Thread by @chainalysis

Over the last several days, we’ve seen media outlets publish faulty blockchain analysis related to the movement of funds by #DarkSide, the #ransomware group behind the Colonial Pipeline hack.

https://twitter.com/chainalysis/status/1454142695874695170

Blockchain analysis firms erroneously identified DarkSide’s movement of funds as a simple peel chain, without identifying the mixer involved. They incorrectly traced the funds to exchanges & other services based on that conclusion. bit.ly/3pSSDxU

A peel chain is a transaction pattern commonly seen in blockchain analysis, in which funds appear to move through several intermediate addresses. Peel chains occur naturally and aren’t inherently obfuscatory or evidence of money laundering. bit.ly/3pSSDxU

Ultimately, the faulty analysis came down to the first mistake we cover in our blog: Failure to identify mixers. bit.ly/3pSSDxU

DarkSide in fact sent funds to a mixer and received new funds at another address. Investigators who didn’t know this were in fact tracing funds no longer under DarkSide’s control. bit.ly/3pSSDxU

The error demonstrates how important data quality is in assessing blockchain analysis providers. This is especially important in ransomware investigations, where the use of mixers is a common obfuscation technique. bit.ly/3pSSDxU

Incorrect analysis can lead to erroneous subpoenas, which waste the time and resources of both investigators and the exchanges who are asked to provide information. bit.ly/3pSSDxU

Read our blog to learn about other common blockchain analysis mistakes that can lead investigators astray. bit.ly/3pSSDxU

Note: This Twitter thread was updated from a previous version to include a definition of the term "peel chain.”