1 Introduction
1.1 The World of Cryptocurrencies
An abundant amount of cryptocurrencies have been introduced to the world of blockchain over the past couple of years, with Bitcoin remaining the most distinguished among them all. These virtual currencies have progressed extensively over the lifespan of them originally being introduced, with each one claiming to be more secure and superior over the other. As of April 2018, there are over 1,500 cryptocurrencies within the blockchain network with Bitcoin, by market capitalization, being the largest one, followed by Ethereum, Ripple, Bitcoin Cash, Litecoin and EOS. As it can be seen, the history of cryptocurrencies has been extremely volatile, particularly over the third quarter of 2017, with considerably sharp rises and drops in their value. However, despite these occurrences, the world of virtual currency perpetually maintains a devoted user group.
The notorious pioneer of them all, Bitcoin have become a progressively ubiquitous digital pseudo-currency over the last year, through which users trade electronically and more anonymously than via traditional electronic transfers. It is an effective decentralized cryptographic currency system that was first introduced by an individual, known by the alias of Satoshi Nakamoto in January 2009. The network is based on a peer-to-peer architecture eliminating the need for a central authority to control the capital supply within the system. Bitcoin functions on the proof-of-work system to verify and authenticate the transactions that are carried out within the network, and for further verifications purposes all transactions are public and are available to view using websites such as blockchain.info and blockexplorer.
After conducting further research it became apparent that hardly any extensive work or research has been undergone to better understand the behaviour and objectives of individual users or groups through cryptocurrency transactions. The topics of Network Analytics and Bitcoin were barely combined, and where the intersection occurred, it mainly focused on the anonymity and the cybersecurity of the blockchain network. In this paper we will explore and further analyse the Bitcoin network and the benefits of the blockchain system, whilst attempting to understand the human behaviour and the purpose behind the average daily transactions of its substantial amount of users.
Even though the key point of the blockchain system is to remain anonymous, it is still possible to identify various user groups and business associations within the network. Utilising various online websites and forums it was possible to produce a large categorized list of established users and their known cryptocurrency wallets that store their public and private keys which are used to spend and receive cryptocurrencies such as Bitcoin. By accurately identifying and tracking these known wallets, it was possible to derive 16 different categories that ranged from exchanges to donations.
After having gathered valuable information about these user groups it necessary to acquire all the Bitcoin transactions in a specific timeframe. Therefore, import.io was used to scrape the various block hashes that contained all the daily Bitcoin transactions within the month of April 2018. Within this month there occurred over 5,700,000 transactions, thus looking at a larger timescale would prove extremely difficult. In comparison, since the creation of Bitcoin it took over three years to reach this amount of total transactions, and it continues to grow exponentially every single year. Having gathered all the necessary datasets it was now possible to compare random daily transactions to the wallets of the known categories, with the main objective to analyse human behaviour, identify groups and understand the purpose behind the transactions.
1.2 Bitcoin Technology
A Bitcoin may be defined as a chain of digital signatures within the network. When this digital coin is transferred to the next user it gets electronically signed with a hash of the previous transaction and the public key of the next owner, attaching this information to the end of the Bitcoin. The signatures can also be verified by the payee to prove the chain of ownership.
A unique feature of the currency is that it has a predetermined limited number of 21 million coins in circulation, this is done to prevent inflation in the system. The block subsidy is set to deplete at block 6,930,000 which is estimated to occur around the year 2140. However, the vast majority of the coins, around 99%, will have been mined by around 2032, when the block subsidy will drop to less than 1 BTC per block. Roughly 20.67 million coins exist, thus leaving less than 0.5 million to be mined over the next 100 years. Therefore the money supply will increase at a certain rate.
All the direct personally identifiable information is omitted from all transactions. The source and destination addresses are encoded in the form of public keys and this provides further anonymity. Every public key that serves as a pseudonym has a corresponding private key which is stored in an electronic wallet, these are used to authenticate any transaction. A Bitcoin address is an identifier of 26-35 alphanumeric characters, all beginning with 1, 3 or bc1. For an individual to become part of the network, they must have a client software that runs either on their own device or as a cloud service.
A full node which validates transactions and blocks within the network cannot accept multiple transactions using the same inputs. They can only accept the first transaction they receive and reject all the subsequent ones. This occurs in order to prevent double spending by mischievous users and is a significant part of the proof-of-work system. The main idea behind the proof-of-work concept is to make it expensive for a single user or a group to rewrite the history of transactions once it has been accepted as definitive. That is the reason why Satoshi Nakamoto introduced the use of a timestamp server that takes the hash of a block of transactions, timestamps it, and widely publishes the hash. This proof-of-work involves using hash algorithms such as SHA-256 to find a specific value.
There exists a predetermined target difficulty for mining blocks that is updated for every 2016 blocks that have been generated. This ensures that the time it takes to generate one block is on average about 10 min. The block is only accepted by users if all the transactions within it are valid and the Bitcoins have not been spent previously. Users show their acceptance by using the newly found hash in the previous hash section of the next block that they attempt to generate, therefore adding a new block to the chain. This is known as a blockchain and it contains the entire history of all transactions that have been carried out in the network.
The generation of blocks is referred to as mining and is achieved by providing a certain amount of computational power to the network to solve the proof-of-work problem, these miners are then rewarded when a block generates. There is also competition for receiving the reward, and the more computational power a group of miners possesses the more likely they are to receive the reward. The reward is predetermined and started at 50 BTC, with a schedule to half if value for every 210,000 blocks created. Currently we are in the third block area with 12.5 BTC rewarded. That is why the majority of bitcoins will be mined by the year 2032 as the reward will be too small to continue mining and users will have fewer incentives.
1.3 Bitcoin Economy
To better understand the Bitcoin economy and how the users interact between one another through transactions and various services Figure 1.1 has been introduced below, it shows a general overview of the Bitcoin economy with its distinct participants. Users can exchange currencies into Bitcoins through an exchange platform; withdraw money from Bitcoin ATMs; store Bitcoins in an online wallet; use various services provided by online merchants; pay with Bitcoin in the real economy; take out loans and donate to various donation and media news platforms; profit from other users and receive large amounts; gamble with Bitcoins on gambling sites; incorporate transactions into a block and start mining; verify transactions and publish into the network through blockchain.
The nature of the Bitcoin services is quite unstable due to regulations or unsecure platforms that facilitate theft. Over the years a substantial amount of service providers like exchanges, faucets and online merchants have been shut down by the FBI due to money laundering, trading illegal goods and several thefts, examples include Mt. Gox, Silk Road and Instawallet.
2 Literature Review
2.1 Project Design
2.2 Preceding Work
The majority of the recent research mainly concentrates on the de-anonymization of the Bitcoin network as well as the cybersecurity of its users. However some research was undergone that has been based on the identification of user’s demographics and using transactions as a means of assessment. The majority of this work mainly focuses on the initial years of the Bitcoin system.
McGinn et al. presented a systemic top-down visualization of Bitcoin transaction activity to explore dynamically generated patterns of algorithmic behaviour. They exposed an effective force-directed graph visualization employed in their large-scale data observation facility to accelerate the data exploration and derive useful insight among domain experts and general public alike. The high-fidelity visualizations allowed for collaborative discovery of unexpected high frequency transaction patterns, including automated laundering operations, and the evolution of multiple distinct algorithmic denials of service attacks on the Bitcoin network.
Fleder, Kester and Pillai explored the level of anonymity in the Bitcoin system by introducing a two-fold approach. They annotated the public transaction graph by linking bitcoin public keys to real people, either definitively or statistically and they also ran the annotated graph through a graph-analysis framework to find and summarize activity of both known and unknown users. They concluded that by leveraging several sources of publicly available information via web-scraped forums and Bitcoin’s transaction ledger, the Bitcoin transaction network is shown to be not entirely anonymous.
Reid and Harrigan considered the topological structure of two networks derived from Bitcoin’s public transaction history. They show that the two networks have a non-trivial topological structure, provide complementary views of the Bitcoin system and have implications for anonymity. They combine those structures with external information and techniques such as context discovery and flow analysis to investigate an alleged theft of Bitcoins, which at the time of theft, had a market value of approximately half a million US dollars.
Lischke and Fabian examined the economy and transaction network of the Bitcoin system during the first four years of its existence. They established and analysed a novel integrated dataset that enriched data from the Bitcoin blockchain with off-network data such as business categories and geo-locations. Their analyses revealed the major Bitcoin businesses and markets and gave insights on the business distribution by countries and how they evolved over time. They were also able to find a gambling network that featured many very small transactions as well as regional differences in the adoption of the business distribution.
3 Methods
3.1 Data Collection and Operation
There is a substantially large amount of transactions that occur daily, and nowadays in a typical week more than 1,000,000 transactions occur on average. Thus it is fascinating to understand what kinds of transactions occur between the different types of users. In order to achieve this, we first need to identify and categorise all the known wallets that are currently being used for receiving Bitcoins. This can be done through various platforms and forums. Using walletexplorer.com, a Bitcoin block explorer platform, and reddit.com, a discussion website, we could identify and locate 104,020 addresses which belong to 113 different entities. These entities were then classified into 16 distinct categories, which ranged from heavy, intermediate and low transaction flows. They are described in more detail below
Heavy Transaction Flow:
Mining Pools – Miners share their computing resources and share their computing power over a network. The reward is split equally according to the amount of work they contributed to the probability of finding a block.
Exchanges – Users can trade their local currencies, other cryptocurrencies, and gold into Bitcoins. The majority of exchanges are electronic however there are also local exchanges available.
Intermediate Transaction Flow:
Richest – Top 10,000 wallets that belong to individuals that possess the highest amount of Bitcoins. These range from 199,103 BTC to 150 BTC.
Gambling – Wallets are associated with gambling and belong to various online gambling platforms that offer various casino games which utilise Bitcoin.
Storage – Various online platforms that offer users secure storage services of their various cryptocurrencies, users in turn are subject to a fee. Some even provide a cold storage vault and a Bitcoin-based debit card.
Payment – Separate online platforms that offer payment services enabling online merchants to accept various cryptocurrencies in the same way as they accept Credit Cards and PayPal in their local currency.
Transfer – Individual online platforms that offer transfer services to their clients, this also includes international transfers, which in turn reduces the amount of fees paid by the individual.
Low Transaction Flow:
Loans – Assorted peer-to-peer lending services which enabled clients from around the world connect to borrow and lend using Bitcoin. They were intended to let users in countries that lack a local credit score system to receive loans, based on an in-house credit-scoring algorithm.
Donations – These are individuals or entities that do not receive payment for their work, and in turn live off donations. They tend to provide free information, e.g. Snowden, and therefore rely on the donations of other users.
Vanity – These are addresses which the user chooses and creates themselves, attempting to generate an ID with their business tag within the address, this is often common for donation addresses.
Media News – These are information platforms that provide free services to the public by publishing various articles. In order for the content to continue to be created they receive donations from other users.
Earning – These are platforms that request various online services to be completed by the willing clients. As payment for the completed work users will receive payment in Bitcoins. Jobs include reviewing websites, advertising etc.
Darknet – These are wallets that are associated with receiving payment for various illegal products and services. Silk Road is an example of a platform that was seized by the FBI for advertising and selling various illegal substances.
Public – The only known legal market that sells various products online is Purse.io, where users are able to purchase legal goods and in turn pay with Bitcoin.
Tumbler – These are platforms and service providers which are used to hide and disguise the origin and previous transactions of Bitcoins. This mixing makes it difficult to prove where the cryptocurrency originally came from.
Faucet – These are reward systems, usually in the form of a website or app, which dispense rewards in the form of a Satoshi (0.00000001 BTC) for visitors to claim in exchange for completing a captcha or task as described by the website.
After having obtained various identified wallets, they would now need to be compared to a series of confirmed daily transactions in a particular timeframe. Due to the current popularity of Bitcoin there are a substantial amount of transactions that occur daily, therefore gathering 1 year worth of transactions would prove problematic to work with. Therefore three time frames have been chosen and assigned in periods of 1 Day (01/04/18), 2 Weeks (01/04/18 – 14/04/18) and 1 Month (01/04/18 – 30/04/18), with the total number of transactions being 135129, 2472061 and 5753341 respectively.
The transactional data was obtained from blockchain.info, a Bitcoin block explorer service. This was done using import.io, a data extraction platform. In order for the data to be gathered accurately the block heights and hashes were scraped first. Each block is relayed by different mining pools and since the webpages that contain all the transactional data, mined by a specific mining pool, include the hash of the block within the url it was easier to generate and scrape all the urls for a specific day. The ‘Hashes.csv’ files contain all the hash heights and links for various timed frames. The ‘Transaction.csv’ files contain all the detailed transactional information within that specific time scale. There is a limited amount of information that can be scraped from blockhain.info and the number of variables very limited. Each row represents a single transaction and each column is a new variable, this is described in more detail below.
‘url’ – This simply contains all the urls that are used to view the detailed blocks of transactions on blockchain.info.
‘block #’ – This summarises some elementary block information including block number, number of transactions, output total etc.
‘Sender’ – These are the wallets of the users that send a certain amount of Bitcoins to another user. They contain all the wallets of the senders that are associated with the transaction. As it can be seen some contain more than one wallet within each transaction, this is done to reduce paying extra transaction fees.
‘Receiver’ – These are the wallets of the users that receive a certain amount of Bitcoins from another user. They contain all the wallets of the receivers that are associated with the transaction. Once again some transactions contain more than one receiver. On the right side of each wallet is also the BTC receiving amount of that particular wallet.
‘Total’ – This is the total value of the entire transaction in Bitcoin.
‘Time’ – This is the specific date and time period that the transaction occurred in.
This data proves to be appropriate as it represents a substantial amount of transactional interaction among an even larger array of users. The dataset is also extremely accurate for this amount of interactions between an even larger amount of users. It is a good representation for the average daily interplay between the various classes of users. Within the dataset there were on average over 8 million unique wallets that were identified, which belong to various entities and clients that interconnect on a daily basis. By nature this dataset gives a clear representation of the real world, how a single currency operates and moves around on a worldwide scale, in which millions of users are connected on a daily basis. By utilising and further studying this data we are able to further analyse human behaviour and aim to categorise further unknown users into various segments. It helps us figure out what a typical day of transactions looks like.
3.2 Network Development
In order to make Python more accessible, a virtualenv was installed through the terminal and the command ‘pipenv install’ ran in the project directory. Thus, we could set the correct virtualenv path in any software. It was beneficial to utilise NetworkX, a Python based software package , which provides a large number of algorithms to analyse complex networks. It also comes with the functionality to visualize networks. Other packages like MatPlotLib and Graphviz were also used for rendering the network visualization and layout purposes. These packages are essential in analysing the Bitcoin user network. Another powerful tool for network analysis, particularly for visualizations of network is Gephi, which is a software used to visualise interesting subgraphs and clusters of the Bitcoin network.
Following this we had to import and clean the raw data file from the ‘Transaction.csv’ and ‘Wallets by Category.xlsx’ files. We need to parse the ‘Transaction.csv’ files in order to build the adjacency matric and the corresponding network graphs from the transactional data. SQLite browser , a relational database management system, was used to import the ‘Transaction.csv’ files into the following tables ‘transactions_raw_1’, ‘transactions_raw_2’, ‘transactions_raw_3’ located in the ‘database.sqlite3’ file.
Now in order to create the network we must first iterate over all the transactions, identify all the sender users from the inputs and all the receiver users from the outputs, and then output the pairs of (sender, receiver) as edges. Finally we can create a NetworkX graph and feed the edges into it.
The first network to be created was the transaction network which represents the flow of Bitcoins between various transactions over certain time. Each node depicts a transaction whilst each edge depicts an output of the transaction between the source and the target.
Each edge also contains the value of the transaction in Bitcoins and the timeframe. It is relatively simple to create a transaction network from our dataset.
the first user networks were very close to the original transaction network as the addresses weren't contracted yet.
Following this, we build a user network by combining all the input addresses that appear together within all of the transaction. The first user networks were very similar to the original transaction network as the addresses weren't contracted yet. The results of this step could be improved by using more transactions. The user network was more complex to create and is described in more detail below.
The user network depicts the flow of Bitcoins between various individual users over a specific timeframe. Within the network, each node represents a unique user’s wallet and each edge an incoming-outgoing transaction between a source and a target represents. The input’s wallet ID belongs to the user corresponding to the source and the output’s wallet belongs to the user corresponding to the target. Each edge also contains the Bitcoin value of the transaction and the timeframe.
We first must pre-process our data before we can construct the user network from our dataset. In order to improve our network, we must first contract each subset of nodes whose corresponding wallet IDs belong to a single user. A large amount of users generate new wallets for every transaction to keep transactions from being linked to a single owner, this is the greatest difficulty when faced with such a network of user IDs. It is therefore impossible to completely perfect the network by solely using our dataset.
Using transactions with multiple inputs to contract subsets of nodes in the imperfect network, we construct an additional network in which each node represents a user wallet. We then connect these nodes with edges, where each edge joins a pair of wallets that are both inputs to the same transaction.
Once the networks are created, we sanitized the data and started cross-referencing the transactions with the known addresses. A working pipeline was now created from parsing the data to visualising networks. For the output at the end of the pipeline we can also consider specific time periods. That is why further in the analysis we compare different periods and look at how the network changes over this timescale.
After the network is built and the data has been pre-processed we export into a ‘.gml’ file. The ‘so.gml’ file is then imported into Gephi in order to create the visualizations. We run clustering algorithms to see what groups emerge and the established clusters are then tagged with the help of known wallets. In Gephi it is best to set the node size based on degree, the node colour based on modularity class, the text colour based on category and also use ‘Force Atlas 2’ for layout. The next steps are to work towards gathering further insights on the transaction network and producing accurate visualisations.