[Anonymity] Can I get rid of KYC trace through Lightning?

[Jan_btc]

Good day, everyone!

Firstly, I hope this is the correct sub-forum to post this question.

I'm not new to Bitcoin, but I'm a complete noob when it comes to Lightning network. I was playing around with various BTC/Lightning wallets on my phone and pondering a question. Say I have this scenario:

I buy BTC on a KYC exchange and transfer it (on-chain) to a hot wallet on my desktop. From there I transfer it (again on-chain) to Muun wallet on my phone. From Muun I pass it through Lightning network to Speed wallet, also on my phone and finally I send it (on-chain) to my final cold storage address. Neither Muun or Speed wallet have any KYC data (except knowing my phone number, I guess?). Is that one Lightning transfer enough to cut the trace or it is still somehow possible to associate the final address back to the original exchange?

Thanks 

[LoyceV]

Is that one Lightning transfer enough to cut the trace or it is still somehow possible to associate the final address back to the original exchange?

It breaks the on-chain connection, and is probably going to be quite difficult to trace. But I'm not sure how likely it is to find the trace.

I have a different question for you:

finally I send it (on-chain) to my final cold storage address.

Who are you trying to hide from? Depending on the answer, this may or may not be a good idea. If you want to sell your Bitcoin when it's worth a lot more in the far future, a KYC exchange (or your bank) may ask questions that are a lot easier to answer if your Bitcoin came directly from a KYC exchange.

[Satofan44]

Neither Muun or Speed wallet have any KYC data (except knowing my phone number, I guess?).

I don't know the particulars of those wallets, but they probably collect at least some analytics. Some wallet providers collect a lot of data, but they are more often altcoin wallets or multichain wallets. Be careful and analyze before using.

It would be much better to exchange the BTC to Monero or Zcash, and exchange it back after a while. You can use decentralized exchanges or semi centralized providers like ChangeNow. Generally a lot of the below applies directly to Bitcoin and using Lightning Network, you just have to translate the things. Are you using a custodial wallet, are you using your own node or SPV, and so on.

There are some quick notes what you need to consider and how you can be tracked, loosely ordered on the easiness of tracking you:

• Address. Example scenario: You exchange BTC from address A to Monero on address B, and then you exchange Monero from the same address B to Bitcoin to address C. In this case, if you used the same service provider it is easy to track you or even if you used two different services a comparison of the two data pools can lead to deanonymization.
• Fingerprint. Using the same browser fingerprint and/or IP address on the same or different services. Again, the risk here is data pooling between services whether by the service providers themselves or by third party analytics.
• Amounts. Exchanging the same amounts can provide a limited or non existent anonymity pool depending on the specific of your situation. A simple example. If you exchange 0.1 BTC to Monero today which is about 32 XMR now, and then you exchange 32 XMR tomorrow back to Bitcoin you lose any anonymity there as it is clear that it the same entity.
• Timing. Timing is extremely important and in the short term destroys any anonymity that you may get. However, it can be considered also for longer periods of time when combined with other data. A short term example is given. You exchange 0.1 BTC to Monero which is about 32.12 XMR. You split it into two addresses of 16.06 each to avoid amount correlation attacks, and then you proceed instantly to make two exchanges of 16.06 XMR minus the fees back to Bitcoin. The likelihood that this is the same entity is extremely high.
• There are probably a few others, but these are the major ones that to mind first. Maybe I should consider writing a thread about it..

Depending on the anonymity that you require or need, something like this should be your flow to maximize your anonymity set.

• Two browsers with different fingerprints and different proxies or VPN IPs. Make sure that you use IPs that you normally do not use from your VPN or proxy provider.
• Two different services, one in each browser. Whether from the KYCNOT exchanges or semi centralized providers like ChangeNow.
• Swap to Monero using 1 service. Split to new addresses in random amounts, avoid address reuse.
• Wait for time to pass, the longer you can wait the better it is. This is entirely up to you but longer is better, we are talking about days or weeks if possible. Keep in mind that you are exposed to exchange rate fluctuations here, but if you value the anonymity gains or require it then that is the cost to pay for this.
• Swap back to Bitcoin using the other service, optimally each swap should go to a new Bitcoin address and you should do this over the course of some time and not instantly swap all splits in a sequence.

This is more like a base, very strong anonymity setup. You can make each point deeper, mix and match to your preference. I can't tell you how many splits are required or how much time you need to wait, generally more is always better. Just be mindful of costs, and basic errors. Research each point, understand what you are doing. If you have superficial knowledge of this topic, you will do some things and have a false sense of accomplishment and anonymity. It may come back to bite you in the long future, depending on what you are doing and why.

If you want to sell your Bitcoin when it's worth a lot more in the far future, a KYC exchange (or your bank) may ask questions that are a lot easier to answer if your Bitcoin came directly from a KYC exchange.

If he plans to sell it again on a KYC exchange, this will cause a lot of trouble yes. If he never plans to sell on a KYC exchange, then he is fine with this. Generally, there is no issue if you get your coins from semi-centralized providers but obviously for large amounts questions will be asked. Additionally, laws keep changing for the worse and depending on where the user lives he may need a lot more proof in the future than he does now.

[Jan_btc]

Who are you trying to hide from? Depending on the answer, this may or may not be a good idea. If you want to sell your Bitcoin when it's worth a lot more in the far future, a KYC exchange (or your bank) may ask questions that are a lot easier to answer if your Bitcoin came directly from a KYC exchange.

I indeed plan to hold most of my BTC into the far future, when adoption and infrastructure to spend it will be so common, we won't have to use exchanges anymore, nor have the need to turn it into fiat. At that point the absurdity of paying capital gains on BTC we spend will hopefully also be gone.

But my question was mostly just technical - to better understand these things. So far I haven't parted with a single SAT yet. I don't trade or anything like that.

@Satofan44, thanks for the extensive reply. Much appreciated!!

[Bitcoin Smith]

But my question was mostly just technical - to better understand these things. So far I haven't parted with a single SAT yet. I don't trade or anything like that.

Yes the trail breaks when you transfer Munn to Speed via LN because it's happening offline and only who control the entry as well as exit nodes can link that if they want to and it is almost impossible via chain analysis to link back the transfer with KYCed address unless you reuse the address again to link with any KYCed funds again.

[Satofan44]

Yes the trail breaks when you transfer Munn to Speed via LN because it's happening offline and only who control the entry as well as exit nodes can link that if they want to and it is almost impossible via chain analysis to link back the transfer with KYCed address unless you reuse the address again to link with any KYCed funds again.

No, this is not true. The link is not broken and there are many ways you can be tracked. Please don't give incorrect information here.

But my question was mostly just technical - to better understand these things. So far I haven't parted with a single SAT yet. I don't trade or anything like that.

@Satofan44, thanks for the extensive reply. Much appreciated!!

I hope that you have understood that my answer applies pretty much directly to LN as well. Just think about it, starting with the address reuse example. In addition, there are probably some LN specific concerns. Reading a paper such as this one could be interesting to you: https://arxiv.org/abs/2003.12470.

If you have any questions about any specific points, but how it relates to LN feel free to ask. Generally you can think about it this way: Almost everything is possible, it just depends on the following:

• Who is looking? From random users to state agencies.
• How hard are they looking for it? From basic analysis of addresses to correlational timing and more complex attacks.
• And most importantly, how many resources are they willing to spend tracking you?

[Jan_btc]

• And most importantly, how many resources are they willing to spend tracking you?

Assuming a state actor with near unlimited resources (time, money & legal power), my guess is everything can be analyzed. Of course they would need to obtain data from every wallet involved in the transfers, while the base layer is completely open and easy to inspect.

I'm thinking more in the sphere of what's plausible - how much resources would a state employ, to go after a random citizen who might have spend 50 bucks of BTC on a dinner, without declaring capital gains on it? For example. Not something that is nearly 100% anonymous in all cases (and requires a lot of technical knowledge), just less traceable and less worth going after. On-chain is too easy to follow, while Lightning adds just enough obfuscation to become a hassle - as far as I understand it.

Then there's the consideration that KYC is a huge security issue for end users (hacking of exchanges, data leaks, etc). A person doesn't need nefarious reasons for wanting to improve their anonymity. I didn't understand these things when I first started to save in Bitcoin. There's a lot to learn.

Thanks again everyone for your inputs!  

[LoyceV]

how much resources would a state employ, to go after a random citizen who might have spend 50 bucks of BTC on a dinner, without declaring capital gains on it?

They won't go after one particular random citizen, they'll just analyze everything they can and see what comes out.

Then there's the consideration that KYC is a huge security issue for end users (hacking of exchanges, data leaks, etc). A person doesn't need nefarious reasons for wanting to improve their anonymity.

Obfuscating your current holdings won't change the potential risk from a data leak.

[dkbit98]

Is that one Lightning transfer enough to cut the trace or it is still somehow possible to associate the final address back to the original exchange?

No it's certainly not enough.
Lightning Network is centralized network and analytic companies like Chainalysis are already tracking everything on Lightning Network.
Another problem is that Lightning is not mean for larger amount of coins, and you also need to get back coins on-chain at some point.

[nc50lc]

Is that one Lightning transfer enough to cut the trace or it is still somehow possible to associate the final address back to the original exchange?

Lightning Network is centralized network and analytic companies like Chainalysis are already tracking everything on Lightning Network.

I'm interested to know what is your definition of the Lightning Network being "centralized".
Because it's not managed by a single authoritarian or a central server.

If it's a reference to those old topics about "banking hubs" lightning nodes, those are just for FUD purposes.