Tracing a dark web service on the blockchain
Cryptocurrency crimes and scams are inevitable, and there is no place better than the dark web with the added anonymity.
However, not only is it easy to identify the relationship between certain sites, but there are also a number of "digital fingerprints" an onion site can leave behind.
In this case study, we take a look at:
- How to identify the link between onion sites on the dark web
- How to identify the relationship between two bitcoin addresses
- How to trace addresses to a registered exchange
The dark web services: two of the many
The two subjects of this case study are BancoPanama, a banking site selling anonymous "offshore banking accounts" for bitcoin, and Dark Web UnlockDevices, a service that allows you to anonymously unlock phones through bitcoin payment.
This case study is not to identify whether these are scam sites or not. Rather, it is to identify the relationship between them, to show that they are owned by the same person, and to trace their blockchain fingerprints to a registered cryptocurrency exchange.
Analysis tools for dark web onion sites
In this case study, we are going to use four tools:
- Fresh Onions, a crawler for websites
- Wallet Explorer
- Blockchain Explorer
- Tor Browser
The most important of these are Fresh Onions and Wallet Explorer. Fresh Onions basically tells you any hidden information that you might not see on an onion site and is great for identifying any of these "digital fingerprints" we are looking for. Wallet Explorer is useful as it identifies all bitcoin addresses owned by one single wallet. When dealing with cryptocurrencies, one wallet may own numerous addresses.
Identifying fingerprints of dark web services
The relationship between these two dark web onion sites can be identified using the Fresh Onion crawler. The relevant detail we are looking for is an SSH fingerprint. Essentially it is a unique marker a site will carry. With Fresh Onions, we can see all of the other sites that hold that same fingerprint.
This shows that there is an SSH relationship between the two onion sites we identified earlier. Now let us take a look at the blockchain evidence.
Blockchain forensics: where does the money go?
The first step to any analysis of a dark web site is to locate its cryptocurrency address. This may be various currencies, but for the most part, bitcoin is the ruler of the crypto world, and thankfully it has a very public blockchain.
We can tell a number of things just from one bitcoin address, such as:
- How many transactions have taken place
- Where money has come from and how much
- Where money has been sent and how much
- A historical timeline of transactions
- And other associated bitcoin addresses in that wallet
The last one of these is where Wallet Explorer comes into effect. With this tool, we are able to identify any other bitcoin addresses owned by the same wallet.
So what is the relationship between the two sites? When we access their bitcoin addresses through the "purchase" section of the website, we can identify two main addresses: the address of the BancoPanama site ending in XZ4jo, and the address of the Dark Web UnlockDevices site ending in KUrE.
The relationship between these two websites is that they are from the same wallet, meaning that they are owned by the same entity or person. I found this using Wallet Explorer, where we can identify the dual ownership of the addresses by simply entering one into the search function, and then revealing the entire wallet.
Tracing the payments through to an exchange
The transactions paid into these accounts are what normal transactions should look like when viewed on the blockchain. But following the outgoing transactions uses more addresses.
For this transaction, the key recipient address ending in Ndpe can be one of two things: a bitcoin mixing service, or an exchange.
For many vendors on the dark web, a mixing service, or cryptocurrency tumbler, guarantees anonymity as it essentially scrambles the addresses and the payments made. Perfect for illegal vendors and scammers, not for law enforcement.
Ndpe is a unique address as the majority of its payments are made into bitcoin address 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s. This bitcoin address ending in bu1s belongs to Binance, a registered cryptocurrency exchange. We can see this through a simple Google search, which also reveals a tweet from Binance themselves.
Blockchain analysis of the Ndpe address
The address of Ndpe belongs to the wallet 000030bc2e. This wallet contains more than 120,000 bitcoin addresses, many of which are seeing large volumes of transactions every day.
Ndpe is likely the bitcoin address of an exchange, or it may be a very well-used bitcoin tumbling service, which would explain the large volume of bitcoin addresses it holds in its wallet, allowing it to essentially scramble transactions.
Each one of the addresses in this wallet use Binance as the final source of all of their transactions. The top five addresses all show their largest payouts to Binance, and we can see this on the blockchain.
As you can see, there is a relationship of funds from these two dark web onion sites, to the Ndpe address on the blockchain. Since we have established that these two dark web onion sites are run by the same owner, it is likely the person is using a single tumbler or exchange. There is also an ongoing financial relationship between the Ndpe address, and other addresses in the same wallet, and Binance’s address ending in bu1s.