Scientific knowledge map · Paper #49
Longitudinal Analysis of Misuse of Bitcoin
2019 · 17th International Conference on Applied Cryptography and Network Security (ACNS)
- Applied
- algorithm
Research question
What does the paper try to establish?
What quantitative patterns distinguish Bitcoin addresses observed on the dark web from the broader blockchain over time, and can CoinJoin transactions be detected well enough to avoid treating mixer-induced links as ordinary counterparties?
Central answer
What is the proposed answer?
The study joins the Bitcoin blockchain through May 2018 with addresses harvested from dark-web pages in 2016–2017, filters and labels those addresses, and introduces a constrained subset-search heuristic for CoinJoin detection. It reports declining dark-web address visibility, much higher activity and mixing among dark-web addresses, and concentration of associated value, while explicitly warning that crawl coverage, inherited labels, and heuristic errors preclude causal or exhaustive claims.
Full paper abstract
Abstract
We conducted a longitudinal study to analyze the misuse of Bitcoin. We first investigated usage characteristics of Bitcoin by analyzing how many addresses each address transacts with (from January 2009 to May 2018). To obtain a quantitative estimate of the malicious activity that Bitcoin is associated with, we collected over 2.3 million candidate Bitcoin addresses, harvested from the dark web between June 2016 and December 2017. The Bitcoin addresses found on the dark web were labeled with tags that classified the activities associated with the onions that these addresses were collected from. The tags covered a wide range of activities, from suspicious to outright malicious or illegal. Of these addresses, only 47,697 have tags we consider indicative of suspicious or malicious activities. We saw a clear decline in the monthly number of Bitcoin addresses seen on the dark web in the periods coinciding with takedowns of known dark web markets. We also found interesting behavior that distinguishes the Bitcoin addresses collected from the dark web when compared to activity of a random address on the Bitcoin blockchain. For example, we found that Bitcoin addresses used on the dark web are more likely to be involved in mixing transactions. To identify mixing transactions, we developed a new heuristic that extends previously known ones. We found that Bitcoin addresses found on the dark web are significantly more active, they engage in transactions with 20 times the neighbors and 4 times the Bitcoin amounts when compared to random addresses. We also found that just 2,828 Bitcoin addresses are responsible for 99% of the Bitcoin value used on the dark web.
Provenance: Transcribed from the checked-in full-text PDF; only typography, paragraph joining, discretionary hyphenation, and line-break artifacts were normalized.
Evidence profile
Six dimensions, kept separate
The chart summarizes documented evidence and process. It is not a correctness probability, confidence score, or ranking, and no composite score is calculated.
LowMediumHighN/A = not assessed
A smaller value means less documented support for that dimension, not that the paper is false or unimportant.
- Epistemic evidence High
-
The paper analyzes hundreds of millions of ledger observations and millions of crawl candidates with documented collection, filtering, algorithm, statistics, and limitations; missing ground truth and heuristic error constrain interpretation.
Blockchain time range, counts, and cross-check IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset CoinJoin conditions, constrained subset search, fee bounds, and pseudocode Coverage, labeling, ground-truth, and heuristic limitations - Auditability High
-
A complete checked-in paper with hash/page count, precise method/result anchors, and DOI is inspectable. The derived corpus, code, and raw analysis outputs are not available in this map.
Research objective, data scale, contributions, and headline findings Official peer-reviewed publication identity - Production provenance Medium
-
Authors, venue, funding, DOI, data windows, upstream IRB status, collection tool, and analysis procedures are documented; contributor roles, code revision, derived-data fixity, and run lineage are not.
IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset Official peer-reviewed publication identity - External scrutiny Medium
-
ACNS review and upstream IRB oversight provide external process checks, but public peer reports, artifact evaluation, and independent reproduction were not located.
IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset Official peer-reviewed publication identity - Reception Low
-
OpenAlex reported 8 citations on 2026-07-11; under the finalized rubric, 0 through 8 located citations is Low.
Dated citation-count snapshot - Contribution significance Medium
-
The work contributes a large longitudinal joined dataset analysis and independent CoinJoin heuristic, while missing ground truth and unavailable artifacts limit certainty and reuse.
Research objective, data scale, contributions, and headline findings Coverage, labeling, ground-truth, and heuristic limitations
Assessment: Ai draft author review pending · 2026-07-11 · rubric 0.2. These dimensions describe documented support and process, not truth, correctness, or a universal ranking. No composite score is calculated.
Top-down and bottom-up view
Hierarchical knowledge map
Collapse a branch for a top-level reading, or follow its source links and child nodes to audit the evidence and boundaries underneath it.
Longitudinal Bitcoin misuse analysis
A blockchain/dark-web measurement study with a new CoinJoin heuristic and explicit caveats about observation, labels, and missing ground truth.
Research objective, data scale, contributions, and headline findings-
question Research question
research questionHow prevalent and behaviorally distinctive is suspicious Bitcoin activity visible on dark-web pages, after accounting for mixer-generated transaction graph noise?
Research objective, data scale, contributions, and headline findings -
contribution Central answer
empirically supportedObserved dark-web addresses are more active, more connected, and more likely to mix than random blockchain addresses, but the sample measures public crawl visibility rather than all misuse.
Dark-web address time series, active/malicious subsets, and takedown observations Heuristic runtime, approximation boundary, and CoinJoin prevalence Dark-web neighborhood comparison and interpretation cautions -
dataset group Joined longitudinal datasets constructed from public and prior data
The analysis combines a nearly complete public blockchain window with candidate addresses extracted from an independently collected and labeled dark-web crawl.
Blockchain time range, counts, and cross-check IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset-
dataset Bitcoin blockchain through May 2018
public ledger observationThe study analyzes 397,301,155 unique active addresses and 316,386,663 transactions from genesis through May 2018, cross-checking aggregate counts against Blockchain.info.
Blockchain time range, counts, and cross-check -
dataset Dark-web address corpus
sampled and inherited labelsOnionCrawler ran twice daily from June 2016 to December 2017; checksum filtering reduces about 2.3 million candidates to 2,093,568 valid addresses, of which 47,697 carry selected suspicious/malicious tags.
IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset Dark-web address time series, active/malicious subsets, and takedown observations
-
-
scope What is measured
observationalAn address inherits an onion page's labels, and activity is inferred from public transactions. This establishes associations and behaviors, not wallet ownership, intent, legal status, or causal effects.
IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset Coverage, labeling, ground-truth, and heuristic limitations -
algorithm CoinJoin identification heuristic specified and executed
The algorithm detects repeated equal-valued outputs, checks participant/input consistency, then uses a fee-bounded depth-first subset search to assign inputs to participant outputs.
CoinJoin conditions, constrained subset search, fee bounds, and pseudocode-
algorithmic limit NP-hard search and large-input shortcut
explicit approximationSubset allocation is NP-hard; transactions with over 17 inputs that pass the first filters are labeled CoinJoin without exhaustive search, creating an explicit false-positive/false-negative boundary.
CoinJoin conditions, constrained subset search, fee bounds, and pseudocode Heuristic runtime, approximation boundary, and CoinJoin prevalence
-
-
method Neighborhood analysis
specifiedAddresses are vertices and sender/receiver co-occurrence creates undirected edges; inferred CoinJoins are excluded from selected neighborhood calculations because mixer participants are not ordinary counterparties.
Transaction-graph construction and whole-chain statistics -
claim group Main quantitative findings descriptive empirical
Findings describe the sampled windows and classification rules; they are not estimates of all illicit cryptocurrency use.
Research objective, data scale, contributions, and headline findings Dark-web address time series, active/malicious subsets, and takedown observations Dark-web neighborhood comparison and interpretation cautions-
claim Decline aligned with market takedowns
observed associationMonthly addresses seen on the dark web decline over the sample and show drops during known market-takedown periods; the paper does not claim the takedowns are the sole cause.
Dark-web address time series, active/malicious subsets, and takedown observations -
claim Higher observed CoinJoin participation
heuristic supportedThe heuristic marks 0.4% of all addresses but 2.3% of dark-web addresses as CoinJoin participants, approximately a fivefold difference.
Heuristic runtime, approximation boundary, and CoinJoin prevalence -
claim Higher connectivity and transaction volume
dataset supportedDark-web addresses have much higher neighbor and activity distributions than the full chain, although public visibility and service/exchange addresses can strongly bias that comparison.
Dark-web neighborhood comparison and interpretation cautions -
claim Concentrated associated value
dataset supportedWithin the dark-web-associated set, 2,828 addresses account for 99% of held bitcoin; this does not mean those addresses are controlled by dark-web operators.
Dark-web address time series, active/malicious subsets, and takedown observations Dark-web neighborhood comparison and interpretation cautions
-
-
evidence group Evidence stack
large scale observationalPublic-ledger data, twice-daily dark-web crawling, inherited and partially manually verified labels, address checksums, a specified heuristic, transaction graphs, descriptive statistics, and temporal comparisons support the findings.
Blockchain time range, counts, and cross-check IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset CoinJoin conditions, constrained subset search, fee bounds, and pseudocode Dark-web neighborhood comparison and interpretation cautions -
limitation group Validity limits
explicitCrawl coverage is incomplete; labels come from prior page classification; address visibility favors popular services; ownership and ground truth are missing; mixer detection is heuristic; privacy coins and activity after the windows are outside scope.
Coverage, labeling, ground-truth, and heuristic limitations Dark-web neighborhood comparison and interpretation cautions Future cross-chain, attribution, and synchronization analyses -
artifact group Reproducibility resources
partialThe paper provides pseudocode, date ranges, counts, tag lists, and methodology. This audit did not locate public code, the derived address/tag corpus, query outputs, or a fixed analysis environment.
IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset CoinJoin conditions, constrained subset search, fee bounds, and pseudocode -
scrutiny External scrutiny
venue reviewed and irb upstreamACNS publication establishes venue review; the upstream crawl received SRI IRB approval. Neither is equivalent to independent statistical reproduction or label validation.
IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset Official peer-reviewed publication identity -
lineage Follow-on analysis directions
open directionsThe paper proposes extending the design across other cryptocurrencies, entity/geographic attribution sources, and synchronized cross-chain activity.
Future cross-chain, attribution, and synchronization analyses
Audit trail
Source index
Locators state the depth of the current audit. PDF page numbers, where present, are one-based file pages; metadata-, summary-, and abstract-bounded records explicitly identify their limitations.
- Research objective, data scale, contributions, and headline findings Abstract and Sections 1-1.3, PDF pages 1-4
- Coverage, labeling, ground-truth, and heuristic limitations Section 1.4, PDF page 4
- Bitcoin address validation and CoinJoin mechanics Section 2, PDF pages 4-6
- Blockchain time range, counts, and cross-check Section 3.1, PDF pages 6-7
- IRB-approved upstream crawl, OnionCrawler, labeling, checksum filtering, and dataset Section 3.2, PDF pages 7-9
- Dark-web address time series, active/malicious subsets, and takedown observations Section 3.3, PDF pages 9-10
- CoinJoin conditions, constrained subset search, fee bounds, and pseudocode Sections 4-4.1 and Algorithm 1, PDF pages 10-14
- Heuristic runtime, approximation boundary, and CoinJoin prevalence Section 4.2, PDF page 14
- Transaction-graph construction and whole-chain statistics Section 5.1 and Tables 3-4, PDF pages 14-16
- Dark-web neighborhood comparison and interpretation cautions Section 5.2 and Tables 5-8, PDF pages 16-18
- Future cross-chain, attribution, and synchronization analyses Section 6, PDF pages 18-19
- Official peer-reviewed publication identity ACNS 2019, DOI 10.1007/978-3-030-21568-2_13
- Dated citation-count snapshot OpenAlex reported 8 citing works on 2026-07-11