The Bisq DAO: On the Privacy Cost of Participation

TL;DR

This paper analyzes the privacy implications of participating in the Bisq DAO, revealing how blockchain data can be used to de-anonymize users and exposing privacy risks in decentralized exchanges.

Contribution

It introduces a novel address clustering heuristic to map blockchain addresses to participants and combines blockchain and peer-to-peer data for comprehensive privacy analysis.

Findings

Participants can be de-anonymized through address clustering.

Multiple aliases, including real-world names, are identified.

Dominant transactors influence the market dynamics.

Abstract

The Bisq DAO is a core component of Bisq, a decentralized cryptocurrency exchange. The purpose of the Bisq DAO is to decentralize the governance and finance functions of the exchange. However, by interacting with the Bisq DAO, participants necessarily publish data to the Bitcoin blockchain and broadcast additional data to the Bisq peer-to-peer network. We examine the privacy cost to participants in sharing this data. Specifically, we use a novel address clustering heuristic to construct the one-to-many mappings from participants to addresses on the Bitcoin blockchain and augment the address clusters with data stored within the Bisq peer-to-peer network. We show that this technique aggregates activity performed by each participant: trading, voting, transfers, etc. We identify instances where participants are operating under multiple aliases, some of which are real-world names. We identify the dominant transactors and their role in a two-sided market. We conclude with suggestions to better protect the privacy of participants in the future.