Part 1: Visual Bitcoin analysis
This blog is the first of two posts looking at how our network visualization toolkits can help you make sense of Bitcoin transactions. We’ll use Bitcoin data throughout, but the concepts of visual Bitcoin analysis could also be applied to other cryptocurrencies.
Whether it’s Bitcoin’s value fluctuations, million-dollar hacks, the launch of new currencies or stories of regulators grappling with a brave new world, barely a week passes without cryptocurrencies hitting the headlines.
While governments and banks still dislike the concept of digital currencies, there’s a huge business opportunity. Compared to traditional fiat currencies, decentralized cryptocurrencies offer a secure, low-cost way to transfer funds anywhere in the world. They’re widely regarded as the future of finance, so it’s no wonder people want to learn more.
What is Bitcoin?
There are whole websites devoted to the inner workings of Bitcoin. For this post, we’ll keep it simple.
Bitcoin is a digital currency that uses the blockchain to manage and secure transactions. Unlike traditional currencies, Bitcoin is not backed by an institution, like a government or bank. Instead, its value is based on its users’ trust in the system.
Bitcoin coins are mined and can be sent between users’ wallets as transactions that have input addresses and output addresses. Transactions are contained within blocks. A user can have many wallets, and wallets can have many addresses, and addresses can be generated on demand.
To maintain trust within a global financial network of anonymous strangers, every transaction is broadcast to every node in the network. In fact, every Bitcoin wallet contains a record of every single transaction in the history of data, which allows validation of future transactions.
Broadcasting those transactions globally can result in disagreement across the network which could undermine the whole currency, so Bitcoin uses a blockchain solution to maintain and protect the correct order of transactions.
We can see the value of network visualization. Bitcoin is connected by design, and all the data is in the public realm. The cryptographic references used to represent the wallets, transactions, blocks, addresses, and everything else are easy for computers to read, but not humans. Visual Bitcoin analysis helps people identify transaction patterns and make sense of the endlessly-growing network.
Let’s look at some of the techniques we can use to visualize and understand Bitcoin transactions. In all of the following examples, we used data from blockchain.com’s API.
Why visualize blockchains?
Bitcoin network visualization
Here’s a recent block, visualized with KeyLines.
In our model, transactions are represented by grey nodes with a double arrow icon. Inputs to these transactions are shown in orange, and outputs in teal. We’ve scaled nodes by their value. The time bar shows the count of transactions over time.
Although this view looks pretty, it gives little insight into the data.
Bitcoin transactions are public but anonymized. To protect that anonymity, users commonly generate a fresh address for every transaction, but not always. For reasons of convenience, indifference to anonymity or unawareness, around half of the addresses in a typical block are reused.
That means we can group transaction inputs and outputs by address with the guarantee that all nodes in a group are controlled by the same user, to reveal some more interesting patterns:
Identifying automated Bitcoin transactions
Here, a single address is sending bitcoins to lots of other unique address pairs. Each of these transactions has exactly one input (orange) and three outputs (teal), with one of these outputs returning (potentially as change) to the sending address.
The next pattern shows rapidly-spent outputs. For each transaction in this chain, a small amount of the input is siphoned off to a different address, and the remainder is used as input to the next transaction in the chain. All of these transactions happened in a 5-minute window.
These charts show unusual patterns that could be completely innocent. Armed with more data and heuristics, however, an analyst could discover something more interesting.
Identifying manual Bitcoin transactions
Zooming in to a different area in the block, we can see a new collection of patterns which probably indicate the transactions were manual rather than automated.
What makes us believe these transactions are not automated? There are certain characteristics that suggest (but do not guarantee) these transactions were manually orchestrated:
- Disconnected transactions; these transactions do not share any addresses with other transactions in the block they are in
- Exactly two unique addresses, suggesting that the transaction was between two parties
- Output to an address that was also an input, suggesting that this is a ‘change’ output, which is typical when transacting with another party
- Infrequent and irregular timings
Visualizing all transactions in a single block might seem uninteresting. After all, a block (mostly) contains transactions from a small time window, with no structure beyond that.
However, as we’ve seen, taking a time-bound set of transactions and visualizing it in a single chart can be a useful detection technique for uncovering patterns and anomalies that require investigation. It’s widely used by fraud analysts.
Try it for yourself
In part two, we’ll visualize individual Bitcoin transactions, and see how our network visualization toolkits can help users investigate specific activity. You’ll find more inspiration for visual Bitcoin analysis in our blog post on building a live Bitcoin timeline & graph visualization.
In the meantime, if you’d like to learn more about network visualization or try visualizing your own cryptocurrency data, request a free trial of KeyLines and ReGraph – our network visualization toolkits.
