Empirical Analysis of Ransomware Payment Tracking using Chainalysis Reactor in the Bitcoin Ecosystem

Abstract

Cryptocurrency has gained grand attention as a key to developing online financial services and e-commerce for a decade. However, representative cryptocurrencies, such as Bitcoin and Ethereum, have recently become the main currencies in the Dark Web black market for illegal trade, fraud, and funds theft through ransomware by exploiting its anonymity. Moreover, mixers and decentralized exchanges for exchanging tokens to conceal their origin make it challenging to identify the initial funds. To this end, we aim to extract distinct and unique patterns related to cryptocurrency laundering from a criminal behavioral perspective by schematizing the relationship and status between the wallet addresses and corresponding transactions in real-world crime examples. Based on case studies to track ransomware payments using cryptocurrency, we demonstrate that our proposed heuristic approach contributes to uncovering cryptocurrency laundering from the given transaction graph, including both reported crime and non-custodial wallets.