Analysis: Are 70 percent of Ethereum’s Transaction Value the Result of a Huge Mixer?

For some months the Ethereum network has processed more transactions than Bitcoin. However, a recent study discovers that 68 percent of the transaction’s value belongs to a huge mixer which obfuscates the origin of the ether. But the source could be more boring than supposed on first thought.

Actually Ethereum enjoys the nimbus of being the ‘white’ blockchain. While bitcoin has the bad reputation as the Dark Net’s currency of choice, ether usually is classified as the innocent currency of banks and geeks.

However, this standing has started to totter. Not only has the ICO hype demonstrated that Ethereum’s first ‘killer app’ is being a global platform for unregulated crowdfunding – a new analysis of Ethereum’s transaction graph has what it takes to disrupt the ‘nice guy’ image further. At least the authors of the analyses claim that in the center of Ethereum’s economic activity is – a mixer. And usually, mixers are not said to be a tool for those who have nothing to hide.

But before we take premature conclusions, let’s take a look at the analysis.

Throwaway Addresses at the Core of the Scheme

The Cyber Blog team analyzed all Ethereum transactions from Genesis Block to September 15, 2017. To do so, they clustered the addresses, which means that they searched for patterns which indicate that the addresses belong together. The concept is well known from Bitcoin, where sophisticated clustering algorithms have started to play a growing role in law enforcement’s investigations of Dark Net activities.

The clustering analysis of Ethereum’s blockchain resulted in a remarkable new finding; there is a class of “throwaway addresses.” These addresses received money, sent money shortly after and have never been used since then. “The temporary addresses constituted 46 percent of all active addresses and processed 65 percent of total transaction value during the analyzed period,” the authors write. Let that sink in. Nearly half of all addresses ever used in Ethereum. Nearly a third of all value that has ever been transferred with Ethereum.

However, these numbers sound more alarming than they are. The value of transactions is, as Vitalik Buterin pointed out in his answer to the article, confusing. “I think that ‘total quantity of ETH sent’ is a completely useless metric, because it is easily spoofable; if I were to send 400k ETH to myself in every block, then that would generate ~2b ETH moved per day, outshining whatever this ‘mixer’ is by a factor of 100, and I would probably be paying less than this thing in transaction fees to accomplish that. This is precisely the reason why the bitcoin community prefers talking about ‘coin days destroyed.’”

If you take another metric, the number of daily transactions, the role of the mixer gets more manageable. It accounts for ten percent of all transactions. One tenth is still a lot, but it has nearly no influence on the rapid growth of this number, which reached 300,000 to 500,000 in 2017. The mixer might be important, but not as important as the study presents it to be.

A Mixer between Exchanges

But let’s go back to what the investigation found out further. They research where the coins, which have been mixed, came from, and where they went. The result is this interesting illustration.

The major part of the input to the mixer comes from six exchanges. From their wallets, 31 million ether are sent into the mixing pattern. When they leave it, they go back to six exchanges. Between the exchanges, the coins are transacted 80 times, by which the mixer produced a transactional value of 2.5 billion ether. Between the exchanges and the core of the mixer is a shell, consisting of temporary and permanent addresses. The throwaway addresses in the core of the mixer receive amounts of around 500, 1,000, 2,000, 3,000, 5,000 or 10,000 ether.

Another graph illustrates how the share of the mixer’s transactions of all Ethereum transactions has grown over time.

It can be seen that the mixer simmered since mid-2015. After a test in late summer 2016, it became fully active in late 2016.

A deeper analysis of the observed addresses disclosed a certain pattern. The analysts divided the one-time addresses into six groups, depending on the value of the transaction they received; 500, 1,000, 2,000, 3,000, 5,000 or 10,000 ether.

“Take one set of addresses, e.g., addresses with incoming amounts of around 1000 ETH. After being active for some time, this set of addresses becomes inactive, and this is when another set steps in, e.g., that with 3000 incoming ETH per transaction. Thus, addresses ‘act’ as if orchestrated following one another over time which makes us think there is a certain system managing these activities. These addresses constitute the core of the scheme.”

‘Mixer’ Doesn’t Equate to Money Laundering

The Cyber Blog called their finding a ‘mixer,’ because obviously, this is what the throwaway addresses do; they mix ether and hide their origin so that it is hard to impossible to determine the trail of the money. The term mixer is usually used to describe activities relating to criminal money laundering. However, this is a dangerous prejudice. Cryptocurrencies like ether are very transparent and have insufficient privacy-preserving mechanisms. Increasing the privacy of coins is necessary, not just for criminals, but for everybody.

At least the analyst’s speculation is open-minded about the purpose of this huge mixing scheme they found. They had several guesses. First, it could be a cryptocurrency exchange mixing customer’s funds to make sure their clients get “clean money” which can’t be connected with criminal activities. Second, it might be possible that some entity wants to protect citizens of the US against unwanted contact with the regulators of their mother country. Third, the analysts speculate that some exchanges use this mixing scheme to transfer funds between them securely. And fourth it is possible that the analysts genuinely discovered a giant system of criminal money laundering with Ethereum.

An indicator for the last guess is that some of the addresses surrounding the mixer are connected to hacked coins, for example, this one. However, it might be inevitable that hacked coins end on exchanges at some point in time.

The Ethereum community voiced a fifth guess; the analysts, they claim, have found the wallets of Coinbase and GDAX. Interestingly in the list of exchanges, the analyst’s name Coinbase, the biggest exchange in the USA, as missing. This makes it plausible that it is simply the wallets of Coinbase rotating between the other exchanges.

So it is possible that the findings of Cyber Blog are less of a crime thriller than their blog suggests. It is also possible that the importance of the mixer for the economic activity on Ethereum is significantly smaller than the presented numbers pretend. However, the investigation is still exciting.