Hacker News Reader

Comment by stingraycharles | Hacker News Reader

It’s important to note that it’s not just splitting up your own transactions, it’s that it’s actually other people’s coins that end up in your destination wallets. As such, it becomes very difficult to trace: techniques for doing this are similar to large scale deanonimization of Tor traffic, and involve large scale pattern analysis.

View on HN

> It’s important to note that it’s not just splitting up your own transactions, it’s that it’s actually other people’s coins that end up in your destination wallets. As such, it becomes very difficult to trace

It was my basically uninformed impression that the bitcoin blockchain consists of a series of transaction records that look like this:

- Address xxxxx1x sends 10 bitcoins to address xxxxx2x; address xxxxx7x mints 25 bitcoins

That is to say, the records show that balances increase and decrease, but there is no actual concept of a uniquely identifiable bitcoin (with, say, a serial number) -- there are only balances held by accounts. On this model, it isn't possible to say that other people's coins end up in your destination wallets. Is that not accurate?

(The fact that you can divide one bitcoin into 100,000,000 satoshi also suggests that there's no such thing as an individual bitcoin...)

The way that it works is that a certain number of coins are created when a block is mined. That number is recorded on the ledger associated with an address. Let's say it's 25 BTC, but it can be any number -- it doesn't matter. If you don't spend any of that BTC, then it exists only as that number -- a chunk if you wish. It is indivisible. It sits as 25 BTC in the account. If you decide to spend 5 BTC of the 25, then the ledger records that 5 BTC goes to wherever you are sending it and 20 BTC goes to your wallet. The previous 25 BTC chunk is removed. The 5 BTC exists as a "chunk" in the other wallet and the 20 BTC exists as a "chunk" in your wallet. The 25 BTC "chunk" no longer exists. Each wallet has a list of these "chunks" of BTC. Let's say that I have a 7 BTC "chunk" as well as the 20 BTC chunk. I want to send 22 BTC to someone else. It will take remove both my 20 BTC "chunk" and my 7 BTC "chunk" and give me a 5 BTC "chunk". I can't remember if the recipient gets a 22 BTC "chunk" or a 20 BTC "chunk" and a 5 BTC "chunk" (it's been a long time since I looked at the source code). I think the former, but it is traceable where the original came from and how they "chunks" where split up.

Hopefully that makes it a bit more clear. The word "chunk" is my own -- if you start using it in other discussions, nobody will know what you are talking about ;-) However, the main thing is that the wallets do not contain balances, but lists of transactions that ended up giving them coins. While there is no such thing as a "coin", it's discrete amounts rather than flowing in and out like water.

Not accurate. You can trace the life of a particular 'coin' value -- which is generated in the coinbase reward in a block and spent later on in a UTXO (unclaimed transaction output). We like to pretend that bitcoin is fungible, but it strictly is not; You can trace the life of every 50, 25 and now 12.5 Bitcoin from birth to currently unspent. They all get mixed, so it can be difficult.

Also, what you are describing is the so called 'account' model -- used by Ethereum, EOS, etc. Bitcoin is a 'utxo' model, which allows specific inputs/outputs to be traced.

   (The fact that you can divide one bitcoin into 100,000,000 satoshi
    also suggests that there's no such thing as an individual bitcoin...)

Wouldn't it rather say "there is such a thing as a satoshi" ?

No, because my first argument still applies in full to satoshi. There are balances of satoshi, but no individual satoshi.

every satoshi can be traced from birth until unspent. There are most certainly individual satoshi. they live in UTXO's.

This is not true. Say I have a wallet with two Satoshi, and I transfer one each to two different wallets. Then I transfer two Satoshi from those wallets to a new wallet. Which way did each Satoshi take? You can't say!

It looks like it is true in a technical sense; a bitcoin transaction record specifies a prior transaction as its input, rather than specifying a source address. So as a purely formal matter, your example records will look like this in relevant part:

    T0885: 100 Satoshi from T0002 to address xxxxx0x # 1 wallet, 2 Satoshi
    T1001:   1 Satoshi from T0885 to address xxxxx1x
    T1104:   1 Satoshi from T0885 to address xxxxx2x # Each Satoshi moves to a separate new wallet
    T1300:   1 Satoshi from T1104 to address xxxxx3x
    T1400:   1 Satoshi from T1001 to address xxxxx3x # and then they recombine

https://en.bitcoin.it/wiki/Transaction

From that record, it's clear that one Satoshi moved from address 0x to address 3x by way of transaction 1001, and the other one did the same by way of transaction 1104.

However, there is no instrumental difference between an address's balance from one transaction and its balance from another transaction, as the behavior of the address is controlled by the private key associated with that address, and two balances belonging to the same address necessarily share the associated private key. I'm not sure what this is supposed to accomplish.

The transaction sequence in your example is not possible. A transaction output can only be used once as an input. To me, the operation would rather look like these three transactions:

    100 Satoshi from A1
        2 Satoshi to A2
        98 Satoshi to Ax

    2 Satoshi from A2
        1 Satoshi to A3
        1 Satoshi to A4

    1 Satoshi from A3
    1 Satoshi from A4
        2 Satoshi to A5

Edit: Sorry I referred to "wallets" in my previous comment. This allows a scenario where the Satoshis are kept in separate transactions all the time. But I'm not interested in those scenarios. I'm talking about scenarios with multiple inputs and outputs. Where you can't say which of the inputs went which way. In this transaction:

    1 Satoshi from A1
    1 Satoshi from A2
        1 Satoshi to A3
        1 Satoshi to A4

You can't tell which Satoshi went where.

Yeah, I will 'change' my position on this. Satoshis in a single UTXO that are split are fungible - in your scenario you cannot identify the specific sat: either a1->a3, or a1->a4. This is kind of like 'forward fungibility'. You can however trace the value in satoshi's back from A4 to their coinbase at birth. At best, we introduce a UTXO taint percentage from previous inputs. Its this taint from other, external inputs that break backwards fungibility (due to taint).

So make public the addresses, give out a reward for proof of destination, and then let the cryptohacker community get after it. Kraken is offering $100k, we just need the addresses.

Reply on news.ycombinator.com