2017/08/15 by Steven Goldfeder, Goldfeder, Steven, Harry Kalodner +5 · 4 voices · 3 citations
Computer Science · Social Sciences · #Blockchain Technology Applications and Security #Internet Traffic Analysis and Secure E-voting #Privacy, Security, and Data Protection #cs.CR
paper · pdf · doi:10.48550/arxiv.1708.04748
openalex publication_date 2017/08/15 · openalex created_date 2022/10/04 · openalex updated_date 2026/07/28
We show how third-party web trackers can deanonymize users of\ncryptocurrencies. We present two distinct but complementary attacks. On most\nshopping websites, third party trackers receive information about user\npurchases for purposes of advertising and analytics. We show that, if the user\npays using a cryptocurrency, trackers typically possess enough information\nabout the purchase to uniquely identify the transaction on the blockchain, link\nit to the user's cookie, and further to the user's real identity. Our second\nattack shows that if the tracker is able to link two purchases of the same user\nto the blockchain in this manner, it can identify the user's entire cluster of\naddresses and transactions on the blockchain, even if the user employs\nblockchain anonymity techniques such as CoinJoin. The attacks are passive and\nhence can be retroactively applied to past purchases. We discuss several\nmitigations, but none are perfect.\n