The common-input-ownership heuristic

Graduate · enrolled learners

This lesson opens with Bitfinex hack, 2016, seized 2022.

What happened

In August 2016 about 120,000 bitcoin was stolen from the exchange Bitfinex and then largely sat still for years. Moving it was the problem, because on a transparent ledger every attempt to spend or consolidate reveals structure. Over time investigators clustered the thieves' addresses: when a single transaction spends several inputs at once, those inputs are almost always controlled by one entity, since one party must hold all the keys to sign them, so each such transaction merges the addresses it spends into one cluster. Following these and other patterns across years of laundering attempts through addresses and services, investigators tied the cluster to accounts and identities. In February 2022 the Department of Justice seized roughly 94,000 bitcoin, then worth about 3.6 billion dollars, and arrested Ilya Lichtenstein and Heather Morgan. No cryptography was broken; the ledger's own structure, read with the right heuristic, is what built the cluster.

The decision point

The Bitfinex thieves held anonymous-looking addresses and still lost, because addresses are not the unit that matters; entities are, and the chain quietly reveals which addresses belong to the same entity every time that entity spends. The common-input-ownership heuristic is the first and most powerful tool for that: inputs spent together in one transaction share an owner, so transactions weld addresses into clusters. This is the analyst's move from reading single addresses to reading actors. It is a heuristic, not a theorem, it can be defeated by techniques that deliberately break the shared-ownership assumption, but it is right often enough that patient clustering turned a field of unlabeled addresses into a case that put people in front of a judge. Learning to cluster is learning to see the entity behind the addresses.

Recorded loss

$3,600,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.