{"schema_version":"0.1","map_id":"paper-49-map","publication_id":49,"publication_anchor":"paper-49","slug":"paper-49","canonical_path":"/knowledge/papers/paper-49/","machine_path":"/knowledge/papers/paper-49.json","root_node_id":"paper-49","stage":"mapped_draft","contribution_type_vocabulary_version":"0.1","contribution_types":["algorithm"],"title":"Longitudinal Analysis of Misuse of Bitcoin","year":2019,"status":"Published","venue":"17th International Conference on Applied Cryptography and Network Security (ACNS)","topic":"secure-systems-networks","labels":["Applied"],"authors":["Karim Eldefrawy","Ashish Gehani","Alexandre Matton"],"keywords":["Bitcoin","dark web","longitudinal measurement","CoinJoin detection","transaction graph","cryptocurrency misuse"],"research_question":"What quantitative patterns distinguish Bitcoin addresses observed on the dark web from the broader blockchain over time, and can CoinJoin transactions be detected well enough to avoid treating mixer-induced links as ordinary counterparties?","central_answer":"The study joins the Bitcoin blockchain through May 2018 with addresses harvested from dark-web pages in 2016–2017, filters and labels those addresses, and introduces a constrained subset-search heuristic for CoinJoin detection. It reports declining dark-web address visibility, much higher activity and mixing among dark-web addresses, and concentration of associated value, while explicitly warning that crawl coverage, inherited labels, and heuristic errors preclude causal or exhaustive claims.","curation":{"drafted_at":"2026-07-11","drafted_by":[{"actor_type":"ai","name":"OpenAI Codex","role":"full-text data/method extraction and initial assessment"}],"method":"Source-grounded review of the complete checked-in paper, including visual inspection of title, dataset, algorithm, and results pages. Data provenance, algorithm steps, quantitative findings, and stated limitations were read; code, datasets, and calculations were not independently rerun.","source_scope":"full_source_audit","approval":{"status":"pending","note":"AI-authored source map awaiting full author audit. Statistical interpretations, counts, and ratings remain provisional."}},"sources":[{"id":"source-paper-49-author-pdf","type":"author_hosted_copy","title":"Longitudinal Analysis of Misuse of Bitcoin","url":"/pubs/2019/btc_acns2019.pdf","provenance_category":"author","media_type":"application/pdf","sha256":"da730c6a2804ed673c22f8dc7052837cfd87c3db19b378583b24eb88c8b5bd1f","page_count":20},{"id":"source-paper-49-official","type":"official_publication_record","title":"ACNS 2019 publication record","url":"https://doi.org/10.1007/978-3-030-21568-2_13","provenance_category":"official"},{"id":"source-paper-49-citations","type":"citation_index_snapshot","title":"OpenAlex work W2947572383","url":"https://openalex.org/W2947572383","accessed_at":"2026-07-11"}],"source_anchors":[{"id":"anchor-paper-49-problem","source_id":"source-paper-49-author-pdf","label":"Research objective, data scale, contributions, and headline findings","locator":"Abstract and Sections 1-1.3, PDF pages 1-4","url":"/pubs/2019/btc_acns2019.pdf#page=1"},{"id":"anchor-paper-49-limitations","source_id":"source-paper-49-author-pdf","label":"Coverage, labeling, ground-truth, and heuristic limitations","locator":"Section 1.4, PDF page 4","url":"/pubs/2019/btc_acns2019.pdf#page=4"},{"id":"anchor-paper-49-bitcoin","source_id":"source-paper-49-author-pdf","label":"Bitcoin address validation and CoinJoin mechanics","locator":"Section 2, PDF pages 4-6","url":"/pubs/2019/btc_acns2019.pdf#page=4"},{"id":"anchor-paper-49-blockchain","source_id":"source-paper-49-author-pdf","label":"Blockchain time range, counts, and cross-check","locator":"Section 3.1, PDF pages 6-7","url":"/pubs/2019/btc_acns2019.pdf#page=6"},{"id":"anchor-paper-49-darkweb","source_id":"source-paper-49-author-pdf","label":"IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset","locator":"Section 3.2, PDF pages 7-9","url":"/pubs/2019/btc_acns2019.pdf#page=7"},{"id":"anchor-paper-49-dark-results","source_id":"source-paper-49-author-pdf","label":"Dark-web address time series, active/malicious subsets, and takedown observations","locator":"Section 3.3, PDF pages 9-10","url":"/pubs/2019/btc_acns2019.pdf#page=9"},{"id":"anchor-paper-49-heuristic","source_id":"source-paper-49-author-pdf","label":"CoinJoin conditions, constrained subset search, fee bounds, and pseudocode","locator":"Sections 4-4.1 and Algorithm 1, PDF pages 10-14","url":"/pubs/2019/btc_acns2019.pdf#page=10"},{"id":"anchor-paper-49-mixing-results","source_id":"source-paper-49-author-pdf","label":"Heuristic runtime, approximation boundary, and CoinJoin prevalence","locator":"Section 4.2, PDF page 14","url":"/pubs/2019/btc_acns2019.pdf#page=14"},{"id":"anchor-paper-49-neighborhood","source_id":"source-paper-49-author-pdf","label":"Transaction-graph construction and whole-chain statistics","locator":"Section 5.1 and Tables 3-4, PDF pages 14-16","url":"/pubs/2019/btc_acns2019.pdf#page=14"},{"id":"anchor-paper-49-comparison","source_id":"source-paper-49-author-pdf","label":"Dark-web neighborhood comparison and interpretation cautions","locator":"Section 5.2 and Tables 5-8, PDF pages 16-18","url":"/pubs/2019/btc_acns2019.pdf#page=16"},{"id":"anchor-paper-49-future","source_id":"source-paper-49-author-pdf","label":"Future cross-chain, attribution, and synchronization analyses","locator":"Section 6, PDF pages 18-19","url":"/pubs/2019/btc_acns2019.pdf#page=18"},{"id":"anchor-paper-49-publication","source_id":"source-paper-49-official","label":"Official peer-reviewed publication identity","locator":"ACNS 2019, DOI 10.1007/978-3-030-21568-2_13","url":"https://doi.org/10.1007/978-3-030-21568-2_13"},{"id":"anchor-paper-49-reception","source_id":"source-paper-49-citations","label":"Dated citation-count snapshot","locator":"OpenAlex reported 8 citing works on 2026-07-11","url":"https://openalex.org/W2947572383"}],"nodes":[{"id":"paper-49","kind":"paper","parent_id":null,"order":1,"epistemic_status":"published_empirical_study","title":"Longitudinal Bitcoin misuse analysis","summary":"A blockchain/dark-web measurement study with a new CoinJoin heuristic and explicit caveats about observation, labels, and missing ground truth.","source_anchor_ids":["anchor-paper-49-problem"]},{"id":"paper-49-question","kind":"question","parent_id":"paper-49","order":1,"epistemic_status":"research_question","title":"Research question","summary":"How prevalent and behaviorally distinctive is suspicious Bitcoin activity visible on dark-web pages, after accounting for mixer-generated transaction graph noise?","source_anchor_ids":["anchor-paper-49-problem"]},{"id":"paper-49-answer","kind":"contribution","parent_id":"paper-49","order":2,"epistemic_status":"empirically_supported","title":"Central answer","summary":"Observed dark-web addresses are more active, more connected, and more likely to mix than random blockchain addresses, but the sample measures public crawl visibility rather than all misuse.","source_anchor_ids":["anchor-paper-49-dark-results","anchor-paper-49-mixing-results","anchor-paper-49-comparison"]},{"id":"paper-49-data","kind":"dataset_group","parent_id":"paper-49","order":3,"epistemic_status":"constructed_from_public_and_prior_data","title":"Joined longitudinal datasets","summary":"The analysis combines a nearly complete public blockchain window with candidate addresses extracted from an independently collected and labeled dark-web crawl.","source_anchor_ids":["anchor-paper-49-blockchain","anchor-paper-49-darkweb"]},{"id":"paper-49-data-chain","kind":"dataset","parent_id":"paper-49-data","order":1,"epistemic_status":"public_ledger_observation","title":"Bitcoin blockchain through May 2018","summary":"The study analyzes 397,301,155 unique active addresses and 316,386,663 transactions from genesis through May 2018, cross-checking aggregate counts against Blockchain.info.","source_anchor_ids":["anchor-paper-49-blockchain"]},{"id":"paper-49-data-dark","kind":"dataset","parent_id":"paper-49-data","order":2,"epistemic_status":"sampled_and_inherited_labels","title":"Dark-web address corpus","summary":"OnionCrawler ran twice daily from June 2016 to December 2017; checksum filtering reduces about 2.3 million candidates to 2,093,568 valid addresses, of which 47,697 carry selected suspicious/malicious tags.","source_anchor_ids":["anchor-paper-49-darkweb","anchor-paper-49-dark-results"]},{"id":"paper-49-measurement-model","kind":"scope","parent_id":"paper-49","order":4,"epistemic_status":"observational","title":"What is measured","summary":"An address inherits an onion page's labels, and activity is inferred from public transactions. This establishes associations and behaviors, not wallet ownership, intent, legal status, or causal effects.","source_anchor_ids":["anchor-paper-49-darkweb","anchor-paper-49-limitations"]},{"id":"paper-49-algorithm","kind":"algorithm","parent_id":"paper-49","order":5,"epistemic_status":"specified_and_executed","title":"CoinJoin identification heuristic","summary":"The algorithm detects repeated equal-valued outputs, checks participant/input consistency, then uses a fee-bounded depth-first subset search to assign inputs to participant outputs.","source_anchor_ids":["anchor-paper-49-heuristic"]},{"id":"paper-49-algorithm-bound","kind":"algorithmic_limit","parent_id":"paper-49-algorithm","order":1,"epistemic_status":"explicit_approximation","title":"NP-hard search and large-input shortcut","summary":"Subset allocation is NP-hard; transactions with over 17 inputs that pass the first filters are labeled CoinJoin without exhaustive search, creating an explicit false-positive/false-negative boundary.","source_anchor_ids":["anchor-paper-49-heuristic","anchor-paper-49-mixing-results"]},{"id":"paper-49-graph","kind":"method","parent_id":"paper-49","order":6,"epistemic_status":"specified","title":"Neighborhood analysis","summary":"Addresses are vertices and sender/receiver co-occurrence creates undirected edges; inferred CoinJoins are excluded from selected neighborhood calculations because mixer participants are not ordinary counterparties.","source_anchor_ids":["anchor-paper-49-neighborhood"]},{"id":"paper-49-claims","kind":"claim_group","parent_id":"paper-49","order":7,"epistemic_status":"descriptive_empirical","title":"Main quantitative findings","summary":"Findings describe the sampled windows and classification rules; they are not estimates of all illicit cryptocurrency use.","source_anchor_ids":["anchor-paper-49-problem","anchor-paper-49-dark-results","anchor-paper-49-comparison"]},{"id":"paper-49-claim-trend","kind":"claim","parent_id":"paper-49-claims","order":1,"epistemic_status":"observed_association","title":"Decline aligned with market takedowns","summary":"Monthly addresses seen on the dark web decline over the sample and show drops during known market-takedown periods; the paper does not claim the takedowns are the sole cause.","source_anchor_ids":["anchor-paper-49-dark-results"]},{"id":"paper-49-claim-mixing","kind":"claim","parent_id":"paper-49-claims","order":2,"epistemic_status":"heuristic_supported","title":"Higher observed CoinJoin participation","summary":"The heuristic marks 0.4% of all addresses but 2.3% of dark-web addresses as CoinJoin participants, approximately a fivefold difference.","source_anchor_ids":["anchor-paper-49-mixing-results"]},{"id":"paper-49-claim-activity","kind":"claim","parent_id":"paper-49-claims","order":3,"epistemic_status":"dataset_supported","title":"Higher connectivity and transaction volume","summary":"Dark-web addresses have much higher neighbor and activity distributions than the full chain, although public visibility and service/exchange addresses can strongly bias that comparison.","source_anchor_ids":["anchor-paper-49-comparison"]},{"id":"paper-49-claim-concentration","kind":"claim","parent_id":"paper-49-claims","order":4,"epistemic_status":"dataset_supported","title":"Concentrated associated value","summary":"Within the dark-web-associated set, 2,828 addresses account for 99% of held bitcoin; this does not mean those addresses are controlled by dark-web operators.","source_anchor_ids":["anchor-paper-49-dark-results","anchor-paper-49-comparison"]},{"id":"paper-49-evidence","kind":"evidence_group","parent_id":"paper-49","order":8,"epistemic_status":"large_scale_observational","title":"Evidence stack","summary":"Public-ledger data, twice-daily dark-web crawling, inherited and partially manually verified labels, address checksums, a specified heuristic, transaction graphs, descriptive statistics, and temporal comparisons support the findings.","source_anchor_ids":["anchor-paper-49-blockchain","anchor-paper-49-darkweb","anchor-paper-49-heuristic","anchor-paper-49-comparison"]},{"id":"paper-49-boundaries","kind":"limitation_group","parent_id":"paper-49","order":9,"epistemic_status":"explicit","title":"Validity limits","summary":"Crawl coverage is incomplete; labels come from prior page classification; address visibility favors popular services; ownership and ground truth are missing; mixer detection is heuristic; privacy coins and activity after the windows are outside scope.","source_anchor_ids":["anchor-paper-49-limitations","anchor-paper-49-comparison","anchor-paper-49-future"]},{"id":"paper-49-artifacts","kind":"artifact_group","parent_id":"paper-49","order":10,"epistemic_status":"partial","title":"Reproducibility resources","summary":"The paper provides pseudocode, date ranges, counts, tag lists, and methodology. This audit did not locate public code, the derived address/tag corpus, query outputs, or a fixed analysis environment.","source_anchor_ids":["anchor-paper-49-darkweb","anchor-paper-49-heuristic"]},{"id":"paper-49-scrutiny","kind":"scrutiny","parent_id":"paper-49","order":11,"epistemic_status":"venue_reviewed_and_irb_upstream","title":"External scrutiny","summary":"ACNS publication establishes venue review; the upstream crawl received SRI IRB approval. Neither is equivalent to independent statistical reproduction or label validation.","source_anchor_ids":["anchor-paper-49-darkweb","anchor-paper-49-publication"]},{"id":"paper-49-lineage","kind":"lineage","parent_id":"paper-49","order":12,"epistemic_status":"open_directions","title":"Follow-on analysis directions","summary":"The paper proposes extending the design across other cryptocurrencies, entity/geographic attribution sources, and synchronized cross-chain activity.","source_anchor_ids":["anchor-paper-49-future"]}],"relations":[{"id":"paper-49-relation-answer-question","type":"addresses","from_id":"paper-49-answer","to_id":"paper-49-question"},{"id":"paper-49-relation-chain-data","type":"component_of","from_id":"paper-49-data-chain","to_id":"paper-49-data"},{"id":"paper-49-relation-dark-data","type":"component_of","from_id":"paper-49-data-dark","to_id":"paper-49-data"},{"id":"paper-49-relation-data-claims","type":"supports","from_id":"paper-49-data","to_id":"paper-49-claims"},{"id":"paper-49-relation-algorithm-mixing","type":"supports","from_id":"paper-49-algorithm","to_id":"paper-49-claim-mixing"},{"id":"paper-49-relation-algorithm-graph","type":"filters","from_id":"paper-49-algorithm","to_id":"paper-49-graph"},{"id":"paper-49-relation-model-claims","type":"qualifies","from_id":"paper-49-measurement-model","to_id":"paper-49-claims"},{"id":"paper-49-relation-evidence-claims","type":"supports","from_id":"paper-49-evidence","to_id":"paper-49-claims"},{"id":"paper-49-relation-boundaries-claims","type":"limits","from_id":"paper-49-boundaries","to_id":"paper-49-claims"},{"id":"paper-49-relation-lineage-paper","type":"contextualizes","from_id":"paper-49-lineage","to_id":"paper-49"}],"assessment":{"id":"paper-49-assessment-2026-07-11","rubric_version":"0.2","assessed_at":"2026-07-11","status":"ai_draft_author_review_pending","note":"These dimensions describe documented support and process, not truth, correctness, or a universal ranking. No composite score is calculated.","axes":[{"id":"epistemic_evidence","level":"high","rationale":"The paper analyzes hundreds of millions of ledger observations and millions of crawl candidates with documented collection, filtering, algorithm, statistics, and limitations; missing ground truth and heuristic error constrain interpretation.","basis_source_anchor_ids":["anchor-paper-49-blockchain","anchor-paper-49-darkweb","anchor-paper-49-heuristic","anchor-paper-49-limitations"]},{"id":"auditability","level":"high","rationale":"A complete checked-in paper with hash/page count, precise method/result anchors, and DOI is inspectable. The derived corpus, code, and raw analysis outputs are not available in this map.","basis_source_anchor_ids":["anchor-paper-49-problem","anchor-paper-49-publication"]},{"id":"production_provenance","level":"medium","rationale":"Authors, venue, funding, DOI, data windows, upstream IRB status, collection tool, and analysis procedures are documented; contributor roles, code revision, derived-data fixity, and run lineage are not.","basis_source_anchor_ids":["anchor-paper-49-darkweb","anchor-paper-49-publication"]},{"id":"external_scrutiny","level":"medium","rationale":"ACNS review and upstream IRB oversight provide external process checks, but public peer reports, artifact evaluation, and independent reproduction were not located.","basis_source_anchor_ids":["anchor-paper-49-darkweb","anchor-paper-49-publication"]},{"id":"reception","level":"low","rationale":"OpenAlex reported 8 citations on 2026-07-11; under the finalized rubric, 0 through 8 located citations is Low.","basis_source_anchor_ids":["anchor-paper-49-reception"]},{"id":"contribution_significance","level":"medium","rationale":"The work contributes a large longitudinal joined dataset analysis and independent CoinJoin heuristic, while missing ground truth and unavailable artifacts limit certainty and reuse.","basis_source_anchor_ids":["anchor-paper-49-problem","anchor-paper-49-limitations"]}]},"reception_snapshot":{"as_of":"2026-07-11","method":"OpenAlex DOI lookup","citation_count":8,"source_url":"https://openalex.org/W2947572383","signals":["OpenAlex reported 8 works citing the ACNS paper."],"limitation":"The count varies by index/date and does not indicate independent reproduction, data reuse, or validation of the CoinJoin classifier."}}