Privacy while making use of Bitcoin

[Nathrixxx]

Considering how often i make bitcoin transactions this days on several occasions and different purpose, I've come to think of it that do i really have privacy with all these transactions am doing?... then i begin to run a research on how to secure my privacy on bitcoin transactions which birth to writing these thread.

 It is believed that tracing Bitcoin wallet address/transactions is pseudo-anonymity meaning it may and may not be traceable with the use of forensic analysis as all transaction records were stored on a public ledger on the block chain which anyone can see.


It is paramount to note that seing the transactions that occur on the public ledger of block chain technology is not tantamount to revealing the details for the Bitcoin transaction and the public keys but can lead to, although multiple addresses can be linked up using the blockchain for lookup.

Otherwise, Virtual Assets Service Providers (VASP) has the transaction details of Bitcoin addresses linked on the block chain technology with exchanges, custodial wallets, and custodians which provide cryptocurrency services to retail users and businesses in which all the required details of know your customer (KYC) given at the registration point can be use to trace your real world identity.

Transactions can be traced using the app Coinpath® app which is efficient in tracing Bitcoin transactions and Bitquery explorer use to track money flow in graphical representation all on the block chain technology, while simple payment verification (SPV) which connects to the central server is also a challenging factor regarding privacy.

Let’s see an example of an hacker on how to trace bitcoin transactions using Coinpath® technology.

The bitcoin address mentioned here belongs to the hacker —bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

Coinpath® APIs give you all the source and destination addresses that sent or received transactions from any bitcoin address. image below shows the top 10 addresses, which received bitcoins from the hacker’s address.


As we can see, a Binance exchange wallet received the transaction from the hacker’s address. However, the hacker used multiple intermediate wallets before sending money to the Binance wallet.
Using the Binance KYC solution, we can identify who received this money and conduct further investigation as the details and identity of the user can be given.

Knowing fully how privacy can be difficult on exchanges, centralized services and SPV wallets, are there possible means one can use non custodial wallet like SPV and still maintain having privacy? Also i understand how this can be wrongly abused by scammers but for the sake of respective corporate and individual's personal desire for privacy not to be overlooked.

https://www.luno.com/learn/en/article/can-you-trace-a-bitcoin-address
https://bitquery.io/blog/trace-bitcoin-transaction-and-address

[1713511774]

1713511774

[tranthidung]

You can use Wasabi wallet and don't use block explorers to check your transactions. If you use it, do it with Tor connection.

[o_e_l_e_o]

Knowing fully how privacy can be difficult on exchanges, centralized services and SPV wallets, are there possible means one can use non custodial wallet like SPV and still maintain having privacy?

Privacy isn't just difficult when using centralized exchanges - it is nearly impossible. Centralized exchanges are increasingly giving in to various governments' demands to track and de-anonymize as many transactions and addresses as they can. Every satoshi you deposit to a centralized exchange is investigated through blockchain analysis in an attempt to ascertain where it came from, and every satoshi you withdraw is similarly investigated to ascertain where it goes. All the addresses you use to interact with a centralized exchange are linked to your account, and from there probably to your real life identity since you have probably completed KYC at the exchange in question. If you are very determined you might be able to hide the final destination of your coins via things like coinjoin transactions and mixers, but the exchange (and your government) will still know how much you bought and when you bought it.

In terms of your wallet choice, if you want privacy then run your own node over Tor. Anything else is a sub-optimal solution. If you need to use an SPV wallet (such as when traveling), then set up your own node and server at home you can point your SPV wallet at. If you can't do that either, then you need to pick an SPV wallet designed for privacy such as Wasabi, run it over Tor if it doesn't do this by default, keep coins that you don't want linked segregated in to different wallets, coinjoin and mix your coins, and be careful not to link addresses (especially change addresses) together in the same transaction.

[witcher_sense]

Coinpath® APIs give you all the source and destination addresses that sent or received transactions from any bitcoin address. image below shows the top 10 addresses, which received bitcoins from the hacker’s address.

Haven't heard about Coinpath tools before but I assume that the principles on which it is based and operating are no different from other similar blockchain analysis tools. You should know that despite the fact that blockchain is transparent and open for observation, everything occurring within it may be interpreted differently. Also, there are two types of links between addresses: deterministic and probabilistic. While deterministic links by definition are clear and unquestionable, probabilistic ones are very questionable because the algorithms used to estimate the probability are based on common heuristics, which are relatively simple to trick.

As we can see, a Binance exchange wallet received the transaction from the hacker’s address. However, the hacker used multiple intermediate wallets before sending money to the Binance wallet.
Using the Binance KYC solution, we can identify who received this money and conduct further investigation as the details and identity of the user can be given.

It doesn't matter how many hops between an address A and address B if there weren't any measures taken to break the link between them.

[Charles-Tim]

It is best to run your own node if you want privacy, in this case you will not depend on any central server. Making use of SPV wallet depends on central server to connect to the blockchain which in the process will definitely link your address to other addresses and also to your IP (if not using VPN or Tor) which can even be linked to your real identity. But if you run the full node will make you not to depend on any central server. Even if you in the full node, you will not also depend on blockchain explorers but all can be checked on your own node directly including the mempool rather than depending on third parties.

To learn more about privacy, you can click on the below link, you will be able to know about CoinJoin, Mixing service and more about privacy.

[Education] Bitcoin Privacy and Anonymity

And the worst of all is by making use of centralized exchanges which already have your identity with them.

[bitmover]

Just using bitcoin by itself doesn't provide a good privacy. But you can use third party services to achieve a good privacy for yourself.

Wasabi, coinjoin and mixers are all very good services which will help us to achieve the privacy we all need, but those services aren't magical solutions. We need to protect our privacy as well, avoiding sharing our documents with exchanges and using a good wallet.

Additionally,  coin control is a very important feature that most good wallets already have. Coin control allows you to decide which input to spend, so you don't mix different addresses in a single transaction,  making you harder to track and to connect your addresses.

[hugeblack]

Privacy is often associated with cost and knowledge. Without detailed and accurate knowledge, any error may lead to revealing your identity, but you can determine how difficult it is to track your identity.
The average user, with a few courses and costs, can learn how to hide his identity from the platforms, but you will need more to hide from governments and from a government that has resources to track you or wants to track you.

I can give you some advice but you have to decide how deep of privacy you want and you have to remember that mistakes will happen sooner or later and therefore you should not do anything illegal.

It all starts with a clean machine, running Tor, open source software, a full node, and no browsers, block explorers, or any closed source tool.

[Welsh]

When o_e_l_e_o says nearly impossible, they aren't exaggerating that fact either. To remain anonymous, and keep your privacy you need to be absolutely perfect in everything you do, and this usually means not using any third party whatsoever. Basically, if you want privacy you have to go the long way around on everything, which makes it less convenient. This is why so many people are willing to give up their privacy, because it isn't convenient to keep it. Now, I'm not saying that you shouldn't strive to keep your privacy intact, quite the opposite actually. However, there are different levels to privacy. There's complete anonymity, which is on the extreme side of things, and then there's only allowing certain users or companies have identifying things about you, that however should be avoided whenever possible as long as it's legal to do so, because you don't know how these companies are storing your data, which could be insecurely or you don't actually know who they are sharing your data with willingly.

Even when you run your own node over Tor it isn't perfect. There's always the risk that the person who's running that end node, can compromise your privacy. This largely depends on what information you're sharing to them in the first place, and if you are routing any other traffic through Tor. If your just running your node through Tor, then that's actually pretty decent level of protection.

I think the change addresses are usually the culprit in giving up someone's identity simply because they overlook it, then they accidentally link addresses together. To avoid this you need to be consciously aware of the change addresses, and make transactions accordingly.

Privacy is often associated with cost and knowledge. Without detailed and accurate knowledge, any error may lead to revealing your identity, but you can determine how difficult it is to track your identity.
The average user, with a few courses and costs, can learn how to hide his identity from the platforms, but you will need more to hide from governments and from a government that has resources to track you or wants to track you.

When your trying to keep your privacy from the government, then this is when that nearly impossible statement seriously comes into play. You're basically up against a government that has pretty much unlimited funding in this department. Edward Snowden proved that they will go to great lengths to spy on it's own people, as well as other nations. This included tapping in physical connections, and compromising several big phone companies, which are still operating today. Basically, you keep your privacy intact against the government is going to require you to be absolutely perfect in everything that you do, and I'll be honest most people won't be able to do it.  For example, Tor is recommended, but it has been known that law enforcement have ran Tor exit nodes, and monitored the traffic going through it. This has been quite well documented in big cases around the world. It's by no means a perfect solution.

[Magicalking]

It is becoming more difficult to have privacy. Bitcoin transactions are already visible on the blockchain.com for all to see. Blockchain forensics can track bitcoin transactions to multiple addresses till it gets to a centralised exchange where the bitcoin is cashed out. A release of the user KYC  documentation that can identify the account holder can be requested by the police for investigation. I suggest mixing bitcoins to cover your tracks. There are sites that offer these kind of services for example chipmixer.  Also use monero and other privacy coins, their transactions are not public.
Chainanalysis have advanced their methods to track users data using blockchain explorers, they scrap the ip addresses of unsuspecting users. This article is one big surprise 
 https://www.google.com/amp/s/www.coindesk.com/business/2021/09/21/leaked-slides-show-how-chainalysis-flags-crypto-suspects-for-cops/%3foutputType=amp

[ShowOff]

We should have realized why every user is encouraged to use 1 address for 1 transaction if we want to maintain privacy for the better. I don't know exactly if this method will help bitcoin users once they use mixer service to keep their privacy untraceable. I read some of the solution in this thread based on the answers, maybe needed by those who really don't want to be tracked. Just one thing that confuses us, when the bitcoins we own are legal asset then why should we cover them up from the government?

[o_e_l_e_o]

While deterministic links by definition are clear and unquestionable

I'm not sure there is such a thing as unquestionable when it comes to blockchain analysis. Even two inputs being used together in the same transaction doesn't prove common ownership, and is exactly how coinjoin transaction obfuscate things. Things like change addresses and address types can be manually tweaked to make them appear the opposite of what is actually going on. Everything is based on probabilities. Only with additional external evidence, such as KYC from a centralized exchange, can you say for sure what is going on.

I think the change addresses are usually the culprit in giving up someone's identity simply because they overlook it, then they accidentally link addresses together.

In terms of general privacy, I think it's being very lax with your personal info and completing KYC left, right, and center at a variety of questionable exchanges or scam ICOs/airdrops/etc. In terms of blockchain evidence, I'd agree with you regarding change addresses. There are a number of things you can do, from redirecting change directly to a mixer to buying exact amounts of good or selecting precise inputs to not create any change at all.

Also use monero and other privacy coins, their transactions are not public.

Monero is the only privacy coin which is actually private.

[Charles-Tim]

Just one thing that confuses us, when the bitcoins we own are legal asset then why should we cover them up from the government?

It is like you telling someone a secret, if the secret has gone more than 100 miles should not be surprising, ones you reveal an information to the government, also know that you are revealing it to scammers. The data breach on exchanges and other centralized services is enough to answer this. Ledger is a reputed hardware company and yet not still an exchange, why are people even calling ledger wallet owners after the ledger data breach, calling them that they will visit them one day, although reported to be a call from another country and another languages were spoken. If your name, home address and ID card can be known in data breach, then are you safe? It is not common yet that criminals are not visiting crypto owners linked to data breach, but this could be possible in the future.

Another scenario of the information provided, data was breached by hackers, the hackers sent malware or phishing email to victims, the victims clicked on malware link or provided his seed phrase in a site provided in the email link while click on, or a link on the email that resembles the exchange they are using, just to scam the victims, many people have been scammed this way. Kyc is extremely dangerous.

Another scenario, if exchange workers are linked to hack, then how wouldn't data breach be possible by them. Some sim swap attack is just because of insider unknown to people, also many bank account hack is as a result of bank workers. Criminals do not have it written on their forehead, nobody can be trusted, even government workers can not be trusted while yet the government are still third party, the exchange also have the kyc.

Kyc deprived people of privacy and makes people not safe.

I think the change addresses are usually the culprit in giving up someone's identity simply because they overlook it, then they accidentally link addresses together.

I'd agree with you regarding change addresses.

Also that almost all wallets do not have coin control and address freeze, it is the wallet that will do all itself and link many addresses utxo together while making transaction which is obvious on the blockchain, this makes almost all bitcoin wallet not recommendable as they do not have this coin control and address freeze feature and yet automatically and poorly selecting the coins while making transaction.

And if you ever decide to use coinjoin/mixer, you need to realize that the coin can't be deposited to to centralized exchange/custodial wallet without major problem such as locked account and demand to explain the coin.

I'd totally accept this, I do not know much about reputed mixers on this forum but likely the coins might not be seized (but just a guess), but CoinJoin could lead to coin seizure, I have read a post similar about this on this forum in the past about a reputed mixer on this forum:

I've never been banned while using ChipMixer on Binance, not saying that it is immune just that CoinJoins are a lot more obvious.

Although, be it mixer or CoinJoin, there is nothing bad to split the coins sending it to different addresses at different time period and making it up to or more than 5 hops for each. You are definitely right.

[o_e_l_e_o]

Also that almost all wallets do not have coin control and address freeze

Partly, but it is trivial to use a wallet which does have coin control if you are interested in doing so. I think it is more an issue of poor education and knowledge among the majority of bitcoin users.

I do not know much about reputed mixers on this forum but likely the coins might not be seized (but just a guess), but CoinJoin could lead to coin seizure

I mix and/or coinjoin literally every coin I have ever had in my possession, and have never once had an issue with a coin being accepted somewhere, but I am also fairly unique in that I refuse to use centralized exchanges or payment processors such as BitPay.

I've always hated that exchanges refusing a coinjoined coin is seen as an issue with coinjoin. It isn't. Coinjoin is achieving exactly what it is meant to achieve. It is an issue with the exchange in question. If your exchange is so hell bent on invading your privacy and spying on you that they will refuse a deposit if they cannot see its entire history, then you should be leaving that exchange immediately and looking elsewhere, not compromising your own privacy by giving up on coinjoin and then handing your financial history over to them on a silver platter.

[Nathrixxx]

After series of vital information given on how to secure one's privacy from the members of the forum, I've taken a step further in research for various related topics all taking on the use of coinjoin, wasabi wallet and running a "full nod"  though these may be tasking and financial demanding. But for the sake of newbies who are kin to learning, ive come across this wonderful article that theoretically explained the whole process. Protect your bitcoin through privacy

[witcher_sense]

I'm not sure there is such a thing as unquestionable when it comes to blockchain analysis. Even two inputs being used together in the same transaction doesn't prove common ownership, and is exactly how coinjoin transaction obfuscate things. Things like change addresses and address types can be manually tweaked to make them appear the opposite of what is actually going on. Everything is based on probabilities. Only with additional external evidence, such as KYC from a centralized exchange, can you say for sure what is going on.

While writing that post, I was thinking that if all transactions in the bitcoin blockchain were deterministic, meaning that, there wouldn't be a place for making guesses, we wouldn't see any surveillance companies trying to sell their controversial interpretation of what is going on. In my view, a transaction can be considered deterministic only if it has a single explanation at any point in time, whoever you ask should come to exactly the same conclusion as yours. Actually, the only deterministic transaction I can think of at the moment is that which has only one input and only one output. At least, it is unquestionable that there was no leftover created upon the transfer between address A and address B!