Ressurecting Address Clustering in Bitcoin, How to Peel a Million, Exploring Unconfirmed Transactions for Effective Bitcoin Address Clustering

[DanGould]

Ressurecting Address Clustering in Bitcoin
How to Peel a Million
Exploring Unconfirmed Transactions for Effective Bitcoin Address Clustering

Ressurecting Address Clustering in Bitcoin

Ressurecting Address Clustering in Bitcoin

Cluster collapse is our goal

if you can ID payjoin you can induce cluster collapse. self-spend can as well.

e.g. WalletExplorer.com applied co-spend and change id from miekeljohn which collapsed a huge MtGox cluster.

"A single misidentified change output could collapse their clusters" explains the power of payjoin.

Nothingmuch: Having an implementation focus, as defenders, could allow us to make concrete recommendations.
e.g. knowing what fingerprints your counterparty is using, use this heuristic crate in your code, sample, randomize behavior some of the time.

Mitigation 2: If one has reason to believe their coins are disjoint (union find of potentially linkable to each other vs assigned separate clusters), simulate payment between subclusters that maintains disjointness. e.g. make a self-spend as another transaction between two self-owned clusters before making a fowrard payment. Also gives us a price (in both sats and time) in contrast to batching for privacy defense.

Threshold vote vs random forest of decision trees.

Random forest:

make decision trees (e.g. A holds, now look at B. Does B hold? Then look at C. Does C hold? etc.) learn from the ground truth data then

Threshold vote:

.97 million transactions with both outputs in the same cluster. Upper bound for rate of payjoin usage? Upper bound is 2-outputs assigned to the same cluster even though they should be assigned separate clusters.

Is a Chainanalysis adversary actually trying to cluster accurately?

• They could be clustering to create a false image of a cluster.
• They're trying to profit over a narrative to law enforcement and compliance officers.
• I.e. they may only be ruling out the implausible and then trying to satisfy the customers' view of the world.

Goal: correct away from cluster collapse but correct against false boundaries.

How to Peel a Million

How to Peel a Million

findNext2 has an exceptionally low false positive rate.

They identify 4 extremely naive change production heuristics. We can campaigne to have these changed with minimal effort on the implementation side. Just a matter of convincing.

Exploring Unconfirmed Transactions for Effective Bitcoin Address Clustering

Exploring Unconfirmed Transactions for Effective Bitcoin Address Clustering

cpfp more often done for change than payment txs (Heuristic)

collecting this unconfirmed tx data would be super valuable. maybe b10c has it?

combine non-interactive coinjoin w/ TRUC on different stages of the protocol to be more careful about what data you reveal. Ephemeral anchors can be thought