Bitcoin and similar cryptocurrencies are becoming increasingly popular as a payment method in both legitimate and illegitimate online markets. Such markets usually deploy a review system that allows users to rate their purchases and help others to determine reliable vendors. Consequently, vendors are interested into accumulating as many positive reviews (likes) as possible and to make these public. However, we present an attack that exploits these publicly available information to identify cryptocurrency addresses potentially belonging to vendors. In its basic variant, it focuses on vendors that reuse their addresses. We also show an extended variant that copes with the case that addresses are used only once. We demonstrate the applicability of the attack by modeling Bitcoin transactions based on vendor reviews of two separate darknet markets and retrieve matching transactions from the blockchain. By doing so, we can identify Bitcoin addresses likely belonging to darknet market vendors.
Keywords
- Bitcoin
- Markets
- Reviews
- Identification
Understanding Privacy-Related Advice on Stack Overflow Revisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis Employees’ privacy perceptions: exploring the dimensionality and antecedents of personal data sensitivity and willingness to disclose Visualizing Privacy-Utility Trade-Offs in Differentially Private Data Releases Analyzing the Feasibility and Generalizability of Fingerprinting Internet of Things Devices CoverDrop: Blowing the Whistle Through A News App Building a Privacy-Preserving Smart Camera System FP-Radar: Longitudinal Measurement and Early Detection of Browser Fingerprinting Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps How to prove any NP statement jointly? Efficient Distributed-prover Zero-Knowledge Protocols Editors’ Introduction PUBA: Privacy-Preserving User-Data Bookkeeping and Analytics Who Knows I Like Jelly Beans? An Investigation Into Search Privacy SoK: Plausibly Deniable Storage d3p - A Python Package for Differentially-Private Probabilistic Programming Updatable Private Set Intersection Knowledge Cross-Distillation for Membership Privacy RegulaTor: A Straightforward Website Fingerprinting Defense Privacy-Preserving Positioning in Wi-Fi Fine Timing Measurement Efficient Set Membership Proofs using MPC-in-the-Head Checking Websites’ GDPR Consent Compliance for Marketing Emails Comprehensive Analysis of Privacy Leakage in Vertical Federated Learning During Prediction Understanding Utility and Privacy of Demographic Data in Education Technology by Causal Analysis and Adversarial-Censoring User-Level Label Leakage from Gradients in Federated Learning Privacy-preserving training of tree ensembles over continuous data Differentially Private Simple Linear Regression Increasing Adoption of Tor Browser Using Informational and Planning Nudges