Bitcoin exchange wallets - How do they know

[thom88]

I was wondering for some time now, how analytics software such as chain analysis or whale alert find out which wallets belong to an exchange. I was trying to find the answer but I was not fully content with what I found so I try here, where I am sure the subject matter experts can explain this to me and maybe other members of the community who care.

First, I know the easy approach of withdrawing from an exchange like Kraken and then they can obviousely see from where the funds were sent. That's easy.
That gives them in most cases 1 to N addresses that recently have been used by that exchange.

Second, they could then find all addresses ever used in combination with the ones used for the initial withdraw (as input) and like that find surely plenty of addresses and transactions that can be allocated to that particular exchange.

BUT is that enough? Is that all they do?

I doubt exchanges share their deposit addresses and withdraw addresses with those service providers even if just anonymous??

Same goes for the fact that some (e.g. Binance) started to ban deposits coming from an address that used a mixer. How would Binance know its a mixer?

If I posted this in the wrong section, I am sorry but I did not know where else to post as its kind of technical

[1714183874]

1714183874

[1714183874]

1714183874

[1714183874]

1714183874

[1714183874]

1714183874

[hosseinimr93]

After you deposit some fund into a exchange, your fund will be moved from your deposit address to the exchange's wallet.

Let's say I deposit some fund to address A and you deposit to address B. All the fund from addresses A and B will be moved to address C.
So, I can know that address B is deposit address of a user of the exchange and address C is the exchange's wallet.

[bitmover]

Many of Binance and other exchanges addresses are publicly known.

For example, take a look at tether rich list. Those are the addresses which hold the largest amounts of tether:
https://wallet.tether.to/richlist

Some of them are BTC addresses from exchanges. This is 1FoWyxwPXuj4C6abqwhjDWdz6D4PZgYRjA a omni address from Binance.

Exchanges also receive funds from LOTS of individuals. They need to send funds from hot to cold wallets and vice versa. Those cold wallet addresses will get known very quickly by anyone who is just looking at the blockchain.

Take a look at the bitcoin rich addresses list. There are many exchanges there as well:
https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html



And, you can also check this domain which list all big exchanges addresses:
https://www.walletexplorer.com/wallet/Binance.com
https://www.walletexplorer.com/wallet/Bitfinex.com
https://www.walletexplorer.com/wallet/Kraken.com

And so on, just look for the exchange you want to know.

[PrimeNumber7]

Many exchanges have made their cold storage addresses public. Blockchain analysis companies can look at transactions to/from cold storage addresses (which will typically be addresses controlled by the exchange and not customer addresses).

Blockchain analysis companies will 'cluster' groups of addresses together using a variety of techniques. The simplest of which is looking at inputs to transactions, and connecting the addresses together. More advanced techniques involve looking at change addresses plus other criteria to add addresses to a cluster.

[thom88]

Many of Binance and other exchanges addresses are publicly known.

For example, take a look at tether rich list. Those are the addresses which hold the largest amounts of tether:
https://wallet.tether.to/richlist

Some of them are BTC addresses from exchanges. This is 1FoWyxwPXuj4C6abqwhjDWdz6D4PZgYRjA a omni address from Binance.

Exchanges also receive funds from LOTS of individuals. They need to send funds from hot to cold wallets and vice versa. Those cold wallet addresses will get known very quickly by anyone who is just looking at the blockchain.

Take a look at the bitcoin rich addresses list. There are many exchanges there as well:
https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html



And, you can also check this domain which list all big exchanges addresses:
https://www.walletexplorer.com/wallet/Binance.com
https://www.walletexplorer.com/wallet/Bitfinex.com
https://www.walletexplorer.com/wallet/Kraken.com

And so on, just look for the exchange you want to know.

But why don't they use multiple addresses (like 10,000 different ones)? They actively reduce privacy on the entire network because of this.

What about mixers? How can Binance know that someone used a mixer? Of course, there is always the option of using it yourself but is that really it?

[bob123]

But why don't they use multiple addresses (like 10,000 different ones)? They actively reduce privacy on the entire network because of this.

Only the exchanges can answer this question.

But i'd assume to show everyone that they still own the funds and that they are safely stored.

What about mixers? How can Binance know that someone used a mixer? Of course, there is always the option of using it yourself but is that really it?

It depends.
Some mixers have pattern which shows you that these coins come from a mixer, but still doesn't allow to connect the input from the mixer to the output.

It's like with coinjoins. You'll always know whether the coins came from a coinjoin. But you won't know which inputs corresponds to the output.

[20kevin20]

But why don't they use multiple addresses (like 10,000 different ones)? They actively reduce privacy on the entire network because of this.

Exchanges are public companies, and having more privacy means more of a burden for governments whenever they want to analyze someone's transactions. Imagine all txs from Binance came through mixers. Would be hell of a work for govs to analyze the chain - and Binance would be suspected of helping crimes.

What about mixers? How can Binance know that someone used a mixer? Of course, there is always the option of using it yourself but is that really it?

Most of the time, it's when the very recent history (1-2txs) of your address comes from a mixer. If you don't bounce your BTC from address to address after mixing the coins, the mixed transaction is so recent they'll suspect you were the person who used the mixer.

[thom88]

It depends.
Some mixers have pattern which shows you that these coins come from a mixer, but still doesn't allow to connect the input from the mixer to the output.

It's like with coinjoins. You'll always know whether the coins came from a coinjoin. But you won't know which inputs corresponds to the output.

Could you explain me about that pattern? Do you have an example of mixer with such pattern and one without so I can try it? (I assume the one in your sig is one without )

Coinjoin is rather rare but also there, how can you see its a coinjoin and not just a wallet with funds?I know that for wasabi you can check for bc1qa24tsgchvuxsaccp8vrnkfd85hrcpafg20kmjw but thats it?

Most of the time, it's when the very recent history (1-2txs) of your address comes from a mixer. If you don't bounce your BTC from address to address after mixing the coins, the mixed transaction is so recent they'll suspect you were the person who used the mixer.

This is what i find very interesting in the first place. How many txs back you go. I man if you go back 20 TX on any address, there is a fair chance to find half the bitcoins tainted in some way. The only clean BTC is a virgin one fresh from the mint, depending on how far back one goes