7 ms·

Stolen ETH goes here to get a shave and a new suit, then it can go wherever it likes https://tornado.cash/ https://tornado.cash/

josephd79 5y ago
You know, outside of use cases for scammers and hackers. This protocol is actually pretty interesting. I'm actually surprised it's not getting more attention then what it already has.
codethief 5y ago
Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and withdrawal. That very much sounds like an impossibility statement like "Use Tornado Cash and no one will be able to trace your transaction". OTOH, they also say that > After depositing, users should wait some amount of time before withdrawing to improve their privacy. and that > To preserve privacy a relayer can be used to withdraw to an address with no ETH balance. So it seems privacy is not a binary switch here and, instead, it can be "improved" and "preserved". But what is it then? Can deposit and withdrawal be linked or not? Are the privacy guarantees as absolute and strong as the FAQ make them out to be?
- MauranKilom 5y ago
  I fail to see the contradiction. All they claim is that the protocol is secure. It obviously cannot prevent you from revealing your transaction via other means. For example, by publicly announcing it.
- k__ 5y ago
  If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.
  - Nextgrid 5y ago
    I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?
    - ceejayoz 5y ago
      There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.
      - garbagetime 5y ago
        Even things like buying houses (and I have heard of people buying houses with ETH). People generally like privacy when it comes to medium and large purchases, regardless of what it is that they are purchasing.
        pjc50 5y ago
        It would be illegal to anonymously buy property in the UK. https://www.gov.uk/government/publications/how-to-buy-a-home/how-to-buy#id-checks https://www.gov.uk/government/publications/how-to-buy-a-home... > People generally like privacy when it comes to medium and large purchases The "war on money laundering" goes against this.
        ceejayoz 5y ago
        https://www.cbsnews.com/news/pandora-papers-uk-real-estate-hiding-assets-shell-companies-corruption/ https://www.cbsnews.com/news/pandora-papers-uk-real-estate-h... > But the recent Pandora Papers leak has revealed that U.K. properties worth nearly $5.5 billion, according to those who've analyzed the documents, have been purchased through offshore shell companies that hide the owners' identities. > "Using a shell company means that no one need ever know that the asset is yours," said anti-corruption activist Duncan Hames, Director of Policy at Transparency International. "Indeed, the British government probably doesn't know."
- norswap 5y ago
  It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew. So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of the deposits, but not which one. As for privacy improvements: - If you deposit then immediately withdraw, observers might suspect that you instantly withdrew your deposit. - You need ETH for the withdrawal transaction, which has to come from somewhere (making it potentially traceable). With their relayers you can withdraw to an empty account while hiding the origin of the transaction fee.
  - generalizations 5y ago
    > the only thing you know is that each withdrawal matches one of the deposits, but not which one. If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made. Best case, you wait long enough and maybe someone else deposits 3.799 ETH.
    - dannyw 5y ago
      That is why they have a few standard sizes.
    - deleted 5y ago
      [deleted]
    - deleted 5y ago
      [deleted]
    - okwubodu 5y ago
      It only lets you use fixed multiples for this reason (0.1, 1, 10, etc.). You can reasonably narrow it down as the amounts get higher, though.
  - numbsafari 5y ago
    I wonder if it could be argued in court that use of such a system makes you party to a conspiracy.
Nextgrid 5y ago
I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with horrible crime beyond just fraud or theft.
- Grustaf 5y ago
  Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.
  - ceejayoz 5y ago
    > I don't think we are under obligation to keep our funds traceable? Oh, you do. Not being able to prove the source of your funds puts you at serious risk of asset forfeiture.
    - gumby 5y ago
      Oh, once you’re talking about asset forfeiture, even an ironclad provenance doesn’t help.
    - Grustaf 5y ago
      That's not quite what I'm talking about. Obviously if you transfer money to your account you need to be able to explain where it comes from. But once you have the money, you can turn them into cash or gold if you want. At that point they are anonymous. If you the give them to someone, well then they need to explain where it came from. Also, if you want to put them back into your account, you'd need to show provenance.
  - linspace 5y ago
    We are totally under the obligation to justify funds. To start with, because taxes, but also there are a lot of legislation put in place to prevent money laundering under threat of very high fines for non compliance, even if no laundering happened
mrep 5y ago
Amazing. So now you can steal a bunch of crypto and wash it. Holy shit, if you then create some BS coin which gets a bunch of "investors" (really just you investing the coins you stole), you could steal hundreds of millions if not billions of dollars and get it fully laundered and recognized as legitimate by the government, all from your computer anywhere in the world. What a time to be alive as a criminal hacker!
- pjc50 5y ago
  I do wonder at what point this gets serious and starts interacting with OFAC; if it really worked as uncensorable finance, we'd have seen a tanker of Iranian oil sold for bitcoin. Doesn't quite seem to have reached that scale yet. I suspect a lot of nonsense is tolerated by the US authorities because it's enabling Chinese nationals to evade China's export controls, though.
  - f38zf5vdt 5y ago
    Isn't even better than that? They'd have anonymous internet cash to use to bribe foreign officials at a time when many nations have been tightening the noose around finance and what an individual is allowed to own.
- 323 5y ago
  Tornado cash doesn't launder your crypto. Just breaks the link between the heist and your new crypto address. If you steal billions, you still have the problem of justifying them.
  - pas 5y ago
    Unless you happen to know of jurisdictions where there's a "no questions asked buy government bonds jubilee".
  - mrep 5y ago
    That is the point of the BS coin, that is what you attach your identity to and then you trade all of the washed coins for your new BS coin. Creating/mining the BS coin is where your legitimacy comes from.

josephd79 5y ago

You know, outside of use cases for scammers and hackers. This protocol is actually pretty interesting. I'm actually surprised it's not getting more attention then what it already has.

codethief 5y ago

Could someone ELI5 how Tornado Cash achieves (or doesn't achieve) privacy? Their FAQ say: > Is it possible to compromise the protocol and find out information about depositors? -- No, Tornado Cash is a decentralized protocol based on zero knowledge proofs. Its smart contracts are immutable, have no admins, and the proofs are based on strong cryptography. Only the user possessing the Note is able to link deposit and withdrawal. That very much sounds like an impossibility statement like "Use Tornado Cash and no one will be able to trace your transaction". OTOH, they also say that > After depositing, users should wait some amount of time before withdrawing to improve their privacy. and that > To preserve privacy a relayer can be used to withdraw to an address with no ETH balance. So it seems privacy is not a binary switch here and, instead, it can be "improved" and "preserved". But what is it then? Can deposit and withdrawal be linked or not? Are the privacy guarantees as absolute and strong as the FAQ make them out to be?

MauranKilom 5y ago
I fail to see the contradiction. All they claim is that the protocol is secure. It obviously cannot prevent you from revealing your transaction via other means. For example, by publicly announcing it.
k__ 5y ago
If you put 123ETH into Tornado from address A and then withdraw 123ETH shortly after from Tornado to address B this will be written to the blockchain. It might not be evidence that A and B are your addresses, but strong implications. So, you put it into Tornado and wait days, weeks, or even months, so it could be a random transaction.
- Nextgrid 5y ago
  I wonder what would be a legitimate, non-suspicious reason to interact with such a service at all?
  - ceejayoz 5y ago
    There are entirely legal, legitimate things one might do while still wanting to have some privacy about it. Buying porn, for example, might be something you're fine with but not really want tied to your known address.
    - garbagetime 5y ago
      Even things like buying houses (and I have heard of people buying houses with ETH). People generally like privacy when it comes to medium and large purchases, regardless of what it is that they are purchasing.
      - pjc50 5y ago
        It would be illegal to anonymously buy property in the UK. https://www.gov.uk/government/publications/how-to-buy-a-home/how-to-buy#id-checks https://www.gov.uk/government/publications/how-to-buy-a-home... > People generally like privacy when it comes to medium and large purchases The "war on money laundering" goes against this.
        ceejayoz 5y ago
        https://www.cbsnews.com/news/pandora-papers-uk-real-estate-hiding-assets-shell-companies-corruption/ https://www.cbsnews.com/news/pandora-papers-uk-real-estate-h... > But the recent Pandora Papers leak has revealed that U.K. properties worth nearly $5.5 billion, according to those who've analyzed the documents, have been purchased through offshore shell companies that hide the owners' identities. > "Using a shell company means that no one need ever know that the asset is yours," said anti-corruption activist Duncan Hames, Director of Policy at Transparency International. "Indeed, the British government probably doesn't know."
norswap 5y ago
It's a coin mixer: you deposit ETH into a common pool shared with a bunch of other people, and you get back (off-chain) a code that can be used to redeem your deposit at a later date. Since there is no link between the code and the sender on-chain, nobody knows which contributor to the pool withdrew. So if there are N deposits then later N withdrawals, the only thing you know is that each withdrawal matches one of the deposits, but not which one. As for privacy improvements: - If you deposit then immediately withdraw, observers might suspect that you instantly withdrew your deposit. - You need ETH for the withdrawal transaction, which has to come from somewhere (making it potentially traceable). With their relayers you can withdraw to an empty account while hiding the origin of the transaction fee.
- generalizations 5y ago
  > the only thing you know is that each withdrawal matches one of the deposits, but not which one. If there were e.g. three deposits for 5.542, 3.799, and 10.4322 ETH, and someone withdrew 3.799 ETH, then it seems like you'd know which deposit they made. Best case, you wait long enough and maybe someone else deposits 3.799 ETH.
  - dannyw 5y ago
    That is why they have a few standard sizes.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - okwubodu 5y ago
    It only lets you use fixed multiples for this reason (0.1, 1, 10, etc.). You can reasonably narrow it down as the amounts get higher, though.
- numbsafari 5y ago
  I wonder if it could be argued in court that use of such a system makes you party to a conspiracy.

Nextgrid 5y ago

I don't understand how these mixer services work with regards to law enforcement. Wouldn't the any outputs of such laundering services be considered dirty to begin with, regardless of whether or not the supposed inputs were clean originally? If anything, I'd expect the output of such a service to be even worse than most inputs, as the money will be mixed with all the inputs, some of which would be associated with horrible crime beyond just fraud or theft.

Grustaf 5y ago
Isn't that a bit like saying cash is dirty? I don't think we are under obligation to keep our funds traceable? Perhaps we are getting closer to that point though.
- ceejayoz 5y ago
  > I don't think we are under obligation to keep our funds traceable? Oh, you do. Not being able to prove the source of your funds puts you at serious risk of asset forfeiture.
  - gumby 5y ago
    Oh, once you’re talking about asset forfeiture, even an ironclad provenance doesn’t help.
  - Grustaf 5y ago
    That's not quite what I'm talking about. Obviously if you transfer money to your account you need to be able to explain where it comes from. But once you have the money, you can turn them into cash or gold if you want. At that point they are anonymous. If you the give them to someone, well then they need to explain where it came from. Also, if you want to put them back into your account, you'd need to show provenance.
- linspace 5y ago
  We are totally under the obligation to justify funds. To start with, because taxes, but also there are a lot of legislation put in place to prevent money laundering under threat of very high fines for non compliance, even if no laundering happened

mrep 5y ago

Amazing. So now you can steal a bunch of crypto and wash it. Holy shit, if you then create some BS coin which gets a bunch of "investors" (really just you investing the coins you stole), you could steal hundreds of millions if not billions of dollars and get it fully laundered and recognized as legitimate by the government, all from your computer anywhere in the world. What a time to be alive as a criminal hacker!

pjc50 5y ago
I do wonder at what point this gets serious and starts interacting with OFAC; if it really worked as uncensorable finance, we'd have seen a tanker of Iranian oil sold for bitcoin. Doesn't quite seem to have reached that scale yet. I suspect a lot of nonsense is tolerated by the US authorities because it's enabling Chinese nationals to evade China's export controls, though.
- f38zf5vdt 5y ago
  Isn't even better than that? They'd have anonymous internet cash to use to bribe foreign officials at a time when many nations have been tightening the noose around finance and what an individual is allowed to own.
323 5y ago
Tornado cash doesn't launder your crypto. Just breaks the link between the heist and your new crypto address. If you steal billions, you still have the problem of justifying them.
- pas 5y ago
  Unless you happen to know of jurisdictions where there's a "no questions asked buy government bonds jubilee".
- mrep 5y ago
  That is the point of the BS coin, that is what you attach your identity to and then you trade all of the washed coins for your new BS coin. Creating/mining the BS coin is where your legitimacy comes from.