Blockchain analysis is essential for understanding how cryptocurrencies like Bitcoin are used in practice, and address clustering is a cornerstone of blockchain analysis. However, current techniques rely on heuristics that have not been rigorously evaluated or optimized. In this paper, we tackle several challenges of change address identification and clustering. First, we build a ground truth set of transactions with known change from the Bitcoin blockchain that can be used to validate the efficacy of individual change address detection heuristics. Equipped with this data set, we develop new techniques to predict change outputs with low false positive rates. After applying our prediction model to the Bitcoin blockchain, we analyze the resulting clustering and develop ways to detect and prevent cluster collapse. Finally, we assess the impact our enhanced clustering has on two exemplary applications.

The half-day workshop on Cryptoasset Analytics allows researchers from different disciplines to present their newest findings related to cryptoassets. This workshop is relevant for the Web research community for two reasons. First, on a technical level, fundamental concepts of cryptoassets are increasingly integrated with Web technologies. Second, we witness the formation of socio-technical cryptoasset ecosystems, which are tightly connected to the Web. The program features a mix of invited talks and a selection of peer-reviewed submissions. Workshop topics range from empirical studies, over analytics methods and tools, to case studies, datasets, and cross-cutting issues like legal or ethical aspects.

Analysis of blockchain data is useful for both scientific research and commercial applications. We present BlockSci, an open-source software platform for blockchain analysis. BlockSci is versatile in its support for different blockchains and analysis tasks. It incorporates an in-memory, analytical (rather than transactional) database, making it orders of magnitudes faster than using general-purpose graph databases. We describe BlockSci's design and present four analyses that illustrate its capabilities, shedding light on the security, privacy, and economics of cryptocurrencies.

How predictable are life trajectories? We investigated this question with a scientific mass collaboration using the common task method; 160 teams built predictive models for six life outcomes using data from the Fragile Families and Child Wellbeing Study, a high-quality birth cohort study. Despite using a rich dataset and applying machine-learning methods optimized for prediction, the best predictions were not very accurate and were only slightly better than those from a simple benchmark model. Within each outcome, prediction error was strongly associated with the family being predicted and weakly associated with the technique used to generate the prediction. Overall, these results suggest practical limits to the predictability of life outcomes in some settings and illustrate the value of mass collaborations in the social sciences.

Anti-money laundering regulation aims to prevent illicit proceeds from being reintroduced into the legal economy. Existing regulation targets financial intermediaries with record keeping and reporting requirements, enabled by the verification of customers’ identities (KYC). These strategies fall short in cryptocurrencies, where transactions can be conducted without the involvement of regulated intermediaries. Transaction blacklisting is a complementary regulation approach, incentivizing users and requiring intermediaries to check coins against public blacklists of illicit funds before accepting them. Blacklisting works on top of many existing cryptocurrencies today, improves anti-money laundering outside of regulated intermediaries and protects innocent users from inadvertently accepting illicit funds. In this paper, we discuss the intricacies of blacklisting, how it would change the Bitcoin ecosystem and how it can remain effective in the presence of privacy-preserving cryptocurrencies. We hope this paper provides a starting point for discussions among researchers, regulators and the cryptocurrency ecosystem around blacklisting.1

The codebases of many popular cryptographic libraries are the result of decades of development and incremental changes. OpenSSL for example, arguably the most important crypto library available today, has been around since 1998 [6]. As a result, the libraries’ application programming interfaces (APIs) have been continuously adapted and changed, often increasing their complexity and making them harder to use correctly. Correct API usage is especially important in the context of information security, because neglecting even minor details can lead to a complete break of the security the protocol is intended to provide (cf. [2]). With OpenSSL, mistakes such as ignoring a single return statement have been observed to be able to lead to a complete breach in confidentiality [3]. A recent line of academic work has applied model checking techniques to discover API misuse (cf. [3, 8]). In this context, the goal of this project is to evaluate the feasibility of using Bounded Model Checking techniques (in particular, the Bounded Model Checker CBMC [1]) to validate correct API usage. For this, we will develop property monitors that allow to check that programs follow a correct sequence of API calls. The remainder of this report is structured as follows. Section 2 presents the necessary background on the validation of SSL certificates. Section 3 explains how we can use property monitors in combination with a Bounded Model Checker such as CBMC to validate correct API usage, and Section 4 shows the concrete validation we perform for OpenSSL. Section 5 presents some examples of applying our property models and discusses the limitations of this approach. Finally, Section 6 concludes the report.

Cryptocurrency exchanges have a history of deploying poor security policies and it is claimed that over a third of exchanges were compromised by 2015. Once compromised, the attacker can copy the exchange’s wallet (i.e. a set of cryptographic private keys) and appropriate all its coins. The largest heist so far occurred in February 2014 when Mt. Gox lost 850k bitcoins and unlike the conventional banking system, all theft transactions were irreversibly confirmed by the Bitcoin network. We observe that exchanges have adopted an overwhelmingly preventive approach to security which by itself has not yet proven to be sufficient. For example, two exchanges called NiceHash and YouBit collectively lost around 8.7k bitcoins in December 2017. Instead of preventing theft, we propose a reactive measure (inspired by Bitcoin vaults) which provides a fail-safe mechanism to detect the heist, freeze all withdrawals and allow an exchange to bring a trusted vault key online to recover from the compromise. In the event this trusted recovery key is also compromised, the exchange can deploy a nuclear option of destroying all coins.

Monero is a privacy-centric cryptocurrency that allows users to obscure their transactions by including chaff coins, called “mixins,” along with the actual coins they spend. In this paper, we empirically evaluate two weaknesses in Monero’s mixin sampling strategy. First, about 62% of transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis — that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such a way that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80% accuracy over all transactions with 1 or more mixins. Next, we turn to the Monero ecosystem and study the importance of mining pools and the former anonymous marketplace AlphaBay on the transaction volume. We find that after removing mining pool activity, there remains a large amount of potentially privacy-sensitive transactions that are affected by these weaknesses. We propose and evaluate two countermeasures that can improve the privacy of future transactions. DOI Editor to enter DOI Received ..; revised ..; accepted ... *Corresponding Author: Malte Möser: Princeton University, E-mail: mmoeser@princeton.edu Kyle Soska: Carnegie Mellon University, E-mail:

In the cryptographic currency Bitcoin, all transactions are recorded in the blockchain - a public, global, and immutable ledger. Because transactions are public, Bitcoin and its users employ obfuscation to maintain a degree of financial privacy. Critically, and in contrast to typical uses of obfuscation, in Bitcoin obfuscation is not aimed against the system designer but is instead enabled by design. We map sixteen proposed privacy-preserving techniques for Bitcoin on an obfuscation-vs.-cryptography axis, and find that those that are used in practice tend toward obfuscation. We argue that this has led to a balance between privacy and regulatory acceptance.

This paper contributes a systematic account of transaction anonymization techniques that do not require trust in a single entity and support the existing cryptographic currency Bitcoin. It surveys and compares four known techniques, proposes tailored metrics to identify the use of each technique (but not necessarily its users), and presents longitudinal measurements indicating adoption trends and teething troubles. There is a tradeoff between the choice of users' preferred protection mechanisms and the risk that pertaining transactions can be singled out, which hurts privacy due to smaller anonymity sets unless a critical mass adopts the mechanism.

We present the first measurement study of JoinMarket, a growing marketplace for more anonymous transfers in the Bitcoin ecosystem. Our study reveals that this market is funded with multiple thousand bitcoins and generated a turnover of almost 29.5 million USD over the course of 13 months. Assessing the resilience of the market against a well-funded attacker, we discover that in a typical scenario, a selective attack with a 90% success rate requires an investment of 14 000– 54 000 USD (which is recoverable after the attack). We present economic arguments to explain the existence of this novel market for anonymity and underpin the hypothesis of heterogeneous time preference with empirical data.

Monero is a privacy-centric cryptocurrency that allows users to obscure their transactions by including chaff coins, called mixins, along with the actual coins they spend. In this paper, we empirically evaluate two weaknesses in Monero's mixin sampling strategy. First, about 62% of transaction inputs with one or more mixins are vulnerable to chain-reaction analysis -- that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such a way that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the newest input. We estimate that this heuristic can be used to guess the real input with 80% accuracy over all transactions with 1 or more mixins. Next, we turn to the Monero ecosystem and study the importance of mining pools and the former anonymous marketplace AlphaBay on the transaction volume. We find that after removing mining pool activity, there remains a large amount of potentially privacy-sensitive transactions that are affected by these weaknesses. We propose and evaluate two countermeasures that can improve the privacy of future transactions.

This paper presents an extension to Bitcoin’s script language enabling covenants, a primitive that allows transactions to restrict how the value they transfer is used in the future. Covenants expand the set of financial instruments expressible in Bitcoin, and enable new powerful and novel use cases. We illustrate two novel security constructs built using covenants. The first, vaults, focuses on improving the security of private cryptographic keys. Historically, maintaining these keys securely and reliably has been a critical vulnerability for Bitcoin users. We show how covenants enable vaults, which disincentivize key theft by preventing an attacker from gaining full access to stolen funds. The second construct, poison transactions, is a generally useful mechanism for penalizing double-spending attacks. Bitcoin-NG, a protocol that has been recently proposed to improve Bitcoin’s throughput, latency and overall scalability, requires this feature. We show how covenants enable poison transactions, and detail how Bitcoin-NG can be implemented progressively as an overlay on top of the Bitcoin blockchain.

Bitcoin as deployed today does not scale. Scalability research has focused on two directions: 1 redesigning the Blockchain protocol, and 2 facilitating 'off-chain transactions' and only consulting the Blockchain if an adjudicator is required. In this paper we focus on the latter and provide an overview of Bitcoin payment networks. These consist of two components: payment channels to facilitate off-chain transactions between two parties, and the capability to fairly exchange bitcoins across multiple channels. We compare Duplex Micropayment Channels and Lightning Channels, before discussing Hashed Time-Locked Contracts which enable Bitcoin-based payment networks. Finally, we highlight challenges for route discovery in these networks.

We present the first measurement study of JoinMarket, a growing marketplace for more anonymous transfers in the Bitcoin ecosystem. Our study reveals that this market is funded with multiple thousand bitcoins and generated a turnover of almost 8 million USD over the course of eight months. Assessing the resilience of the market against a wellfunded attacker, we discover that in a typical scenario, a selective attack with 90 % success rate requires an investment of 32,000 USD (which is recoverable after the attack). We formulate stylized economic models of supply and demand to explain the existence of this novel market for anonymity and underpin some theoretical arguments with empirical data.

The Bitcoin protocol supports optional direct payments from transaction partners to miners. These "fees" are supposed to substitute miners' minting rewards in the long run. Acknowledging their role for the stability of the system, the right level of transaction fees is a hot topic of normative debates. This paper contributes empirical evidence from a historical analysis of agents' revealed behavior concerning their payment of transaction fees. We identify several regime shifts, which can be largely explained by changes in the default client software or actions of big intermediaries in the ecosystem. Overall, it seems that rules dominate ratio, a state that is sustainable only if fees remain negligible.

If Bitcoin becomes the prevalent payment system on the Internet, crime fighters will join forces with regulators and enforce blacklisting of transaction prefixes at the parties who offer real products and services in exchange for bitcoin. Blacklisted bitcoins will be hard to spend and therefore less liquid and less valuable. This requires every recipient of Bitcoin payments not only to check all incoming transactions for possible blacklistings, but also to assess the risk of a transaction being blacklisted in the future. We elaborate this scenario, specify a risk model, devise a prediction approach using public knowledge, and present preliminary results using data from selected known thefts. We discuss the implications on markets where bitcoins are traded and critically revisit Bitcoin’s ability to serve as a unit of account.

Bitcoin, a distributed, cryptographic, digital currency, gained a lot of media attention for being an anonymous e-cash system. But as all transactions in the network are stored publicly in the blockchain, allowing anyone to inspect and analyze them, the system does not provide real anonymity but pseudonymity. There have already been studies showing the possibility to deanonymize bitcoin users based on the transaction graph and publicly available data. Furthermore, users could be tracked by bitcoin exchanges or shops, where they have to provide personal information that can then be linked to their bitcoin addresses. Special bitcoin mixing services claim to obfuscate the origin of transactions and thereby increase the anonymity of its users. In this paper we evaluate three of these services – Bitcoin Fog, BitLaun-dry, and the Send Shared functionality of Blockchain.info – by analyzing the transaction graph. While Bitcoin Fog and Blockchain.info successfully mix our transaction, we are able to find a direct relation between the input and output transactions in the graph of BitLaundry.