Virtual Money–At Your Own Risk

University of Luxembourg

Bitcoin is the new money: minted and exchanged on the Internet. Faster and cheaper than a bank, the service is attracting attention from all over the world. But a big question remains: are the transactions really anonymous?

Bitcoin does not protect a user’s Internet Protocol (IP) address and it can be linked to transactions in real time, according to a study from researchers at the University of Luxembourg’s Laboratory of Algorithmics, Cryptology and Security.

Bitcoin entry nodes, to which a user’s computer connects in order make a transaction, form a unique identifier for the duration of the session, but the researchers found this unique pattern can be linked to a user’s IP address. Moreover, transactions made during one session, even those made with unrelated pseudonyms, can be linked together.

The researchers say hackers would only need a few computers and about 1,500 Euros per month for server and traffic costs to carry out the method, which can expose up to 60 percent of the IP addresses behind the transactions made over the Bitcoin network.

“This Bitcoin network analysis combined with previous research on transaction flows shows that the level of anonymity in the Bitcoin network is quite low,” says Luxembourg professor Alex Biryukov. The team presented a paper on how to prevent the attack at the recent ACM Conference on Computer and Communications Security in Scottsdale, AZ. The researchers also have written software patches and discussed them with Bitcoin core developers.  Report