Chainalysis runs Electrum nodes.

[Dabs]

https://www.coindesk.com/business/2021/09/21/leaked-slides-show-how-chainalysis-flags-crypto-suspects-for-cops/

Leaked Slides Show How Chainalysis Flags Crypto Suspects for Cops
Walletexplorer.com, a block explorer site secretly operated by Chainalysis, has provided law enforcement with “meaningful leads,” the documents say.

Another way Chainalysis captures Bitcoin user data is by running nodes that verify transactions, the documents confirm. This allows the company to capture data leaks on the publicly accessible internet, or clearnet, from users’ simplified payment verification (SPV) wallets. Those services were designed to prioritize easy storage over foolproof security (although to be fair they are arguably more secure than wallets that rely on APIs to verify transactions).

“The downside to this design is that when the user wallet connects to the network, a variety of information is revealed - the user’s IP address, the full set of addresses in the wallet (used and unused) and the version of the wallet software,” according to the slide deck. “Chainalysis runs a series of nodes on the Bitcoin network ... and if a user connects to one of our nodes, we receive the above information.”

The picture below that paragraph shows the word Electrum.

That Chainalysis runs its own data-capturing nodes would not come as a surprise to privacy-focused Bitcoiners; the community has long suspected as much.

“We’ve always known that they’re running nodes - it’s just a matter of which services they’re connected to,” said Colin Harper, the head of content at Luxor Tech, a bitcoin mining company.

We've know this, but now it's confirmed. Or leaked. Or whatever.

Time to run your own servers!

[Charles-Tim]

The ways to privacy can be cost effective, but much more better than not having privacy. It is best to have the full blockchain and run your own node with Tor for privacy reasons.

But what I noticed is that most bitcoin users like the SPV wallets just because it requires little memory space for download and also work effectively, but it does not guarantee privacy, many people now are even using it directly with their IP address, an easy way to link bitcoin users to their real identity.

People can try to want to maximize privacy, but SPV wallets can truly not give effective result because it runs with servers that will connect to the blockchain, the server operators can easily know the addresses wallet users are using and also know other information. The best is to run full node with Tor which gives privacy.

[jackg]

But what I noticed is that most bitcoin users like the SPV wallets just because it requires little memory space for download and also work effectively, but it does not guarantee privacy, many people now are even using it directly with their IP address, an easy way to link bitcoin users to their real identity.

Yeah I'm not sure electrum works well for privacy either even if you use tor as you can still end up linking your whole wallet together as one (which might be a problem if you come to use an exchange).

I'd imagine, given the number of servers that are available, electrum and other spv clients will get different upgrades to help combat this issue and increase privacy (such as getting nodes to send the blockchain to clients for analysis or sending individual addresses to different notes to help make things more private - it'd be hard for electrum's team to enforce/and in some cases suggest the use of tor or vpns though).

[NeuroticFish]

We've know this, but now it's confirmed. Or leaked. Or whatever.

Time to run your own servers!

Indeed, time to run our own servers. Correction: as pooya87 said, it's even better to just run your own full node.

And although it is something expected, the fact it's now public knowledge is imho important.
For example, maybe an update (or fork?) of Electrum will be developed for being privacy focused? Maybe with options for customizing when and which addresses to be queried, maybe with clients connecting to multiple servers to ask randomly for information? I guess that it also can be done. Of course, the top solution remains the use of own server.

[dkbit98]

It's no surprise that Walletexplorer is actually Chainalysis and most other explorers are also tracking or collecting IP addresses but you can always run your own open source explorer to avoid this.
Same goes for Electrum wallet, and I was talking for some time that people should run their own nodes and use wallets with Tor support like Wasabi.
Maybe people don't care about privacy and think they have nothing to hide now, but this can bite them hard in future.

Time to run your own servers!

Even better is running your own Bitcoin node.

[NotATether]

What a perfect time to purpose the new 64GB RAM server I rented recently with RAID0 SSDs as an electrum node! (Of course, it's supposed to be running other things, but Electrum nodes are dead cheap to host).

I'm not sure one node is going to be enough though - maybe I'll run nodes on my reverse proxies as well.

Walletexplorer.com, a block explorer site secretly operated by Chainalysis, has provided law enforcement with “meaningful leads,” the documents say.

Is it really a surprise though? The walletexplorer creator works for Chainalysys. It even says so on the main site.

[DaveF]

Walletexplorer.com, a block explorer site secretly operated by Chainalysis, has provided law enforcement with “meaningful leads,” the documents say.

Is it really a surprise though? The walletexplorer creator works for Chainalysys. It even says so on the main site.

I remember some conversation abut that when it popped up like 4 or 5 years ago. And some people were upset because they ran a bunch of queries for firstbits there and were freaking out that 'the man' now has their information. 

As for the Electrum nodes. The more you want privacy the more work you have to put into it, by running your own nodes & servers. The issue is that too many people do not know how, and of those that do know how to do it, many do not want to be bothered.

Not saying that we should throw our hands up and do nothing, just dealing with the reality of it all.

-Dave

[o_e_l_e_o]

Lesson one is to run your own node.
Lesson two is to not look up your own transactions on block explorers.
Lesson three is to do everything over Tor.

If you really need a block explorer, then you can run your own instance of mempool.space. All the code is open source, and they even give you instructions: https://github.com/mempool/mempool

I'm not sure I believe their statements regarding Monero until I see evidence to back it up. Of course Chainalysis will claim they've been able to provide some "meaningful leads" (which could mean almost anything) on Monero transactions, because that's what they want the US government to believe so that they will keep giving them expensive contracts.

[DaveF]

Lesson one is to run your own node.
Lesson two is to not look up your own transactions on block explorers.
Lesson three is to do everything over Tor.

If you really need a block explorer, then you can run your own instance of mempool.space. All the code is open source, and they even give you instructions: https://github.com/mempool/mempool

I'm not sure I believe their statements regarding Monero until I see evidence to back it up. Of course Chainalysis will claim they've been able to provide some "meaningful leads" (which could mean almost anything) on Monero transactions, because that's what they want the US government to believe so that they will keep giving them expensive contracts.

And I know some people probably want me to shut up about them by now, but you don't even need to know anything about linux / programming / tech because all of the node in a box appliances that I keep talking about have some form of a block explorer built in or with a 1 click install.
raspiblitz / mynodebtc / umbrel

Take your pick and do it yourself.

-Dave

[pooya87]

It has always been a well known fact that when you are using SPV clients you are sacrificing privacy (and in some cases security) for convenience. We always knew that not just chain-analyzers but also government agents are running SPV nodes. I wouldn't be surprised that some of these shady closed source wallets were created by them too.

Walletexplorer.com, a block explorer site secretly operated by Chainalysis,

It is not a secret when it is well known. Walletexplorer is like their "free trial" for their "premium service".

Time to run your own servers!

I'm sorry but that's silly. If you can run your own Electrum node then why not just run a simple full node. The full node needs less resources too!

[NeuroticFish]

Lesson two is to not look up your own transactions on block explorers.

I think that if one checks many more transactions than only his own on block explorers, this lesson/rule may no longer be that important.

I'm not sure I believe their statements regarding Monero until I see evidence to back it up.

I think that the Monero parts is a huge overstatement from them. I think that on the best case they can follow transactions that comply certain strict rules (for example very big transactions with small mixin).

If you can run your own Electrum node then why not just run a simple full node. The full node needs less resources too!

Very good point! I was studying yesterday the options for having my own Electrum server and I just noticed that it cannot be done with pruned full node. And then, whatever I do, the full node is already all I need. And lately Bitcoin Core also accepts HW, which is something I surely have to try out.

[o_e_l_e_o]

I think that if one checks many more transactions than only his own on block explorers, this lesson/rule may no longer be that important.

True, but the majority of people don't do this, and people who do maybe only check two or three random transactions which doesn't muddy the waters enough to be useful. The issue is also not only which transactions you check, but how you check them. Looking up some random transactions or addresses is one thing, but a lot of people use block explorers to check their own transactions until it gets its first confirmation. If you've searched for 50 transactions, and 49 of them you only loaded once, but 1 of them you refreshed the page 20 times, then that's a dead giveaway as well.

I think that the Monero parts is a huge overstatement from them. I think that on the best case they can follow transactions that comply certain strict rules (for example very big transactions with small mixin).

Either that, or people de-anonymizing themselves in ways which are unrelated to the Monero protocol, such as (as above) putting their hash and view key in to a blockchain explorer website or doing all their transactions via a honeypot node without using Tor.

[dkbit98]

Lesson two is to not look up your own transactions on block explorers.

Or even better option is to run your own block explorer, for example Mempool.space is open source, it can be self-hosted and it looks amazing.
If you don't like mempool.space there are other alternatives like BTC RPC Explorer with Bitcoin Core, and few others.
Installation instructions for mempool.space can be found on their github page:
https://github.com/mempool/mempool

How many of you actually tried to run your own explorer?
With the way how world is going right now, I think we are soon going to have to host everything on our own.

[DaveF]

If you can run your own Electrum node then why not just run a simple full node. The full node needs less resources too!

Very good point! I was studying yesterday the options for having my own Electrum server and I just noticed that it cannot be done with pruned full node. And then, whatever I do, the full node is already all I need. And lately Bitcoin Core also accepts HW, which is something I surely have to try out.

You kind of need an electrum node for mobile wallets / lightweight wallets on your phone / tablet / netbook anything that where even running a pruned node is not viable.
Even if you have a powerhouse laptop that can handle everything without stress if you go on vacation how is the Wi-Fi / Internet in general at the hotel? Do you want to have to sit for 2 hours while you get the blocks you missed while getting there because of crap bandwidth?

How many of you actually tried to run your own explorer?
With the way how world is going right now, I think we are soon going to have to host everything on our own.

More or less yes. You either do it yourself or have 0 idea what is being done with the data.
I have an open electrum node for people to use. Am I more or less trustworthy then some random public node? I know I am, or would at least like to think I am.
You don't know that.

-Dave

[Wind_FURY]

Time to run your own servers!

And/or run/use your own full node. But embrassing to admit, I haven’t been running my node everyday for a few months since the pandemic started. I run it only when I make a transaction from that wallet, or when it needs syncing.

Is it time to stop, and discourage use of Electrum?

[ABCbits]

And although it is something expected, the fact it's now public knowledge is imho important.
For example, maybe an update (or fork?) of Electrum will be developed for being privacy focused? Maybe with options for customizing when and which addresses to be queried, maybe with clients connecting to multiple servers to ask randomly for information? I guess that it also can be done. Of course, the top solution remains the use of own server.

It'll be difficult to make Electrum more privacy focused, mainly because Electrum send list of address to a server at once. It means you need to update Electrum protocol or implement BIP 157/158 instead.

For those who value their privacy, but with limited resource, they better use Wasabi Wallet which use BIP 157 and Tor by default.

[Dabs]

Electrum (the wallet) still needs to connect to a compatible Electrum server. There are a few now, even a "Personal Server" which can be pruned, but only your own wallet can connect to it (and only one wallet app at a time, so if you try with a desktop app AND a mobile app on a phone or tablet, one of them will not work.)

The one I am considering is Fulcrum. I've seen that from my desktop app that I keep as watch-only for a bunch of different wallets and even empty ones.

https://github.com/cculianu/Fulcrum/releases

Sometimes I'd manually pick the electrum server, they have interesting names. I think there is an aantonop server. Looks like it belongs to Andreas. There's also Johoe's server (where we sometimes look at graphs for bitcoin mempool statistics.)

I have an open electrum node for people to use. Am I more or less trustworthy then some random public node? I know I am, or would at least like to think I am.
You don't know that.

Care to share your node? Is it running from home or is it running from some VPS / hosted?

Is it time to stop, and discourage use of Electrum?

Nah, this is just a reminder to be careful. You can still use Electrum, just be aware that your privacy is not safe if you don't use tor/vpn or your own server.

[o_e_l_e_o]

Sometimes I'd manually pick the electrum server, they have interesting names. I think there is an aantonop server. Looks like it belongs to Andreas. There's also Johoe's server (where we sometimes look at graphs for bitcoin mempool statistics.)

You should be careful with this. electrum.aantonop.com and electrum.jochen-hoenicke.de both belong to the respective person since they are hosted at their personal sites, but you have no way of knowing that Jochen Hoenicke isn't sharing data with third parties. Also, anyone (such as the NSA) could spin up a similar looking server, such as electrum.a-anton.com to trick people in to thinking it is trustworthy.

Nah, this is just a reminder to be careful. You can still use Electrum, just be aware that your privacy is not safe if you don't use tor/vpn or your own server.

Even using Tor does not necessarily give you privacy in this scenario. The Electrum servers you connect to will still be able to link all the addresses in your wallet to each other, even if they cannot see your real IP address. If you open more than one wallet without changing Tor circuit, then again, those wallets (and all the addresses within each one) can be easily linked too.

[NotATether]

And/or run/use your own full node. But embrassing to admit, I haven’t been running my node everyday for a few months since the pandemic started. I run it only when I make a transaction from that wallet, or when it needs syncing.

I have also stopped running my full node after it caused my web server to frequently run out of memory.

Is it time to stop, and discourage use of Electrum?

Why? Just because Chainalysis is running a bunch of Electrum nodes? I think that's going a bit too overboard, especially considering that there is no replacement for it.

You should be careful with this. electrum.aantonop.com and electrum.jochen-hoenicke.de both belong to the respective person since they are hosted at their personal sites, but you have no way of knowing that Jochen Hoenicke isn't sharing data with third parties. Also, anyone (such as the NSA) could spin up a similar looking server, such as electrum.a-anton.com to trick people in to thinking it is trustworthy.

Or they can just forsake the domain name altogether and just display an IP address.

[ranochigo]

And/or run/use your own full node. But embrassing to admit, I haven’t been running my node everyday for a few months since the pandemic started. I run it only when I make a transaction from that wallet, or when it needs syncing.

Is it time to stop, and discourage use of Electrum?

Electrum is not designed for privacy, it is just a Bitcoin wallet. If you are aware of the privacy trade-offs for Electrum, then there is nothing wrong with using it. At no point in time did people think that their privacy is preserved simply by using Electrum alone.

If you really care about privacy, you wouldn't use Electrum in the first place. Samourai and Wasabi wallet both offers far superior privacy as compared to Electrum and are SPV wallets as well.