Ghost Clusters: Evaluating Attribution of Illicit Services through Cryptocurrency Tracing
No ratings
Presented at USENIX Security 2025 by
One of the principles in cryptocurrency tracing is putting a name to an address—a process called attribution. Attribution is key for both law enforcement and compliance professionals. Blockchain intelligence companies sell attribution as a service by leveraging pseudonymous blockchains, clustering heuristics, and labeling of addresses. In this paper, we perform a case study on Chainalysis, the market leader, and evaluate its attribution by comparing it against ground-truth data on three seized illicit services—BestMixer, Hansa Market, and Wall Street Market. To design the evaluation, we interview front-line law enforcement professionals and learn how they trace cryptocurrencies using blockchain intelligence providers. We identify three evaluation techniques— i.e., address overlap, money flows, and address roles—that realistically measure attribution in line with law enforcement use cases. Using these techniques, we show that for our three illicit services, Chainalysis provides a reliable lower bound (24.54 to 94.85 percent accurate), and produces very few false positives (less than 0.5 percent). Also, we find that coverage changes over time. We reason about factors that influence attribution and demonstrate the importance of attributing certain key addresses to achieve high coverage, and with that, show that when including a second blockchain intelligence provider, the difficulties in generalizing results.