Bitcoin Anonymity: Myths, User Deanonymization Methods, and Blockchain Transparency
Introduction
Hello, dear friends. Pavluu here. It’s been a while since I’ve written anything original—the last time was back in 2019, and even then, it was half a translation. Did you miss me? Today, I want to share a structured reflection on Bitcoin, which is currently riding high as its price nears $50,000. But this isn’t about investments or the potential of crypto. Let’s dive in.
Bitcoin’s Blockchain: Too Transparent for the Black Market
First, for those not deeply familiar: blockchain is primarily a network technology—a distributed, immutable ledger that can’t be faked. Each cryptocurrency has its own blockchain, a network of participants with specific rights depending on the degree of (de)centralization, consensus algorithm, and other features. There are open, closed, and hybrid blockchains; Bitcoin’s is open.
Bitcoin is a decentralized, peer-to-peer network anyone can join by simply creating a BTC wallet. Transactions are fully transparent and can be viewed on various explorers, such as:
- https://www.blockchain.com/explorer (classic BTC transaction explorer)
- https://blockchair.com/ (searches across 17 blockchains)
For example, if you look up a wallet’s history on Blockchair, you’ll immediately see its balance, transaction history, and total volume. Knowing the transaction history of one wallet makes it easy to establish links to others and track the movement of funds, despite decentralization, pools, and the use of multiple addresses per transaction.
Even bots like @EyeGodsBot can quickly analyze a BTC address and export all transaction history for further analysis, even in Excel.
Example
Suppose you buy illegal goods on the darknet. You use a crypto service that doesn’t let you change your BTC address, and on the darknet market, you often forget to click “Change Address” next to your wallet. So, you have two fixed addresses. Someone could get your BTC address from the crypto service, analyze which addresses you send money to most often, and easily guess which is your darknet market wallet. This is a simple, if technically rough, example of linking wallets.
The takeaway: Bitcoin’s anonymity is so fragile it’s barely worth mentioning. This isn’t a call to abandon Bitcoin—it’s a fantastic investment tool with no real analog except maybe DeFi token YFI. But analyzing Bitcoin transactions isn’t that hard, and even using a mixer doesn’t guarantee full protection, especially if the mixer is low quality.
For instance, the company ChainAnalysis has helped deanonymize and catch hundreds of sellers and users from the Silk Road darknet marketplace. ChainAnalysis operates worldwide, and nothing stops law enforcement from using their services if needed.
Bitcoin and Crypto “Anonymity”
By 2021, it’s almost a joke to claim Bitcoin is anonymous. I wrote about this back in 2018, translating an article on using Bitcoin transaction analysis to deanonymize Tor hidden service users. The research used Big Data analysis to find the owners of wallets linked to Silk Road and identified thousands of wallets serving Wikileaks, Pirate Bay, and Silk Road offshoots.
Here’s an example of what a Bitcoin wallet’s connection to Tor hidden services looks like after analysis. Full research here.
But what about anonymous cryptocurrencies? Alternatives like ZCash and Dash aren’t truly private. For example, one study found that 85% of ZCash transactions are transparent and traceable, and only 7% of the remaining 15% are actually private. Dash’s own marketing director has said, “Dash is a cryptocurrency for payments, not for anonymity.” The only privacy coin really worth mentioning today is Monero, though it once had a vulnerability that allowed XMR theft, which was quickly patched.
Some darknet marketplaces have considered using Litecoin (LTC) for transactions. In a 2018 study, about 30% of European darknet deals were paid in Litecoin. It’s fast, had minimal network load, attracted less attention, and had a more stable price.
In 2021, Litecoin’s testnet will launch MingleJingle—a new version of MimbleWimble, enabling fully non-interactive transactions and untraceable addresses. This could make LTC even more attractive for privacy-focused users.
By the way, many original darknet news sources like DeepDotWeb have been taken down by Europol and the FBI, making it hard to find reliable information on law enforcement operations against the dark web.
Methods of Deanonymizing Bitcoin Users
Let’s look at the main methods, based on the article “Bitcoin Users Deanonymization Methods” by Russian researchers from HSE.
Active Methods
- Social Engineering: Classic OSINT plus deception techniques—fake accounts, phishing, malware, etc. Not very effective in unskilled hands.
- P2P Network Analysis: Bitcoin nodes are either servers (accepting incoming TCP connections) or clients (not accepting). Most deanonymization attacks target servers. Hackers can capture the IP address that broadcasts a transaction and monitor traffic (classic MitM). In 2015, Bitcoin switched to a “diffusion” protocol to counter such attacks, but advanced versions still exist, with up to 30% accuracy in deanonymization.
Passive Methods
- OSINT: Searching open sources for wallet addresses, e.g., on forums, and linking them to user identities. Not very effective, but possible.
- Multi-Input Heuristic: Analyzing transactions with multiple inputs to determine which addresses belong to the same user, using special algorithms.
- Change Address Heuristic: Since Bitcoin generates new addresses after each transaction, analyzing transaction history can help trace back to the original wallet.
- Clustering: Using the above heuristics, researchers can cluster addresses belonging to the same user. This method has identified exchange and casino wallets with just a small set of known transactions.
- Fingerprinting: Web trackers can deanonymize users who pay with crypto on e-commerce sites using cookies. Two attack types:
- Linking a user to a specific blockchain transaction by matching address, amount, and time.
- Cluster intersection: Linking two purchases by the same user to blockchain addresses using graph methods.
- Graph Methods: The entire blockchain can be viewed as a directed acyclic graph. By analyzing transaction and address graphs, researchers can identify major wallets linked to darknet markets and gambling sites.
- Transaction Graph: Nodes are transactions; edges are coin flows with timestamps.
- Address Graph: Shows relationships between input and output addresses.
- User Graph: Groups addresses likely belonging to the same user.
More technical details can be found in the original research.
Mixers, KYC, and AML
Mixers
Mixers are designed to obfuscate transactions and “clean” Bitcoins obtained illegally. You send your coins through a pool of addresses and receive “clean” coins in return. The more addresses used, the higher the fee. However, many mixers are scams or run by darknet markets, and the coins you get may still be “dirty.” Finding a reliable mixer that can fool AML systems is tough—you might get scammed, or the mixer might be useless. Always check mixers via DuckDuckGo and tools like @cryptoaml_bot.
For example, a transaction run through a low-quality mixer may still be flagged as “Dark Market” by AML bots, making it hard to cash out via services like Chatex, which now also uses AML checks.
KYC and AML
- KYC (Know Your Customer/Client): Financial institutions (banks, exchanges, crypto exchanges) must verify your identity before processing transactions. This means submitting documents to prove who you are.
- AML (Anti-Money Laundering): Measures to prevent money laundering, terrorist financing, and WMD financing. Most major crypto exchanges (Binance, Kucoin, etc.) have implemented AML and KYC, monitoring users and their transactions. For “dark” market users, this is a major obstacle—exchanges may reject transactions from “Dark Market” or “Mixer” categories, forcing users to find buyers in Telegram chats or use less reliable exchangers.
For example, someone once sold a small amount of Bitcoin via a random exchanger on BestChange, only to be accused by police of laundering money. The story ended well, but it’s a reminder to be cautious about which services you use.
Conclusion
Bitcoin’s blockchain is open and fully transparent, making transaction analysis and wallet deanonymization possible. For the shadow economy, this is risky, though things work differently in Russia. Not only is BTC not anonymous, but neither are Dash or Zcash—only Monero has maintained its privacy reputation. Bitcoin transactions are a key to deanonymizing Tor service users, casting doubt on its reliability for darknet payments. Litecoin may have more potential in this area.
There are many ways to deanonymize Bitcoin users, often used in combination. Graph methods are currently the most advanced and dangerous for Bitcoin and Tor users. Mixers can help, but many are scams or provide dirty coins. Finding a good one takes time and money. AML and KYC are the natural path for scaling crypto projects, but a huge obstacle for black market players, who must seek out non-AML services or physical buyers in chats and forums.
Sources
- Pavlu (2018) How the US Government Studies Blockchain
- Pavlu (2018) Study: Litecoin May Become the #1 Cryptocurrency in the Darknet
- Pavlu (2018) Using Bitcoin Transaction Analysis to Deanonymize Tor Hidden Service Users
- S. Nakamoto (2008) Bitcoin: A Peer-to-Peer Electronic Cash System
- A. Vikati (2018) How Private Are Privacy Coins: A Closer Look at Zcash and Zclassic’s Blockchains
- Dash should not be considered a privacy coin, Dash team says
- Monero wallet vulnerability made it possible to steal XMR from exchanges
- S. Avdoshin, A. Lazarenko (2018) Bitcoin Users Deanonymization Methods
- Evaluating User Privacy in Bitcoin
- A fistful of bitcoins: characterizing payments among men with no names
- When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies
- Bitcoin Transaction Graph Analysis
- Litecoin Crypto Telegram
- Flooding (computer networking) – Wikipedia
- What is KYC and AML?
I hope you enjoyed my reflection—perhaps a bit late, but still relevant. I promise to publish more original articles in 2021!