News for hackers. Stuff that matters.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Monday September 09, 2019 @01:34PM (#20920308)
> It's meant to be anonymous

Unfortunately, Bitcoin (BTC) is not anonymous, as you pointed out. It never was; and with tax laws requiring copious transaction information, it is particularly easily traceable.

That's the idea behind Monero & Co., which tries to mix things up a bit (literally). The anonymity is still not perfect, especially against state-level actors.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by Lordarminius on Monday September 09, 2019 @01:46PM (#20920467)
>The anonymity is still not perfect, especially against state-level actors.

With PirateChain it is, but true anonymity brings with it other technical challenges.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by vkou on Monday September 09, 2019 @02:02PM (#20920626)
It also brings legislative challenges, such as 'prove that your money did not come from running an international assassination ring'.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Monday September 09, 2019 @02:06PM (#20920661)
I haven't heard of PirateChain. However, the state-level threat model includes things like taxes, where (e.g.) people in the US have to report every transaction they make.

If most people report their PirateChain transactions, amount in, amount out, then the problem is that unreported transactions would stick out and would probably be associable with wallets. Am I getting this wrong?

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by toast0 on Monday September 09, 2019 @06:19PM (#20923106)
As long as transactions are in the right categories, you can group multiple similar transactions and report the dates as 'various'.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by Lordarminius on Monday September 09, 2019 @03:55PM (#20921781)
A requirement to report taxes is not normally thought of as a threat to privacy coins per se. And the whole privacy coin thing is modelled on the belief that the state has no business knowing all your financial details.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Monday September 09, 2019 @06:02PM (#20922965)
I think it should be, when the tax reporting requirements are so granular; and in such cases, the effect is analogous to a timing attack.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by AlexCoventry on Monday September 09, 2019 @02:17PM (#20920762)
What are the laws requiring reporting of every transaction?

I know it's necessary to report transactions which establish the cost basis for capital gains, but doesn't mandate report of all transactions.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by sobani on Tuesday September 10, 2019 @03:31AM (#20925866)
The IRS considers Bitcoin an asset. Every time you buy/sell goods with Bitcoin or just plain buy/sell Bitcoin, you have to report that as if you were buying/selling any other asset, like stocks. So most Bitcoin transactions will be subject to capital gains tax.

https://www.investopedia.com/articles/investing/040515/are-t...

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ibeckermayer on Tuesday September 10, 2019 @10:50AM (#20928852)
Please correct me if I’m wrong — does this fact not imply that any attempt to actually use cryptocurrency as a currency to buy and sell goods (I.e. how we currently commonly use USD) is completely impossible, since the capital gains taxes will cause everything to cost substantially more?
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by sobani on Tuesday September 10, 2019 @11:14AM (#20929107)
The tax is only on the gains of the worth of the spend Bitcoin. If you buy a Bitcoin and immediately spend it on something, there will be no gain, so $0,00 taxes.

If you bought a Bitcoin when it was $5000 and you spend 0.2 Bitcoin today (now they're ~$10000 a piece) you would need to report $1000 of capital gains.

You could argue that would make your 0.2 Bitcoin / $2000 purchase cost more, because you have to add the tax. On the other hand, if you sell those Bitcoin later, you would have to pay those capital gains tax anyway.

The story does become a bit more complex when you factor in long-term vs short-term capital gains tax.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ineedasername on Monday September 09, 2019 @09:23PM (#20924290)
In the US, all transactions to/from a financial institution of $10,000 or higher (including cash) must be reported. Same applies if multiple transactions on the same day reach that limit. So all attempts to cash out will be hard to avoid tracking. Also, attempts to structure transactions to avoid this, like $9999 per day, is illegal with jail and fines applied.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by Ambele on Monday September 09, 2019 @01:42PM (#20920417)
Bitcoin can be anonymous though in certain use-cases. You can create a new bitcoin public/private key pair on a computer that has never (and will never) touched the internet. Once you send the coins from an address to this new address, the network will now know the IP address of the sender, but it won't know anything about the unknown recipient.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by hobofan on Monday September 09, 2019 @01:53PM (#20920527)
It knows that in some way/shape/form the old address is associated with the new address, so most likely it is the same entity, or a transaction partner. Bitcoin is not supposed to be anonymous, and very unsuitable for use-cases where you want any kind of anonymity guarantee.
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by Ambele on Monday September 09, 2019 @03:26PM (#20921448)
>Bitcoin is not supposed to be anonymous

But it can be used anonymously and probably in some industries is still used anonymously. A counterparty that is willing to swap anonymously acquired and sent altcoins for Bitcoin can provide a privacy conscious individual with anonymous Bitcoins.

If using proxy-chains, Tor, or a real person in another country to broadcast your trade isn't your cup-of-tea because you don't trust them, there is still another less practical way. If you secretly give someone your Bitcoin private key (for example: written on a small piece of paper), you can give or trade those Bitcoins to someone without the network knowing about the transaction.

>so most likely it is the same entity, or a transaction partner.

Conceivably, the transaction could be broadcasted from an important individual's hacked phone or computer without a trace. This is where being innocent until proven guilty becomes important.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Monday September 09, 2019 @06:06PM (#20922996)
> A counterparty that is willing to swap anonymously acquired and sent altcoins for Bitcoin can provide a privacy conscious individual with anonymous Bitcoins.

Not if amounts are tracked, rather than addresses. "oh look, this gal X just lost 5.3876BTC and gained 3.76549ALTCOIN, and this other dude Y just gained 5.3876BTC and lost 3.76549ALTCOIN. Geeze, I wonder if they traded."

And with the proper graph theory tools, much more complex interactions could be tracked.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by nybble41 on Monday September 09, 2019 @07:32PM (#20923668)
The first problem here is that there is no link between the identities across the two currencies. You don't know that X lost some BTC and gained some altcoin. You just know that some BTC was transferred from X to Y and some altcoins were transferred from Z to W—completely different addresses. You also don't know precisely what exchange rate was used, and a privacy-minded service would round to a small number of significant digits (5.4BTC for 3.8ALT) rather than using exact, traceable figures. A proper mixer would probably also use fixed denominations and send each piece to a different address over a randomized timespan.

It's still not immune to tracing, obviously, but it's a much harder problem than just looking for symmetric transactions.

The simplest system, though, is probably just to spend some BTC renting time on a mining rig. It doesn't have to be profitable, just break even. Newly mined bitcoins have no official history to show who paid for the mining.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Tuesday September 10, 2019 @01:43AM (#20925343)
> It's still not immune to tracing, obviously, but it's a much harder problem than just looking for symmetric transactions.

"And with the proper graph theory tools, much more complex interactions could be tracked."

> The simplest system, though, is probably just to spend some BTC renting time on a mining rig. It doesn't have to be profitable, just break even. Newly mined bitcoins have no official history to show who paid for the mining.

That is a good idea.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by nybble41 on Tuesday September 10, 2019 @10:49AM (#20928835)
> "And with the proper graph theory tools, much more complex interactions could be tracked."

So you've said, and I already agreed that it isn't impossible. But do you have any real-world examples where someone followed reasonable OPSEC (fixed denominations, mixers, randomized timing) and still had their transactions successfully traced via these "proper graph theory tools"?

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Tuesday September 10, 2019 @04:44PM (#20933503)
Who would have published such an example? When we deal with opsec, we have to consider what is possible, rather than what has been done in the past. We have to do better than merely "locking the house after the thief has gone".
Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by nybble41 on Wednesday September 11, 2019 @05:16PM (#20944802)
> Who would have published such an example?

Typically that would be either the academic researcher attempting to prove that their investigation technique works, or the prosecutor looking to use the results of such an investigation as evidence in a trial.

> When we deal with opsec, we have to consider what is possible...

Anything is possible. Even ideal encryption algorithms—other than one-time pads—have some non-zero probability of being broken within a reasonable timeframe by a brute-force search, but that doesn't make them useless. As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Thursday September 12, 2019 @09:20AM (#20951084)
Maybe this is where we diverge.

> or the prosecutor looking to use the results of such an investigation as evidence in a trial

I'm inclined to believe in the possibility of parallel constructions being used to cover up the best sources of intel.

> Anything is possible.[...] As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible.

And here, I think it is probably cost-effective to come up with that technology, because it would allow tracing people and transactions that might otherwise be impenetrable. And, if that were the case, I don't have a hard time imagining that it would be of utmost importance to keep such technology under wraps.

But again, at this point it seems like we're comparing pessimism to optimism.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by nybble41 on Thursday September 12, 2019 @06:18PM (#20957074)
> I'm inclined to believe in the possibility of parallel constructions being used to cover up the best sources of intel.

So am I, to a point, but even if they prefer not to disclose their actual methods (and are willing to commit perjury) they can't exactly hide the results. And others wouldn't have any incentive to keep their successes hidden.

> ...I think it is probably cost-effective to come up with that technology...

This isn't a matter of "technology" where some R&D spending up front is likely to lead to a method of cheaply tracing funds. If such a method existed then the system would indeed be broken; it would be akin to finding a critical weakness in an encryption scheme. Barring design flaws, however, the idea is to make all the transactions look the same so that even using your best graph theory tools you can't narrow down the possibilities enough to reasonably investigate all of them. That's what I meant by "not cost-effective": When there are 50 transfers that fit the parameters then you can investigate them all, but if there are 50,000 plausible trails to investigate then that effort would only be worthwhile in very high-profile cases.

Re:94k Bitcoin (1B USD) transferred from unknown wallet to u... by ColanR on Thursday September 12, 2019 @09:00PM (#20958109)
> If such a method existed then the system would indeed be broken

Yes, I think that is the fundamental problem with depending on 'mixers' against state-level actors. We both agreed earlier that the tech is theoretically possible. It seems like we're disagreeing about whether someone exists who is motivated enough to build the tech, and whether that person is also motivated to keep their tech under wraps.

> they can't exactly hide the results

It's a known method that US law enforcement has done in the past. Parallel construction is absolutely a thing. https://en.wikipedia.org/wiki/Parallel_construction

> the idea is to make all the transactions look the same so that even using your best graph theory tools you can't narrow down the possibilities enough to reasonably investigate all of them

I just don't get the impression that it's successful. There's a lot of 'metadata' that could be used to narrow the candidates down: geography, time, transaction amount, method of accessing the exchange (API / browser / desktop app ), age of wallets - I don't know which is specifically relevant here, but there's a lot of similar information which could be used to narrow the possibilities down, and most of it could probably involve 'fuzzy logic'. I just don't think that a threat model which includes state-level actors should ignore the possibility that transactions could be traced through mixers.

By the way, I'm really enjoying this discussion. Thanks for playing. :)