Tornado Cash Addresses
Question:
Tornado Cash is in the news due to the sanctions imposed by the US government and the freezing of $75K of USDC from Circle. The addresses tied to the service have been publicly posted online. (Hint: we also have them in our crosschain address labels table as well).
Overview of essay:
According to the news, the US governance announced the sanctions related to the Virtual Currency Mixer Tornado Cash.
In this essay, the detailed analysis of addresses have been studied by considering these metrics:
- Tornado Cash addresses received the most # of transactions in the last month, quarter, year.
- Tornado Cash addresses received the most transaction volume (worth) in the last month, quarter, year.
- Group the transactions into buckets by value of ETH.
To access the extra data related to these sanctions visit the links on the last part of this essay.
What is Tornado Cash sanctions?
Tornado Cash is a mixer, a protocol designed to pool funds in an effort to obfuscate the origin of any given transaction on Ethereum blockchain.
> “Today, Treasury is sanctioning Tornado Cash, a virtual currency mixer that launders the proceeds of cybercrimes, including those committed against victims in the United States,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. > > Tornado Cash was subsequently used to launder more than $96 million of malicious cyber actors’ funds derived from the June 24, 2022 Harmony Bridge Heist, and at least $7.8 million from the August 2, 2022 Nomad Heist.
This part exactly quoted from the official website of U.S. DEPARTMENT OF THE TREASURY.
As can be seen, the main reason of these sanctions is money laundry application of this mixer
Approach:
To handle this investigation, the Data provided by Flipside community has been adopted, accordingly.
The data related to address of Tornado cash have been shown by crosschain.address_labels with project name 'tornado cash' on Flipside. The rest of the analysis have been done by application of these addresses on ethereum.core.fact_transactions:
-
Most of the parts executed on fact_transactions table.
-
The grouping process of transactions by their ETH_value have been done by:
when ETH_VALUE <= 0.01 then 'under 0.01 ETH' when ETH_VALUE >= 0.01 and ETH_VALUE < 0.1 then '0.01-0.1 ETH' when ETH_VALUE >= 0.1 and ETH_VALUE < 1 then '0.1-1 ETH' when ETH_VALUE >= 1 and ETH_VALUE < 10 then '1-10 ETH' when ETH_VALUE >= 10 and ETH_VALUE < 100 then '10-100 ETH' when ETH_VALUE >= 100 then 'over 100 ETH'
\
Notable findings:
The key findings related to identifying the most used addresses on Tornado cash have been summarized as:
- In the all three time frame, the Tornado cash: router is the most used address of Tornado cash in terms of received transactions and number of senders.
- From the analysis due to the last year, it has been reveled that the Tornado proxy address has the second most used application in term of received transactions and number of unique senders.
- The domination of Tornado cash: router in the last month and quarter is considerably high but for the analysis related to last year, the numbers of tornado cash router and proxy are very close together.
- The addresses have been arranged based on the value of transactions (ETH and USD) and shown in the last month, quarter and year.
- In the last month, the router address has been captured about 160 million USD, in the last quarter this number jumped to over 1 billion USD.
- From the analysis in the last year, two of the most used addresses on Tornado cash are router and proxy in term of worth.
Grouping transactions and senders:
By grouping the transactions based on their ETH value, it can be concluded that:
- Most of the transactions have under 0.01 ETH value. Also, the highest count of participants appears in this bucket.
- The second most used bucket belongs to the transactions with 1-10 ETH value and as can be seen, about 20k unique accounts interacted with this type of transactions.
References and useful links:
- Related news 1: U.S. DEPARTMENT OF THE TREASURY
- Related news 1: Routers
- Tornado Cash
Author:
Credited by MZG
Discord handle: m.zamani#0361
Twitter handle: @GargariZamani