Blockchain forensics ends double spending debate – Cointelegraph Magazine

Ten years after Ethereum's initial coin offering, which sold approximately 60 million ether and raised $18.5 million in Bitcoin, debates about the involvement of various fraud schemes still swirl on social media.

One theory posits that the founders of Ethereum allow investors to artificially increase the success of the ICO by blocking the sale of a large share of Ether under their control.

Magazine conducted a joint investigation with Canada-based blockchain forensics experts at Gray Wolf Analytics to determine whether the ICO's alleged fraudulent pre-sale terms and conditions included double-spending of Bitcoin. The investigation looked for any bitcoins that were deposited, withdrawn, and deposited back into pre-sale wallets.

Three withdrawals were made during the sale. The Ethereum team withdrew approximately 3,800 Bitcoin from the ICO deposit address, also known as the exodus wallet, saying it would use it to cover operational costs and loans. Upon investigation, some subsequent transactions associated with these flows created a cycle in which a relatively small amount of Bitcoin was returned to the depositor's address.

However, while some of the transactions initially showed double-spending characteristics during the investigation, further analysis revealed that the funds in question did not come from the pre-sale address.

Chedi Mbaga, head of forensics at Gray Wolf, told the magazine: “We have concluded with a high degree of certainty that this is not the same BTC that was removed from the migration address.

However, the investigation found some funds with illegal origins, suggesting that bad actors used the Ethereum ICO to launder dirty Bitcoin for pure Ether.

In the year Participating in the Ethereum ICO in 2014 was very easy. All you need to do this is some bitcoins and an email address.

In one example, Gray Wolf's forensic analysis of 499 Bitcoin – the second largest single purchase in an ICO – sought BTC-e, known to serve illegal actors and launder the proceeds of crime.

Although the investigation did not find double costs in the pre-sale of Ethereum, it was clear that no action was taken to limit the sale of Ethereum to illegal actors.

The Ethereum Foundation did not respond to requests for comment.

This is where accusations of double spending can occur.

Approximately 3,800 bitcoins were withdrawn from presale wallets in three batches during the 42-day ICO. A trace of one of these exits shows that Bitcoin was dispersed to different wallets, and in a few transactions, one wallet was seen moving 53 Bitcoins to the exodus wallet “36PrZ1KHYMpqSyAQXSG8VwbUiq2EogxLo2”.

Additionally, there are many ways to withdraw Bitcoin from the three that share these characteristics.

But Mbaga says these traces can be mistaken for double-spending incidents, and blockchain records show a contrary narrative.

First, the “1L1JRVExeKiqBU1pmvoyzCfRzCfEP64pBJ” address is identified as the recipient address of the three results. The first batch of 1,150 bitcoins was transferred from the Ecodus wallet to 1L1J on August 11. From there, the bitcoins seem to have been dispersed to different wallets.

Most of the bitcoins were sent to the second wallet, then 592 bitcoins were transferred to the third wallet, and then 93 bitcoins were sent to the fourth wallet.

The next transaction is where recycling charges arise.

The following wallet contains four transactions with deposits from seven different addresses and two recipient addresses: recipient A and recipient B.

Receiver A is then shown sending 53 bitcoins to the exit address. Without context, this might seem like 53 bitcoins rolled back into the ICO wallet.

But Gray Wolf's analysis shows that these bitcoins are found in six other deposits in the transactions associated with wallet four.

Meanwhile, most of the Bitcoins from Wallet 4 are finally deposited into the Ethereum Foundation Wallet via Receiver B.

Those flows (62.93 out of 93.313 BTC) came from [wallet four] It is placed in the Ethereum Foundation wallet [and] We finally deposit BTC [Recipient A] to different deposits in the back trail,” says Mbaga.

He added that the funds moved from the foreign wallets during the pre-sale did not reflect malicious activities but rather payment and operational expenses.

Why did Bitcoin take off?

It's not like the Ethereum team secretly spent some money during the sale to cover existing expenses.

In fact, the founder of Ethereum, Vitalik Buterin, announced that he would withdraw money before it happened to pay off the loan and operational costs.

“The goal is to withdraw 4,150 BTC from our migration address within the next 48 hours. We reserve the right to withdraw up to 850 BTC more if necessary before the end of the 42-day period of the sale, but at this time the remaining BTC in the address will remain unused until the sale ends. Buterin in August 8, 2014 he blogged.

Blockchain transaction data shows that the Ethereum Foundation spent more than the announced amount (approximately 3,800 Bitcoin) during the pre-sale, with the 1L1J wallet used to manage the funds.

Aside from what appears to be a $3 test transaction, 1L1J has cashed in on Migration Wallet during the presale. This address appears to have been created to facilitate operational flow during the sale, as all funds were quickly emptied and never reused.

Of the total 3,800 bitcoins, Gray Wolf's analysis found at least 1,000 bitcoins were parked, sitting on exchanges or transferred to Ethereum team wallets in 15 transfers. The rest of Bitcoin continues to go over 15 hops.

Terms of the Ethereum ICO

The pre-sale of Ethereum took place under Ethereum Switzerland (EthSuisse). Operations were transferred to the Ethereum Foundation after the ICO, EthSuisse was finally liquidated.

The ICO started on July 22, 2014, and ran for 42 days, ending on September 2. In the end, 31,600 bitcoins were deposited in the migration address for a total of 60 million ether sales. An additional 9.9% of the total presale was allocated to previous contributors, and another 9.9% was allocated to the Ethereum Foundation.

The decision to allocate pre-mining tokens to the founding members was controversial, as the initial supply of Ether pushed to 72 million, the group controls at least 16.7% of the total supply. As a result, by 2024, 60% of the circulating supply of 120 million Ether will be distributed on the Genesis block.

In the first two weeks of the sale, 1 ether was sold for 0.0005 bitcoin, which means that one bitcoin can buy 2,000 ether. Over the next 22 days, the amount of Ether received per Bitcoin decreased by 30 Ether per day. In the last six days, 1 BTC buys 1,337 Ether.

To prevent an investor from acquiring a large portion of the token, EthSuisse limits individual purchases to 2 million ETH, although the terms and conditions state that larger buyers can contact EthSuisse for clearance.

Regardless, there was no strict way to enforce these restrictions.

Any single entity can hypothetically make unlimited purchases with multiple email addresses and repeat this as many times as possible.

Meanwhile, investors have been discouraged from investing directly in pre-sale wallets.

Instead, the ETH presale website will generate a proxy wallet for ICO participants to send their bitcoins. The funds are then transferred to the exit wallet on behalf of the investors. This means that most investors do not control the wallets that store bitcoins directly into the exit wallet.

Gray Wolf has received 9,000 total earnings into the exit wallet on the Bitcoin network.

Of these earnings, 25 or fewer bitcoin purchases dominated the presale with 8,814 transactions. The second most frequent volume was 26 to 50 Bitcoin in 98 transactions. The highest single purchase was recorded for 699 Bitcoin and the second-highest for 499, which can be attributed to BTC-e.

The Ethereum ICO experience can still be emulated by accessing the presale website using the Internet Archive Wayback Machine.

Visitors can still follow the pre-sale prompts to create a fully functional Bitcoin wallet.

Magazine created a wallet through the Ethereum 2014 presale page in June 2024 and sent a very small amount of Bitcoin to verify that the wallet was indeed valid. Magazine can not control the wallet.

Dirty Bitcoin, Pure Ether

In November 2023, the US Department of Justice seized 30,000 Ether ($54 million) from darknet drug dealer Christopher Castelluzzo and the issue of illegal money flow in the Ethereum ICO came to light.

Some of the proceeds from Castelzozo's narcotics business (which were in Bitcoin) were reportedly used to buy Ether in the 2014 ICO. At a faster rate, Castelluzzo was trading 15 Bitcoins for 30,000 Ether.

The Department of Justice in 2011 In 2016, Castelluzzo received an additional 30,000 Ethereum Classic tokens, the cryptocurrency that represents the DAO's hacked records, the current Ethereum blockchain whispers, to recover the damage.

Supporting this trend, the magazine and Gray Wolf's investigation revealed that illegal actors used the Ethereum ICO to launder dirty bitcoins in exchange for pure ether.

Namely, the second largest purchase of 499 bitcoins tracked to BTC-e, an exchange that was shut down by law enforcement in 2017. According to the United States Department of Justice, proceeds of crime obtained and accumulated through illegal means.

Gox, the exchange said that US officials have said that the Mt. Gox hack was used to launder funds, they say.

In June 2023, the Justice Department charged Alexei Bilyuchenko and Alexander Werner with Mt. Gox hack and charged with conspiracy to defraud the funds. Belyuchenko is also accused of conspiring with Alexander Vinnik to run BTC-e from 2011 to 2017. Vinnik pleaded guilty in May 2024.

The Mt. Gox hack in 2011. It came to a crescendo in early 2014, and the proceeds from the theft may have been suspected of being illegally sourced due to lack of anti-money laundering or customer controls in Ethereum pre-sales, says Mbaga.

“Because of the lack of these controls, there is a risk that someone could put in dirty money and come out with pure ETH at the other end,” he said.

In addition to the second largest single purchase order in the Ethereum ICO, the investigation found other Bitcoin deposits that were returned to BTC-e, although these instances occurred in smaller amounts, such as five to 10 bitcoins, Mbaga explained.

In the early days of the ICO, 10 Bitcoin investors bought 20,000 Ethereum. As of June 28, 2024, that's about $68 million.

Where did all the other Bitcoin go?

The remaining funds from the Ethereum pre-sale ended up in dormant wallets or were sent to exchanges, most of which were returned to wallets linked to the Ethereum Foundation.

In addition to the 1L1J address, three other wallets are used to facilitate maximum flow from the external wallet.

The remaining deposits after the end of the pre-sale and behavior patterns suggest that all three wallets belong to the Ethereum group, says Mbaga.

The first withdrawal wallet received 1,202 bitcoins from the Ecodus wallet. Gray Wolf searched for these bitcoins in a 15-hop search depth and found that 428 of those coins were either parked on a dormant wallet, sent to an exchange, or returned to controlled addresses on Ethereum.

A second funder, a member of the Ethereum Foundation, was identified as the largest direct recipient of the pre-sale proceeds. He received 17,219 bitcoins from his migration account.

“In terms of behavioral analysis, the wallets played incredibly different roles. “The 1L1J address looks like it's going to be done at the next hops for upfront processing costs, smaller exchange deposits and smaller individual distributions,” says Mbaga.

“[The first] It was even more so for smaller dispensaries, with a larger share of those funds going back into team purses. And [the second] It was a carry-on bag used mostly for short-term storage.

Finally, a publicly known Ethereum Foundation address received 9,359 Bitcoin and emptied its presale wallet. He also received 14,888 of the 17,219 Bitcoin in the second wallet and retained 24,214 of the BTC proceeds from the pre-sale in September 2015.

to the ether

Although the success method of the Ethereum presale was also popular among fraudsters, 2017 started what is known as the ICO boom, when cryptocurrency projects raised millions of dollars through the successful presale process.

A decade later, a joint investigation by The Magazine and Gray Wolf found that the Ethereum ICO may have created an environment for illegal actors to launder the proceeds of crime on the Bitcoin blockchain, giving themselves a new opportunity on Ethereum.

Some illegal actors holding Ether have seen astronomical growth over the past decade, with Ether trading at $3,380 on June 25, 2024. At the time of the pre-sale, they were trading at around $0.31 per coin.

Meanwhile, the investigation concluded that the pre-sale did not involve double spending of Bitcoin.

The outflow of three parts of the migrated wallet, which was issued to cover spending records, has raised concerns that some of the token's destination may be the same as its origin.

Such double spending allowed the founding team to launch the project's allocation strategy with more than the 12 million tokens already received in the Genesis block.

Transactions on the Bitcoin network have been made to appear to present double-spending activities, but a closer analysis of the route has overturned these suspicions.

Subscribe

A very engaging read in Blockchain. It is given once a week.

John Yun

Yohan Yun is a multimedia journalist who has been reporting on blockchain since 2017. He has contributed to the crypto media outlet Forkast as an editor and covered Asian tech stories as an assistant reporter for Bloomberg BNA and Forbes. He spends his free time cooking and experimenting with new recipes.