The whole article is a plug for Chainalysis, a company that sells its ability to trace crypto transactions to the US government who ironically gave them KYC, the most fundamental and lazy ability to start a business that traces stuff like this.

What I'd like to see Grigg admit to with a straight face is his companies ability to trace monero. his company got the US Government bid for a $625,000 bounty to trace it, and its been two years...so i suspect Grigg's releasing this presser to take some of the heat off the inevitable "no, we cant" he's going to need to admit sooner or later.

https://en.wikipedia.org/wiki/Monero#Efforts_to_trace_transa...

Updated to reflect the thousands, not mil. bounty.

$625,000, not million.

I suspect chainalysis is describing some "poisoned output attack" with respect to monero. See: https://m.youtube.com/watch?v=iABIcsDJKyM

The problem is a well-understood but innate limitation to all sender-obfuscating cryptocurrencies.

> limitation to all sender-obfuscating cryptocurrencies

Only those that allow sending coins to recipients without their explicit approval. On pure Mimblewimble blockchains, the recipient must sign for receipt and is much less likely to accept poisoned funds.

It's irrelevant

Sorry, I didn't watch the video, but couldn't that be avoided by churning a few times?

Sort of, but not really. It is a very nuanced probabalistic attack. The problem is fundamentally that you need others to use your outputs as decoys in order to have plausible deniability.

Call me skeptical of any assumed ill intentions as $625,000 is not a big enough chunk of change to convince me that there is some form of grift going on here, as there's millions to be made elsewhere grifting crypto.

$625k seems like a lot but in the world of government contracting it’s often not. It may be motivating this, but I’m kinda skeptical.

Yeah $625K across two years is just like 3 developers in NYC. It's not a lot of money.

In government contracting, $625k is more like one whitepaper.

> Bad for customers to be sure. Most have no idea what they're doing and have fallen for a scam hook, line, and sinker.

I wouldn't call it a scam, it's written into laws we should all be pretty mad about. It's only a matter of time before KYC companies are the only way to engage legally with cryptocurrencies. While I don't think having all your transactions in a public ledger was ever a smart move for your average joe, just one de-anonymizing event and you're out to dry. I think the bigger issue is the ever eroding privacy policy in many countries.

Sounds like you've never used a DeFi application...Yes, the bridging between on-chain/off-chain still happens through centralized entities, but things like uniswap are entirely run on-chain and don't require any central authority or centralized ledger.

privacy through voluntary swaps is not sybil-proof

This comment is full of incorrect statements.

This comment is one of the laziest ones that you can make. "No it isn't" is literally the top (least useful) strata of the argument pyramid, provides precisely zero extra information, and doesn't belong on Hacker News.

It's not worth going point by point when there's so many fundamental misconceptions. Best to reject the entire comment.

What HN needs is less engagement with useless, time consuming misinformation, and more outright rejection of it.

That may work if you're a known entity who is known to be an expert on the subject, but for an anonymous forum, just saying "you're wrong" without any explanation is stupid and useless.

No, This is incorrect

If you don’t go through it point by point and just reject the entire comment, then how is everyone else supposed to know that it’s misinformation? Right now it’s just your word that it’s incorrect. You have to back your claims up.

I usually don't comment at all on HN crypto threads, it's never been a productive use of time. I slipped on this one, totally on me.

The fact that you made a second comment, yet provided absolutely no refutations of any of the points in the original comment under discussion, suggests that you cannot refute their points.

Although, the phrase "What HN needs is less engagement with useless, time consuming misinformation, and more outright rejection of it." instead suggests that you are of the totalitarian nature that prefers to suppress dissenting thought entirely, so I'm not sure what to think.

What is the point you are trying to convey?

That many things these days are called Blockchain, as if to appear secure, but they're no more sophisticated than centralised databases, while actual blockchains, like Bitcoin as exemplified in its whitepaper, is designed to be a secure and decentralised chain of transactions.

"Blockchain" has stopped meaning anything when people decided to use it for anything remotely related to internet money. It's just become a fancy word executives put on investor decks to woo venture capitalists.

But it doesn't mean that the actual cryptographic technology called blockchain, i.e. a chain of digitally signed transactions with a distributed consensus mechanism, is itself insecure.

Bitcoin is traceable due to its very implementation. Unless you know how to use it properly, it's very easy to deanonymize yourself on accident. And once that happens, all the transactions thereafter are easy to follow.

Monero, on the other hand, is designed to intentionally be hard to trace history of transactions on.

Yes, I edited it out from my comment because I knew someone would point that out and I didn't really want to go on a tangent about it. I meant it's untraceable by some very narrow definitions of tracing.

You'd know that hex address X sent money to Y, but you wouldn't necessarily know that X is John Doe that lives at 1234 Main St., nor you'd be able to tell that, knowing address X, John Doe also owns address Z.

With KYC laws you have a lot more metadata to be able to do correlations like that, but I'm specifically talking about the protocol and the technology itself.

It's important though to mention that you don't need KYC to attach a real identity to a bitcoin wallet. It's harder to do at scale, but if you're interested in finding the bitcoin wallet(s) of a specific person, or the person behind a specific wallet, this can be done with analysis of the blockchain itself and information from other parties to their transactions (which include their ISP, the ISP of some Bitcoin nodes where they advertised their transactions, and the seller sending them physical goods if they are using BTC for that). Also, if a BTC wallet is linked to a physical identity at any time, all past transactions of that physical identity can generally be discovered, often even if they are using separate wallets.

Something about No True Scotsman if I'm understanding correctly.

Don't use AML/KYC entities?

I can't use crypto for anything useful without it. This advice means crypto is useless.

not entirely correct; if you both earn and spend all of your crypto directly as cryptocurrency, then you can fairly easily just remain entirely anonymous. This just doesn't apply to most people, at least most who do legal business.

For me and the vast majority of people that is a complete non-starter. And the primary value of a currenyc is that it gives you liquidity to participate in the economy. Until crypto can claim the same thing it only barely qualifies as a currency in my mind.

What about when it comes to paying taxes on those earnings?

Gains can be reported to the IRS without revealing their source.

Sounds like a recipe for an audit, at least once they can clear their backlog. At which point, I'm pretty certain they're going to want to know more than "generic cap gains sale"/"revenue paid to me in cryptocurrency". They pretty clearly do not want anonymity in the flow of money.

If you spend it to KYC wallets (a company providing Internet hosting, for example), you won't be hard to deanonymize as well.

Is localbitcoin not still a thing?

He is big brained.

> That's because when most people use "blockchain" or "DeFi" they're using AML/KYC entities that post their transaction logs to public servers. Law enforcement eats this up because it saves them the trouble of getting warrants for investigations.

Well, except for the important detail that KYC requirements don't preclude the need for warrants...

> They (loudly, incessantly) proclaim to their friends the benefits of a new money paradigm while deriving all sustenance through the umbilical cord of OldFi.

Yeah, it's almost like crypto can't possibly be a fully self-contained ecosystem, and thus it must by necessity have integration points with the rest of the world. Who could have ever predicted that...

> Well, except for the important detail that KYC requirements don't preclude the need for warrants...

Banks and law enforcement frequently share data without caring about warrants. One example: if you send a $10K wire (in the US), your bank may voluntarily submit a Suspicious Activity Report. And since they may be liable if they choose not to report, but are not liable if they do report, guess which option they typically choose?

Warrants are not a high a hurdle in practice when they are needed. The US has the third-party doctrine, so all information you've communicated to someone does not need a warrant unless otherwise protected. In the US you need to establish real probable cause (otherwise the fruit may be poisoned), but PC is a low legal standard. Non-US jurisdictions don't use the fruit of the poisoned tree doctrine and so the actual legal standard is more like "arguing probable cause for the warrant shouldn't look like an outright perversion of justice". The world's best limbo performer can't dance under that bar.

Hell with KYC a government imposed search of your papers is dictated by law without even a warrant/PC/RAS. Where I live, you can legally carry a concealed gun in a bank without ID but you can't open a damn account and put $20 even with a US passport (without some proof of address).

The traceability of very much part of design of most blockchains, starting with Bitcoin. The whitepaper makes this clear in section "10) Privacy" and the article quotes half of the relevant text.

The remaining half states: "As an additional firewall, a new key pair should be used for each transaction to keep them from being linked to a common owner. Some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner. The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner"

Unlike Bitcoin, account based blockchains make this extra measure of privacy harder as the receiving and sending address is one and the same, however there's no limit to how many accounts one can have, so anonymity is still possible as long as acquiring the coins doesn't reveal your identity.

Those who sign up for cryptocurrency service providers (who are required by law to perform AML/KYC checks - and do so with the consent of their customers) trade away the privacy (of some of their) transactions for the benefits (most commonly, yield and ease of use) said services offer. This is not different from use cases of cash money, where getting cash money from an ATM or most money transmitters will reveal your identity, and while one is free to make in person transactions and remain "anonymous", if one wants to have a bank account or invest legally, then some level of KYC will be in place.

The article indeed asks the wrong question. DeFi can't operate legally without KYC/AML and customers know it. Your comment on the other hand seems to me to be making an error in believing DeFi users don't know this.