A few random thoughts about the recent announcement of Bitcoin addresses entering the OFAC list of sanctioned parties.
An obvious question here is: What does it mean when we say "nobody is permitted to engage in any transaction with one these addresses" ?
First answer: you shouldn't accept a transaction sending bitcoins to you if some of the utxos spent by this transaction are "related" to one these addresses.
The problem is that Bitcoin is a push system. You can't refuse a transaction sending some bitcoins to one of your addresses.
This specificity may also be used by the santioned party for obfuscating the trail.
Split the BTC in small amounts. Send some to random addressess. Send others to addresses controlled by the sanctioned party.
Split the BTC in small amounts. Send some to random addressess. Send others to addresses controlled by the sanctioned party.
Second answer: you shouldn't send bitcoins to one of the addresses controlled by the sanctioned party. This one is easy, right? Not so fast.
Let's take a moment to think about a transactional pattern like P2EP (Pay To Endpoint). blockstream.com/2018/08/08/imp…
Now, let's imagine that the sanctioned party decides to provide a "service" based on P2EP.
Now, let's imagine that the sanctioned party decides to provide a "service" based on P2EP.
Here's a scenario: Alice loves Bob and Bob loves Alice. Eve loves Bob and it's clear that Alice is a problem.
For whatever reason, Alice sends some bitcoins to Eve. Later on, Eve sends these bitcoins to the sanctioned party with a P2EP transaction.
For whatever reason, Alice sends some bitcoins to Eve. Later on, Eve sends these bitcoins to the sanctioned party with a P2EP transaction.
Here's a schema illustrating what is happening:
- Red: Sanctioned party ("very bad people")
- Orange: Entity engaging in a transaction with the sanctioned party ("bad people")
- Green: Others ("good people")
- Red: Sanctioned party ("very bad people")
- Orange: Entity engaging in a transaction with the sanctioned party ("bad people")
- Green: Others ("good people")
And now, here's a schema illsutrating what we'll be seen by blockchain analytics platforms.
Congrats Eve! Your future is bright. Alice just became an entity engaging with the sanctioned party. Alice is prosecuted as a "bad person". Bob breaks off their relationship.
I already hear some of you saying: "God. This is very bad. We shouldn't implement something like P2EP". But this is a mistake.
The thing is that P2EP isn't some kind of new magic technology. P2EP transactions have been possible with the bitcoin protocol since day 1. I wouldn't be surprised if such transactions were already used in the past (hint: they were).
Actually, the current situation is the worst possible. It's already possible to build P2EP transaction but everybody thinks it isn't. Alice is doomed. 😬
No. The real problem is that blockchain analysis mostly relies on weak assumptions like "all inputs of a transaction are controlled by a same entity".
Conclusion: The combo "bitcoin protocol + blockchain analysis + black lists" is a dangerous one. Be careful what you wish for.
/end
