Hacker News Reader

Comment by chrisseaton | Hacker News Reader

> n a difficult to trace manner is a new thing

I still don’t understand - how is Bitcoin difficult to trace when there is a global immutable public record of all transactions?

View on HN

https://en.wikipedia.org/wiki/Cryptocurrency_tumbler

What happens when crypto tumblers run away with the money

Well, of course another will come along!

it seems logical to me a sophisticated syndicate would run their own tumbler. I'd assume there is some kind of OSS wordpress for mixing out there. And I don't think it'd be that hard to get other people to use it to get liquidity (just offer it as a free service).

Presumably the people who use tumblers never transfer such a huge amount of BTC into any one single tumbler, at a time, that would cause the tumbler operator to seriously contemplate pulling an exit scam.

There are projects like Miximus, which is an Eth tumbler with no operator. Participants deposit funds into a smart contract, then when they want to withdraw later, they use zero-knowledge proofs to show that they know one of the private keys without revealing which one.

There's also Zcash, which applies similar logic to all shielded transactions.

Oh that's nice.

Tumble it in small amounts at a time. Maybe the tumbler runs away with a few hundred thousand but you are still left with millions.

You'll have potentially thousands of criminals trying to get their money back? I don't like those odds but if someone wants to try that go ahead.

Isn't 'tumbling' literally a money laundering operation?

yes, and it proves GP's point about crypto enabling crime. It's trivial to implement.

It's just a ledger kept outside so there is no link between the money going in and the money coming out.

Money laundering involves the intentional hiding of the origins of funds obtained through criminal activity. Attributing the source of funds as being criminally obtained is difficult if tumbling is done effectively. If tumbling was reason enough to be suspected of money laundering, so would splitting a $100 at a gas station.

Not necessarily, if the source of the money is legal and you're tumbling it just for privacy reasons, it's not money laundering.

1) You need to be able to tie a BTC address to a human 2) Mixers

Can you really not follow the trail from the mixers?

CipherTrace says they lost the trail on the twitter hackers when they threw the btc they scammed into mixers.

On the other hand, the Feds arrested a kid in Florida, so my question is... how did they find him?

Feds = mixers

> It's not so much loose ends as loose everything.

https://news.ycombinator.com/item?id=24013070

Only 20% of the funds went into mixers.

If I had to guess, the attack was done by a group of people and they split the funds up. Some of them were smarter than others.

It's also possible that the people who have been arrested are simply people who have received stolen goods (knowingly or unknownly). Perhaps they traded something else of value for the Bitcoin and didn't know how dirty it was.

There are other ways to track them than the trail of their BTCs. For instance, did they apply a proper opsec hygiene? Did they brag about it, to friends online or offline?

4chan. He wrote it there, afaik from a Twitter comment with screenshot posted many days ago before the Feds announced the kid.

Then bragged about it and went for more accounts. His friends left him when he went for the high profile accounts. I think it was organized on discord.

The mixers keep a ledger outside the blockchain, so no—and a well written one wouldn't store any logs. You could possibly know that someone used a mixer but you wouldn't be able to track from the blockchain where the money came from. It could've come from 1000s of other transactions all with different amounts—none that would trace back to the source funds wallet.

Do you not tie yourself to your Bitcoin when you try to use it for something physical like turning it into cash or buying a physical asset?

Can you not track all Bitcoins going in and out of a mixer?

I think one of the ideas of mixers is to achieve such a large volume of transactions that dedicating man-hours and personnel resources to tracking down every transaction path becomes cost prohibitive on the part of a law enforcement organization.

The idea is that you can't track any of the transaction paths. There's nothing tying a specific input transaction to a specific output transaction, and great pains are taken to ensure there cannot be any publicly available link.

500 unrelated accounts all deposit money into a single shared account. From that shared account, payments are made to 1,000 other accounts. None of the amounts match the original deposits, even when summed. Whose money is whose?

This is an oversimplification, but it should give you a rough idea of how difficult it is to trace Bitcoin.

Authorities might already know mixers service providers and a subpoena will give them all info they need. Not sure tho, I haven't used bitcoin but there always be weak link somewhere

I would be very surprised if any mixer operators are located in places that care in the slightest about a US subpoena (russia, etc).

How are you going to identify them? When they cash out, all their Bitcoin has already been laundered.

Granted, this is all theoretical. In practice, it’s not unusual for such people to make mistakes that reveal their identity; however, there’s nothing inherent to Bitcoin that ensures they can be de-anonymized.

Usually they attempt to go after hosting providers, but when the services are only accessible by Tor and they’re using bulletproof hosting—hosting providers who do their best to avoid law enforcement—that’s no easy feat. It’s not impossible, but it can be both a technical and diplomatic nightmare.

You clearly have no idea what you're talking about.

> This is an oversimplification, but it should give you a rough idea of how difficult it is to trace Bitcoin.

You'd be surprised. The feds have very advanced taint analysis if they have reason to go after you.

When you use a mixer, there’s a delay between when you put your money in and when it comes back out. The mixing service randomly splits up the transaction into batches and sends them out at different times. So even if you know that somebody sent to a mixer (perhaps as an investigator you could find out mixer addresses by sending lots of transactions to the mixer service yourself), you wouldn’t be able to associate those inputs with any particular output.

If the mixer has a lot of users, at best you could determine that the your target is among the entire set of people who used the mixer this hour/day. Although if the mixer was compromised, you’d have everything. That does seem like a substantial risk. It’s kind of like deciding to trust your vpn. You could mitigate that risk by using multiple mixers.

Wouldn't using multiple mixers increase the risk? You only need to be traced once.

I would not split your transaction between mixers, but instead mix your entire amount through one, then mix all of the outputs through others. Use multiple mixers in series, not in parallel. Compromising one mixer there would associate the inputs and outputs of that step but wouldn’t associate your initial input with your final output. You’d also want to conceal your ip at every step so you don’t get compromised that way either.

Would there not be a huge danger that a mixer operator, if they received $4m+ of BTC in one big transfer, could simply shut down immediately and pull what's known as an 'exit scam'? They would be in possession of the BTC and could themselves then launder it through other mixers.

Perhaps they might do this if the saw keeping the entire 4m as much more lucrative than many years of taking the percentage skimmed off the top from a number of smaller transactions, and just going into "retirement".

You’d only want to use a mixer where your transaction represents a small fraction of the total volume (otherwise it doesn’t provide much anonymity). An exit scam isn’t so appealing in that case. If a mixer charges a 1% fee, with an average delay of 1 hour, the ongoing fee earns more than a one-time exit scam of all transactions in flight after just four or five days. It takes time to establish a reputable mixer and scale up, so your wouldn’t ruin it just to get under a week of profit early. Maybe they’d choose to do the exit scam if a really anomalous huge sum showed up, which is so large they can’t mix it effectively anyway. I don’t know if $4M is a lot by those standards.

Maybe I'm woefully out of touch on the scale of the BTC flowing through mixers on a daily and weekly basis, but if they can earn more than 4M USD in a year by just skimming off the 1%, that's a lot of BTC moving...

In that case, you split your initial sum and run through multiple sequential series in parallel. You produce more crackable sequences, but you still need to crack an entire sequence to trace the owner.

>you could find out mixer addresses

Why would the mixer need to reuse addresses when you could create a brand new one each time.

Investigators could be sending many small transactions into the mixer all the time. Depending on the transaction volume and how the mixer works, they could identify most of the mixer’s transactions this way. This would allow them to show that somebody sent money to or received money from the mixer.

If you understand enough about Bitcoin to know how the immutable ledger works, your questions feel bad faith. One of the biggest “selling points” early on was obviously anonymity.

Reply on news.ycombinator.com