2018 Day 1 - John Bambanek: Adventures in BitCoin Surveillance

### Overview In this presentation, John Bambanek, Vice President of Research and Intelligence at ThreatSTOP and lecturer at the University of Illinois, explores how blockchain surveillance can be leveraged by intelligence analysts and law enforcement to track threat actors. While acknowledging personal skepticism regarding the long-term economic viability of cryptocurrency, Bambanek explains that the public, immutable nature of Bitcoin’s ledger makes it an exceptional environment for tracking illicit financial flows, ranging from white supremacist fundraising to nation-state cybercrime and ransomware operations.

### Key Topics - **Anonymity vs. Privacy:** Bambanek emphasizes that Bitcoin addresses provide pseudonymous anonymity rather than privacy. Because the ledger is completely public, transactions, volumes, timestamps, and wallet relationships are exposed throughout time. When threat actors publicly solicit funds on social media (e.g., Twitter, Gab) or websites, attribution simply becomes an open-source intelligence and search engine problem. - **The Chokepoints of Cryptocurrency:** Although cold storage and multi-signature security techniques exist, user laziness and the ultimate requirement to cash out digital assets funnel cryptocurrency into centralized exchanges. Bambanek notes that the top 10 cryptocurrency exchanges account for roughly 70% of market capitalization, making these centralized entities critical pressure points for intelligence subpoenas and blacklisting. - **Tracking Extremist Financing:** Following the 2017 Charlottesville rally, Bambanek tracked Bitcoin donations to white supremacist figures and outlets, including the Daily Stormer, Counter-Currents, Richard Spencer, and 'weev'. By publishing automated real-time transaction tracking on Twitter, potential donors realized the groups were already sitting on hundreds of thousands to nearly a million dollars in assets, hampering further fundraising appeals. - **Altcoins and Nation-State Tracking:** Bambanek discusses bridging tracking across altcoins like Monero. Although Monero obfuscates transaction amounts directly, Bambanek tracked conversions across intermediary services, uncovering Monero deposit addresses used by North Korean actors laundering WannaCry ransomware proceeds. - **Transaction Pattern Analysis:** Bambanek outlines methods to scan for behavioral markers, such as searching via Blockchair for specific donation numbers like '1488' (a neo-Nazi numeric code), uncovering thousands of transactions. He also developed 'Big Bitcoin', a parser monitoring blocks for large transfers of $500,000 or more to study whale movements and potential extortion payments.

### Technical Details - **Monitoring Tools:** Forked the automated WannaCry Twitter tracker to build real-time monitoring bots for neo-Nazi wallets, converting on-chain quantities into estimated fiat values via exchange rate APIs. - **Heuristics & Signals:** Used Blockchair's API to query exact transaction amounts (such as 14.88, 0.1488, or 0.01488 BTC), identifying approximately 4,500 transactions and over 4,200 previously unlinked wallets. - **Large-Value Detection:** Implemented an automated parser for incoming Bitcoin blocks that filtered out circular exchange self-dealing to aggregate and report transactions exceeding $500,000 USD equivalent.

### Takeaways Cryptocurrency surveillance offers powerful investigative visibility because all historical transactions remain on the ledger forever. The primary vulnerability in cryptocurrency ecosystems lies not in the underlying cryptographic math, but in the centralized exchanges required to liquidate digital holdings into fiat currency. Investigators and enterprises can effectively disrupt illicit actors by monitoring public transactions, pressuring exchanges to enforce blacklists, and analyzing specific transactional signals.