Chainalysis: Building Trust in the Ethereum Blockchain by Mikkel Jensen & Surya Rastogi

Transcript

So, um not sure if you guys are aware but we're from a company called Chainalysis. Um and today we're going to dive into um building trust in the Ethereum blockchain and sort of what our company does in the space. Um sorry about that. I'll keep this closer. Okay, cool. So, just a brief agenda about what's going on. So, first we're going to talk about Chainalysis and our services. Um then we're going to dive into some of the data challenges we have. Um then we're going to actually going to have a long section analyzing some Ethereum data and walking through one of um the investigations we did. And then um we're going to talk generally about the derived insights we gain.

So, uh just a quick background about myself. Um I'm the engineering manager for the blockchain intelligence team at Chainalysis. Um but before this, I was very interested academically in Bitcoin. So, for my undergraduate thesis, I created a set of tools to visualize the Bitcoin blockchain. Um this was for Imperial College and these are some of the pictures from uh my thesis. In the top left, you can see here um these are different views of Bitcoin transactions. Over here, this one has one input and two outputs. The old way of change it addresses. This one has a lot of inputs and one output. So, that would be someone aggregating a lot of funds. And then this has the reverse which is one input and many outputs. So,

someone's disaggregating funds. Um this has generally changed since this this thesis was completed in like 2015. So, uh the block size was not as big an issue back then. Batching was not something that was in enforced or uh regularly used. So, the blockchain itself has changed a lot since then. Um just a bit about myself. I really like network theory and graph analysis. Uh this fun little visualization in the corner is um an algorithm I modified which some of you might know is called Force Atlas 2, and I created multi Force multi gravity Force Atlas 2 to separate different uh graph entities.

Um and down here you can see a cluster over time. So, what does Chainalysis do and what are the services we provide? Well, really we're trying to build trust in the conventional ecosystem. So, I know some people here might want a disjoint financial ecosystem, but our work is about integrating crypto companies into the existing um ecosystem. So, we work with three major um parts of that ecosystem. We work with the cryptocurrency businesses themselves, financial institutions, as well as law enforcement and regulators.

So, we found that in general, the space doesn't grow because every each party doesn't feel comfortable with what's being provided. So, you can see overregulation occurred in some in Japan as well as Korea uh related to some of the exchange hacks that happened, and it caused a lot of privacy coins to actually be delisted. So, first we can see Coincheck had to delist a couple of their privacy coins, then this spread to South Korea, and they started having stricter regulations, um and more exchanges followed suit.

So, our goal is to provide tools that make regulators feel comfortable with these currencies and what they can do with them um to some degree. So, overall, illicit activity prevents the growth for all ecosystem participants. Um I'm sure some of you have mixed opinions about the top half, but I'm sure we can all agree that the bottom two are bad. in general, each of these uh each of the actors in the ecosystem has their own risks and uh needs, and we try to address each of these. So, for cryptocurrency based businesses, they struggle to get bank accounts. It's hard to get banking relationships without having some sort of information on where where funds come from and what risk is associated with them.

For financial institutions, if they expose themselves too much to the to risk, they harm their reputations and if they're large financial institutions, they will face legal repercussions. And lastly, for law enforcement regulators, if they can't enforce the laws they make or the regulations they do to control an industry, they won't be comfortable with that technology growing. So overall, our goal is to work with each of the participants of this ecosystem and give them value that lets them feel more comfortable with cryptocurrencies in the existing financial system.

So some of the data challenges we face. Um we were a very Bitcoin-centric company before. Um but now we've turned a lot to Ethereum. So here is actually Bitcoin on the left and Ethereum on the right. They might look similar to you because they're graphs, but they're actually quite different in the structure underlying. So on the left, it actually captures the UTXO structure um with all UTXO coins and on the right is the most more account-based structure um that we see on any account-based model. Um additionally, smart contracting provides a new layer of analysis that's necessary. We have to go beyond the transactions and go into the execution traces themselves. Um we have to see what sort of execution happens and what

information we can extract from that. Um so this is an example of a of a data field in Ethereum um and it's uh this is pretty old now cuz there are a lot more advanced decompilers, but you basically decompile the data field in to try and figure out what the parameters that were sent to are. transitioning to riskiness insights. So what the tools that we provide for the participants in the ecosystem um is essentially insights on riskiness. Um and these vary based on each of the customer themselves. So if you're say in a country that doesn't consider gambling high risk, you would have customized alerts that don't say that a gambling activity is high risk for you. But, if

you're in the US, for example, that would be high risk. So, we provide a customizable um tool known as KYT uh to cryptocurrency businesses so that they can choose the right risk alerts to get. All right. Now, I'm going to hand it off to Mikko, who will walk you through um one of our investigations and analyzing Ethereum data. Yeah, so um my name is Mikkel, and I work in our research department in Chainalysis. So, I actually get to do some of the fun stuff in the company.

So, I'm going to talk a little bit about some of the the cool stuff that we do. Um and the the subtitle is like what happened to the Ethereum volume in 2017. So, that's sort of the story that I'll be talking about today. And then, I asked my mom to send me a picture for my presentation. So, this is me in my early data science days. I actually think I'm playing Counter-Strike on this um But, just to let you know, like we don't take ourselves too seriously. So, if you think any of this is interesting, please come talk to us afterwards. We're quite nice guys. Um so, basically, what we do is we start out with this idea of not knowing anything on the blockchain. So, this is one of the visualizations um of addresses interacting

in some blocks. And then, our goal is basically to turn this into this. So, we have an idea of what belongs together, how do the different entities interact. So, basically, gain knowledge about who's interacting with who on the blockchain. this is sort of the the background info. It's like we monitor the blockchain and try to figure out what's going on. And if there's something we don't understand that peaks our interest, then we're like, "Whoa, what's going on here?" And then this graph is it's the cumulative volume moved on the Ethereum network. And Oh, I can point. Cool. So, in this period here initially, there was quite a

normal growth and then from this period onwards, it's almost looks like a piecewise function to me. So, you have like sort of a normal growth of volume being moved on the Ethereum and then it shifts into basically a factor of five growth here. So, that's sort of interesting to see. It's like, well, we know a lot of things happened in 2017, a lot of ICOs, um there was a bull run on crypto, but it doesn't really explain why you would move so much ether on the on the network. So, this sort of the starting point is like we see something here where like we can't really explain it. So, let's figure out what's going on.

we can basically if we if we divide these periods into two blocks, so we're basically looking at the initial period on the network and then this high growth period. And one thing we can do is we can look at the frequency distribution. And what that means is basically we're taking all the transfers from that initial blue period down here and saying, "Okay, how much volume was sent in this period and which amount are accountable for the total volume?" So, this graph basically shows that more total volume was sent on the network through smaller transfer amounts. So, that makes sense if you're like a general economic network where it's like where most people don't have so much money, so they're probably going

to be interacting with smaller amounts. So, there's going to be more volume moved through smaller amounts. So, this is sort of intuitive at least to me when I look at it. Like this looks like normal behavior. So, what happens when we overlay a period of that 2017 period? So, this is quite interesting. So, this to me definitely doesn't look like normal economic behavior. It almost looks like artificials that you have these almost smoothing out regions and then they just like sort of drop off here. So, when we see this, one thing is quite noticeable is that more volume is being moved through larger amounts on the network.

So, then again, you can hypothesize, well, why are some people or entities moving more funds through larger amounts? So, then you can I mean, we're basically detectives, so having a list of well, is it because someone wants to boost the volume artificially or are there just more people transacting in a normal way? This definitely doesn't look normal to me. we can also look at what type of addresses were involved in this increase in volume movement on the And so, this graph is basically showing that for for this period, like how much volume was sent through old addresses. And what I mean with old addresses is addresses

that were seen previously on the blockchain um with respect to So, if we're in this bar here, for example, then old addresses means that addresses that were seen before that. Or if we're over here, it means all all the volume that was moved by addresses that were seen before this point. So, it basically shows how much volume is being moved by addresses that were seen before in the blockchain. And then we can also overlay a graph of how much volume is being moved by addresses which was only or first seen in that block range. So, basically newly generated addresses for any point on the timeline.

So, when we do that, that also looks kind of cool because here we definitely have a clear pattern is that something is going on in 2017. Like a lot of volume is being moved and we know it's to larger amounts and now we also know it's um it's for newly generated addresses. So, I mean, I could show you 100 slides and this is just like a very small peak of how we would analyze something. So, we obviously we have a lot more information to go in and say what is like what is going on in the blockchain. But, when we piece all of this together, then we can sort of um we have an idea of which addresses. So, we we know they're newly generated. We know they move a lot of funds through large amounts, and we know a bunch of other things also.

So, we can sort of define which addresses are involved in this movement. Um and then we can cluster them together. And when we're done that, we can sort of do graph analysis as well. So, we sort of look at how are they interacting? Are they interacting in the same way? Because just if you're a specific address, you can still be interacting with other addresses in a different way. So, that doesn't really mean you should be clustered together. So, this is it's a long process, but when we're done, we basically reach something like this where this is a visualization of 25 blocks in 2017. And all the orange dots here are the addresses that were connected together.

That's basically responsible for this huge movement of funds. yeah, I just like graphs. So, I just wanted to give you close-up. Um so, what can we say about Yeah, so another thing is like we know that the addresses responsible this belong together. So, it's one entity. So, what can we say about this entity when we know an entity is responsible for moving so much ETH in 2017? Well, we can go in and say, "Okay, we know all of these addresses belong together. Let's look at how much volume they send to each other."

And here it's denominated as percentage of the total network volume. So, in these block numbers, around 60 to 70% on average was sent inside of this entity. And then the orange is basically the funds that is going outside of this entity. So, this is yeah, around 2 to 3% that's leaking over time. So, there's a huge difference between how much volume is being moved and how much volume is being sent outside of the entity. yeah, that's And I would love to go into detail more about like how the entity looks and like this is a project that took several months. So, this is just sort of the the high-level details, but it's really interesting when you find something

that's responsible for like for some of the periods it's over 90%. So, over 90% of the volume is actually coming from one entity in 2017 on the network. Yeah. Back to Syria. All right. Um well, we're a very growing company and we're expanding quite fast. So, in my team specifically, if you want to work with Miko and myself, we're looking for data scientists and a product manager. So, if either of these interest you, definitely reach out to us and come chat to us.

Um in addition, the company overall is hiring across many fields. Um and also we have major offices based around the world and New York, DC, Copenhagen, London. Um we have quite a few satellite offices um that are smaller. I think coming up uh around the world. So, wherever you're located it's probably likely you can work for us there. Um we're also very remote-friendly, so even if you don't want to be based in an office and you're remote anywhere, um we also are very remote-friendly. Um my team in particular, half of us are spread around Europe and then some of us are in New York.

Um and additionally, no crypto experience is necessary. So, if you want to learn about the industry, if you want to get um insights, we would love to train you and get you up to speed on that and you'll get it on the job. Um and it's not necessary as a prerequisite. Um so, yeah, if you found this talk interesting, um please come speak to us in the sponsors gallery. and yeah, come say hi. Mhm.