Overview over Attacks to User’s Privacy
In this topic, we take a look at some attacks that allow linking addresses to one person.
- Address clustering: linking different addresses to one user or organization
- Identification: gaining knowledge of the real identity (name, address, etc.) of a user behind an address
Address Clustering
Chain analysts use heuristics to cluster addresses. This means attributing addresses to one person or organization.
Heuristics are rules of thumb that make decisions under certain conditions. The strength of heuristics is that they are fairly simple. But at the same time, they are also error-prone and not 100% accurate.
If used isolated, this can easily cause wrong results. But in combination, heuristics can be a powerful tool to gain deeper insight into address clusters.
It is also important to notice that heuristics are of different quality. While some heuristics may be correct in, for example, 90 % of all cases, other heuristics may only be correct in 60 % of all cases.
Before we look at some important heuristics, we need to recap blockchain transactions.
There are two ways to design transactions:
- UTXO-based
- State-based.
UTXO based transactions have an input and an output. And as long as another transaction does not reference an output, it is available for spending (called UTXO = unspent transaction output), if a user provides the correct verification (private key).
Multiple UTXOs can be combined in a single transaction. Bitcoin follows the UTXO-based approach.
Since only complete UTXOs can be referenced, it is necessary to provide an address that receives the change coins. Wallets usually generate a new change address for every address. They also create new addresses for receiving new coins.
State-based transactions are different. Here, the amount that is spendable by an address is stored in a file. And every time this address receives or sends funds, the balance is adjusted accordingly. Ethereum follows the state-based approach. In state-based blockchains, it is common to use one address multiple times. It is not necessary to use change addresses and wallets usually don’t generate new addresses for every received coin. Therefore, fewer addresses are used per user, and it is easier to link transactions to a certain address.
