According to leaked documents walletexplorer.com is a honeypot

[bbc.reporter]

Be cautious if you are using walletexplorer.com and use TOR and other privacy tools. It appears that it was bought by Chainalysis in secret and transformed this into a honeypot. If you visit walletexplorer.com regularly with your public IP address, assume that it is in the government’s list of IP addresses of interest hehehehe.



In the battle to link real-world criminals to their anonymous bitcoin troves, Chainalysis has found a “meaningful” edge: a block explorer website that scrapes visitors’ internet protocol (IP) addresses.

[glow=yellow,1000]According to leaked documents reviewed by CoinDesk, Chainalysis, the largest of the blockchain tracing firms, owns and operates walletexplorer.com.[/glow] Like other block explorers, the service lets anyone view the history of public cryptocurrency wallet addresses. Chainalysis figures that bad actors would use its site to check transactions without fear of “leaving a ‘footprint’” on crypto exchanges, the documents said.

But where the exchanges – and presumably most block explorers – have no eyes, Chainalysis has set its sights. It “‘scrapes’ the IP addresses of suspicious” users that fall into the honeypot of walletexplorer.com according to the documents.

“Using this dataset we were able to provide law enforcement with meaningful leads related to the IP data associated with an address,” the documents, translated from Italian, say. “It is also possible to conduct a reverse lookup on any known IP address to identify other BTC addresses.”

In doing so, Chainalysis has effectively weaponized an unassuming website without disclosing its ties. It has never publicly associated itself with walletexplorer.com, although a note at the bottom of the site’s homepage says its “author” now works at Chainalysis. The website was created in 2014, according to site registration documents that make no mention of Chainalysis.

Read in full https://www.coindesk.com/business/2021/09/21/leaked-slides-show-how-chainalysis-flags-crypto-suspects-for-cops/

[mk4]

Imagine how much data the likes of Blockchain.com and Etherscan has as well.

Here's a tip: Always lookup txids and addresses using Tor. Blockstream.info and Etherscan works decently on Tor.

[pooya87]

It appears that it was bought by Chainalysis in secret and transformed this into a honeypot.

I'm confused here, didn't we already know walletexplorer belongs to chainanalysis? For years I've been telling people that these two services are from the same company. For example here is my post from 2018 (https://bitcointalk.org/index.php?topic=2800620.msg28655662#msg28655662).
I don't remember it completely but I believe I read about the connection on their own website! In other words this has never been something they hid!!! So why is it being treated as a new thing and "leaked documents"?

Here is another post from someone else in 2017 (quoting the footer of the website):
https://bitcointalk.org/index.php?topic=2116107.msg21163750#msg21163750

Here is another quote from 2016

use https://www.walletexplorer.com/ which groups addresses together by spend links. The person that made that site now works at chainalysis.

P.S. Any centralized service including blockexplorers, exchanges, etc. are honeypots whether they are owned by a blockchain analysis firm or not.

[dkbit98]

Imagine how much data the likes of Blockchain.com and Etherscan has as well.

Here's a tip: Always lookup txids and addresses using Tor. Blockstream.info and Etherscan works decently on Tor.

Sure, and you know one more interesting thing about Etherscan and who is working with them?
Those amateurs from Ledger hardware wallet, who knows what more information they collected along with addresses, names and phone numbers...
How it Works: Addresses reported by Ledger to be involved in security incidents will be immediately reflected on Etherscan through a built-in programmatic integration!


https://twitter.com/etherscan/status/1440292655775113222

Ledger is well known for it's ''security''  

P.S. Any centralized service including blockexplorers, exchanges, etc. are honeypots whether they are owned by a blockchain analysis firm or not.

We have alternative self hosted open source explorers but it looks like most people are to lazy to self-host anything :/

[Lucius]

I see no reason for anyone to be surprised that such sites are honeypots, it is already clear to everyone that even using this forum without adequate protection means that you have absolutely no privacy. When the forum was forced to start using Cloudflare, even the admin expressed his opinion on who was behind it.

What I meant is that Cloudflare can see your unencrypted password when you log in. It's still encrypted from the real server to Cloudflare and from Cloudflare to you. So it's not blatantly insecure except in that Cloudflare is very probably an NSA honeypot...

[hugeblack]

It's the first time that I know this information and the poor design of the site and the lack of updating made me think that no one uses it to collect data.

It seems that sites like BLOCKCHAIN.COM will always be under the control of these tools and I also think that some of the Electrum servers will be as well.
Let's not forget that many wallets are closed source, and therefore they will not hesitate to sell users' data to any government parties or at least cooperate with them.
I think that it has become necessary for everyone to manage an entire full nodes on their own and try to avoid the highly popular sites.

[The Cryptovator]

Although we know most explorer tracks our IP address, still we are using it. Because we are unaware of how to save privacy. But when we fall in trouble then we regret it. I know it's hard to save our privacy. Especially once we are making transactions. For most of the use, we don't know how we could hide our IP address when a transaction occurring. I agree we can't trust the internet. We can't realize by using various free services we are hand over our details which would use against us. We are hopeless when we are forced to use the centralized exchange. Then there is no choice due to various reasons.

[PrimeNumber7]

It appears that it was bought by Chainalysis in secret and transformed this into a honeypot.

I'm confused here, didn't we already know walletexplorer belongs to chainanalysis?

I didn't know that chainanalysis had any specific information from the walletexplorer website, but walletexplorer has advertised for years that its creator was hired by chainanalysis.

I am not sure how much useful information someone could gain from the data described in the OP. A site like walletexplorer is likely to be used to look at transactions unrelated to yourself. In other words, if you are looking at a transaction on walletexplorer, you are most likely not looking at your own transaction, or a transaction related to you.

[bbc.reporter]

It appears that it was bought by Chainalysis in secret and transformed this into a honeypot.

I'm confused here, didn't we already know walletexplorer belongs to chainanalysis? For years I've been telling people that these two services are from the same company. For example here is my post from 2018 (https://bitcointalk.org/index.php?topic=2800620.msg28655662#msg28655662).
I don't remember it completely but I believe I read about the connection on their own website! In other words this has never been something they hid!!! So why is it being treated as a new thing and "leaked documents"?

Here is another post from someone else in 2017 (quoting the footer of the website):
https://bitcointalk.org/index.php?topic=2116107.msg21163750#msg21163750

Here is another quote from 2016

use https://www.walletexplorer.com/ which groups addresses together by spend links. The person that made that site now works at chainalysis.

P.S. Any centralized service including blockexplorers, exchanges, etc. are honeypots whether they are owned by a blockchain analysis firm or not.

I feel very ashamed to admit that I did not know this as a cryptonews addict hehe. However, after knowing that Chainalysis owns walletexplorer.com, did anyone suspect of anything that they are collecting visitors’ information to disclose them to the government?

[o_e_l_e_o]

In other words, if you are looking at a transaction on walletexplorer, you are most likely not looking at your own transaction, or a transaction related to you.

I suspect quite a few people use it to try to follow where their own coins end up, particularly in the scenario that they have been hacked or scammed, in which case the website will be able to get some useful data from them.

However, after knowing that Chainalysis owns walletexplorer.com, did anyone suspect of anything that they are collecting visitors’ information to disclose them to the government?

I suspect every block explorer is collecting visitors' information to disclose to any third party which is willing to pay for it, governments included. The only block explorer I suspect might not being doing this is mempool.space since they are completely open source and community driven, but even then, I don't trust them enough not to use Tor or to go looking up my own transactions. If I had a great need to use a block explorer (I rarely do, and when I do it is almost always to look at someone else's transactions to help figure out an issue), then I would run my own instance of mempool.space using their code: https://github.com/mempool/mempool

[Stalker22]

In other words, if you are looking at a transaction on walletexplorer, you are most likely not looking at your own transaction, or a transaction related to you.

I suspect quite a few people use it to try to follow where their own coins end up, particularly in the scenario that they have been hacked or scammed, in which case the website will be able to get some useful data from them.

However, after knowing that Chainalysis owns walletexplorer.com, did anyone suspect of anything that they are collecting visitors’ information to disclose them to the government?

I suspect every block explorer is collecting visitors' information to disclose to any third party which is willing to pay for it, governments included. The only block explorer I suspect might not being doing this is mempool.space since they are completely open source and community driven, but even then, I don't trust them enough not to use Tor or to go looking up my own transactions. If I had a great need to use a block explorer (I rarely do, and when I do it is almost always to look at someone else's transactions to help figure out an issue), then I would run my own instance of mempool.space using their code: https://github.com/mempool/mempool

Exactly. I don't see the big deal here. Every website and service we use collects our IP addresses, so nothing new here. We may not like it, but it's just the way the world works.

My point is that institutions will want to know the IP addresses associated with BTC addresses if they are investigating criminal acts such as terrorist financing and money laundering. If you are concerned about your privacy, you should use Tor or a premium VPN service.

[o_e_l_e_o]

Exactly. I don't see the big deal here. Every website and service we use collects our IP addresses, so nothing new here. We may not like it, but it's just the way the world works.

The big deal here is that you are looking up financial information, which many people will want to keep more private than a lot of their other web activity. If I Google the best recipes for lasagne, I don't really care if the website in question knows my IP, or knows that I was also looking at pizza recipes. If I look up one of my transactions, maybe I don't want the website in question to be able to link that transaction to my IP, and maybe I don't want the website in question to also see me look up my cold storage addresses and link those back to me as well. Some advertisers and marketing agencies may pay for the knowledge that I like Italian food so they can try to send me targeted ads, but there are a lot more third parties, governments included, who will be interested to know just how much bitcoin I am holding or when and where I am spending it.

My point is that institutions will want to know the IP addresses associated with BTC addresses if they are investigating criminal acts such as terrorist financing and money laundering.

That doesn't give them a right to spy on the rest of us, though.

If you are concerned about your privacy, you should use Tor or a premium VPN service.

A VPN just shifts your point of trust from the block explorer to the VPN provider. If you want privacy, use Tor.

[SFR10]

It has never publicly associated itself with walletexplorer.com, although a note at the bottom of the site’s homepage says its “author” now works at Chainalysis.

I don't remember it completely but I believe I read about the connection on their own website! In other words this has never been something they hid!!!
~Snipped~
(quoting the footer of the website):

Apart from the note that's been on the footer area since early 2016 ^{[archived version]}, I'm pretty sure back in the day, there was also a blog post about their connection ^{[tried my best, but couldn't find it]}.

For years I've been telling people that these two services are from the same company.

Same "here"!

So why is it being treated as a new thing and "leaked documents"?

IIRC, that's not the first time that I've seen such behavior from CoinDesk authors.
^{-The same thing goes for some of the CoinTelegraph authors.}

https://i.imgur.com/Dr86Vf2.jpg
https://twitter.com/etherscan/status/1440292655775113222

Ledger is well known for it's ''security''  

[Stalker22]

Exactly. I don't see the big deal here. Every website and service we use collects our IP addresses, so nothing new here. We may not like it, but it's just the way the world works.

The big deal here is that you are looking up financial information, which many people will want to keep more private than a lot of their other web activity.
~

My point is, I don't see a big deal in the topic of this thread. As you pointed out in the post I was referring to:

I suspect every block explorer is collecting visitors' information to disclose to any third party which is willing to pay for it, governments included.
~

Thus, it would be naive to expect that certain clearnet services would behave differently.

My point is that institutions will want to know the IP addresses associated with BTC addresses if they are investigating criminal acts such as terrorist financing and money laundering.

That doesn't give them a right to spy on the rest of us, though.

No? But you live in a jurisdiction with AML laws, right?

I simply want to say that we may not like it, but unfortunately, this is the world we live in, and Big Brother is everywhere.

[o_e_l_e_o]

Thus, it would be naive to expect that certain clearnet services would behave differently.

Ahh right, fair enough. Yeah, we've long known that exchanges report all their users to various governments, and corporations such as Facebook and Google track everything you do online. Thinking block explorers wouldn't do the same is naive at best.

No? But you live in a jurisdiction with AML laws, right?

I simply want to say that we may not like it, but unfortunately, this is the world we live in, and Big Brother is everywhere.

Yes, my jurisdiction has AML laws, but that doesn't mean they should be allowed to spy on innocent people such as myself. Whatever happened to innocent until proven guilty? Big Brother is everywhere, sure, but that doesn't mean it is right or moral or ethical or that we shouldn't do everything we can do fight against it.

[PrimeNumber7]

In other words, if you are looking at a transaction on walletexplorer, you are most likely not looking at your own transaction, or a transaction related to you.

I suspect quite a few people use it to try to follow where their own coins end up, particularly in the scenario that they have bcen hacked or scammed, in which case the website will be able to get some useful data from them.

If you have been hacked or stolen from, there is a good chance you will ask others for help in getting your coin back and will make the details of the transaction public, so there may be multiple people looking at your particular transaction.

This means you could view your own transaction, but 20 other people might also view your transaction. You might also view 100 other transactions unrelated to you. There would not be anything unique about you visiting your own transaction, and the site would have no way of knowing you are viewing your own transaction.

Just because a transaction belongs to you and you visit a block explorer, doesn’t mean the block explorer has any additional Information about you.

[bbc.reporter]

However, after knowing that Chainalysis owns walletexplorer.com, did anyone suspect of anything that they are collecting visitors’ information to disclose them to the government?

I doubt they disclose visitor's data, unless government explicitly asked for it. It's more likely they use visitor's data as additional information to track someone or coin.

They certainly sell it or have a government contract for their data and services. This is simply business for them and the more they produce, it will certainly be more profitable. Also this is nothing. Wait for regulations on the cryptospace hehehe. I speculate many sanctioned public addresses and more questions on bitcoin’s fungibility. I would also expect pumps from anonymous coins.

[cabron]

However, after knowing that Chainalysis owns walletexplorer.com, did anyone suspect of anything that they are collecting visitors’ information to disclose them to the government?

I doubt they disclose visitor's data, unless government explicitly asked for it. It's more likely they use visitor's data as additional information to track someone or coin.

They certainly sell it or have a government contract for their data and services. This is simply business for them and the more they produce, it will certainly be more profitable. Also this is nothing. Wait for regulations on the cryptospace hehehe. I speculate many sanctioned public addresses and more questions on bitcoin’s fungibility. I would also expect pumps from anonymous coins.

Well, they got to make use of the data they got, what else is the use of it but to find something useful from these data. Every tech companies today are doing it because it makes money and the best way to make business is to have a government contract which Chainalysis had done before.

But walletexplorer though can be used by everyone, anyone who wants to find out where coins are from or just tracing someone's wallet will try using walletexplorer, they can't be accused. Someone has got to create another alternative for walletexplorer.

[o_e_l_e_o]

Just because a transaction belongs to you and you visit a block explorer, doesn’t mean the block explorer has any additional Information about you.

It's all about building up a profile. Let's say I look up 20 transactions, one of which is mine and 19 of which are dummy transactions. Provided I am not doing something stupid such as continually refreshing the page only on my unconfirmed transaction, or looking up subsequent child transactions only from my transaction, then sure, that block explorer doesn't gain much information about me. Next week, I also look up 20 more transactions. One of the transactions in this second batch spends the change of one of the transactions from the first batch - the rest of the transactions are completely unlinked from each other. That is a very useful piece of information that the block explorer can now apply to me.

Further, the vast majority of people don't do this. They look up one transaction at a time, which is usually either one they have sent or one they are receiving.

I would also expect pumps from anonymous coins.

I doubt it. We know using centralized exchanges are one of the worst things you can do for your privacy, and we also know that they often treat bitcoin as non-fungible, and yet they continue to grow and attract millions of users. People don't care enough about their privacy to move en masse to Monero.

[PrimeNumber7]

Just because a transaction belongs to you and you visit a block explorer, doesn’t mean the block explorer has any additional Information about you.

It's all about building up a profile. Let's say I look up 20 transactions, one of which is mine and 19 of which are dummy transactions. Provided I am not doing something stupid such as continually refreshing the page only on my unconfirmed transaction, or looking up subsequent child transactions only from my transaction, then sure, that block explorer doesn't gain much information about me. Next week, I also look up 20 more transactions. One of the transactions in this second batch spends the change of one of the transactions from the first batch - the rest of the transactions are completely unlinked from each other. That is a very useful piece of information that the block explorer can now apply to me.

Further, the vast majority of people don't do this. They look up one transaction at a time, which is usually either one they have sent or one they are receiving.

Wallet explorer doesn't actually display unconfirmed transactions, in fact, they will not show transactions that have been recently confirmed, as they only update their database every so often.

For the above reason, I think it would be fairly unusual for someone to look up their own transactions on walletexplorer on any kind of a regular basis. Also, the nature of walletexplorer makes me believe it is fairly common for people to visit their site multiple times to view linked transactions.

What you say may be true for a block explorer such as blockchain.com, but not walletexplorer.