Using publicly available information sources to de-anonymize cryptocurrency wallets

[Brother]

From a legal point of view, cryptocurrency can be defined as property in electronic form, created using cryptographic means, and recorded in a distributed ledger of digital transactions in accordance with the established rules for its maintenance.

From a technical point of view, cryptocurrency is a distributed, open-source, peer-to-peer virtual currency based on mathematical principles, in which there is no centralized administrator, as well as the corresponding control and supervision from government authorities or other third parties.

Cryptocurrencies differ significantly from the usual financial transactions. They do not require a centralized regulator or issuer. At the same time, all cryptocurrency transactions are public and are reflected in a special register - the blockchain. At the same time, there is no data on the actual owner of a particular cryptocurrency wallet in the blockchain. It is anonymous, and actually has the ability to create an unlimited number of unique addresses to the wallet.

The existing methodology for the deanonymization of cryptocurrency transactions involves tracking the entire chain of their execution from the moment of the payment being studied to the intended exchange of cryptocurrency for "fiat money" through cryptocurrency exchanges, in an exchanger or ATM.

To collect data about crypto wallets and track their transactions, you can use regular blockchain observers:

• btc.com
• etherscan.io
• xrpcharts.ripple.com/#/graph
• explorer.bitcoin.com/bch
• litecoinblockexplorer.net
• steexp.com

And also universal browsers:

• blockchair.com
• tokenview.com
• blockchain.com
• bitaps.com
• live.blockcypher.com

The latter make it possible to conduct a more thorough analysis and study several cryptocurrencies in one service. Browsers store the following information about completed transactions:

1. date and time of the transaction
2. sender and recipient cryptocurrency wallet addresses
3. amount of transferred cryptocurrency
4. transaction fee and hash (which serves as proof of the transaction and is used to verify it)

The disadvantages of such browsers include: the lack of built-in systems for visual representation and analysis of transactions, the impossibility of placing a cryptocurrency wallet under control (tracking), as well as the impossibility of automatically assigning the studied cryptocurrency wallets to known entities (persons, projects, exchanges, mixers, etc.).

In part, these disadvantages can be leveled through the use of free software. So the visual presentation of cryptocurrency transactions can be organized using the services:

• sicp.ueba.su
• graphsense.info
• blockpath.com
• c-hound.ai
• oxt.me
• repository github.com/s0md3v/Orbit

The Maltego software package used in our company is also suitable for such studies. Tracking the activity of crypto wallets is possible using solutions such as: cryptocurrencyalerting.com/wallet-watch.html or cryptotxalert.com.

Now that we know how to decompose transactions in a virtual environment, it is necessary to move on to studying the issue of attributing each specific crypto wallet to known entities.

The first thing that comes to mind here is the use of regular Google search capabilities. Proof of ownership of a cryptocurrency wallet may be the indication of the address of the cryptocurrency wallet as a payment system on a website, social network, messenger, blog or forum. Such data can be found by Google search engines.

Of particular interest is the use of Google Dorks.

For example, the search query [wallet_address -block] allows you to clean up the issue by excluding most blockchain browsers from it.

The request [site: bitcointalk.org wallet_address] allows you to search for information about the crypto wallet on the selected site.

The query [site: https: //docs.google.com/spreadsheets Bounty intext: "@ gmail.com"] allows you to find lists of identified crypto wallets used in the Bug Bounty programs.

The use of search engines allows us to detect a bunch of cryptocurrency wallet addresses with other identifiers that may be useful for us to identify its user.

These identifiers include:

• name or nickname
• E-mail address
• phone number
• user ID in a social network or messenger
• the photo
• Website address
• other digital assets, etc.

Search for matches by name is possible in the go.mail.ru/search_social service, by nickname in: t.me/maigret_osint_bot or whatsmyname.app.

User's photo can be identified by following the links:

• findclone.ru
• search4faces.com

Identification of contacts of site owners and domain names is possible when using sites such as:

• domainbigdata.com
• phonebook.cz
• mailshunt.com
• hunter.io

WHOIS data, incl. archived, available on the resources:

• whois.domaintools.com
• drs.whoisxmlapi.com/whois-history

Analysis of advertising identifiers - using the services:

• spiderfoot.net
• themarkup.org/blacklight
• urlscan.io
• spyonweb.com
• dnslytics.com/reverse-analytics

The mobile phone number and email address of the owner of the cryptoasset can be identified using the services TelPoisk, Infosphere, NEO, Prima Inform, IDX, Spectrum Data and a number of others.

Further information on crypto wallets should be searched on "otzoviks".

They are interesting in that they aggregate data on the use of wallets in illegal activities. These services include:

• bitcoinabuse.com
• bitcoinwhoswho.com
• checkbitcoinaddress.com
• cryptscam.com
• scam-alert.io

In part, the bitrankverified.com service, which allows us to conduct a scoring assessment of a crypto wallet, can also be referred to as "otzoviks".

And attributing a crypto wallet to an exchange, exchanger or other entity can be verified using resources such as:

• walletexplorer.com
• bitinfocharts.com
• oxt.me

In the end, it should be noted that the detection of exchanges and exchangers in the transaction chains is extremely important, since within the framework of the KYC / AML procedure (in Russia AML / CFT), crypto exchanges have undertaken to identify their users and transfer information about them at a motivated request from law enforcement agencies or court.