[Note: opinions expressed below are solely my own and do not represent the views of my employer or any company I advise.]

Last April, May and August I wrote three posts that attempted to look at the flow of funds: where bitcoins move to throughout the ecosystem.

Thanks to the team at Chainalysis we can now have a more granular view into specific  transfer corridors and movements (not necessarily holdings) between miners, exchanges, darknet markets, payment processors and coin mixers.

The first three charts are backwards looking.

Above is a simplified, color coded version of a tool that Chainalysis provides to its customers such as compliance teams at exchanges.  The thickness of a band accurately represents the volume of that corridor, it is drawn to scale.

What is the method used to generate the plot?

The chord-plot shows all bitcoin transactions in 2015 traced down all the way back to a known entity. This means that the connection between the entities can be any number of hops away.

So for instance, for the exchanges it will include direct arbitrage, but also the modus operandi for bitcoin: individuals buying bitcoins at an exchange and then doing peer-to-peer transfers.  Again this can be any number of hops and then perhaps later end at an exchange again where someone is cashing out.

According to Chainalysis, by hiding all the intermediate steps we can begin to learn how most of the Bitcoin ecosystem is put together (e.g., can it be split into sub systems?, is there a dark and a lit economy?, and what is bitcoin actually used for?).

Legend:

• Blue: virtual currency exchanges
• Red: darknet markets
• Pink: coin mixers
• Green: mining pools
• Yellow: payment processors

Altogether there are 14 major exchanges tracked in blue including (in alphabetical order): Bitfinex, Bitreserve (now Uphold), Bitstamp, BitVC (subsidiary of Huobi), BTCC (formerly BTC China), BTC-e, Circle, Coinbase (most), Huobi, itBit, Kraken, LocalBitcoins, OKCoin and Xapo.

The identity of 12 exchanges were removed with the exception of BTC-e and LocalBitcoins.

• BTC-e was founded in July 2011 and is one of the oldest operating exchanges still around.  It does not require users to provide KYC documentation nor has it implemented AML processes.  This has made it an attractive exchange for those wanting to remain anonymous.

• LocalBitcoins was founded in June 2012 and is a combination of Craigslist and Uber for bitcoin transfers.  It enables users to post trade requests on its site and provides escrow and reputation services for the facilitation of those trades.  Like BTC-e, it does not require users to provide KYC documentation nor has it implemented AML processes.  As a result it is a popular service for those wanting to trade bitcoins anonymously.

SharedCoin (depicted in pink above) is a product / service from Blockchain.info that allows users to mix their coins together with other users.  It is one of about a dozen services that attempt to — depending who you talk to — delink the history or provenance of a bitcoin.

Founded in the spring of 2013, Agora (depicted in red above) was the largest known darknet market operating in 2015.

Forward Tracing

For each of the entities labeled on the charts below there is a ‘send to self’ characteristic which in fact are the UTXOs that originate from that entity and ends in unspent funds without first hitting another service.  So it can be both cold storage owned by the service or someone hoarding (“hodling”) coins using that service.

Interestingly enough, the deposits held at one VC-backed intermediary almost all stay cold.

Above is LocalBitcoins.

Above is BTC-e.

Above is SharedCoin.

Questions and Answers

I also spoke with the Chainalysis team about how their clustering algorithm worked.

Q: What about all the transactions that did not go between central parties and intermediaries?  For instance, if I used my wallet and sent you some bitcoins to your wallet, how much is that in terms of total activity?

A: The analysis above is intended to isolate sub-economies, not to see who is directly trading with who. The Chainalysis team previously did a Chord of that roughly a year ago which shows the all-time history (so early days will be overrepresented) and it was based only on one hop away transactions and normalized to what the team can ascribe to a known service.

The new chord above is different as it continues searching backwards until it locates an identified entity – this means it could have passed through an other either unidentified or less perfectly described service – but as it is same for everything and we have the law of large numbers it will still give a pretty accurate picture of what subeconomies exist.  It was made to identify if the Bitcoin network had a dark economy and a lit economy (e.g. if the same coins were moving in circles e.g. dark-market->btc-e->localbitcoin->dark-market and what amount of that loop would include the regulated markets too).

So, for example, the transfers going between the regulated exchanges, many will be multihop transfers, but they start and end in regulated exchanges and as such could be described as being part of the lit economy.

Q: What specific exchange activity can you actually identify?

A: It varies per service but Chainalysis (and others) have access to some “full wallets” from clients.  Also newer deposits are often not known so the balance in a wallet will be underestimated due to how the current algorithms work.

Further, some services require special attention and special analytics to be well represented due to their way of transacting – this includes some of the regional dark markets and Coinbase (due to how the company splits and pools deposits, see below).  By looking at all the known entities and how many addresses they contain as a percentage of all addresses ever used for bitcoin in all time, Chainalysis has significant coverage and these are responsible for more than half of all transactions ever happened.

Q: And what was the motivation behind building this?

A: The initial purpose of the plot was to identify subsystems and pain points in the ecosystem – the team was at first uncertain of the possibility that every Bitcoin user simply bought bitcoins from exchanges to buy drugs but that does not seem to be the case.  Most drug buyers use LocalBitcoins and sellers cash-in via mixers on LocalBitcoins or BTC-e (for the larger amounts).

Q: How large is SharedCoin and other mixers?

A: SharedCoin is currently around 8 million addresses and Bitcoin Fog is 200,000 addresses; they are the two largest.1

Additional analysis

Based on the charts above, what observations can be seen?

• With a forward tracing graph we can see where all the unspent bitcoins come from (or are stored).  One observation is that intermediaries, in this case exchanges, are holding on to large quantities of deposits.  That is to say that many users (likely traders) — despite the quantifiable known risks of trusting exchanges — still prefer to store bitcoins on virtual currency exchanges.  Or to look at it another way: exchanges end up with many stagnant bitcoins and what this likely means is that users are buying lots of bitcoins from that exchange and not moving them and/or the exchange itself is holding a lot of bitcoins (perhaps collected via transaction fees or forfeited accounts).2

• A lot of the activity between exchanges (as depicted in blue lines) is probably based on arbitrage.  Arbitrage means if Exchange A is selling bitcoins for a higher price than Exchange B, Alice will buy bitcoins on Exchange B and transfer them to Exchange A where they are sold for a profit.
• Despite the amount of purported wash trading and internal bot trading that several Chinese exchanges are believed to operate, there is still a lot of on-chain flows into and out of Chinese-based exchanges, most likely due to arbitrage.
• An unknown amount of users are using bitcoin for peer-to-peer transactions.  This may sound like a truism (after all, that’s what the whitepaper pitches in its title), but what this looks like above is that people go to exchanges to transfer fiat currencies for virtual currencies.  Then users, using the P2P mechanic of bitcoin (or other virtual currencies), transfer their coins to someone else.  We can see this by counting hops between the exchanges.

A potential caveat

Because of how certain architectures obfuscate transactions — such as Coinbase and others — it can be difficult for accurate external data analysis.  However with their latest clustering algorithm, Chainalysis’s coverage of Coinbase now extends to roughly the same size of the size of Mt. Gox at its height.3

Why can this be a challenge?  Coinbase’s current design can make it difficult for many data analytics efforts to clearly distinguish bitcoins moving between addresses.  For instance, when Bob deposits bitcoins into one Coinbase address he can withdraw the deposit from that same address up to a limit.  After about two bitcoins are withdrawn, Bob then automatically begins to draw out of a central depository pool making it harder to look at the flow granularly.

Other secondary information also makes it unclear how much activity takes place internally.  For instance, in a recent interview with Wired magazine, Coinbase provided the following information:

According to Coinbase, the Silicon Valley startup that operates digital bitcoin wallets for over 2.8 million people across the globe, about 20 percent of the transactions on its network involve payments or other tasks where bitcoin is used as a currency. The other 80 percent of those transactions are mere speculation, where bitcoin is traded as a commodity in search of a profit.

In a subsequent interview with New York Business Journal, Coinbase stated that it “has served 2.9 million people with $3 billion worth of bitcoin transactions.”

It is unclear at this time if all of those transactions are just an aggregation of trades taking place via the custodial wallet or if it also includes the spot exchange it launched last January.

Future research

Publishing cumulative bitcoin balances and the number of addresses for different entities such as exchanges could help compliance teams and researchers better understand the flows between specific exchanges.  For instance, a chart that shows what percentage of the 15 million existing bitcoins everyone holds at a given moment over different time intervals.

This leads to the second area: rebittance, a portmanteau of remittance and bitcoin.  Last year it was supposed to be the “killer app” for cryptocurrencies but has failed to materialize due in part, to some of the reasons outlined by Save on Send.4 Further research could help identify how much of the flows between exchanges and the peer-to-peer economy is related to cross-border value transfer as it relates to rebittance activity.

And as the market for data analysis grows in this market — which now includes multiple competitors including Coinalytics, Blockseer, Elliptic and Scorechain — it may be worth revisiting other topics that we have looked at before including payment processors, long-chains and darknet markets and see how their clustering algorithms and coverage are comparable.

Conclusions

For compliance teams it appears that the continued flow between illicit corridors (darknet markets) is largely contingent on liquidity from two specific exchanges: BTC-e and LocalBitcoins.  In addition, coin mixing is still a popular activity: from this general birds-eye view it appears as if half of the known mixing is directly related to darknet market activity and the motivation behind the other half is unknown.

Based on the information above other economic activity is still dwarfed by arbitrage and peer-to-peer transactions. And lastly, based on current estimates it appears that several million bitcoins are being stored on the intermediaries above.

[Note: special thanks to Michael Gronager and the Chainalysis team for their assistance and feedback on this post.]

1. There are many regional smaller projects in, for example, smaller European countries whose flows may be underrepresented as they are less known in part because they do not use commonly used languages. However most are likely a part of the long tail of coin distribution. [↩]
2. There is a spectrum of intermediaries in which bitcoins are stagnant (or active).  For instance, in an interview last May, Wences Casares, founder and CEO of Xapo stated:

   Still, Casares indicated that Xapo’s customers are most often using its accounts primarily for storage and security. He noted that many of its clientele have “never made a bitcoin payment”, meaning its holdings are primarily long-term bets of high net-worth customers and family offices.

   “Ninety-six percent of the coins that we hold in custody are in the hands of people who are keeping those coins as an investment,” Casares continued. [↩]

3. See also The missing MtGox bitcoins from WizSec [↩]
4. There are notable exceptions that have gained regional traction including: BitX, Coins.ph and Align Commerce. [↩]