Curriculum·Graduate·G102
Wallet Clustering and Heuristics
The Bitfinex hack of August 2016 and its unwinding in 2022. 119,754 bitcoin was stolen and then sat, mostly unmoved, for years.
Start with lesson 14 lessons · about 2 hours · free account to read in full
Lesson 1 opens on
Bitfinex hack, 2016, seized 2022
In August 2016 119,754 bitcoin was stolen from the exchange Bitfinex in more than 2,000 unauthorized transactions, and most of it then sat still for years. Moving it was the problem, because on a transparent ledger every attempt to spend or consolidate reveals structure. Over five years about 25,000 of the coins were moved out through a complicated laundering process, through exchanges, darknet markets and chain hopping, that ended with some of the funds in financial accounts controlled by Ilya Lichtenstein and Heather Morgan, and investigators traced it there.
The lessons
- G102-01The common-input-ownership heuristicState the common-input-ownership heuristic and why it clusters addresses into entitiesabout 30 min · opens on Bitfinex hack, 2016, seized 2022
- G102-02Change addresses and behavioral fingerprintsExplain change-address detection and how it extends a cluster beyond co-spent inputsabout 30 min · opens on Mt. Gox, traced by WizSec, 2011 to 2014
- G102-03Clustering across services and chainsExplain why address-level clustering heuristics do not carry across a bridge or an exchangeabout 31 min · opens on Lazarus cross-chain laundering, 2022 onward
- G102-04When a heuristic is wrongName the failure modes of the clustering heuristics: CoinJoin, custodial co-spends, and dustingabout 31 min · opens on CoinJoin and the false-cluster failure mode