Does it take significant skill to "analyze the blockchain"?

[PolarPoint]

The blockchain is a big database. All the data is in there, it's like a maze. I think forensics needs to develop tools to dig evidence, to find where the coins went after passing through a mixer. It is not a simple task.

[1713490004]

1713490004

[1713490004]

1713490004

[bitcoiner422]

Aren't there no "from" addresses in btc? Is it possible to track btc still?

There are what I usually name "from" addresses and change addresses. A typical bitcoin transaction can look like this:

https://blockchain.info/tx/72e3dd987cc0cc31def333577e7539b85687d90db922698c08f5d4fef9bb9ade

Here we have, I think, one "from" address and two "to" addresses one of which is (probably?) a change address, i.e. an address that belongs to the sender, so the sender sends the "change" back to itself.

Edit: It this case it appears that the change address is the same as the sender address. Guess it depends on the wallet software which practices are used.

[DannyHamilton]

There are what I usually name "from" addresses and change addresses. A typical bitcoin transaction can look like this:

https://blockchain.info/tx/72e3dd987cc0cc31def333577e7539b85687d90db922698c08f5d4fef9bb9ade

You are mistaken.

What you linked to is NOT what a bitcoin transaction looks like at all.

That is an interpretation of a bitcoin transaction from a website named "blockchain.info".  Many of their "interpretations" are completely invalid.

The transaction that you linked to ACTUALLY looks like this:

Code:

010000000146251de97677c71f1f424d8e13fb16c7a7fc6d23f333f14706366f6699055170000000006a47304402206a4c1869c4f8b7eb8df4cfba11f4dede0150e7c11fe9869e0a4a3e75b08eeeab0220764f96ff03bed219bf2e33ad794dadcc55cb1570da311eb264e28dc02a74281c012103ac8c8750e1928af5669f2eb48f14f8fe0719f6998460d83a4e34649b27eb40e7ffffffff02e463ad00000000001976a914075fa95bada38883db875aa53bdf50def0c3177888acb54d0800000000001976a9145032641a2053fd09a529511b30f28cc5f59a86bd88ac00000000

Broken down into its parts that's...

VERSION:

Code:

01000000

QTY OF INPUTS:

Code:

01

INPUT 1:

Code:

46251de97677c71f1f424d8e13fb16c7a7fc6d23f333f14706366f6699055170000000006a47304402206a4c1869c4f8b7eb8df4cfba11f4dede0150e7c11fe9869e0a4a3e75b08eeeab0220764f96ff03bed219bf2e33ad794dadcc55cb1570da311eb264e28dc02a74281c012103ac8c8750e1928af5669f2eb48f14f8fe0719f6998460d83a4e34649b27eb40e7ffffffff

QTY OF OUTPUTS:

Code:

02

VALUE OF OUTPUT 1 (11363300 satoshis encoded in Hex):

Code:

e463ad0000000000

OUTPUT 1 SCRIPT:

Code:

1976a914075fa95bada38883db875aa53bdf50def0c3177888ac

VALUE OF OUTPUT 2 (544181 satoshis encoded in Hex):

Code:

e463ad0000000000

OUTPUT 2 SCRIPT:

Code:

1976a9145032641a2053fd09a529511b30f28cc5f59a86bd88ac

Please show me in that actual transaction where you see a "from address" (or any address at all).

[bitcoiner422]

Please show me in that actual transaction where you see a "from address" (or any address at all).

Does this mean that the addresses cannot be deterministically computed from the above transaction data?

[DannyHamilton]

Please show me in that actual transaction where you see a "from address" (or any address at all).

Does this mean that the addresses cannot be deterministically computed from the above transaction data?

That depends on what you are trying to accomplish, why you are trying to accomplish it, and what additional information you are willing to access to "determine an address".

Usually when someone is looking for a "from address" they are misunderstanding how bitcoins works and attempting to do something that will result in confusion, lost bitcoins, frustrated users, and generally a mess that can be avoided by doing things properly.

[alani123]

People have created tools like https://bitiodine.net/ and they're helping do some detective work. However, it's hard to associate bitcoin addresses with real-world names. What's even harder is to know at what point bitcoins trafficked from address to address could have changed ownership.

[tspacepilot]

Please show me in that actual transaction where you see a "from address" (or any address at all).

Does this mean that the addresses cannot be deterministically computed from the above transaction data?

That depends on what you are trying to accomplish, why you are trying to accomplish it, and what additional information you are willing to access to "determine an address".

Usually when someone is looking for a "from address" they are misunderstanding how bitcoins works and attempting to do something that will result in confusion, lost bitcoins, frustrated users, and generally a mess that can be avoided by doing things properly.

I admit that I'm often mistaken, but aren't those "inputs" and "outputs" public keys corresponding to private keys that can be used to sign transactions?  And there's a 1-1 mapping between keys and addresses (right?).  So, in some sense, aren't those inputs and outputs in correspondence with addresses?

[DannyHamilton]

I admit that I'm often mistaken, but aren't those "inputs" and "outputs" public keys corresponding to private keys that can be used to sign transactions?  And there's a 1-1 mapping between keys and addresses (right?).  So, in some sense, aren't those inputs and outputs in correspondence with addresses?

No.

The outputs contain a script, and these scripts in this transaction do contain a hash of a public key, but an output isn't required to have a hash of a public key, or it could contain the hash of multiple public keys.  Even if it does contain the hash of a public key, it may not be a P2PKH script or a P2SH script, in which case there is no valid address that the output script could be represented as.

The inputs contain the necessary data to satisfy the script in the previously unspent output that is being spent.  In the transaction presented, the script that is being satisfied did require a public key, so the input does contain a public key, but other scripts in other transactions may require multiple public keys, or no public keys at all.

[tspacepilot]

I admit that I'm often mistaken, but aren't those "inputs" and "outputs" public keys corresponding to private keys that can be used to sign transactions?  And there's a 1-1 mapping between keys and addresses (right?).  So, in some sense, aren't those inputs and outputs in correspondence with addresses?

No.

The outputs contain a script, and these scripts in this transaction do contain a hash of a public key, but an output isn't required to have a hash of a public key, or it could contain the hash of multiple private keys.  Even if it does contain the hash of a public key, it may not be a P2PKH script or a P2SH script, in which case there is no valid address that the output script could be represented as.

Thanks for the education!  So, is it fair to say that an output is always always associated with 1 or more addresses (either through a hash of a public key, or a hash of multiple private keys)?   I have to admit, I don't fully understand the case where there's "no valid address that the output script could be represented as" except under the case where this is true because of a payment to a multisignature conjunction of addresses.  Please forgive my ignorance.

The inputs contain the necessary data to satisfy the script in the previously unspent output that is being spent.  In the transaction presented, the script that is being satisfied did require a public key, so the input does contain a public key, but other scripts in other transactions may require multiple public keys, or no public keys at all.

Again, can you help me understand the "none at all" case?

[DannyHamilton]

Thanks for the education!  So, is it fair to say that an output is always always associated with 1 or more addresses (either through a hash of a public key, or a hash of multiple private keys)?

No.

An output is associated with a script.  That script may, or may have any of (or none of) a one or more public keys, one or more public key hashes.

I have to admit, I don't fully understand the case where there's "no valid address that the output script could be represented as" except under the case where this is true because of a payment to a multisignature conjunction of addresses.  Please forgive my ignorance.

A script encumbers the output with some requirement that must be met in order to use that output as an input to a new transaction.  There are a couple of very common scripts (P2PKH and P2SH) that have been defined and given a version number.  This defined "script version" allows the entire script to be represented with its version and its data.  In thses common scripts the data is a hash (a public key hash in the case of P2PKH, and a script hash in the case of P2SH)  The version, hash, and a checksum are then encoded as an "address".

However, it is possible to create scripts other than these common script types. It is also possible to create scripts that do not contain a hash or a public key at all. In that case, there is no recognized version number that represents the script and therefore no agreed way to represent the output as an address.

Again, can you help me understand the "none at all" case?

As a simple example take a look at this transaction:
https://blockchain.info/tx/8bae12b5f4c088d940733dcd1455efc6a3a69cf9340e17a981286d3778615684

There are two outputs.

One was sent to: 1HnhWpkMHMjgt167kvgcPyurMmsCQ2WPgg

The other was sent to an output that has no representable address.

[tspacepilot]

Thanks for the education!  So, is it fair to say that an output is always always associated with 1 or more addresses (either through a hash of a public key, or a hash of multiple private keys)?

No.

An output is associated with a script.  That script may, or may have any of (or none of) a one or more public keys, one or more public key hashes.

I have to admit, I don't fully understand the case where there's "no valid address that the output script could be represented as" except under the case where this is true because of a payment to a multisignature conjunction of addresses.  Please forgive my ignorance.

A script encumbers the output with some requirement that must be met in order to use that output as an input to a new transaction.  There are a couple of very common scripts (P2PKH and P2SH) that have been defined and given a version number.  This defined "script version" allows the entire script to be represented with its version and its data.  In thses common scripts the data is a hash (a public key hash in the case of P2PKH, and a script hash in the case of P2SH)  The version, hash, and a checksum are then encoded as an "address".

However, it is possible to create scripts other than these common script types. It is also possible to create scripts that do not contain a hash or a public key at all. In that case, there is no recognized version number that represents the script and therefore no agreed way to represent the output as an address.

Again, can you help me understand the "none at all" case?

As a simple example take a look at this transaction:
https://blockchain.info/tx/8bae12b5f4c088d940733dcd1455efc6a3a69cf9340e17a981286d3778615684

There are two outputs.

One was sent to: 1HnhWpkMHMjgt167kvgcPyurMmsCQ2WPgg

The other was sent to an output that has no representable address.

I see.  Thanks for turning up that example.  So, I think you're emphasizing that because the output is a script the script coulde be malformed, unconventional, etc and therefore no output address(es) could be found for that.  Are all of these cases unspendable bitcoins?  How can someone satisify the requirements to spend the bitcoins sent to that output which is not representatble as an address?

EDIT: Actually, heh, maybe a total of zero satoshis sent to the unrepresentable-as-address output doesn't provide a good situation for your to explain how they could be spent.  But if that had been a non-zero output to that unrepresentable-as-address output, could it be spent?

[Gleb Gamow]

It all depends on what you are trying to do.

If you just want to identify what address a particular bitcoin transaction was sent to, then no. There's no skill needed.

On the other hand, if you are attempting to use forensic accounting practices to identify a series of transactions that were all sent to or from a particular person or business after that person or business attempted to hide their activity with "mixers" or various "mixing" techniques, then yes.  There is a significant amount of skill and education needed.

That's how I found that Josh Zerlan of BFL (BF Labs Inc./Butterfly Labs) was trading back and forth in Pirate's Ponzi scheme, and at the same time calling out others as criminals for trading with a criminal, namely Trendon Shavers.

[DannyHamilton]

- snip -
As a simple example take a look at this transaction:
- snip -

I see.  Thanks for turning up that example.  So, I think you're emphasizing that because the output is a script the script coulde be malformed, unconventional, etc and therefore no output address(es) could be found for that.  Are all of these cases unspendable bitcoins?

No, they are not all unspendable, some are.  Some aren't.  The one I provided as an example is not spendable.  It was just the fastest and easiest type for me to find an example of.  There are other types that are spendable.

How can someone satisify the requirements to spend the bitcoins sent to that output which is not representatble as an address?

"That output" cannot be spent.  There is no scriptSig that can be provided in an input that will satisfy that particular script

EDIT: Actually, heh, maybe a total of zero satoshis sent to the unrepresentable-as-address output doesn't provide a good situation for your to explain how they could be spent.

Correct.  That was only intended as an example of how outputs don't have to be encode-able as addresses.  That particular output uses a single output script command (OP_RETURN)  followed by arbitrary data.

But if that had been a non-zero output to that unrepresentable-as-address output, could it be spent?

No, that particular output is unspendable.  It was only intended as an example of how transaction outputs that the network considers "valid" aren't always encode-able as addresses.  There are other output scripts that can be spent, but which cannot be encoded as addresses.

Here's an example of an output that is spendable (and was spent) that cannot be encoded as any of the standard address formats:
https://blockchain.info/tx/b8fd633e7713a43d5ac87266adc78444669b987a56b3a65fb92d58c2c4b0e84d

[tspacepilot]

No, that particular output is unspendable.  It was only intended as an example of how transaction outputs that the network considers "valid" aren't always encode-able as addresses.  There are other output scripts that can be spent, but which cannot be encoded as addresses.

Here's an example of an output that is spendable (and was spent) that cannot be encoded as any of the standard address formats:
https://blockchain.info/tx/b8fd633e7713a43d5ac87266adc78444669b987a56b3a65fb92d58c2c4b0e84d

Got it.  I see clearly in blockchain.info that they've choked on that 0.03 output.  Can you reasonably easily let me know what's going on with this one (since it's not an unspendable output AND it's not encodable as an address (or as a series of addresses, ie, a multisig requirement))?

Thanks again, sincerely, for helping me/us learn about this.  I'm pushing back on you a bit here because I have often seen posts from the more technically informed saying "there are no addresses!!!", but I'm not convinced that they are entirely halluncinated artifacts.  I'm thinking that people are saying "there are no addresses" with such finality because they're trying to emphasize a point which is going to help newbies or those who don't have time to understand the subtleties.  However, for those of us who are curious about the actual state of affairs, I'm just trying to squeeze you for a few more details.  Thanks again!

Also, do you happen to have the list of the script codes which can be in a valid output (or know where to find it on a web-page, or in the source code for bitcoin-core)? Perhaps that page would answer my questions without you haveing to write to me so much

[Bit_Happy]

....However, for those of us who are curious about the actual state of affairs, I'm just trying to squeeze you for a few more details.  Thanks again!

Also, do you happen to have the list of the script codes which can be in a valid output (or know where to find it on a web-page, or in the source code for bitcoin-core)? Perhaps that page would answer my questions without you haveing to write to me so much

+2 for getting my brain active.
This old thread is still valid, and/or certainly competes well with the more modern ones?

[thankyoulord]

i really don't think analyzing blockchain takes any special skill. Blockchain is very easy and simple to understand. Just do a little research as there are lots of books, articles and publications about blockchain that will help give you a good knowledge about blockchain.

[teejayrichard2]

no significant skill is needed to analyze the blockchain. Once you can read and understand, it simple. People think blockchain is complex to analyze and understand but it is not.

[Cryptrx]

To an extent it does take some still to be able to analyse blockchain. Skill in the sense that you must be knowledgeable about blockchain to actually be able to analyse, through reading or taking blockchain courses.

[Lunalionn]

Blockchain is a very high technology that requires a certain understanding to be able to analyze and apply it in practice.

[kingpin4321]

The blockchain technology is quite new and except you have link or connection to it. It might be difficult to get a hand of it. But it's not really very complicated