The Complex Community Structure of the Bitcoin Address Correspondence Network

Bitcoin is built on a blockchain, an immutable decentralized ledger that allows entities (users) to exchange Bitcoins in a pseudonymous manner. Bitcoins are associated with alpha-numeric addresses and are transferred via transactions. Each transaction is composed of a set of input addresses (associated with unspent outputs received from previous transactions) and a set of output addresses (to which Bitcoins are transferred). Despite Bitcoin was designed with anonymity in mind, different heuristic approaches exist to detect which addresses in a specific transaction belong to the same entity. By applying these heuristics, we build an Address Correspondence Network: in this representation, addresses are nodes are connected with edges if at least one heuristic detects them as belonging to the same entity. In this paper, we analyze for the first time the Address Correspondence Network and show it is characterized by a complex topology, signaled by a broad, skewed degree distribution and a power-law component size distribution. Using a large-scale dataset of addresses for which the controlling entities are known, we show that a combination of external data coupled with standard community detection algorithms can reliably identify entities. The complex nature of the Address Correspondence Network reveals that usage patterns of individual entities create statistical regularities; and that these regularities can be leveraged to more accurately identify entities and gain a deeper understanding of the Bitcoin economy as a whole.

1 Introduction

Cryptocurrencies are rapidly growing in interest, becoming a popular mechanism to perform pseudonymous exchanges between users (entities). They also allow payments in a decentralized manner without needing a trusted third party. The first and most popular cryptocurrency is Bitcoin, which uses an immutable and publicly available ledger to facilitate transactions between entities. Moreover, given its pseudo-anonymity, Bitcoin has also been used to perform activities in illegal markets. For example, Foley et al. [1] estimate that one-quarter of entities in the Bitcoin network are associated with illegal activity. Consequently, several governing challenges have arisen, and law enforcement agents are particularly interested in techniques that allow tracing the origin of funds. Specifically, in Bitcoin, given the ledger’s public nature, tracing the funds can be achieved by inspecting the history of transactions in the system. However, identifying the entities is a complex task because they can use different pseudonyms (addresses) in the system. By the Bitcoin protocol, it is impossible to completely de-anonymize the entities; however, not all entities prioritize anonymity [2], and it is possible to find recoverable traces of their activity in the transaction history.

The structure of the transactions allows, in some cases, tracing back address pseudonyms that potentially belong to the same entity. For example, Meiklejohn et al. [3] apply heuristics and then cluster together pseudonyms based on evidence of shared spending authority. In this paper, we study the application of several heuristics that leads to creating a sequence of Address Correspondence Networks. Each of these networks includes weighted links between addresses that potentially belong to the same entity, thus approaching entity identification from a network science perspective. Even though other approaches use networks to model some parts of the Bitcoin economic dynamics (e.g. [4–7]), to the best of our knowledge, network science approaches have not addressed the problem of analyzing the Address Correspondence Network to date. In this study, we show that the Address Correspondence Networks have a strong community structure and general-purpose clustering approaches are suitable for analyzing them. Furthermore, our experiments suggest that having a set of identified entities generates large gains in cluster quality—however, this gain quickly declines, and a small number of known entities is enough to produce significant increase in the quality of the detection.

The rest of this paper is organized as follows: Section 2 explains the basics of the Bitcoin blockchain, heuristics, entity identification and related work. Section 3 presents our methods for constructing Address Correspondence Networks, the clustering technique and its quality metrics. In Section 4, we discuss our findings, and finally, in Section 5, we discuss conclusion and future work.

2 Background and Related Work

This section introduces the main concepts related to Bitcoin. Next, it discusses the task of identifying addresses controlled by the same entity, followed by a reviews of the main studies in the area.

2.1 The Bitcoin Blockchain

Bitcoin was introduced in [8] as a decentralized payment network and digital currency which would be independent of central bank authorities. It is built on a blockchain, an immutable decentralized ledger that allows users, i.e. entities, to exchange the units of account (Bitcoins) in a pseudonymous manner. Entities transacting in the Bitcoin network control addresses—unique identifiers which have the right to transfer specific amounts of Bitcoins.

There are different types of addresses, which determine how the associated Bitcoins are accessed. For example, to spend Bitcoins associated with an address of type Pay to Public Key Hash (P2PKH), the entity needs to present a valid signature based on their private key, and a public key that hashes to the P2PKH value. Another example is the Pay to Script Hash (P2SH) address type: it defines a script for custom validation, which may include several signatures, passwords and other user-defined requirements. We denote with a an address and with $\mathcal{A}$ the set of $\left\{a_1,\dots ,a_n\right\}$ addresses appearing in the Bitcoin blockchain. Furthermore, we denote an entity as e, with $\mathrm{ℰ}$ representing the set $\left\{e_1,\dots ,e_k\right\}$ of entities that own Bitcoin addresses.

To spend or receive Bitcoins, entities create transactions. A transaction t is composed of a set of input addresses, a set of output addresses, and information specifying the amount of Bitcoins to be allocated to each output address. Formally, let $\mathcal{T}$ be the set of transactions stored in the Bitcoin blockchain, and $\mathcal{P}\left(\mathcal{A}\right)$ be the power set of $\mathcal{A}$. We model with $\mathrm{i}:\mathcal{T}\to \mathcal{P}\left(\mathcal{A}\right)$ and $\mathrm{o}:\mathcal{T}\to \mathcal{P}\left(\mathcal{A}\right)$ the mappings between a transaction and its input and output address sets. The sum of Bitcoins associated with the input addresses equals the sum of Bitcoins associated with the output addresses plus transaction fees. Therefore, if an entity wishes to spend only a partial amount of Bitcoins associated with the input addresses, the remainder is typically sent to an existing or newly created change address controlled by the initiating entity. Transaction outputs that have not yet been used as inputs to other transactions are referred to as UTXOs (unspent transaction outputs).

The transaction history is replicated on multiple nodes in the Bitcoin network. Entities broadcast new transactions to other nodes in the network. As part of Bitcoin’s decentralized consensus protocol, specialized miner nodes are incentivized to solve proof-of-work puzzles that validate new transactions and group them into blocks. Blocks are sequentially appended to the blockchain; the number of blocks preceding a particular block is known as its block height. Furthermore, entities may specify a transaction’s locktime. This is the minimum block height the blockchain must reach before miners should consider validating the transaction, i.e. a transaction with locktime j is added to block $j+1$ or later.

A peculiar property of the Bitcoin network is the pseudonymity: entities conceal their identity through the use of nameless addresses (pseudonyms), linking an address to a real-world entity exposes their entire activity on the Bitcoin network, since the transaction history is publicly available. Entities are therefore advised to generate a new address for every transaction, so that each address is used once as a transaction output and once as a transaction input.

2.2 Address Clustering

The objective of address clustering is to find sets of addresses ${\mathcal{A}}_i\subseteq \mathcal{A}$ that are controlled by the same entity $e_i$. Formally, the objective is to find a map $\mathrm{e}:\mathcal{A}\to \mathrm{ℰ}$ such that ${\mathcal{A}}_i=\left\{a_j|\mathrm{e}\left(a_j\right)=e_i\right\}$. There exist multiple heuristics for identifying address pairs controlled by the same entity. We consider seven heuristics implemented by Kalodner et al. [9], the majority of which seek to identify change addresses in the outputs of a transaction (linking these with the transaction inputs).

1) Multi-input: All input addresses of a transaction are assumed to be controlled by the same entity.

2) Change address type: If all input addresses of a transaction are of one address type (e.g. P2PKH or P2SH), the potential change addresses are of the same type.

3) Change address behavior: Since entities are advised to generate a new address for receiving change, an output address receiving Bitcoins for the first time may be a change address.

4) Change locktime: If a transaction’s locktime is specified, outputs spent in different transactions on the same block as the specified locktime may be change addresses. Intuitively, this is because the entity initiating the transaction also knows its locktime.

5) Optimal change: If an output is smaller than any of the transaction inputs, it is likely a change address.

6) Peeling chain: In a peeling chain, a single address with a relatively large amount of Bitcoins begins by transferring a small amount of Bitcoins to an output address, with the rest being allocated to a one-time change address. This process repeats several times until the larger amount is reduced, meaning that addresses continuing the chain are potential change addresses Meiklejohn et al. [3].

7) Power of 10: This heuristic assumes that the sum of deliberately transferred Bitcoins in a transaction is a power of 10. If such an output is present, the other outputs may be change addresses.

2.3 Related Work

Address clustering in Bitcoin has been the subject of numerous studies. Initial studies focused on the multi-input heuristic. For example, Nick [10] identify more than 69% vulnerable addresses using only this heuristic. Also Harrigan and Fretter [11] consider the multi-input heuristic and attribute its effectiveness to frequent address reuse, as well as the presence of large address clusters having high centrality measures with respect to transactions between clusters. Furthermore, they suggest that incremental cluster growth and the avoidable merging of large clusters makes the multi-input heuristic suitable for real-time analysis. Fleder et al. [12] construct directed transaction graphs for periods of 24 h and 7 months. In such graphs, the nodes are addresses and each edge represents a transaction from an input address to an output address. They obtain address entity labels by scraping public forums and social networks. By applying the multi-input heuristic, they identify transactions where labeled addresses have interacted with a large number of known entities such as SatoshiDICE and Wikileaks.

Meiklejohn et al. [3] combines the multi-input heuristic with a second one, similar to the change address behavior heuristic. They identify major entities and interactions between them, and note that the change address heuristic tends to collapse address groups into large super-clusters. Zhang et al. [13] consider another variation of the change address behavior heuristic, and show that it improves clustering quality when address reduction is used as a performance measure. In this study, we focus on the heuristics introduced in Section 2.2 by Kalodner et al. [9].

Patel [14] proposes novel approaches to Bitcoin address clustering. He considers clustering an undirected, weighted heuristic graph, where the nodes are addresses, and each edge indicates the presence of at least one of eight heuristics (a superset of those introduced in Section 2.2) linking those addresses to the same entity. Each heuristic is assigned a positive weight, such that their sum is equal to one. The edge weight is the sum of the heuristic weights for which the corresponding heuristic is present between two addresses. The author applies a variety of generic graph clustering algorithms (e.g. k-means, spectral, DBSCAN) as well as graph sparsification and coarsening techniques to the constructed heuristic graph. In this study, we propose the address correspondence network, which is similar to the network built by Patel [14] However, in our correspondence network, an edge between two addresses represents the number of times the heuristics identify the pair as controlled by the same entity. We use a label propagation algorithm to build the clusters, using ground truth information to drive the algorithm.

There exist other approaches and extensions to address clustering. Ermilov et al. [15] show that higher cluster homogeneity can be achieved when transaction data is augmented with off-chain information from the internet. Biryukov and Tikhomirov [16] propose incorporating lower-level network information to enhance deanonymization. Furthermore, Harlev et al. [17] extend address clustering by using supervised machine learning to predict the type of entity controlling addresses in an unlabeled cluster. In our study, in addition to using a ground truth to guide the clustering construction, we introduce a temporal component in the analysis. We build address correspondence networks for various time intervals. In this way, we can analyze the evolution of the network over time.

3 Methodology

We expand upon the work of Patel [14] by performing address clustering on so-called Address Correspondence Networks, denoted ${\mathcal{G}}_{[o,c]}$, where $[o,c]$ is a time interval. Nodes are Bitcoin addresses that are involved in transactions between a time instant o and a time instant c. ${\mathcal{G}}_{[o,c]}$ contains an undirected link $\left(a_i,a_j\right)$ between two addresses when at least one of the heuristics introduced in Section 2.2 detects $a_i$ and $a_j$ as belonging to the same entity. We posit that the topology of ${\mathcal{G}}_{[o,c]}$ encodes further insights on the identity of the entities and, ultimately, on the $\mathrm{e}\left(a_j\right)$ map.

For some addresses $a_j$, the controlling entity is known. Using the block explorer tool provided by Janda [18], we obtain entity labels for 28 million addresses involved in transactions before 2017. We refer to this data set as the ground truth. The mapping information contained in the ground truth is denoted with ${\mathrm{e}}^{\mathrm{\star }}$, such that ${\mathcal{A}}^{\mathrm{\star }}=\left\{a_j|\exists {\mathrm{e}}^{\mathrm{\star }}\left(a_j\right)\right\}\subseteq \mathcal{A}$ is the set of addresses for which the entity label is known. We use the ground truth to 1) sample from $\mathcal{T}$ and 2) to evaluate the quality of address clustering methods.

The remainder of this section is organized as follows. Section 3.1 describes the method for sampling from $\mathcal{T}$. This sample is divided further into cumulative and partial subsets, which are described in Section 3.2. Section 3.3 details the construction of the Address Correspondence Networks. We explain our approach to clustering these networks in Section 3.4, while the metrics used to evaluate clustering quality are introduced in Section 3.5.

3.1 Transaction Sampling

For computational feasibility, we restrict our analysis to a sample of $\mathcal{T}$, as depicted in Figure 1. First, we randomly select a subset ${\mathcal{A}}_0^S\subseteq {\mathcal{A}}^{\mathrm{\star }}$ of the addresses in the ground truth. Next, we select all transactions involving an address $a\in {\mathcal{A}}_0^S$ as an input or output, i.e., ${\mathcal{T}}_0^S=\left\{t|\exists a\in {\mathcal{A}}_0^S:a\in \mathrm{i}\left(t\right)\cup \mathrm{o}\left(t\right)\right\}$. We then build the set ${\mathcal{A}}_1^S$ of addresses that appear in transactions of ${\mathcal{T}}_0$ but not in ${\mathcal{A}}_0^S$, i.e. ${\mathcal{A}}_1^S=\left\{a|a\notin {\mathcal{A}}_0^S\wedge \exists t\in {\mathcal{T}}_0^S:a\in \mathrm{i}\left(t\right)\cup \mathrm{o}\left(t\right)\right\}$. The aforementioned process is then repeated in a similar manner. This involves finding the set ${\mathcal{T}}_1^S$ of transactions which include at least two addresses in ${\mathcal{A}}_1^S$, i.e., ${\mathcal{T}}_1^S=\left\{t|t\notin {\mathcal{T}}_0^S\wedge \exists a_1,a_2\in {\mathcal{A}}_1^S:a_1\in \mathrm{i}\left(t\right)\cup \mathrm{o}\left(t\right)\wedge a_2\in \mathrm{i}\left(t\right)\cup \mathrm{o}\left(t\right)\wedge a_1\ne a_2\right\}$. We set the condition on two addresses per transaction to reduce the size of the subsequently constructed Address Correspondence Networks. Finally, we build ${\mathcal{A}}_2^S$ as the addresses appearing in transactions of ${\mathcal{T}}_1^S$ and not already in ${\mathcal{A}}_0^S$ or ${\mathcal{A}}_1^S$, i.e. ${\mathcal{A}}_2^S=\left\{a|a\notin {\mathcal{A}}_0^S\cup {\mathcal{A}}_1^S\wedge \exists t\in {\mathcal{T}}_1^S:a\in \mathrm{i}\left(t\right)\cup \mathrm{o}\left(t\right)\right\}$.

FIGURE 1

FIGURE 1. The transaction sampling process.

As a result, this process constructs a set of sampled transactions ${\mathcal{T}}^{\mathcal{S}}=T_0^S\cup T_1^S$ having addresses ${\mathcal{A}}^{\mathcal{S}}={\mathcal{A}}_0^{\mathcal{S}}\cup {\mathcal{A}}_1^S\cup {\mathcal{A}}_2^{\mathcal{S}}$. An advantage of this sampling method is that the constructed Address Correspondence Networks are centered around ground truth seed addresses, thereby exploiting the previous knowledge of controlling entities.

3.2 Partial and Cumulative Transaction Sets

To study the evolution of the Bitcoin Address Correspondence Network over time, we create temporal subsets of the transactions in ${\mathcal{T}}^S$. Each subset includes only the transactions in ${\mathcal{T}}^S$ that were generated in a specific time interval. We create time intervals using two different strategies, which we name cumulative and partial, summarized in Figure 2.

FIGURE 2

FIGURE 2. Cumulative and partial transaction sets, and construction of the Address Correspondence Networks.

The cumulative strategy creates eight time intervals of progressively increasing width,¹$\left\{[\mathrm{01.07.11},\mathrm{30.06.}y],[\mathrm{01.07.11},\mathrm{31.12.}y]|y\in \left[\mathrm{12,15}\right]\right\}$, while the partial strategy creates eight time intervals of fixed width, $\left\{[\mathrm{01.01.}y,\mathrm{30.06.}y],[\mathrm{01.07.}y,\mathrm{31.12.}y]|y\in \left[\mathrm{12,15}\right]\right\}$. It follows that cumulative time intervals overlap, while partial time intervals are disjoint.

Cumulative transaction sets are denoted with ${\mathcal{T}}_{[11\text{s}2,y\text{s}s]}^S$, which refers to all transactions in ${\mathcal{T}}^S$ that were generated between the second semester of 2011 and the $s^{\text{th}}$ semester of y, e.g., ${\mathcal{T}}_{\left[11\text{s}\mathrm{2,14}\text{s}1\right]}^S$ includes transactions generated in the interval $[\mathrm{01.07.11},\mathrm{30.06.14}]$. Partial transaction sets are denoted with ${\mathcal{T}}_{[y\text{s}s,y\text{s}s]}^S\equiv {\mathcal{T}}_{\left[y\text{s}s\right]}^S$, e.g., ${\mathcal{T}}_{\left[14\text{s}1\right]}^S$ refers to transactions generated in the interval $[\mathrm{01.01.14},\mathrm{30.06.14}]$. It is worth noting that while partial transaction sets do not share transactions, they may still share addresses which are used in multiple transactions.

3.3 Address Correspondence Network Construction

Let $\mathrm{w}:\mathcal{A}\times \mathcal{A}\to \mathrm{\mathbb{N}}$ be a function that counts how often an address pair, $\left(a_1,a_2\right)$, is detected by any of the seven heuristics introduced in Section 2.2 as being controlled by the same entity (considering only transactions in ${\mathcal{T}}_{[o,c]}^S$). It is worth noting that $\mathrm{w}$ is symmetric (or undirected), i.e. $\mathrm{w}\left(a_1,a_2\right)=\mathrm{w}\left(a_2,a_1\right)$.

The information captured by applying $\mathrm{w}$ to each pair of addresses in ${\mathcal{A}}_{[o,c]}^S$ is collected in Address Correspondence Networks, defined as undirected weighted graphs ${\mathcal{G}}_{[o,c]}=\left({\mathcal{A}}_{[o,c]}^S,{\mathrm{ℒ}}_{[o,c]},\mathrm{w}\right)$. The construction process is depicted in Figure 2. The addresses in ${\mathcal{A}}_{[o,c]}^S$ are the vertices of the graph, and $\mathrm{w}$ is the weight function. ${\mathrm{ℒ}}_{[o,c]}\subseteq {\mathcal{A}}_{[o,c]}^S\times {\mathcal{A}}_{[o,c]}^S$ is the set of edges connecting address in two ways:

1) Pairs $\left(a_i,a_o\right)$ such that it exists a transaction $t\in {\mathcal{T}}_{[o,c]}^S$ having respectively $a_i$ and $a_o$ in its input and output address sets $i\left(t\right)$ and $\mathrm{o}\left(t\right)$, and having $\mathrm{w}\left(a_i,a_o\right)>0$.

2) Pairs $\left(a_{i_1},a_{i_2}\right)$ such that it exists a transaction $t\in {\mathcal{T}}_{[o,c]}^S$ having both $a_{i_1}$ and $a_{i_2}$ in its input set $i\left(t\right)$, and having $\mathrm{w}\left(a_{i_1},a_{i_2}\right)>0$.

Note that in a transaction, different heuristics can concur by identifying the same address as a change address, increasing the weights of the edges related to such an address. Figure 3 shows the degree distribution of the Address Correspondence Networks ${\mathcal{G}}_{\left[11s\mathrm{2,12}s1\right]}$ and ${\mathcal{G}}_{\left[11s2\right]}$. The two distributions show a similar shape, but note that the left plot is a cumulative graph and the right plot is a partial graph; this indicates that the correspondence networks appear to preserve common properties across time. Table 1 provides descriptive statistics of the 16 Address Correspondence Networks we constructed from the eight partial and cumulative transaction sets. While the degree distributions cannot be assimilated to a single statistical distribution, they are skewed and fat-tailed, features that are recognized in complex networks of different contexts like biological, technological or social interactions [19].

FIGURE 3

FIGURE 3. Degree distribution for cumulative ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}$ and partial ${\mathcal{G}}_{\left[15\text{s}1\right]}$.

TABLE 1

TABLE 1. Number of nodes, edges and ground truth addresses of the partial and cumulative Address Correspondence Networks for each semester from 2012 to 2015.

Figure 4 shows the distribution of ground truth entities in the Address Correspondence Networks. In each plot, we compare a cumulative network and the partial network from its last six months, e.g. ${\mathcal{G}}_{\left[11s\mathrm{2,13}s1\right]}$ with ${\mathcal{G}}_{\left[13s1\right]}$. The number of known entities in the networks from 2012 is small, ${\mathcal{G}}_{\left[12s1\right]}$ and ${\mathcal{G}}_{\left[12s2\right]}$ do not show any relation with their pairs. However, from 2013, the similarity between distributions of known entities of partial and cumulative networks is notorious.

FIGURE 4

FIGURE 4. Distribution of ground truth entity sizes, $\left|{\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}\right|$.

3.4 Address Correspondence Network Clustering

Let ${\mathcal{G}}_{[o,c]}=\left({\mathcal{A}}_{[o,c]}^S,{\mathrm{ℒ}}_{[o,c]},\mathrm{w}\right)$ be the Address Correspondence Network for the time interval $[o,c]$. We approach the entity identification problem by applying a community detection algorithm to ${\mathrm{ℒ}}_{[o,c]}$ (therefore assuming that communities are sets of addresses belonging to the same entity). In ${\mathcal{G}}_{[o,c]}$, highly interconnected vertices are clusters (communities) of addresses linked by one or several heuristics. Community detection algorithms find clusters of vertices highly interconnected but with sparse links between clusters. Specifically, the Label Propagation Algorithm (LPA) by Raghavan et al. [20] finds communities and has linear complexity on the number of edges $\mathcal{O}\left({\mathrm{ℒ}}_{[o,c]}\right)$. The comparative study by Yang et al. [21] shows that the scalability of LPA outperforms other fast clustering algorithms, including Leading Eigenvector by Newman [22], Walktrap by Pons and Latapy [23], and Multilevel by Blondel et al. [24]. In LPA, each node is initialized with a unique label, denoting the cluster it is part of (the controlling entity of an address). In the basic case, all the nodes are initially assigned a random label. Afterward, each node is randomly visited and assigned a label according to the majority voting of its neighbors. The process repeats until every node in the network gets a label to which most of its neighbors belong. Figure 5 shows a clustering for the partial network ${\mathcal{G}}_{\left[12s2\right]}$.

FIGURE 5

FIGURE 5. The Address Correspondence Network ${\mathcal{G}}_{\left[12s2\right]}$. Clusters are identified by color.

To initialize parts of the nodes, we use the information from the ground truth ${\mathrm{e}}^{\mathrm{\star }}$. Let ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$ denote the set of ground truth addresses in ${\mathcal{G}}_{[o,c]}$, i.e., ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}={\mathcal{A}}_{[o,c]}^S\cap {\mathcal{A}}^{\mathrm{\star }}$, and let ${\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}$ be the set of ground truth entities in ${\mathcal{G}}_{[o,c]}$, i.e. ${\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}=\left\{{\mathrm{e}}^{\mathrm{\star }}\left(a\right)\right|\exists a\in {\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\}$. We assign to a subset of nodes ${\mathcal{A}}_{[o,c]}^I\subseteq {\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$ the label from the ground truth, i.e. ${\mathrm{e}}^{\mathrm{\star }}\left(a\right)$. It holds that ${\mathcal{A}}_{[o,c]}^I\subseteq {\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\subseteq {\mathcal{A}}_{[o,c]}^S$ and, concomitantly, $\left|{\mathcal{A}}_{[o,c]}^I\right|\le \left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|\le \left|{\mathcal{A}}_{[o,c]}^S\right|$.

In this paper, we are interested in exploring the ability of community detection algorithms to provide additional information about the true identities of users. We hypothesize that the Address Correspondence Network encodes additional information about the entities that control specific addresses. We argue that successive applications of heuristics may lead to connections between addresses controlled by the same entity that are denser and higher weighted than connections between addresses of different entities. Following this argument, we apply LPA to obtain a disjoint set of clusters ${\mathcal{C}}_{[o,c]}=\left\{{\mathcal{C}}_{[o,c]}^{\left(1\right)},\dots ,{\mathcal{C}}_{[o,c]}^{\left(k\right)}\right\}$, such that ${\cup }_{i=1}^k{\mathcal{C}}_{[o,c]}^{\left(i\right)}={\mathcal{A}}_{[o,c]}^S$. Because of the additional information provided by the ground truth, we modified LPA to avoid that the addresses in ${\mathcal{A}}_{[o,c]}^I$ can change label, as they are associated with the actual entity according to the ground truth information.

In the experiments, we vary the proportion p of initialized nodes, that is defined as:

$p=\left|{\mathcal{A}}_{[o,c]}^I\right|/\left|{\mathcal{A}}_{[o,c]}^S\right|.$

Since $\left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|/\left|{\mathcal{A}}_{[o,c]}^S\right|$ varies across networks and is an upper bound on the proportion of initialized nodes, the domains of the approximated functions also vary.

3.5 Cluster Quality Analysis

Finally, we quantify the clustering quality as a function of cluster size and entity size. Given an Address Correspondence Network ${\mathcal{G}}_{[o,c]}$ and set of clusters ${\mathcal{C}}_{[o,c]}=\left\{{\mathcal{C}}_{[o,c]}^{\left(1\right)},\dots ,{\mathcal{C}}_{[o,c]}^{\left(k\right)}\right\}$ produced by LPA, we analyze the quality of ${\mathcal{C}}_{[o,c]}$ by defining a set of discrete random variables to describe characteristics of the network, and by five metrics: modularity to give information about the intrinsic quality of the clusters (and inherent topological structure of the network), homogeneity, entropy, Adjusted Mutual Information (AMI) and Adjusted Rand Index (ARI) to compare the clusters with the ground truth labels. Furthermore, all metrics are measured as functions of the proportion of initialized nodes p.

3.5.1 Random Variables

To study the characteristics of the network, we define the following discrete random variables associated with the distributions of entities, addresses, and known addresses in the address correspondence network.

The first random variable, E, assumes a value from the set of entities according to their frequency in the correspondence network. More specifically, E can assume the value $e\in {\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}$ with probability equal to the numbers of addresses in ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$ mapped to e, divided by the total number of addresses in ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$, i.e.:

$P\left(e\right)=\frac{\left|\{a\in {\mathcal{A}}_{[o,c]}^{\mathrm{\star }}|e={\mathrm{e}}^{\mathrm{\star }}\left(a\right)\}\right|}{\left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|}.$

In addition to E, we also define variables that assume values in the entity set according to their frequency in specific clusters. Let $E_i$ be the variable associated to the ith cluster, i.e. $i\in [1,|{\mathcal{C}}_{[o,c]}\left|\right]$. For each i, we build a histogram of the frequency of entities in ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$, by counting for each entity e the number of addresses associated to e through the ground truth data in ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$. Such a histogram is used to approximate the distribution of entities over ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$ and serves to describe $E_i$. Formally let ${\mathcal{A}}_{[o,c]}^{\left(i\right)}={\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\cap {\mathcal{C}}_{[o,c]}^{\left(i\right)}$ be the set of addresses in ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$ which are part of the ground truth. $E_i$ can assume a value e in ${\mathrm{ℰ}}_{[o,c]}^{\left(i\right)}=\left\{{\mathrm{e}}^{\mathrm{\star }}\left(a\right)\right|a\in {\mathcal{A}}_{[o,c]}^{\left(i\right)}\}$ with probability:

$P\left(e\right)=\frac{\left|\{a\in {\mathcal{A}}_{[o,c]}^{\left(i\right)}|e={\mathrm{e}}^{\mathrm{\star }}\left(a\right)\}\right|}{\left|{\mathcal{A}}_{[o,c]}^{\left(i\right)}\right|}.$

The variable C assumes a cluster identifier according to its frequency over the addresses in the ground truth. C can assume a value ${\mathcal{C}}_{[o,c]}^{\left(i\right)}\in {\mathcal{C}}_{[o,c]}$ with probability defined by the number of addresses in ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$ and ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$ (i.e. ${\mathcal{A}}_{[o,c]}^{\left(i\right)}$) divided by the total number of addresses in ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$, i.e.:

$P\left({\mathcal{C}}_{[o,c]}^{\left(i\right)}\right)=\frac{\left|{\mathcal{A}}_{[o,c]}^{\left(i\right)}\right|}{\left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|}.$

Finally, we define variables complementary to $E_i$ to describe the frequency of clusters among each entity. We indicate with $C_j$ the variable associated to the jth entity $e_j$, with $j\in [1,|{\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}\left|\right]$. Given the entity $e_j$, we build the histogram of the appearance of $e_j$ in each cluster of ${\mathcal{C}}_{[o,c]}$. As for the $E_i$ variables, we approximate the real distribution using the ground truth data, and considering only the addresses from ${\mathcal{A}}^{\mathrm{\star }}$ to build the bins. Formally, $C_j$ can assume values in ${\mathcal{C}}_{[o,c]}$ with probability:

$P\left({\mathcal{C}}_{[o,c]}^{\left(i\right)}\right)=\frac{\left|\{a\in {\mathcal{C}}_{[o,c]}^{\left(i\right)}|e_j={\mathrm{e}}^{\mathrm{\star }}\left(a\right)\}\right|}{\left|\{a\in {\mathcal{A}}_{[o,c]}^{\mathrm{\star }}|e_j={\mathrm{e}}^{\mathrm{\star }}\left(a\right)\}\right|}.$

3.5.2 Metrics

Modularity, initially proposed by Newman and Girvan [25], compares the clusters with a random baseline. This is done by computing the difference between the number of edges inside the clusters with the expected value of edges using the same clusters but with random connections between the nodes. Let $\left|{\mathcal{C}}_{[o,c]}\right|$ be the number of clusters in the Address Correspondence Network ${\mathcal{G}}_{[o,c]}$, $q_{ij}$ the ratio of edges connecting addresses between cluster ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$ and cluster ${\mathcal{C}}_{[o,c]}^{\left(j\right)}$, and $r_i={\displaystyle \sum }_j{q}_{ij}$ the ratio of edges with at least one end in ${\mathcal{C}}_{[o,c]}^{\left(i\right)}$. The modularity is defined as:

$Q={\displaystyle \sum }_{i=1}^{\left|{\mathcal{C}}_{[o,c]}\right|}\left(q_{ii}-r_i^2\right).$

A value close to 0 indicates that the community structure is akin to a random network, while values close to 1 indicate strong community structures, meaning dense connections inside the communities and sparse connections between them.

Information Theory Metrics: Entropy, introduced in an information theory context by Shannon [26], quantifies the expected amount of information or uncertainty contained in a random variable. Let X be a discrete random variable, which can assume values $\left\{x_1,x_2,\dots ,x_k\right\}$ with probability $\left\{P\left(x_1\right),P\left(x_2\right),\dots ,P\left(x_k\right)\right\}$. The entropy of X is defined as:

$H\left(X\right)=-{\displaystyle \sum }_{x\in 1}^{k}P\left(x\right){\text{log}}_{2}P\left(x\right),$

while the normalized Shannon entropy is:

$\widehat{H}\left(X\right)=\frac{H\left(X\right)}{H_{max}\left(X\right)}=\frac{H\left(X\right)}{{\text{log}}_2\left(k\right)}.$

We use the normalized entropy of $E_i$ and $C_j$ to study the clusters by the perspective of the entities and the one of the cluster themselves.

Entropy also gives important information of the interrelation between random variables. Let us consider two variables X and Y, and let $P\left(X,Y\right)$ be the joint probability distribution. The conditional entropy $H\left(Y|X\right)$ is defined as:

$H\left(Y|X\right)=-{\displaystyle \sum }_{x\in X,y\in Y}P\left(x,y\right)\frac{{\text{log}}_{2}P\left(x,y\right)}{P\left(x\right)}$

The conditional entropy indicates how much extra information is needed to describe Y given that X is known. Additionally, the amount of information needed on average to specify the value of two random variables is $H\left(X,Y\right)=H\left(X|Y\right)+H\left(Y\right)$.

We use conditional entropy to measure the quality of the clusters. We do it by comparing them with the distribution of the entities in the Address Correspondence Network, exploiting the variables E and C. Such a measure is named homogeneity and is initially introduced by Rosenberg and Hirschberg [27]. Ideally, a cluster should only contain addresses that are controlled by the same entity. In such a case, clusters are homogeneous and it holds $H\left(E|C\right)=0$. The homogeneity score $h\in \left[\mathrm{0,1}\right]$ is defined by:

$h=\{\begin{array}{ll}1\hfill & \text{if}H\left(E,C\right)=0\hfill \\ 1-H\left(E|C\right)/H\left(E\right)\hfill & \text{otherwise}\hfill \end{array}.$

The fundamental Mutual Information (MI) [28] quantifies the agreement between partitions. In addition to ${\mathcal{C}}_{[o,c]}$, let ${\mathcal{K}}_{[o,c]}=\left\{{\mathcal{K}}_{[o,c]}^{\left(1\right)},\dots ,{\mathcal{K}}_{[o,c]}^{\left(k\right)}\right\}$ be an alternative set of clusters. We introduce the variable K to describe the distribution of the addresses in ${\mathcal{K}}_{[o,c]}$, similarly to how we defined C for ${\mathcal{C}}_{[o,c]}$ in Section 3.5.1. The MI of C and K is defined as:

$\text{MI}\left(C,K\right)=H\left(K\right)-H\left(K|C\right),$

and quantifies the reduction of the uncertainty of ${\mathcal{C}}_{[o,c]}$ due to the knowledge of ${\mathcal{K}}_{[o,c]}$. The average MI value between ${\mathcal{C}}_{[o,c]}$ and ${\mathcal{K}}_{[o,c]}$ tends to increase as the number of clusters increases, even if there is no difference in the clustering methodology, e.g. if the partitions are assigned clusters randomly. The Adjusted Mutual Information defined by Vinh et al. [29] takes into account the randomness using the expected value of MI $E\left[\text{MI}\right]$ and normalizes its value:

$\text{AMI}\left(C,K\right)=\frac{\text{MI}\left(C,K\right)-E\left[\text{MI}\left(C,K\right)\right]}{\langle H\left(C,K\right)\rangle -E\left[\text{MI}\left(C,K\right)\right]}.$

AMI gets values in the $\left[\mathrm{0,1}\right]$ interval, and when two partitions perfectly match, $\text{AMI}=1$.

Finally, we consider the Rand Index (RI), initially proposed by Rand [30], which compares two set of clusters while ignoring permutations. Let ${\mathcal{C}}_{[o,c]}$ and ${\mathcal{K}}_{[o,c]}$ be two sets of clusters. Let $x\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)$ be the number of pairs of addresses from the ground truth ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$ which are in the same cluster in ${\mathcal{C}}_{[o,c]}$ and in the same cluster in ${\mathcal{K}}_{[o,c]}$, i.e.:

$x\left({\mathcal{C}}_{\left[o,c\right]},{\mathcal{K}}_{\left[o,c\right]}\right)=\left|\{(a_1,a_2)\right|a_1,a_2\in {\mathcal{A}}_{[o,c]}^{\mathrm{\star }},a_1\ne a_2$

$\wedge \exists {\mathcal{C}}_{[o,c]}^{\left(i\right)}\in {\mathcal{C}}_{[o,c]}:a_1,a_2\in {\mathcal{C}}_{[o,c]}^{\left(i\right)}$

$\wedge \exists {\mathcal{K}}_{[o,c]}^{\left(j\right)}\in {\mathcal{K}}_{[o,c]}:a_1,a_2\in {\mathcal{K}}_{[o,c]}^{\left(j\right)}\}$

and let $y\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)$ be the number of address pairs from the ground truth ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$ which are in different clusters of ${\mathcal{C}}_{[o,c]}$ and in different clusters of ${\mathcal{K}}_{[o,c]}$, i.e.:

$y({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]})=\left|\{(a_1,a_2)\right|a_1,a_2\in {\mathcal{A}}_{[o,c]}^{\mathrm{\star }},a_1\ne a_2$

$\wedge \exists {\mathcal{C}}_{[o,c]}^{\left(i\right)},{\mathcal{C}}_{[o,c]}^{\left(j\right)}\in {\mathcal{C}}_{[o,c]}:a_1\in {\mathcal{C}}_{[o,c]}^{\left(i\right)},a_2\in {\mathcal{C}}_{[o,c]}^{\left(j\right)},i\ne j$

$\wedge \exists {\mathcal{K}}_{[o,c]}^{\left(k\right)},{\mathcal{K}}_{[o,c]}^{\left(l\right)}\in {\mathcal{K}}_{[o,c]}:a_1\in {\mathcal{K}}_{[o,c]}^{\left(k\right)},a_2\in {\mathcal{K}}_{[o,c]}^{\left(l\right)},k\ne l\}$

The Rand Index is defined as:

$\text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)=\frac{x\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)+y\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)}{\left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|\times \left(\left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|-1\right)},$

where the denominator is the number of address pairs in ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$. As with MI/AMI, we consider an adjusted version of RI, the Adjusted Rand Index (ARI) as proposed by Hubert and Arabie [31], which accounts for chance:

$\text{ARI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)=\frac{\text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)-E\left[\text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)\right]}{\text{max}\langle \text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)\rangle -E\left[\text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)\right]},$

where $E\left[\text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)\right]$ denotes the expected value of $\text{RI}\left({\mathcal{C}}_{[o,c]},{\mathcal{K}}_{[o,c]}\right)$. As for AMI, an ARI value of 1 indicates perfectly matching partitions, while a value of 0 indicates independent partitions. Warrens [32] shows that ARI is equivalent to Cohen’s Kappa Cohen [33], which is well suited for the evaluation of community detection methods, as discussed by Liu et al. [34].

4 Results

We first analyze the size of the clusters identified by LPA for the Address Correspondence Networks described in Section 3, whose statistics are shown in Table 1. Figure 6 shows the cluster size distribution of ${\mathcal{G}}_{\left[11s\mathrm{2,13}s1\right]}$ and ${\mathcal{G}}_{\left[15s1\right]}$, for initialization proportions $p=0$ and $p=0.1$. Note that the density of the small clusters, in both cases, shifts to reach larger cluster sizes when $p=0.1$, as well as the maximum cluster size of ${\mathcal{G}}_{\left[11s\mathrm{2,13}s1\right]}$. This indicates that even a small proportion of initialized nodes, such as $p=0.1$, considerably modifies the cluster distribution in the networks.

FIGURE 6

FIGURE 6. Cluster size distribution of ${\mathcal{G}}_{\left[11s\mathrm{2,13}s1\right]}$ and ${\mathcal{G}}_{\left[15s1\right]}$ for p = 0.0$p=0.0$ and p = 0.1$p=0.1$. The alpha values of the power-law distribution fits are also shown.

We also fit a power-law distribution to the cluster size distribution, shown by the dotted red lines with the corresponding alpha values in Figure 6. Furthermore, the power-law distribution fits the data significantly better than an exponential distribution, resulting in p-values of less than $0.1\text{\%}$ using likelihood ratio tests [35]. The exponents are larger for p = 0$p=0$ than for p = 0.1$p=0.1$, in agreement with the observation related to the range of values in the cluster size. In general, the distributions are very heterogeneous. Additionally, the cluster size distribution suggests that, from a Correspondence Network perspective, there is a preferential attachment dynamic in the address generation where entities that control many addresses are likely to generate more addresses than others.

Next, we study the behavior of the intra-cluster total degree (number of edges connecting nodes that belong to the same cluster) and the inter-cluster degree (number of edges between nodes that belong to different clusters) as functions of the cluster size. For the total intra-cluster degree, there are two extreme behaviors that can be expected. On the one hand, a linear dependency on cluster size would signal that address reuse is negligible (therefore that privacy-preserving usage are commonplace), and the topology of the correspondence network encodes no additional information about the identity of the users that control the addresses. On the other hand, a quadratic relationship (close to the theoretical maximum $\propto c\left(c-1\right)/2$) would signal that the clusters are very densely interconnected, and the actual address reuse is high. Therefore, it would be possible to infer actual information about the users by directly inspecting the correspondence network through network science methods. In Figure 7, the extreme values of the intra-cluster degree of ${\mathcal{G}}_{11s\mathrm{2,13}s1}$ and ${\mathcal{G}}_{15s1}$ are above a linear function (red dotted line) and below a quadratic function (yellow dashed line) of the cluster size. The same lines are depicted in the inter-cluster degree distributions showing that the intra-cluster degree grows faster. By applying an Ordinary Least Squares regression (OLS), the slope of a fitting line is in both networks bigger in the intra-cluster case. Furthermore, bigger entities preserve this behavior, showing that the correspondence network has an inherent community structure. Thus, this result is not valid only for entities that control a small number of addresses, and it follows that it is a general property of the network.

FIGURE 7

FIGURE 7. Comparison of the total intra-cluster and inter-cluster degrees for ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}$ and ${\mathcal{G}}_{\left[15\text{s}1\right]}$. We also show the lines $y=x$ (red, dotted) and $y=x\left(x-1\right)/2$ (yellow, dashed).

Figure 8 shows the number of clusters returned by LPA, $\left|{\mathcal{C}}_{[o,c]}\right|$, as a function of p. The dashed lines indicate the number of entities $\left|{\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}\right|$ for each Address Correspondence Network. $\left|{\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}\right|$ is a lower bound of the true number of entities, since each network also contains addresses not in the ground truth. This is supported by $\left|{\mathcal{C}}_{[o,c]}\right|\ge \left|{\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}\right|$ holding for each test point. In general, $\left|{\mathcal{C}}_{[o,c]}\right|$ decreases sharply at small p, after which the rate of decrease slows and stabilises. $\left|{\mathcal{C}}_{[o,c]}\right|$ tends to be lower for partial networks than for cumulative networks, and can be explained by partial networks having a lower $\left|{\mathrm{ℰ}}_{[o,c]}^{\mathrm{\star }}\right|$.

FIGURE 8

FIGURE 8. Number of clusters as a function of p.

The complexity and structure of the Address Correspondence Network are stable over time: Figures 9–11 show AMI, ARI and homogeneity as functions of p. Since these metrics require ground truth labels, they are computed only for addresses in ${\mathcal{A}}_{[o,c]}^{\mathrm{\star }}$. We observe that AMI and ARI lead to similar results: they rapidly increase before converging to the maximum value as p increases. In contrast, homogeneity exhibits no such initial rapid increase, and instead increases linearly with p. The mean levels of AMI, ARI and homogeneity do not consistently increase or decrease with increasing half-year. Furthermore, the mean metric levels for the partial networks appear to be comparable to those for the cumulative networks. This suggests that the complexity and structure of the Address Correspondence Network communities remain stable over time.

FIGURE 9

FIGURE 9. AMI as a function of p.

FIGURE 10

FIGURE 10. ARI as a function of p.

FIGURE 11

FIGURE 11. Homogeneity as a function of p.

The effect of the node initialization: If the cost of labeling a Bitcoin address is assumed to be constant, the marginal gain in clustering quality per unit cost from increasing p quickly declines. Considering that homogeneity remains constant across all p, it appears that increasing p is cost-effective until around $p=0.1$. At this point, ${\mathcal{A}}_{[o,c]}^I$ contains most of the information required to describe the community structure. The observed saturations in $\left|{\mathcal{C}}_{[o,c]}\right|$, AMI and ARI suggest that increasing p beyond 0.1 adds only idiosyncratic community information, yielding little improvement in clustering quality. This is further confirmed by studying clustering modularity as a function of p in Figure 11. Modularity appears mostly constant except for a sharp initial change, showing a robust community topology that is consistently detected after initializing a small proportion of nodes.

To assert the significance of the results presented in Figures 8–12, we repeated the experiments for 100 randomized versions of the ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}$ and ${\mathcal{G}}_{\left[15\text{s}1\right]}$ Address Correspondence Networks. The i$i-$th randomized network was obtained by performing $4i\cdot \left|{\mathrm{ℒ}}_{[o,c]}\right|$ edge swaps on the original network, according to the algorithm proposed by Maslov [36], which preserves the network’s degree distribution. With the exception of $\left|{\mathcal{C}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}\right|$ for ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}$, the randomized results show little variation. However, all randomized results appear significantly different to those for the original networks. This suggests that the (non-randomized) results shown in Figures 8–12 are a consequence of more complex network properties rather than solely the degree distribution.

FIGURE 12

FIGURE 12. Modularity as a function of p.

Furthermore, the effect of node initialization order was studied by repeating the experiments for the ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}$ and ${\mathcal{G}}_{\left[15\text{s}1\right]}$ networks using 100 random orderings. The node initialization order does not seem to affect the general level and shape of the curves. Small perturbations observed in Figures 8–12 appear to be idiosyncrasies of the chosen ordering, and may be larger for smaller networks (since the curves for ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,13}\text{s}1\right]}$ vary more than the ones for ${\mathcal{G}}_{\left[15\text{s}1\right]}$).

The effect of cluster and entity sizes: Figure 13 shows $\widehat{H}\left(E_i\right)$ and $\widehat{H}\left(C_j\right)$ for the ${\mathcal{G}}_{\left[14\text{s}1\right]}$, ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,14}\text{s}1\right]}$, ${\mathcal{G}}_{\left[15\text{s}2\right]}$ and ${\mathcal{G}}_{\left[11\text{s}\mathrm{2,15}\text{s}2\right]}$ networks. $\widehat{H}\left(E_i\right)$ and $\widehat{H}\left(C_j\right)$ are expressed as functions of the relative cluster and entity sizes, i.e. normalized to $\left|{\mathcal{A}}_{[o,c]}^{\mathrm{\star }}\right|$, respectively. We run experiments with $p=0$ and $p=0.1$. We note that $\widehat{H}\left(E_i\right)$ correlates negatively with the relative cluster size, and $\widehat{H}\left(C_j\right)$ correlates negatively with relative entity size. For small clusters and entities, there are strips of points located at the minimum and maximum values of $\widehat{H}\left(E_i\right)$ and $\widehat{H}\left(C_j\right)$. This is to be expected: if we consider a cluster with only two addresses, both associated with the same entity, $\widehat{H}\left(E_i\right)$ is minimum. If two addresses are mapped to different entities, we obtain a uniform entity label distribution, and $\widehat{H}\left(E_i\right)$ is maximum. Such extreme fluctuations become less likely as cluster size increases. Large clusters, therefore, tend to be purer than smaller clusters, corresponding to a higher clustering quality. Similarly, entities represented by more addresses are distributed more asymmetrically across clusters, again corresponding to a higher clustering quality. This is in agreement with the results in Figure 7, where the community structure is shown to become more apparent for larger clusters.

FIGURE 13

FIGURE 13. Normalized entropy as a function of relative cluster size and relative entity size.

Furthermore, the mean levels of $\widehat{H}\left(E_i\right)$ and $\widehat{H}\left(C_j\right)$ for the partial networks are always less than or equal to the ones of the corresponding cumulative networks (comparing row 1–3 and row 2–4 in Figure 13). This suggests that partial networks allow a higher quality of interpretation regarding the community structure. A possible explanation for this is that Bitcoin entities have less time to obfuscate their activity: the longer the considered transaction history, the more the obfuscation attempts accumulate and the more difficult it becomes to detect the true community structure.

Interestingly, the average $\widehat{H}\left(E_i\right)$ and $\widehat{H}\left(C_j\right)$ increase after initialising $10\text{\%}$ of nodes. The increase in $\widehat{H}\left(E_i\right)$ can be explained by the loss of small, homogeneous clusters with low $\widehat{H}\left(E_i\right)$. For $\widehat{H}\left(C_j\right)$, the increase is likely due to the decrease in the number of clusters, which in turn causes $H_{max}\left(E_i\right)$ to decrease.

5 Conclusion and Future Work

In this paper, we consider the application of a general-purpose community detection algorithm, LPA, to detect address clusters that are controlled by the same entity in the Bitcoin transaction history. Specifically, we apply LPA to Address Correspondence Networks, which incorporate information from a variety of simple address linking heuristics. We detect a strong community structure within these networks by inspecting their intra- and inter-cluster degrees. We find that the inter-cluster degree grows faster than the inter-cluster degree for cluster size increments. Address correspondence networks are therefore suitable for the application of general community detection methods from the broader field of network science—this creates an entry point for future researchers to move far beyond the application of primitive heuristics.

Since LPA is able to exploit ground truth information, we find that clustering quality improves as the number of labeled addresses in the Address Correspondence Networks increases. However, under the assumption that the cost of labeling a Bitcoin address is constant, we find that the marginal gain in clustering quality per unit cost quickly declines. Under this assumption, we propose that address labeling is cost-effective until around p = 0.1 $p=0.1$, i.e. until 10% of all addresses in the Address Correspondence Network are identified. Furthermore, we find that choosing which addresses to label does not have a significant effect on clustering quality. Finally, we find that the structure of communities in the Address Correspondence Network remains stable over time. Partial Address Correspondence Networks are, therefore, reasonable proxies for their cumulative counterparts (and far less demanding from a computational point of view).

For future work, we plan to conduct experiments to test the robustness of the heuristics and specific combinations between them. For example, analyzing their likelihood and studying their contribution to the links between addresses. From a network reconstruction perspective, link prediction is an interesting approach to improve the correspondence network by validating current links and predicting missing ones. Additionally, different machine learning approaches can be implemented to graph analysis; supervised methods are suitable if more ground truth information is available in the future.

Data Availability Statement

Publicly available datasets were analyzed in this study. This data can be found here: https://bitcoin.org/en/download, https://www.walletexplorer.com/.

Author Contributions

JF and AP developed the software, curated the data, run the analyses, created the visualizations, and wrote the initial draft. DD and CT contributed with the conceptualization and methodology, supervised the study and reviewed and edited the text. AB supervised the study and reviewed and edited the text. All authors discussed the results. All authors worked and agreed on the final version.

Funding

DD acknowledges partial funding from by the Swiss National Science foundation under contract #407550_167177. CT acknowledges financial support from the University of Zurich through the University Research Priority Program on Social Networks.

Conflict of Interest

The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.

Footnotes

¹We represent dates in the use the DD.MM.YY format.

References

1. Foley S, Karlsen JR, Putniņš TJ. Sex, Drugs, and Bitcoin: How Much Illegal Activity Is Financed through Cryptocurrencies? Rev Financial Stud (2019) 32:1798–853. doi:10.1093/rfs/hhz015

CrossRef Full Text | Google Scholar

2. Gaihre A, Luo Y, Liu H. Do Bitcoin Users Really Care about Anonymity? an Analysis of the Bitcoin Transaction Graph. In: 2018 IEEE International Conference on Big Data (Big Data) (2018). p. 1198–207. doi:10.1109/BigData.2018.8622442

CrossRef Full Text | Google Scholar

3. Meiklejohn S, Pomarole M, Jordan G, Levchenko K, McCoy D, Voelker GM, et al. A Fistful of Bitcoins. Commun ACM (2016) 59:86–93. doi:10.1145/2896384

CrossRef Full Text | Google Scholar

4. Kondor D, Pósfai M, Csabai I, Vattay G. Do the Rich Get Richer? an Empirical Analysis of the Bitcoin Transaction Network. PLoS ONE (2014) 9:e86197. doi:10.1371/journal.pone.0086197

PubMed Abstract | CrossRef Full Text | Google Scholar

5. Javarone MA, Wright CS. From Bitcoin to Bitcoin Cash. Proc 1st Workshop Cryptocurrencies Blockchains Distributed Syst (2018):77–81. doi:10.1145/3211933.3211947

CrossRef Full Text | Google Scholar

6. Vallarano N, Tessone CJ, Squartini T. Bitcoin Transaction Networks: An Overview of Recent Results. Front Phys (2020) 8:286. doi:10.3389/fphy.2020.00286

7. Bovet A, Campajola C, Mottes F, Restocchi V, Vallarano N, Squartini T, et al. The Evolving Liaisons between the Transaction Networks of Bitcoin and its price Dynamics. arXiv:1907.03577 [physics, q-fin] ArXiv (2019) 1907:03577.

Google Scholar

8. Nakamoto S. Bitcoin: A Peer-To-Peer Electronic Cash System (2008). Available at SSRN: https://ssrn.com/abstract=3440802

9. Kalodner H, Goldfeder S, Chator A, Möser M, Narayanan A. BlockSci: Design and Applications of a Blockchain Analysis Platform. arXiv:1709.02489 [cs] ArXiv (2017) 1709:02489.

Google Scholar

10. Nick JD. Data-Driven De-anonymization in Bitcoin. Tech. Rep. Zurich: ETH Zurich (2015).

11. Harrigan M, Fretter C. “The Unreasonable Effectiveness of Address Clustering”. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld) (2016), 368–373. doi:10.1109/UIC-ATC-ScalCom-CBDCom-IoP-SmartWorld.2016.0071

CrossRef Full Text | Google Scholar

12. Fleder M, Kester MS, Pillai S. Bitcoin Transaction Graph Analysis. arXiv:1502.01657 [cs] ArXiv (2015) 1502:01657.

Google Scholar

13. Zhang Y, Wang J, Luo J. Heuristic-Based Address Clustering in Bitcoin. IEEE Access (2020) 8:210582–91. doi:10.1109/ACCESS.2020.3039570

CrossRef Full Text | Google Scholar

14. Patel Y. Deanonymizing Bitcoin Transactions an Investigative Study on Large-Scale Graph Clustering. Princeton University Senior Theses, Princeton University (2018).

15. Ermilov D, Panov M, Yanovich Y. Automatic Bitcoin Address Clustering. In: 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA). Mexico: Cancun IEEE (2017). p. 461–6. doi:10.1109/ICMLA.2017.0-118

CrossRef Full Text | Google Scholar

16. Biryukov A, Tikhomirov S. Deanonymization and Linkability of Cryptocurrency Transactions Based on Network Analysis. In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P). Stockholm, Sweden: IEEE (2019). p. 172–84. doi:10.1109/EuroSP.2019.00022

CrossRef Full Text | Google Scholar

17. Harlev MA, Sun Yin H, Langenheldt KC, Mukkamala RR, Vatrapu R. Breaking Bad: De-anonymising Entity Types on the Bitcoin Blockchain Using Supervised Machine Learning. In: Proceedings of the 51st Hawaii International Conference on System Sciences 2018. United States: Hawaii International Conference on System Sciences (HICSS) (2018). p. 3497–506. Proceedings of the Annual Hawaii International Conference on System Sciences.

Google Scholar

18.[Dataset] Janda A. WalletExplorer.com: Smart Bitcoin Block Explorer (2017).

19. Barabási A-L, Bonabeau E. Scale-Free Networks. Sci Am (2003) 288:60–9. doi:10.1038/scientificamerican0503-60

CrossRef Full Text | Google Scholar

20. Raghavan UN, Albert R, Kumara S. Near Linear Time Algorithm to Detect Community Structures in Large-Scale Networks. Phys Rev E (2007) 76:036106. doi:10.1103/PhysRevE.76.036106

CrossRef Full Text | Google Scholar

21. Yang Z, Algesheimer R, Tessone CJ. A Comparative Analysis of Community Detection Algorithms on Artificial Networks. Sci Rep (2016) 6:30750. doi:10.1038/srep30750

PubMed Abstract | CrossRef Full Text | Google Scholar

22. Newman MEJ. Finding Community Structure in Networks Using the Eigenvectors of Matrices. Phys Rev E (2006) 74:036104. doi:10.1103/PhysRevE.74.036104

CrossRef Full Text | Google Scholar

23. Pons P, Latapy M. Computing Communities in Large Networks Using Random Walks. Jgaa (2006) 10:191–218. doi:10.7155/jgaa.00124

CrossRef Full Text | Google Scholar

24. Blondel VD, Guillaume J-L, Lambiotte R, Lefebvre E. Fast Unfolding of Communities in Large Networks. J Stat Mech (2008) 2008:P10008. doi:10.1088/1742-5468/2008/10/p10008

CrossRef Full Text | Google Scholar

25. Newman MEJ, Girvan M. Finding and Evaluating Community Structure in Networks. Phys Rev E (2004) 69. doi:10.1103/physreve.69.026113

CrossRef Full Text | Google Scholar

26. Shannon CE. A Mathematical Theory of Communication. Bell Syst Tech J (1948) 27:379–423. doi:10.1002/j.1538-7305.1948.tb01338.x

CrossRef Full Text | Google Scholar

27. Rosenberg A, Hirschberg J. V-measure: A Conditional Entropy-Based External Cluster Evaluation Measure. In: Proceedings of the 2007 Joint Conference on Empirical Methods in Natural Language Processing and Computational Natural Language Learning (EMNLP-CoNLL). Prague, Czech Republic: Association for Computational Linguistics (2007). p. 410–20.

Google Scholar

28. Cover TM, Thomas JA. Elements of Information Theory (Wiley Series in Telecommunications and Signal Processing). USA: Wiley-Interscience (2006).

29. Vinh NX, Epps J, Bailey J. Information Theoretic Measures for Clusterings Comparison: Variants, Properties, Normalization and Correction for Chance. J Machine Learn Res (2010) 11:2837–54.

Google Scholar

30. Rand WM. Objective Criteria for the Evaluation of Clustering Methods. J Am Stat Assoc (1971) 66:846–50. doi:10.1080/01621459.1971.10482356

CrossRef Full Text | Google Scholar

31. Hubert L, Arabie P. Comparing Partitions. J Classification (1985) 2:193–218. doi:10.1007/BF01908075

CrossRef Full Text | Google Scholar

32. Warrens MJ. On the Equivalence of Cohen's Kappa and the Hubert-Arabie Adjusted Rand Index. J Classif (2008) 25:177–83. doi:10.1007/s00357-008-9023-7

CrossRef Full Text | Google Scholar

33. Cohen J. A Coefficient of Agreement for Nominal Scales. Educ Psychol Meas (1960) 20:37–46. doi:10.1177/001316446002000104

CrossRef Full Text | Google Scholar

34. Liu X, Cheng H-M, Zhang Z-Y. Evaluation of Community Detection Methods. IEEE Trans Knowl Data Eng (2019) 32:1. doi:10.1109/TKDE.2019.2911943

CrossRef Full Text | Google Scholar

35. Clauset A, Shalizi CR, Newman MEJ. Power-Law Distributions in Empirical Data. SIAM Rev (2009) 51:661–703. doi:10.1137/070710111

CrossRef Full Text | Google Scholar

36. Maslov S. Specificity and Stability in Topology of Protein Networks. Science (2002) 296:910–3. doi:10.1126/science.1065103

PubMed Abstract | CrossRef Full Text | Google Scholar