The Traceability of Bitcoin’s Unspent Transaction Output System

During the 35th Annual ACFE Global Fraud Conference, Sean Tweed, CFE, gave fraud investigators an overview of Bitcoin and how it can be used to trace funds across different addresses in his session titled, “The Traceability of Bitcoin’s Unspent Transaction Output System”. Contrary to popular belief, Bitcoin was not created by criminals to be an untraceable tool for money laundering. Criminals have exploited it, but its model was actually created to make transactions public and traceable.  

Tweed explained that most individuals involved in transactions of Bitcoin use pseudonyms. However, unspent transaction output systems can allow investigators to make deductions and therefore break down pseudonymity. Because every input is an unspent output, investigators can trace funds across different addresses. 

This is seen in an account-based model. When a person receives a certain amount of Bitcoin and sends some of it to another person, the unused Bitcoin (or leftover amount) goes to a change address. This is called an unspent transaction output. The creation of the new address can be understood as a change address detection heuristic. 

Another bitcoin heuristic that investigators can use is that if two addresses are inputs to the same transaction, then one can conclude they are controlled by the same user. This is because the one-time change address is controlled by the same user as the unput addresses. 

The majority of Tweed’s clients in his cryptocurrency investigations are victims of investment schemes. His goal in an investigation is to follow the money and then find an exit point. He traces funds until they are transferred to a cryptocurrency exchange where he can discover addresses associated with the exchanges. 

Understanding the transaction output systems and heuristics can also allow investigators to trace back through transactions and find additional victims. The victim will have sent Bitcoin to the fraudster’s address, which the fraudster combines with other inputs into the same change address.  

A fraudster using Bitcoin will try to make their funds difficult to trace, but informed investigators can use Bitcoin’s transaction output system to identify potential fraud.