This document discusses cryptocurrency analytics and summarizes a presentation on the topic. It introduces some of the most frequent questions received about cryptocurrency and outlines the goals of developing scalable quantitative methods and tools to better understand cryptocurrency ecosystems through micro-level analysis of individual transactions and macro-level analysis of actors and their relationships. Example analytics methods are described, including blockchain analytics techniques like address clustering and transaction network analysis.

1. O BITCOIN WHERE ART THOU?
An Introduction to Cryptocurrency Analytics
Dr. Bernhard Haslhofer
Oesterreichische Nationalbank (OeNB) | Research Seminar
2018-01-12

2. 1. Which cryptocurrency should I buy?
2. What do you think about cryptocurrency X?
3. Where can I buy cryptocurrency X? Is it safe?
4. Can you help me setting up a cold wallet?
5. How will the price of cryptocurrency X evolve?
MOST FREQUENT QUESTIONS I GET
2

3. PUBLIC ATTENTION
3

4. • Cryptocurrencies have entered mainstream
• Public opinion is often misinformed and based
on insufficient and / or unexamined evidence
• Systematic scientific examination of entire
cryptocurrency ecosystems still in its infancy
• Missing methods, insufficient tool support
MOTIVATION
Image source: https://www.flickr.com/photos/namecoin/22995486509
4

5. • Contribute to a better understanding of the structure
and dynamics of cryptocurrency ecosystems
• Multidisciplinary cooperation to answer specific
(research) questions related to cryptocurrencies
• Develop scalable quantitative methods, tools and
services that help in answering those questions
• Micro-level analysis: inspect atomic entities
(block, transaction, address, currency flow)
• Macro-level analysis: investigate real-world actors
and services and their relationships
OUR GOALS
CRYPTOCURRENCY
ANALYTICS
5

6. INSIGHT INTO
CRYPTOCURRENCY
ECOSYSTEMS
Global
De-centralized
Transparent
Pseudo-Anonymous
Complex, dynamic
Networks
Exchanges
ATMs /
Vouchers
Payment
Services
Darknet
Markets
Mixing
Services
graphsense.info
30M
clusters
480K
blocks
1.5B
relations
296M
addresses
249M
transactions
For Whom?
Science
Public
Authorities
FinTech /
Banks

7. • Bitcoin: A (Very) Brief Introduction
• Cryptocurrency Analytics Methods
• GraphSense Cryptocurrency Analytics Platform
• Example Study: Ransomware Payments in the Bitcoin Ecosystem
• Future Research Directions
• Q & A
MY PLAN FOR TODAY
7

8. EXAMPLE TRANSACTION
8

9. TRANSACTION PROCESSING
Broadcast
Transaction
Blockchain
9
Bitcoin P2P Network

10. TRANSACTION PROCESSING
Collect pending
Transactions
Blockchain
10
Bitcoin Miners
Bitcoin P2P Network

11. TRANSACTION PROCESSING
Find & Broadcast
Block
Bitcoin P2P Network
Bitcoin Miners
Blockchain
11

12. TRANSACTION PROCESSING
Synchronize
Blocks
Blockchain
12
Bitcoin P2P Network

13. ANATOMY OF A BITCOIN TRANSACTION
13
txid: a6b06e...
blockhash: 0000ba7..
txid: 7f252a ….
vout: 1
scriptSig: Signature
value: 0.00460479
n: 0
addresses: [1Archive…]
value: 0.00566296
n: 1
addresses: [1MuSWq…]
List of inputs List of outputs
Bitcoin
Addresses
Reference to unspent
output of previous
transaction (UTXO)

14. ANATOMY OF A BITCOIN TRANSACTION
14
txid: a6b06e...
blockhash: 0000ba7..
txid: 7f252a ….
vout: 1
scriptSig: Signature
value: 0.00460479
n: 0
addresses: [1Archive…]
value: 0.00566296
n: 1
addresses: [1MuSWq…]
sum(List of inputs) sum(List of outputs)≥

15. ANATOMY OF A BITCOIN TRANSACTION
15
txid: a6b06e...
blockhash: 0000ba7..
txid: 7f252a ….
vout: 1
scriptSig: Signature
value: 0.00460479
n: 0
addresses: [1Archive…]
value: 0.00566296
n: 1
addresses: [1MuSWq…]
sum(List of inputs) sum(List of outputs)−Transaction Fee =

16. COINBASE TRANSACTION
16
txid: a60f6e2b...
blockhash: 0000ba7..
coinbase: “0367c4...” value: 25.42394247
n: 0
addresses: [1KFHE7…]

17. • Bitcoin: A (Very) Brief Introduction
• Cryptocurrency Analytics Methods
• GraphSense Cryptocurrency Analytics Platform
• Example Study: Ransomware Payments in the Bitcoin Ecosystem
• Future Research Directions
• Q & A
MY PLAN FOR TODAY
17

18. My focus for today
18
TAXONOMY OF ANALYTICS METHODS
Cryptocurrency
Analytics
P2P Network
Analytics
Blockchain Analytics
Network Analytics Clustering Heuristics
[Biryukov et al., 2014]

19. 19
BLOCKCHAIN ANALYTICS
Blockchain Analytics
Network Analytics Clustering Heuristics
Transaction Network
Address Network

20. 20
TRANSACTION NETWORK
t1
t3
t2
t4
[Reid and Harrigan 2012]
0,00321 BTC
2016-03-14 17:33:50
directed
acyclic
temporal

21. 21
TRANSACTION NETWORK | CONSTRUCTION
txid: a6b06e...
blockhash: 0000ba7..
txid: 7f252a ….
vout: 1
scriptSig: Signature
vin
value: 0.00460479
n: 0
addresses: [1Archive…]
vout
Target node id
Source node id
Timestamp (via referenced block)
Value

22. 22
ADDRESS NETWORK
a1
a2
a3
a5
a7 a8
a6
a9 a10
Estimated Value
No. Transactions
[Fleder et al. 2015, Filtz et al. 2017]
(bi-)directed
cyclic

23. 23
ADDRESS NETWORK | CONSTRUCTION
txid: a6b06e...
blockhash: 0000ba7..
txid: 7f252a ….
vout: 1
scriptSig: Signature
vin
value: 0.00460479
n: 0
addresses: [1Archive…]
vout
Source node id
Target node id
No Transactions = aggregated count of edges with same node ids

24. 24
ESTIMATED VALUE | COMPUTATION
inputs and outputs as shown in Table I.
Fig. 2. Bitcoin transaction value assignment
Therefore, we estimate the flow of actual Bitcoins betw
two addresses using the following formula:
TABLE I. BITCOINFLOW
Transaction Formula Estimated BTC
A1 A3 3 * (2/7) 0.857
A2 A3 3 * (5/7) 2.143
A1 A3 4 * (2/7) 1.143
A2 A4 4 * (5/7) 2.857
IV. ANALYSIS
a1 → a3 = 3 ∗
&
'
a1
tx
a2
a3
a4
2 3
45
[Filtz et al. 2017]

25. 25
BLOCKCHAIN ANALYTICS
Blockchain Analytics
Network Analysis Clustering Heuristics
Multiple-Input Heuristics [Nakamoto, 2008]
Change Heuristics [Meiklejohn, 2013]
Temporal Behaviour [Ortega, 2013]
Transaction Fingerprinting [Fleder et. al, 2015]

26. c1
c1
MULTIPLE INPUT HEURISTICS
26
a1
tx
a2
c2
a2
ty
a3
Same address
[Nakamoto, 2008]

27. c1
MULTIPLE INPUT HEURISTICS
27
a1
tx
a2
a2
ty
a3
Tag
Tag
[Nakamoto, 2008]

28. 28
BLOCKCHAIN ANALYTICS
Blockchain Analytics
Network Analysis Clustering Heuristics

29. c6c5
c4
c7
c3
c2
c1
29
CLUSTER / ENTITY NETWORK
a1
a2
a3
a5
a7 a8
a6
a9 a10
Estimated Value
No. Transactions
directed
cyclic

30. • Address clustering
• is a cornerstone of cryptocurrency analysis
• partitions the set of addresses observed in the Bitcoin blockchain into maximal
subsets of addresses that are likely controlled by the same real-world actor
• Multiple input heuristics can identify more than 69% of the addresses stored by
lightweight clients
MULTIPLE INPUT HEURISTICS | EFFECTIVENESS
30
[Harrigan and Fretter, 2016]
Figure 1. A graphical summary of the most significant flows of bitcoin between the largest address clusters during Bitcoin’s first five years in existence.
The vertices correspond to address clusters: red vertices are darknet markets; purple vertices are gambling services; green vertices are exchanges and blue
vertices are mining pools. The gray vertices are not immediately identifiable using publicly available information.
Maxwell described CoinJoin [12], a protocol for trust-

31. • Bitcoin: A (Very) Brief Introduction
• Cryptocurrency Analytics Methods
• GraphSense Cryptocurrency Analytics Platform
• Example Study: Ransomware Payments in the Bitcoin Ecosystem
• Future Research Directions
• Q & A
MY PLAN FOR TODAY
31

32. • Basic Functionality: 1Archive1n2C579dMsAu3iC6tWzuQJz8dN
• Micro-level analysis: 3Nxwenay9Z8Lc9JBiywExpnEFiLp6Afp8v (Bitcoin Rich List)
• Macro-level analysis: 1BjTR3NhTiVPKfbsZhrfx4vYKH4DLeh9UT (AlphaBay Market)
DEMOS
32

33. GRAPH CONSTRUCTION APPROACH
33
A
A A
AA
C
T
BlockchainAddress
Graph
Address
Cluster
Tags
Enrichmentprocess
[Haslhofer et al., 2016]
Statistics (as of Sept. 2017)
Transactions: 249,408,683
Addresses: 296,862,290
Clusters: 30,645,426
Address graph
- nodes (= addresses): 296,862,290
- edges (= aggregated transactions): 1,567,227,841
All data points are pre-computed and stored in
a de-normalized form

34. SOFTWARE COMPONENTS
34

35. OPEN SOURCE !
35

36. • Bitcoin: A (Very) Brief Introduction
• Cryptocurrency Analytics Methods
• GraphSense Cryptocurrency Analytics Platform
• Example Study: Ransomware Payments in the Bitcoin Ecosystem
• Future Research Directions
• Q & A
MY PLAN FOR TODAY
36

37. • Ransomware has become dominant
cybercrime threat
• Over 500 families
• Ransom payments almost exclusively in
Bitcoin
• More comprehensive, evidence-based
picture still missing
RANSOMWARE STUDY | MOTIVATION
37

38. 38
Preliminary results are omitted in public slide deck.
Final results and paper is expected to published in Q2/2018

39. • Bitcoin: A (Very) Brief Introduction
• Cryptocurrency Analytics Methods
• GraphSense Cryptocurrency Analytics Platform
• Example Study: Ransomware Payments in the Bitcoin Ecosystem
• Future Research Directions
• Q & A
MY PLAN FOR TODAY
39

40. • Bitcoin linkability
• All transactions can be linked to prior outputs
• Allows construction of transaction, address, and cluster
graphs
• Monero obscures transactions by including chaff transaction
inputs
• Zcash supports shielded transactions to obscure parties and
amounts
• Ethereum is a “turing-complete” blockchain (smart contracts)
POST-BITCOIN CURRENCY ANALYTICS
40

41. • Working hypothesis:
• Bitcoin is supposed to be a decentralized system
• However, it has very strong centralization
tendencies
• Best example: Mining business
• Research Goals
• Better understanding of mining business across
ledgers
• Investigate economic behavior to infer “real”
structure of mining business
INSIGHT INTO THE MINING ECONOMY
41

42. • Cybercriminals increasingly turn their attention to
cryptocurrency services
• Major target: cryptocurrency exchanges
• Attacks are conducted in the same way as
targeted attacks on banks with similar or
sometimes identical tools and tactics
• Comeback of fraudulent schemes (Ponzi scheme,
investment scams, greater fool theory, etc.)
• Idea: systematic investigation and monitoring for
informed policy making
FINANCIAL CRIME FORENSICS
42

43. • If actors in the cryptocurrency ecosystem exceed
certain monetary thresholds, they might pose an
economic risk
• Ideas
• Develop network-based methods to quantify risks
• Stress test entire ecosystem
• ....
IDEA: SYSTEMIC RISK INVESTIGATION
43

44. O BITCOIN WHERE ART THOU?
An Introduction to Cryptocurrency Analytics
Dr. Bernhard Haslhofer
bernhard.haslhofer@ait.ac.at

45. EVERYWHERE !
Cryptocurrency analytics contributes to a better understanding
Dr. Bernhard Haslhofer
bernhard.haslhofer@ait.ac.at

46. • [Nakamoto, 2008]: Bitcoin: A peer-to-peer electronic cash system
• [Reid and Harrigan 2012]: An Analysis of Anonymity in the Bitcoin System
• [Meiklejohn, 2013]: A fistful of bitcoins: characterizing payments among men with no names
• [Ortega, 2013]: The bitcoin transaction graph—anonymity
• [Biryukov et al., 2014]: Deanonymisation of clients in Bitcoin P2P network
• [Fleder et. al, 2015]: Bitcoin Transaction Graph Analysis
• [Haslhofer et. al, 2016]: O Bitcoin Where Art Thou? Insight into Large-Scale Transaction Graphs.
• [Möser and Böhme, 2016]: Join Me on a Market for Anonymity
• [Harrigan and Fretter, 2016]: The Unreasonable Effectiveness of Address Clustering
• [Filtz et al, 2017]: Evolution of the Bitcoin Address Graph
• [Miller et al, 2017]: An Empirical Analysis of Linkability in the Monero Blockchain
• [Kumer et al, 2017]: A Traceability Analysis of Monero's Blockchain
• [Quesnelle 2017]: On the Linkability of ZCash transactions
REFERENCES
46