Question

Tornado Cash is in the news due to the sanctions imposed by the US government and the freezing of $75K of USDC from Circle. The addresses tied to the service have been publicly posted online. (Hint: we also have them in our crosschain address labels table as well).

What is Tornado Cash and why would it be targeted by the US government? Why might an address interact with the service?

The addresses tied to the service have been publicly posted online. Using those addresses answer the following:

How many addresses are still using the service despite the sanctions?
Which addresses have been interacting the most with Tornado Cash?
Break the addresses down by frequency and volume of tokens and describe how the groups are using the service differently.
Is there anything else interesting about its users?

Part 2: Why would Tornado Cash be targeted by the US government?

Suppose you are a blockchain analyst and you are currently searching and tracking a hacker. Recently, he has stolen assets by abusing flash loans. After exploring the address through Etherscan, you will find that the hacker has used the Tornado Cash network for money laundering.

You can see that the hacker deposited the stolen assets into one of Tornado's smart contracts, but there's no way to know which account the assets ended up being deposited into. If you think of ways off the grid in your search, maybe a good idea will catch your eye; For example, tracking Tornado cash withdrawals to the exact amount that was stolen in this abuse.

So if a hacker has stolen 100 Ethereum, it might be a good idea to search for all withdrawals that match that amount. So if the said thief was not smart enough and did not think a few steps ahead, you will probably succeed in reducing the number of possible options to a few addresses by considering the date of the transaction. But if your hacker is a smart person and has thought of a way to avoid this situation in advance, he will probably withdraw these 100 Ethereum in ten steps. That is, he withdraws 10 Ethereum at each stage. That way, his withdrawals get mixed up with other transactions, making it literally impossible to tell who the hacker might be.

Maybe this hacker has decided to withdraw the stolen assets within a few months with random and variable amounts and protect his identity with maximum power and accuracy. In this case, your situation will be even more complicated than before.

Now, due to the existence of these capabilities in Tornado Cash, money laundering or financial transactions in the process of buying and selling weapons or drugs and other illegal activities can be done easily without identifying the traces of money. This is why the US government is targeting Tornado Cash.

Part 1: What is Tornado Cash?

TornadoCash is a non-cryptic privacy solution for the Ethereum network based on zero-aware snarks (zk-SNARKs). By using this protocol, users can break a loop of activities on the chain in order to preserve the privacy of the transaction, between the recipient and the destination address.

This network acts as a sophisticated coin mixer and uses smart contracts. Tornado accepts deposits made on the Ethereum blockchain and then allows other addresses to withdraw them. Since withdrawals are made from the project's smart contract liquidity pools, there will be no way to know who the original sender is.

As you know, "hash" is a type of function that takes inputs such as letters, numbers, and images from you and returns an encrypted output with a fixed length. TornadoCash creates a secret hash after a user deposits assets into the network. Then the smart contracts accept the deposit through this hash.

The acceptance of deposits by smart contracts is called "Commitment". The purpose of the pledge is to identify the true sender. In addition, it is the responsibility of the user to prove that the intended user is the owner of the asset during the withdrawal process. By entering the hash when requesting, the user essentially confirms their identity while remaining anonymous to others.

Part 3: How many addresses are still using the service despite the sanctions?

The addresses related to the tornado project can be extracted from the flipside_prod_db.crosschain.address_labels table.

To answer this question, we use the ethereum.core.fact_transactions table and consider transactions that are successful and the destination address of the transaction is among the addresses related to the tornado project. Then we count the number of unique source addresses (distinct from_address) of these transactions per day.

Part 3: Conclusion

On August 8, the news of the sanctions was announced. As you can see in the graph above, the number of addresses that used this service increased on August 8th and 9th, and on August 10th, it was similar to the days before the ban was announced. Although it is too early to judge and if more time passes, it will be better to judge whether the sanctions have had an impact on the use of this service or not. But until today, when three days have passed since the ban, you can see that the ban has not had a negative effect on the number of users of this service. And the number of users has not only not decreased, but also increased.

Part 4:Which addresses have been interacting the most with Tornado Cash?

In the chart below, we have shown the top 10 addresses that have had the largest number of transactions to Tornado addresses until now.

Part 4: Conclusion

In the ranking based on the number of transactions made to Tornado addresses until now, the address 0xbe4d1e137a24af091be80ae58d652279665e3a27 has won the first place with 12720 transactions. The address 0xa0f0287683e820ff4211e67c03cf46a87431f4e1 was ranked second with 10440 transactions in these three days, and the address 0xd6187b4a0f51355a36764558d39b2c21ac12393d was ranked third with 9620 transactions.

\
In the ranking based on the number of transactions made to Tornado addresses since the day of the sanction until now, the address 0x4a72162980676ac2a1161913b083e9358166d3b0 has won the first place with 129 transactions. The address 0x12d92fed171f16b3a05acb1542b40648e7ced384 was ranked second with 117 transactions in these three days, and the address 0x28c6c06298d514db089934071355e5743bf21d60 was ranked third with 91 transactions.

In the chart below, we have shown the top 10 addresses that have had the largest number of transactions to Tornado addresses after the sanction (from 2022-08-08 until now).