Investigating transactions in cryptocurrencies

TL;DR

This paper investigates the privacy and traceability of transactions across various cryptocurrencies and services, revealing that user anonymity can be compromised even in privacy-focused coins and across different platforms.

Contribution

It introduces new heuristics for tracking users in privacy-enhanced cryptocurrencies and across cross-chain transactions, demonstrating that user privacy is less robust than previously believed.

Findings

User anonymity in Zcash can be reduced using heuristics based on usage patterns.

Cross-chain transactions can be tracked across different ledgers.

Most participants in the Forsage scam lost money, highlighting the risks in smart contract schemes.

Abstract

This thesis presents techniques to investigate transactions in uncharted cryptocurrencies and services. Cryptocurrencies are used to securely send payments online. Payments via the first cryptocurrency, Bitcoin, use pseudonymous addresses that have limited privacy and anonymity guarantees. Research has shown that this pseudonymity can be broken, allowing users to be tracked using clustering and tagging heuristics. Such tracking allows crimes to be investigated. If a user has coins stolen, investigators can track addresses to identify the destination of the coins. This, combined with an explosion in the popularity of blockchain, has led to a vast increase in new coins and services. These offer new features ranging from coins focused on increased anonymity to scams shrouded as smart contracts. In this study, we investigated the extent to which transaction privacy has improved and whether users can still be tracked in these new ecosystems. We began by analysing the privacy-focused coin Zcash, a Bitcoin-forked cryptocurrency, that is considered to have strong anonymity properties due to its background in cryptographic research. We revealed that the user anonymity set can be considerably reduced using heuristics based on usage patterns. Next, we analysed cross-chain transactions collected from the exchange ShapeShift, revealing that users can be tracked as they move across different ledgers. Finally, we present a measurement study on the smart-contract pyramid scheme Forsage, a scam that cycled $267 million USD (of Ethereum) within its first year, showing that at least 88% of the participants in the scheme suffered a loss. The significance of this study is the revelation that users can be tracked in newer cryptocurrencies and services by using our new heuristics, which informs those conducting investigations and developing these technologies.