff transactions, especially when the XMR that made them up is respent, you can deanonmyize users. This is why people recommend you do not reuse wallets often but that still does not solve the problem. Zcash I think is secure, or is per most analyses I've read.
Original comment Live BTC transactions in Twitter hack
simonh
Neutral mention · rule
Don't tell the crypto Bruhs about the several vulnerabilities already found in the Monero anonnymisation system. https://arxiv.org/pdf/1704.04299/ The problem is also one of credibility, Bitcoin was supposed to be private and breaching privacy has proved to be pretty trivial. Encryption is hard, but maintaining anonymity is much harder.
Original comment Chainalysis CTO said blockchain is easier to trace than paper money
ianmiers
Neutral mention · rule
Crypto tribalism aside, you got two technical points fundamentally wrong about the cryptography: 1) snarks are fast now. It takes 3 seconds on a pixel phone for Zcash. 2)The decoy based approaches Monero uses are subject to all kinds of passive and active attacks. Both in practice ( https://arxiv.org/pdf/1704.04299/) and just fundamentally: https://www.youtube.com/watch?v=9s3EbSKDA3o. There are ways to mitigate some of these problems to a degree. This is why you hear Monero people talk about coin control and churning (both of which can make you stand out in other ways). But the fact that they have to mention that should tell you its far from a perfect solution…
Read the full comment
cryptographically. There's a reason projects go with the large anonymity set approach. And if you're a cryptographer at ConsenSys, you should know that: it's what Ethereum is doing with Aztec. You also should know several projects, including Zcash, are working on trustless setup zk proofs. (Disclosure: I am involved in Zcash.)
Original comment Zcash Open Major Grants
brian_cloutier
Neutral mention · rule
If you give me a link I'm happy to "read more" but you're going to have to give me a link or make an argument, I have no interest in going searching for something so likely to be wrong. Here is an active deanonymization attack [1]: > We show how an attacker can take advantage of Monero’s Bulletproof protocol, which reduces transaction fees, to flood the network with his own transactions and, consequently, remove mixins from transaction inputs. Assuming an attack timeframe of 12 months, our findings show that an attacker can trace up to 47.63% of the transaction inputs at a cost of just 1,746.53 USD. Sounds pretty bad to me. Here's another attack [2]: > First, about 62% of…
Read the full comment
transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis — that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such away that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80 %accuracy over all transactions with 1 or more mixins. I don't care what "calculations" say, if so many transactions can be deanonymized then those calculations were calculating the wrong thing. [1] https://eprint.iacr.org/2019/455 [2] https://arxiv.org/pdf/1704.04299/
Original comment Coinbase Card
oarsinsync
Neutral mention · rule
> A whole world currency that is potentially immune to inflation and government manipulation. You said potentially, so I’ll give you this one. > No currency conversion fees. This is a function of the market, not the underlying instruments. It’s also not true of most crypto markets, and I’m not confusing the spread with fees at exchanges. > The ability to send funds to anyone with no middle man and no fee (besides the miners). No fee (besides the miners) isn’t much different to no fee (except this fee). It’s still a fee, and in the case of Bitcoin, the fee has potential to be prohibitive (and already is for some use cases that it was designed for, e.g. buying a cup of…
Read the full comment
coffee). > Also the removal of business and corporate surveillance. Right now Banks, Mastercard, stripe, venmo etc. know everything about you. They can then leverage that information in any way that they want. I don't like that. You run for office on an anti banking or big business platform and amazingly its leaked that you have an ongoing monthly subscription to X. Bitcoin is not anonymous, Monero could be unmasked[1], if you’re leaving a digital footprint, someone will eventually be able to follow it. [1] https://arxiv.org/pdf/1704.04299.pdf
Original comment How Dirty Money Disappears into the Black Hole of Cryptocurrency
DINKDINK
Neutral mention · rule
>To-date there is no public research on fundamental aspect of Monero What about these papers? "An Empirical Analysis of Linkability in the Monero Blockchain" - https://arxiv.org/abs/1704.04299 "A Traceability Analysis of Monero’s Blockchain" - https://link.springer.com/chapter/10.1007/978-3-319-66399-9_... https://youtu.be/qpn9ICem5wk?t=704
Original comment Ask HN: Who is hiring? (March 2018)
R0b0t1
Recommendation · rule
https://www.youtube.com/watch?v=YgtF7psIKWg&feature=youtu.be... https://tokyo2018.scalingbitcoin.org/transcript/tokyo2018/ho... https://arxiv.org/pdf/1704.04299/ Basically, the chaff transactions go to/from wallets actually owned by people. If you analyze enough of the chaff transactions, especially when the XMR that made them up is respent, you can deanonmyize users. This is why people recommend you do not reuse wallets often but that still does not solve the problem. Zcash I think is secure, or is per most analyses I've read.
Original comment Live BTC transactions in Twitter hack

Keep following the thread.

More in Databases

More from the same topics.

2017arXiv

The Case for Learned Index Structures

Tim Kraska, Alex Beutel, Ed H. Chi +2

Indexes are models: a B-Tree-Index can be seen as a model to map a key to the position of a record within a sorted array, a Hash-Index as a model to map a key to a position of a record within an unsorted array, and a BitMap-Index as a model to indicate if a data record exists or not.

Databases
19 mentions14 months
5HN score