This blog is the first of two posts looking at how our network visualization toolkits can help you make sense of Bitcoin transactions. We’ll use Bitcoin data throughout, but the concepts could also be applied to other cryptocurrencies.
Whether it’s Bitcoin’s value fluctuations, million-dollar hacks, the launch of new currencies or stories of regulators grappling with a brave new world, barely a week passes without cryptocurrencies hitting the headlines.
While governments and banks still dislike the concept of digital currencies, there’s a huge business opportunity. Compared to traditional fiat currencies, decentralized cryptocurrencies offer a secure, low-cost way to transfer funds anywhere in the world. They’re widely regarded as the future of finance, so it’s no wonder people want to learn more.
There are whole websites devoted to the inner workings of Bitcoin. For this post, we’ll keep it simple.
Bitcoin is a digital currency that uses the blockchain to manage and secure transactions. Unlike traditional currencies, Bitcoin is not backed by an institution, like a government or bank. Instead, its value is based on its users’ trust in the system.
Bitcoin coins are mined and can be sent between users’ wallets as transactions that have input addresses and output addresses. Transactions are contained within blocks. A user can have many wallets, and wallets can have many addresses, and addresses can be generated on demand.
To maintain trust within a global financial network of anonymous strangers, every transaction is broadcast to every node in the network. In fact, every Bitcoin wallet contains a record of every single transaction in the history of data, which allows validation of future transactions.
Broadcasting those transactions globally can result in disagreement across the network which could undermine the whole currency, so Bitcoin uses a blockchain solution to maintain and protect the correct order of transactions.
We can see the value of network visualization. Bitcoin is connected by design, and all the data is in the public realm. The cryptographic references used to represent the wallets, transactions, blocks, addresses, and everything else are easy for computers to read, but not humans. Visualization identifies transaction patterns and helps people make sense of the endlessly-growing network.
Let’s look at some of the techniques we can use to understand Bitcoin transactions. In all of the following examples, we used data from blockchain.com’s API.
Here’s a recent block, visualized with KeyLines.
In our model, transactions are represented by grey nodes with a double arrow icon. Inputs to these transactions are shown in orange, and outputs in teal. We’ve scaled nodes by their value. The time bar shows the count of transactions over time.
Although this view looks pretty, it gives little insight into the data.
Bitcoin transactions are public but anonymized. To protect that anonymity, users commonly generate a fresh address for every transaction, but not always. For reasons of convenience, indifference to anonymity or unawareness, around half of the addresses in a typical block are reused.
That means we can group transaction inputs and outputs by address with the guarantee that all nodes in a group are controlled by the same user, to reveal some more interesting patterns:
Here, a single address is sending Bitcoins to lots of other unique address pairs. Each of these transactions has exactly one input (orange) and three outputs (teal), with one of these outputs returning (potentially as change) to the sending address.
The next pattern shows rapidly-spent outputs. For each transaction in this chain, a small amount of the input is siphoned off to a different address, and the remainder is used as input to the next transaction in the chain. All of these transactions happened in a 5-minute window.
These charts show unusual patterns that could be completely innocent. Armed with more data and heuristics, however, an analyst could discover something more interesting.
Zooming in to a different area in the block, we can see a new collection of patterns which probably indicate the transactions were manual rather than automated.
What makes us believe these transactions are not automated? There are certain characteristics that suggest (but do not guarantee) these transactions were manually orchestrated:
Visualizing all transactions in a single block might seem uninteresting. After all, a block (mostly) contains transactions from a small time window, with no structure beyond that.
However, as we’ve seen, taking a time-bound set of transactions and visualizing it in a single chart can be a useful detection technique for uncovering patterns and anomalies that require investigation. It’s widely used by fraud analysts.
In part two, we’ll explore individual Bitcoin transactions, and see how our network visualization toolkits can help users investigate specific activity.
In the meantime, if you’d like to learn more about network visualization or try visualizing your own cryptocurrency data, request a free trial of KeyLines and ReGraph – our network visualization toolkits.