4 ms·

Can someone else confirm to me that I'm not crazy and the central distinction of this article is totally bogus? Reasoning: BitCoin isn't, to my knowledge, a sc

by drostie 10y ago

Can someone else confirm to me that I'm not crazy and the central distinction of this article is totally bogus? Reasoning: BitCoin isn't, to my knowledge, a scheme where some private identifier is stored inside each "coin" whose ownership is revealed with a zero-knowledge proof; it's simply one where you have public and private keys and use those private keys to sign transactions saying "Take X1 out of my public key K1 and put X2 in public key K2, with X1 - X2 going to the miner." That is, BitCoins themselves, as I understand them, are just points in a big distributed videogame: they do not represent actual packets of data which are individually 'minted' in mining and stored on your computer until you spend them. If that's correct, then there's no distinction if you tumble-via-miners versus tumble-via-tumblers -- either way the coins are 'freshly minted'; there's simply no other sort of coin. The only real thing that you seem to be able to do here is to tumble via both the tumblers and the miners, which might create some binary tree of complexity if someone tries to "follow the money" -- but that doesn't seem to be what the author is saying. Is there legitimately something in each coin which makes it easier to follow a given bitcoin via tumbling than through miner-money-laundering, or are they really just the same thing performed through different channels, with a much slower rate of success for the MML tumbling?

mwilcox 10y ago
Yes tumbling is much more secure if your goal is to anonymise your money. MML is much more easily traceable as you just look at the guy who mined the block and send the authorities to go and speak with him. Especially if the large mining operations are well known. The usefulness to a launderer seems more the simplicity of exchanging a large amount of coins for fiat currency in a single transaction, rather than going through an exchange or sending lots of complex small transactions through a mixer and figuring out how to exchange all of that back without going through an exchange w/ KYC
- CydeWeys 10y ago
  > MML is much more easily traceable as you just look at the guy who mined the block and send the authorities to go and speak with him. Well that's easier said than done. There are a large number of blocks for which the miner is not known. The only reason the miner is known for as many blocks as it is is because several of the largest mining pools tag every block that they mine as a form of accountability to their miners (and of course bragging rights).
  - MichaelGG 10y ago
    OK but you know the account that got the "laundered" money. So whatever you were going to do with the BTC before laundering (like cash them in), you still can't do. The previous identity flows. I think the article is simply wrong.
    - CydeWeys 10y ago
      No you don't know where the laundered money ends up. See my other longer comment in this thread, but the gist of it is that the pool will use the transaction fee to pay their mining rewards out of, and pay out rewards from previous blocks to a series of separate virgin addresses controlled by the original party in a way that looks indistinguishable from mining reward payouts. I will grant you that the article didn't fully explain the process, and elided important details.
      - drostie 10y ago
        Most of the "important details" aren't, as far as I can see. The only big thing that the pool adds is plausible deniability: everything else can be simulated by sufficiently complex tumblers; it's just that the vast majority of mining payouts are untainted that gives this a mixing effect. (You can delay payments and pay back in installments to multiple addresses that are not the source address but are owned by that person, via either mechanism.) Running some numbers, it looks like about 98% of Bitcoin's hashrate seems to be held in the top 10 mining pools; assuming this isn't a common service provided by those top pools then a mining pool which launders too will have, say, 1% of the network hashrate at most. That's actually a nice place to be in; it means you get a payout roughly every 1000 minutes of 25 BTC (~$400) plus what looks like typically 1500 transactions or so paying you about a nickel apiece -- so let's optimistically say you get a payout of $600 total every 16 hours, or $900/day. Maybe you can keep plausible deniability going even when 25% of your revenues come from laundering transactions, so that means they can launder about $300/day. That's not too bad, about $100k/year, but it's not a massive chunk of the money laundering happening worldwide either, which usually is quoted in at least terms of billions of dollars -- so 4-5 orders of magnitude larger. Even considering how much the network as a whole could maybe launder if they were crazy about it (100x more participation in laundering, 10x more revenues from laundering transactions) you're still only 1-10% of total global money laundering by this mechanism before you have no presumption of "most of this money is clean so the laundered money is properly hidden." So e.g. if you wanted to launder $1m within a year using our example pool then you'd have to pay in $2700/day and the legitimate transactions of the pool would only be 900/3600 = 25%; I'm not claiming that this is insecure -- but rather that a normal tumbling system could do this too, purchasing 25% of the money-to-be-laundered from a BitCoin exchange, gradually paying out over a year, and reselling the surplus 25% back on the exchange, for no real difference in security (but potential gains in speed and volume). If you charge a 10% laundering fee then this is an investment of $250k to gain $350k over the course of 550 installments in the year, so if I'm doing the math right that's a return rate of 0.13094%/installment or a nominal rate of 72%/year -- plenty enough to cover whatever risks there are in the currency, inflation, opportunity cost, etc. So it wouldn't be prohibitively much to ask the laundering network to invest, if I'm doing these numbers right.
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
joshuak 10y ago
You are correct in that tracing a transaction fee is equivalent to tracing any kind of transaction. There is no event horizon for transaction fees as implied by the article. New coins have no history because they are new, the coins for the fee are not new, they are simply added to the reward total for successfully mining them. --- That being said the bitcoin metaphor is misleading in the details as metaphors always are. There are no bitcoins, in that there are no IDs that are kept in an inventory that represent every individual bitcoin. Instead bitcoins are represented as ledger entries only. The traceability, or lack thereof, comes from the ability to trace the ledger entries. It goes something like this: Miner: "Everyone agrees I now have 25 bitcoins in account M1. Because I'm a winner!" Miner: Tx :: Send 25 bitcoins from M1 account, to P2 (Person 2's public key) Person 2: Tx :: Send 5 bitcoins from P2, to P3. Balances M1: 0 P2: 20 P3: 5 P3's bitcoins can be traced to P2, and then M1. Now P2 sends a transaction with a high fee (up to now no fees were paid). Person 2: Tx :: Send 1 bitcoin from P2, to P4, with a tx fee of 19. Miner 2: "Everyone agrees I now have 44 bitcoins in my M2 account. Because I'm a winner!" Balances M1: 0 P2: 0 P3: 5 P4: 1 M2: 44 M2's bitcoins can be traced to 25 new coins, 19 fee coins given by P2, who go them form m1. P3 is not involved in the transaction history, and every transaction is traceable.
CydeWeys 10y ago
In traditional tumbling, let's say you have ten people who all want to intermingle their funds. So you have ten inputs and ten outputs, and now there's some plausible deniability added because you don't know which particular one of the ten any given output corresponds to. But you do know it belongs to one of the ten, which is still significant information. And, most importantly, the vast majority of Bitcoiners do not use tumbling services. With mining, however, you are intermingling with the activities of an entire mining pool. It is WAAAY harder to trace. Let's say I want to launder 1,000 BTC, and I have a sympathetic mining pool that will launder it for me. So I sign a 1,000 BTC transaction that gives it all away as a transaction fee, and they include it in their next mined block, eating the full bonus. Then, separately, either before or after, and possibly far separated in time chronologically, they issue a series of transactions to a set of separate virgin receiving addresses I have created that total up to, say, 999 BTC (they keep 1 BTC as their mixing fee). As a key point, these transactions do NOT spend the output of the 1,000 BTC reward block, but rather, block generation rewards from previous blocks they've mined. They are indistinguishable from standard mining reward payouts, which any pool goes through a huge number of every day. Those 999 BTC I now have spread across my addresses are way more anonymized than anything I could get with a traditional mixing pool.
- joshuak 10y ago
  This does not serve as a tumbling mechanism because the participants aren't peers. The coins went all one direction from source to many destinations. If those many destinations don't, in turn, pay the source back in some way you've just lost the money not laundered it.
  - CydeWeys 10y ago
    I don't understand your objection. The mechanism I explained works to launder and obscure the auditable trail of Bitcoin. All I figure is that you're pointing out some there is some risk inherent in the mining pool simply walking away with the money. OK, sure. There's lots of trust involved in the Bitcoin ecosystem. Every time I buy something on the Internet with Bitcoin I'm trusting the retailer to send me what I ordered rather than walking away with my money. Every time I transfer BTC to an exchange in order to sell it I'm similarly trusting that they won't instead simply screw me over.

by drostie 10y ago

mwilcox 10y ago

Yes tumbling is much more secure if your goal is to anonymise your money. MML is much more easily traceable as you just look at the guy who mined the block and send the authorities to go and speak with him. Especially if the large mining operations are well known. The usefulness to a launderer seems more the simplicity of exchanging a large amount of coins for fiat currency in a single transaction, rather than going through an exchange or sending lots of complex small transactions through a mixer and figuring out how to exchange all of that back without going through an exchange w/ KYC

CydeWeys 10y ago
> MML is much more easily traceable as you just look at the guy who mined the block and send the authorities to go and speak with him. Well that's easier said than done. There are a large number of blocks for which the miner is not known. The only reason the miner is known for as many blocks as it is is because several of the largest mining pools tag every block that they mine as a form of accountability to their miners (and of course bragging rights).
- MichaelGG 10y ago
  OK but you know the account that got the "laundered" money. So whatever you were going to do with the BTC before laundering (like cash them in), you still can't do. The previous identity flows. I think the article is simply wrong.
  - CydeWeys 10y ago
    No you don't know where the laundered money ends up. See my other longer comment in this thread, but the gist of it is that the pool will use the transaction fee to pay their mining rewards out of, and pay out rewards from previous blocks to a series of separate virgin addresses controlled by the original party in a way that looks indistinguishable from mining reward payouts. I will grant you that the article didn't fully explain the process, and elided important details.
    - drostie 10y ago
      Most of the "important details" aren't, as far as I can see. The only big thing that the pool adds is plausible deniability: everything else can be simulated by sufficiently complex tumblers; it's just that the vast majority of mining payouts are untainted that gives this a mixing effect. (You can delay payments and pay back in installments to multiple addresses that are not the source address but are owned by that person, via either mechanism.) Running some numbers, it looks like about 98% of Bitcoin's hashrate seems to be held in the top 10 mining pools; assuming this isn't a common service provided by those top pools then a mining pool which launders too will have, say, 1% of the network hashrate at most. That's actually a nice place to be in; it means you get a payout roughly every 1000 minutes of 25 BTC (~$400) plus what looks like typically 1500 transactions or so paying you about a nickel apiece -- so let's optimistically say you get a payout of $600 total every 16 hours, or $900/day. Maybe you can keep plausible deniability going even when 25% of your revenues come from laundering transactions, so that means they can launder about $300/day. That's not too bad, about $100k/year, but it's not a massive chunk of the money laundering happening worldwide either, which usually is quoted in at least terms of billions of dollars -- so 4-5 orders of magnitude larger. Even considering how much the network as a whole could maybe launder if they were crazy about it (100x more participation in laundering, 10x more revenues from laundering transactions) you're still only 1-10% of total global money laundering by this mechanism before you have no presumption of "most of this money is clean so the laundered money is properly hidden." So e.g. if you wanted to launder $1m within a year using our example pool then you'd have to pay in $2700/day and the legitimate transactions of the pool would only be 900/3600 = 25%; I'm not claiming that this is insecure -- but rather that a normal tumbling system could do this too, purchasing 25% of the money-to-be-laundered from a BitCoin exchange, gradually paying out over a year, and reselling the surplus 25% back on the exchange, for no real difference in security (but potential gains in speed and volume). If you charge a 10% laundering fee then this is an investment of $250k to gain $350k over the course of 550 installments in the year, so if I'm doing the math right that's a return rate of 0.13094%/installment or a nominal rate of 72%/year -- plenty enough to cover whatever risks there are in the currency, inflation, opportunity cost, etc. So it wouldn't be prohibitively much to ask the laundering network to invest, if I'm doing these numbers right.

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

joshuak 10y ago

You are correct in that tracing a transaction fee is equivalent to tracing any kind of transaction. There is no event horizon for transaction fees as implied by the article. New coins have no history because they are new, the coins for the fee are not new, they are simply added to the reward total for successfully mining them. --- That being said the bitcoin metaphor is misleading in the details as metaphors always are. There are no bitcoins, in that there are no IDs that are kept in an inventory that represent every individual bitcoin. Instead bitcoins are represented as ledger entries only. The traceability, or lack thereof, comes from the ability to trace the ledger entries. It goes something like this: Miner: "Everyone agrees I now have 25 bitcoins in account M1. Because I'm a winner!" Miner: Tx :: Send 25 bitcoins from M1 account, to P2 (Person 2's public key) Person 2: Tx :: Send 5 bitcoins from P2, to P3. Balances M1: 0 P2: 20 P3: 5 P3's bitcoins can be traced to P2, and then M1. Now P2 sends a transaction with a high fee (up to now no fees were paid). Person 2: Tx :: Send 1 bitcoin from P2, to P4, with a tx fee of 19. Miner 2: "Everyone agrees I now have 44 bitcoins in my M2 account. Because I'm a winner!" Balances M1: 0 P2: 0 P3: 5 P4: 1 M2: 44 M2's bitcoins can be traced to 25 new coins, 19 fee coins given by P2, who go them form m1. P3 is not involved in the transaction history, and every transaction is traceable.

CydeWeys 10y ago

In traditional tumbling, let's say you have ten people who all want to intermingle their funds. So you have ten inputs and ten outputs, and now there's some plausible deniability added because you don't know which particular one of the ten any given output corresponds to. But you do know it belongs to one of the ten, which is still significant information. And, most importantly, the vast majority of Bitcoiners do not use tumbling services. With mining, however, you are intermingling with the activities of an entire mining pool. It is WAAAY harder to trace. Let's say I want to launder 1,000 BTC, and I have a sympathetic mining pool that will launder it for me. So I sign a 1,000 BTC transaction that gives it all away as a transaction fee, and they include it in their next mined block, eating the full bonus. Then, separately, either before or after, and possibly far separated in time chronologically, they issue a series of transactions to a set of separate virgin receiving addresses I have created that total up to, say, 999 BTC (they keep 1 BTC as their mixing fee). As a key point, these transactions do NOT spend the output of the 1,000 BTC reward block, but rather, block generation rewards from previous blocks they've mined. They are indistinguishable from standard mining reward payouts, which any pool goes through a huge number of every day. Those 999 BTC I now have spread across my addresses are way more anonymized than anything I could get with a traditional mixing pool.

joshuak 10y ago
This does not serve as a tumbling mechanism because the participants aren't peers. The coins went all one direction from source to many destinations. If those many destinations don't, in turn, pay the source back in some way you've just lost the money not laundered it.
- CydeWeys 10y ago
  I don't understand your objection. The mechanism I explained works to launder and obscure the auditable trail of Bitcoin. All I figure is that you're pointing out some there is some risk inherent in the mining pool simply walking away with the money. OK, sure. There's lots of trust involved in the Bitcoin ecosystem. Every time I buy something on the Internet with Bitcoin I'm trusting the retailer to send me what I ordered rather than walking away with my money. Every time I transfer BTC to an exchange in order to sell it I'm similarly trusting that they won't instead simply screw me over.