Change addresses and behavioral fingerprints

Graduate · enrolled learners

This lesson opens with Mt. Gox, traced by WizSec, 2011 to 2014.

What happened

Mt. Gox was the dominant bitcoin exchange until it collapsed in February 2014 having lost about 850,000 bitcoin, worth roughly 450 million dollars at the time. For years the theft was a mystery. The independent investigator Kim Nilsson, working as WizSec, reconstructed it from the chain: by identifying Mt. Gox's own wallet behavior, spotting which transaction outputs were change returning to the exchange versus real payments out, and following consistent behavioral fingerprints, he showed the coins had been drained steadily from as early as 2011, not in one late event, and traced the flow toward the BTC-e exchange. The analysis fed the 2017 arrest of Alexander Vinnik, alleged operator of BTC-e and launderer of the funds. No single transaction confessed; a pattern of behavior, read consistently across years, is what told the story.

The decision point

Co-spent inputs cluster the obvious way, but most of an entity's structure is not handed to you in one multi-input transaction; it is spread across ordinary payments, each of which quietly returns change to an address the entity controls. Change-address detection extends the cluster along that thread: in a typical payment, one output goes to the recipient and one comes back to the sender as change, and telling them apart, by amount, by whether an address is fresh, by wallet conventions, lets you keep the sender's cluster growing past the payment. Add behavioral fingerprints, consistent fee choices, timing, address formats, and you can recognize the same actor across thousands of transactions where no single one identifies them. This is clustering as pattern recognition: weak signals, each defeasible, combined into an identification strong enough to survive years and support an arrest.

Recorded loss

$450,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.