Blockchain Analysis and Privacy Risk

Transcript

[Applause] [Music] good morning everybody um yeah so i didn't want to make a poor sales pitch so if i'm going to do some more controversial maybe a little bit provoking talk to to some companies maybe also to some of my follow-up speakers but first yeah i mean our company name is called 21 analytics which might sound a bit confusing because we're not doing analytics um we're not like elliptic or chain analysis or any of them um just as a first heads-up um so at first

i have here the definition of what blockchain analysis is taken from everybody's favorite trusted source wikipedia is the process of inspecting identifying clustering modeling and visually representing data on a blockchain but also most importantly connecting that data with real-world information so these companies that try to get data from outside of the blockchain and attach it to addresses and transactions and you can see an example here below it's not cipher trace it could be elliptic all of them have say broadly speaking same concept uh where you have an address here you

see uh the risk score this is from the twitter hack 2020 so the risk is very high if you accept coins from there you see the amount and everything and obviously that's a criminal as a bank you do not want or as a boss in general virtual asset service provider you don't want to want to take um transactions or accept um coins from this source but now the interesting this part is like the i mean all the blockchain data the address the balance everything that's everybody who runs a bitcoin node can check that himself that's public but where do we get the connection to the twitter hack to the risk score now in

this case of course it's it's fairly easy um the twitter hack was more or less i mean everybody saw where the coins are going but for other information where where do they got them from they get it partially from their customers because i just take chain analysis here as a as an example um but their their biggest customers um as you can see here coindesk is an article from 2020 they make a multi-million dollar deals with the us government so they're doing uh every year a lot of money with the agencies meaning the fbi

also the cia especially of course the tax authorities there are those are the the ones who are the number one customers of this companies when it comes to revenue when it comes to a number of customers now i cannot say which company that was it was not elliptic and just but another one where the c c level told me more than 90 percent of their customers are wasps meaning exchanges banks broker crypto companies but the majority of the revenue as i said before comes from the government so what does that mean for you as a wasp as a broker or as an exchange

are you their customer or are your their product like it is with facebook but just in this case you also pay so you're kind of both but you are the number one or maybe not the number one but you're a very important data source because every time you look up an address using elliptic or ch um using any of them shouldn't they call any names they are probably going to register that you as a company are interested in that address that might be because they are a customer of you of course there's no 100 percent guarantee link but this is um interesting information for them it's the same like if you are as a bank you are googling

your customers because you're doing some sanction checks something the google might have an assumption or whoever service is used that this data is actually of of relevance for you so i think this is something every company should have in mind when they do this these lookups especially since the the yeah i mean you're revealing your own privacy like what who are the addresses you're interacting with and you're also revealing the privacy of of your customers so now what can you do to avoid this privacy risk

the first one is a rather simple trick i would say you use a proxy company so the the the the end that the company who provides the on chain analysis service does know that you are doing these requests and the second one is implementing the travel rule for transaction between non-parties and i will explain that later so i just took here taxi as an example how that works is the proxy example you have different financial institutions can be different banks they all access the same

proxy server and then you get different results or it could even be the same data provider but for the data provider it's just one source request so the data provider on one of this on chain analysis company they don't actually know who did the request so you're keeping your privacy and you're keeping the privacy of your customers i think that's a very simple work around that everybody should do if they care about their privacy the second approach is um what you might have here with the new fatf publications is if you implement a travel rule

which means you have to when you transacting from a wasp virtual as a service provider like say from one bank to another for example from a ceba bank to a signum bank you cannot just do an on-chain transaction but you also have to tell the other bank who is the originator the name the account number and the address and who is the beneficiary same there the name on the account number so ceba bank when sending the signal bank know exactly who is sending coins to whom and who they got the coins from so if you do this um you already wet that your counterparty you wetted the the wasps otherwise you wouldn't transact with them that means there is zero reason for

you okay this is my opinion seriously a reason to also do an on-chain um risk score because you know you got your coins from a finma regulated swiss bank so they are as clean as they can get i think this is the advantage of having to deal with the travel rule um yeah i think that's it so are there any questions any comments i really like different opinions to to this especially to to this this question

sorry i'm not fully sure it's really just non-custodial to non-custodials where you have true privacy if you had like a coin join lightning and liquid if this is what you're talking about of course the or if you're a wasp you can do cointron from one wasp to another wasp actually if you implement a travel rule again

um you can do as much mixing between most as you want because then you don't need a risk score so i think this is something wasps should do between each other as a wasp yes you're actually through compliance you get more privacy than without compliance good alright thanks for your time [Applause]