I have been doing some more development work on my bitcoin tracing software - which consists of a C++ program to read the blockchain and pull out interesting tractions by following them in a kind of daisy chain fashion, plus, latterly, some python scripting to do some initial analysis and write them out in a form that can be read by Gephi - where I do some further analysis and layout. Its working well now. I'm now writing a GML file for Gephi (but currently thinking of switching to GraphML for various reasons).
As an exercise I thought I'd take a look at the Silk Road Siezed Coins address (coins seized when the FBI shut down the Silk Road deep web black market site). I thought it would be interesting to map out a little of the bitcoin geography around there and see what showed up.
The trace came out huge - a million plus transactions so I restricted my analysis to just a few thousand. Here is a zoomed out view of the transaction graph I produced
The nodes in yellow are those connected directly to silk road. The lower part of the diagram are loosely connected addresses - mostly in long chains - but the clumping at the top is totally different! Here is a zoomed-in shot of that region:
You can make out some nodes around the edge of the innermost clump with large numbers of connections. The nodes in the middle are clump are special because they are each connected to several of the highly connected "master" nodes. Inedentally there is a yellow node in there. The pink nodes are those two steps removed from "Seized Coins". So what's going on here.
Those highly connected master nodes are all public facing SatoshiDice addresses. SatoshiDice is officially a gambling site. "The Ghost of Satoshi will roll the dice and pick a Lucky Number! " it says. However it is allegedly (from some sources I have read) also used as a tumbler to obfuscate bitcoin trails. To use it you simply send bitcoin to one of its nodes (each pay at a specfied rate) and the nodes send coin back to your address if you win. I can see this would make a powerful tumbler. I'm guessing the nodes are the middle clump are back-end routing ans storage nodes. The fact my trace gets so complex in this area just shows how effecive the mechanism is at creating complexity and confusion. They could be a real challenge to unpick! Perhaps the association with SR was merely that some customers used it to decouple their various wallets for security purposes.
Here is one more screenshot from the vicinity of the SatoshiDice clump. This one is created from a trace extract with over 50k transactions.
No comments:
Post a Comment