5 ms·

Chainalysis Successful Deanonymization Attack on Monero

65 points by Anon84 11mo ago

embedding-shape 11mo ago
It always seemed weird from Day 1 when I reviewed Monero vs Zcash to rely on anonymization that depends on other nodes and number of honest peers, instead of relying on technical anonymization that Zcash does, seems much more reliable and long-term workable, even though it was much harder and took them longer to arrive at good solutions.
- pclmulqdq 11mo ago
  If Zcash had privacy by default, they would have won against Monero for being the private cryptocurrency. As it stands, any private transaction on the Zcash chain stands out like a sore thumb and the use of de-anonymized transactions around it make it easy to figure out how much money was moved. It was a missed layer 8 opportunity on the part of Zcash. This attack doesn't seem to work if you run a monero node, though.
  - embedding-shape 11mo ago
    You'd have a bit more credibility if your complaint was more up to date :) Zcash wallets have defaulted to shielded accounts and transactions for some time already.
    - pclmulqdq 11mo ago
      It took at least half a decade if not a full decade to get to the obvious place and I (and everyone else) wrote Zcash off in that time.
      - vosper 11mo ago
        You said > As it stands, any private transaction on the Zcash chain stands out like a sore thumb Is that actually still the case or has the change to defaults made anonymity more common?
        pclmulqdq 11mo ago
        If you look at recent mined blocks, a majority of transactions are still public. So yes, even if the default is shielded wallets and private transactions for a specific wallet, most of the chain is not using them.
        DennisP 11mo ago
        True, but as of this month 30% of zcash transactions are shielded, and 20-25% of addresses are private. That's a fairly large anonymity set. The percentage of shielded transactions is also increasing, at a rate that will make them a majority within a year if the trend continues. https://www.coindesk.com/research/inside-zcash-encrypted-money-at-planetary-scale https://www.coindesk.com/research/inside-zcash-encrypted-mon...
      - embedding-shape 11mo ago
        > and I (and everyone else) wrote Zcash off in that time Seemingly in the ecosystem you exists in yeah, but in the world at large Zcash seems to have at least 6x the volume. I guess "everyone else" didn't get your memo. Regardless, I don't really care personally which one is better or which one you specifically use, as long as what we say is being truthful :)
        pclmulqdq 11mo ago
        Are you referring to on-exchange volume of a coin that has pumped 10x in a few months? And it's only 6x the on-exchange volume of monero? It sounds like people still don't use it. If you look at the blockchain, you will see very few transactions per block (literally less than one per minute), so it seems the volume is almost entirely on the exchanges. It's probably people speculating on privacy for some reason, combined with some dumping of the pre-mine. The majority of the on-chain use is also public transactions, so it seems the "privacy by default" setting doesn't really matter.
        monero-xmr 11mo ago
        I know (and many others do as well, it’s not that hidden) of the group that pumped Zcash. Very well executed pump
pjdkoch 11mo ago
September 17, 2024
- kobieps 11mo ago
  surprising how often this happens...
  - RandomBacon 11mo ago
    Monero's main "competitor" seems to be Zcash which is run by a VC-backed company. The company gets 20% of all mined Zcash. The incentive is very strong to FUD Monero. As of this comment, Monero is #26 on CoinGecko's list of crypto by marketcap with Zcash at #27. I'm guessing that's why there's a few of these posts on HN all of a sudden.
    - kobieps 11mo ago
      Sure, but I more meant people recycling year old news for clicks, and smart people falling for it. That's a very broad phenomenon and not tied to crypto.
    - pixel_popping 11mo ago
      Useful analysis actually! Thank you
nunobrito 11mo ago
This isn't deanonymization, it is modifying and infiltrating nodes to then listen what is happening from naive users connecting to them. There was never an expectation of privacy when you connect to servers outside your control with non-encrypted data. That is the reason why the article itself mentions that this isn't working when running your own node, as most people do. This is the same thing as complaining that Monero is no longer anonymous because Windows is capturing screenshots and keyboard presses when you open the desktop app. Monero remains anonymous by default.
- dodomodo 11mo ago
  In practice they (allegedly) took anonymouse transaction and linked it to real world identity. Call it what you want.
  - fruitworks 11mo ago
    The transaction wasn't really anonymouse in the first place, but I agree that the UI should warn users more when working in "light wallet" mode.
    - dodomodo 11mo ago
      Nothing is "really anonymouse", it's all a game of information sharing and hiding. I think I now understand the difference in our definitions, for you anonymouse means that at the protocol level no one can link the transaction to "you" (defined by a set of identifiers). My defenition is just "not publicly linked to your real world identity", so for example, sending a message under a pseudu name in a public forum would be anonymous under my defenition but not anonymouse under yours. What do you think?
      - fruitworks 11mo ago
        Necroing this, but my general opinion is that anonymousity is more of a question of extent and the shape of anonymousity sets than a binary condition of anonymouse/public. But you are correct that we can never satisfy the binary condition. Given enough foresnsics, it's possible to link pseudoanonymouse identities to real identities. See chainalysis. I'm sure if you apply stylometry to either of our posts, you could uncover our identities. I think there was a post here doing just that. So my real problem with the pseudoanonymouse model is that when if fails, it generally favors centralized institutions in who are capable of the surveilance needed for correlation. It is asymmetric. People say that bitcoin's transparency is a feature, but the feature is only accessible to those with the metadata, like arkham or chainalysis. Reputation systems can be very useful though.
bhouston 11mo ago
So chainalysis is working for governments now? I guess it makes sense.
- MadsRC 11mo ago
  Now? Chainalysis has always worked for governments… It was basically spawned out of the government needing help with investigating crypto - I think it was Mt. Gox…
  - Anon84 11mo ago
    Exactly. “Tracers in the Dark” (https://a.co/d/aos3Nka https://a.co/d/aos3Nka) does a good job of telling that story and a couple of others from the early days of blockchain analytics
walletdrainer 11mo ago
Chainanalysis is certainly not running the Tor attack as described here. It’s technically possible, but not really practical. We’d have seen darknet markets as they currently exist eradicated a long ago.
486sx33 11mo ago
It’s fairly easy to decrease susceptibility to this attack. #1 run your own node #2 monitor the nodes you are connected to with “sync_info” #3 ban nodes that aren’t up to current block height, strange port connections, and connections from typical spy IP addresses. There could still be a spy node connected when you send your transaction but it won’t have a very high probability of originating from any particular place
yieldcrv 11mo ago
Featherwallet runs a Tor client and connects to Tor nodes after it is done syncing, you can't send a transaction before it is done syncing
kittikitti 11mo ago
It's absolutely wild that Tor and VPN's can be so easily backdoored by governments. The mitigations in this article make sense but how would I explain this to normies who support law enforcement? I guess they can just live in denial.

65 points by Anon84 11mo ago

It always seemed weird from Day 1 when I reviewed Monero vs Zcash to rely on anonymization that depends on other nodes and number of honest peers, instead of relying on technical anonymization that Zcash does, seems much more reliable and long-term workable, even though it was much harder and took them longer to arrive at good solutions.

pclmulqdq 11mo ago
If Zcash had privacy by default, they would have won against Monero for being the private cryptocurrency. As it stands, any private transaction on the Zcash chain stands out like a sore thumb and the use of de-anonymized transactions around it make it easy to figure out how much money was moved. It was a missed layer 8 opportunity on the part of Zcash. This attack doesn't seem to work if you run a monero node, though.
- embedding-shape 11mo ago
  You'd have a bit more credibility if your complaint was more up to date :) Zcash wallets have defaulted to shielded accounts and transactions for some time already.
  - pclmulqdq 11mo ago
    It took at least half a decade if not a full decade to get to the obvious place and I (and everyone else) wrote Zcash off in that time.
    - vosper 11mo ago
      You said > As it stands, any private transaction on the Zcash chain stands out like a sore thumb Is that actually still the case or has the change to defaults made anonymity more common?
      - pclmulqdq 11mo ago
        If you look at recent mined blocks, a majority of transactions are still public. So yes, even if the default is shielded wallets and private transactions for a specific wallet, most of the chain is not using them.
        DennisP 11mo ago
        True, but as of this month 30% of zcash transactions are shielded, and 20-25% of addresses are private. That's a fairly large anonymity set. The percentage of shielded transactions is also increasing, at a rate that will make them a majority within a year if the trend continues. https://www.coindesk.com/research/inside-zcash-encrypted-money-at-planetary-scale https://www.coindesk.com/research/inside-zcash-encrypted-mon...
    - embedding-shape 11mo ago
      > and I (and everyone else) wrote Zcash off in that time Seemingly in the ecosystem you exists in yeah, but in the world at large Zcash seems to have at least 6x the volume. I guess "everyone else" didn't get your memo. Regardless, I don't really care personally which one is better or which one you specifically use, as long as what we say is being truthful :)
      - pclmulqdq 11mo ago
        Are you referring to on-exchange volume of a coin that has pumped 10x in a few months? And it's only 6x the on-exchange volume of monero? It sounds like people still don't use it. If you look at the blockchain, you will see very few transactions per block (literally less than one per minute), so it seems the volume is almost entirely on the exchanges. It's probably people speculating on privacy for some reason, combined with some dumping of the pre-mine. The majority of the on-chain use is also public transactions, so it seems the "privacy by default" setting doesn't really matter.
        monero-xmr 11mo ago
        I know (and many others do as well, it’s not that hidden) of the group that pumped Zcash. Very well executed pump

pjdkoch 11mo ago

September 17, 2024

kobieps 11mo ago
surprising how often this happens...
- RandomBacon 11mo ago
  Monero's main "competitor" seems to be Zcash which is run by a VC-backed company. The company gets 20% of all mined Zcash. The incentive is very strong to FUD Monero. As of this comment, Monero is #26 on CoinGecko's list of crypto by marketcap with Zcash at #27. I'm guessing that's why there's a few of these posts on HN all of a sudden.
  - kobieps 11mo ago
    Sure, but I more meant people recycling year old news for clicks, and smart people falling for it. That's a very broad phenomenon and not tied to crypto.
  - pixel_popping 11mo ago
    Useful analysis actually! Thank you

nunobrito 11mo ago

This isn't deanonymization, it is modifying and infiltrating nodes to then listen what is happening from naive users connecting to them. There was never an expectation of privacy when you connect to servers outside your control with non-encrypted data. That is the reason why the article itself mentions that this isn't working when running your own node, as most people do. This is the same thing as complaining that Monero is no longer anonymous because Windows is capturing screenshots and keyboard presses when you open the desktop app. Monero remains anonymous by default.

dodomodo 11mo ago
In practice they (allegedly) took anonymouse transaction and linked it to real world identity. Call it what you want.
- fruitworks 11mo ago
  The transaction wasn't really anonymouse in the first place, but I agree that the UI should warn users more when working in "light wallet" mode.
  - dodomodo 11mo ago
    Nothing is "really anonymouse", it's all a game of information sharing and hiding. I think I now understand the difference in our definitions, for you anonymouse means that at the protocol level no one can link the transaction to "you" (defined by a set of identifiers). My defenition is just "not publicly linked to your real world identity", so for example, sending a message under a pseudu name in a public forum would be anonymous under my defenition but not anonymouse under yours. What do you think?
    - fruitworks 11mo ago
      Necroing this, but my general opinion is that anonymousity is more of a question of extent and the shape of anonymousity sets than a binary condition of anonymouse/public. But you are correct that we can never satisfy the binary condition. Given enough foresnsics, it's possible to link pseudoanonymouse identities to real identities. See chainalysis. I'm sure if you apply stylometry to either of our posts, you could uncover our identities. I think there was a post here doing just that. So my real problem with the pseudoanonymouse model is that when if fails, it generally favors centralized institutions in who are capable of the surveilance needed for correlation. It is asymmetric. People say that bitcoin's transparency is a feature, but the feature is only accessible to those with the metadata, like arkham or chainalysis. Reputation systems can be very useful though.

bhouston 11mo ago

So chainalysis is working for governments now? I guess it makes sense.

MadsRC 11mo ago
Now? Chainalysis has always worked for governments… It was basically spawned out of the government needing help with investigating crypto - I think it was Mt. Gox…
- Anon84 11mo ago
  Exactly. “Tracers in the Dark” (https://a.co/d/aos3Nka https://a.co/d/aos3Nka) does a good job of telling that story and a couple of others from the early days of blockchain analytics

walletdrainer 11mo ago

Chainanalysis is certainly not running the Tor attack as described here. It’s technically possible, but not really practical. We’d have seen darknet markets as they currently exist eradicated a long ago.

486sx33 11mo ago

It’s fairly easy to decrease susceptibility to this attack. #1 run your own node #2 monitor the nodes you are connected to with “sync_info” #3 ban nodes that aren’t up to current block height, strange port connections, and connections from typical spy IP addresses. There could still be a spy node connected when you send your transaction but it won’t have a very high probability of originating from any particular place

yieldcrv 11mo ago

Featherwallet runs a Tor client and connects to Tor nodes after it is done syncing, you can't send a transaction before it is done syncing

kittikitti 11mo ago

It's absolutely wild that Tor and VPN's can be so easily backdoored by governments. The mitigations in this article make sense but how would I explain this to normies who support law enforcement? I guess they can just live in denial.