ONE of the advantages of Bitcoin—a cryptographic currency popular on the internet—is its anonymity. That means that, although it has plenty of legitimate uses, it is also the favoured scrip of those who wish to buy drugs from sites like the Silk Road, or keep their transactions away from the watchful eyes of the taxman.



Now, though, next month at the Internet Measurement Conference in Barcelona, Sarah Meiklejohn of the University of California at San Diego and her colleagues argue that Bitcoin may not be quite as private as had been assumed. The fact that many Bitcoin users want to convert their digital currencies into the more traditional sort, and the fact that most transactions now pass among a handful of major exchanges and electronic wallets, mean that it is possible to track the movements of large numbers of Bitcoins. Ms Meiklejohn says that the details aren’t enough, by themselves, to identify users. But they could conceivably provide the police with enough information to obtain subpoenas and would reveal who owns an account associated with a transaction.











A bit of review, first. Unlike other currencies, Bitcoin is not based on sovereign fiat or piles of metal. Rather, it relies on a cryptographic process that requires ever-increasing amounts of computational power to produce new units of the currency. The entire thing is based on public-key cryptography, in which a combination of a freely-available “public key” and a secret “private key” allow each owner to keep his funds secure while enabling payments that are irreversible. In the parlance, new bitcoins are “mined” by individuals and consortiums that use computers to rifle through an enormous mathematical space looking for numbers that fit the algorithm’s requirements.









The researchers bought some Bitcoins and then went on a spending spree. They bought and sold items, participated in mining pools, deposited and withdrew money from exchanges, stored Bitcoins in wallet services, gambled and even donated to Wikileaks, which accepts Bitcoins. This allowed them to gather a host of public keys associated with the biggest fish in the Bitcoin ecosystem.









With that information in hand, Ms Meiklejohn and her colleagues set out to analyse the public record of Bitcoin transactions. Every single transaction in the history of the system is publicly available. But it does not name individuals: instead Bitcoins are credited to individual cryptographic keys, and the ownership of those keys remains, in theory, obscure.









But some keys stand out from the rest, by virtue of the fact that they are mentioned only once in the master log. Usually, says Ms Meiklejohn, that means they are “change addresses”, special keys set up to allow the giving of change (in much the same way that you can buy a £3 pint of beer with a £10 note, and expect £7 back in return). If one key owns 1,000 Bitcoins and needs to pay 80 for a product, a change transaction is required in which the 80 is sent to the seller and the 920 back to the owner of the money. This rule of thumb—that one-time addresses signify the giving of change—allowed the researchers to track funds moving over hundreds of transactions. (The actual heuristic for this rule is explained at length in the paper.)









The paper tracks a series of large transactions that aggregated the hefty sum of 613,326 Bitcoins (roughly $74m at current exchanges rates) into a single address that is widely believed to belong to Silk Road, representing about 5% of existing Bitcoins at that time. That account’s holdings were then split and split again. The researchers peel apart the many transactions that sent Bitcoins to many kinds of services, including exchanges. If a precise quantity of Bitcoins was transferred from an account thought to belong to Silk Road to a currency exchange like Mt Gox, then the police might be interested in asking the exchange about the details of the real-world bank account that the money was eventually paid into. The researchers demonstrate the same technique—called “peeling”—with several Bitcoin thefts as well, and suggest that in one large theft, the purloiner is sitting on most of the missing money.









Before the paranoid start dumping their Bitcoins, Ms Meiklejohn says that changes could be made to reduce the trail that her group followed. Mixing services, for instance, can take money from one party and return it using entirely an new key. "Those kinds of services would completely thwart our kind of analysis", she says. But caveat emptor: in the team’s testing of four mixing services, one stole their money and another returned the same key. She says the trust required and volume necessary for mixing simply doesn’t yet exist. The fundamental problem, she says, is that “right now there are not enough ways to buy and sell Bitcoins,” which means that it is difficult to take advantage of the underlying protocol’s anonymity.