US government spooks have cracked ‘anonymous’ Bitcoin wallet Wasabi
For years, Bitcoin wallet Wasabi has led its users to believe its crypto mixing service was private and untraceable.
Turns out, blockchain analytics unit Chainalysis could de-anonymize Wasabi’s mixer with open source techniques.
In fact, revelations from journalist Laura Shin’s new book The Cryptopians, which tracks Ethereum’s early years, showed that Wasabi failed to follow the aptly named protocol ZeroLink.
ZeroLink requires “zero linking” of mixed and unmixed Bitcoin. Wasabi used a ZeroLink alternative called “peelchain.” The wallet was released in 2017.
As the name suggests, large transactions pushed through Wasabi are progressively “peeled” across successive transactions.
Experts have known about a flaw in peelchain-centric designs since July 2019. A member of Samourai described how he could trace 10 BTC ($389,000) through Wasabi’s mixing process.
According to Bitcoin developer LaurentMT, anyone interested in tracing Wasabi’s mixed coins could do so without advanced tools. Chainalysis simply used a public flaw in the Wasabi mixing service.
Bitcoin wallets are competing to provide the most privacy
Users deposit Bitcoin into the mixer and receive a random collection of other users’ cryptocurrency equal to their original deposit (minus a service fee).
However, Wasabi failed to properly randomize and segregate these Bitcoin. Wasabi’s mixing algorithm was partially deterministic, not truly random.
Worse, Wasabi commingled anonymized BTC with pre-mixed BTC. In all, Chainalysis was able to easily trace the source of certain users’ funds all the way through Wasabi’s mixer.
The New York-headquartered firm traced Bitcoin through Wasabi’s mixing service during its investigation into The DAO, which lost 3.6 million ETH to hackers in 2016 (worth $50 million then, $9.25 billion today).
The event ultimately resulted in a hard fork to return the stolen funds, which birthed Ethereum Classic.
Chainalysis found that The DAO hacker:
- sent stolen funds through Wasabi’s mixer,
- traded ETH for other cryptocurrencies like Bitcoin and GRIN,
- directed crypto through Bitcoin Lightning nodes and at least four exchanges.
A developer for Wasabi’s primary competitor, Samourai Wallet, said Wasabi “dropped the ball” by not implementing ZeroLink.
ZeroLink requires segregation of pre-link and post-link wallets and mixing through Chaumian CoinJoin, a technique named after famed cryptographer David Chaum.
A supposedly anonymous donation to the Tor Project from a Samourai-linked wallet in 2019 demonstrated ZeroLink’s ability to generate a more anonymous mixing service than Wasabi.
Samourai Wallet uses Whirlpool, a ZeroLink coinjoin implementation that it created. This protocol mixes transactions from five different participants during each mix to create 1,496 possible interpretations per mix.
Why Bitcoin mixing is important
Podcaster Laura Shin described how analysts can use de-anonymized data from Wasabi’s mixer for investigative journalism.
Shin traced 50 BTC ($1.9 million) related to The DAO hack to a Wasabi wallet. The Bitcoin was then swapped for a supposedly anonymity-focused token, GRIN.
The hacker also sent funds to four different exchanges. Shin alleges that The DAO hacker is Austrian-born Singaporean resident Toby Hoenisch.
Hoenisch was the chief exec of failed crypto payment platform TenX, which conducted an $80 million initial coin offering (ICO) in 2018. He denies Shin’s allegation.
In any case, some users of the Bitcoin network prefer to remain anonymous and transact with privacy.
Like any use of cash, some transactions are illegitimate but most are above board.
Private Bitcoin transactions are as legal as any other paper cash transaction where no one besides the two parties — not even the government — is aware of the transaction.
In contrast to paper cash, however, Bitcoin’s ledger records a permanent history of all transactions since 2009.
Therefore, anyone may trace the flow of funds between Bitcoin wallets used more than once.
Read more: [Bitcoin’s Lightning Network is now under surveillance by US government spooks]
Bitcoin mixing services attempt to solve this issue by allowing privacy-hungry users to obfuscate the source of their wealth from public view.
The real kicker is that Chainalysis has several contracts with US law enforcement agencies like the FBI, FinCEN, and ICE.
So, Chainalysis’ de-anonymization of Wasabi’s mixer could unearth evidence for future civil and criminal cases.
Follow us on Twitter for more informed news.
Out now: the first three episodes of our new investigative podcast series Innovated: Blockchain City.