Tumbling, hashing and mining, oh my! To be an active user of darknet markets, it is necessary to become at least somewhat savvy in cryptocurrency. To learn more about how to safely and securely use cryptocurrencies like bitcoin, read on; we include an intro to marketplace exit scams, a review of the blockchain process and a quick look at bitcoin mining.
As mentioned in our cryptocurrency primer, the process of acquiring bitcoins (or any similar digital currency) can be achieved via numerous methods, each with their own varying degree of anonymity and complexity. Let's dive into the details of the delicate art form of transacting on a darknet market, including tips on keeping your cryptocurrency, and your identity, secure.
Bitcoin tumbling is an optional step one can take to obfuscate the origin of bitcoins in a bitcoin wallet and to whom or where they are being sent when a transaction occurs. Typically, this involves using a third party service to break the connection between the bitcoin address sending the coins and the addresses receiving coins. Depending on the level of tumbling or "mixing" required, the process can take anywhere from 10 minutes to 6 hours.
While a plethora of commercial, third party tumbling services exist, there are equally as many that are fraudulent scam operations. These scams are made possible in part by the fact that all cryptocurrency tumbling services require a fee, usually equivalent to a percentage (1-5%) of the coin value being mixed. Fraudulent sites pose as tumbling services and collect the cryptocurrency from unsuspecting users. No "mixing" occurs, and the cryptocurrency never reaches its intended recipient.
One of the best ways to avoid tumbling scams is to do due diligence and stick with reputable, peer-reviewed services that have been established for a respectable period of time. For a small fee, some of the darknet markets, such as AlphaBay, offer their own internal mixing service using a proprietary mixing methodology to further obfuscate the details of the transactions performed on their site.
Secure Transaction Methods
When purchasing goods or services off of a darknet market, there are, in general, three cryptocurrency transaction methods: Finalize Early (FE), Escrow and Multiple Signature Escrow (multisig).
Finalize Early (Insecure; only use with well-established vendors) This is a payment method, also known as “first” transactions, in which a vendor requires receipt of payment before dispatch of the purchased goods. While risk is required on the buyer's end, this method expedites the transaction as there is little to no risk on behalf of the vendor.
Escrow (Moderately Secure) This is a payment method in which a market will generate a bitcoin address to which the buyer can transfer payment. The market acts as a middleman, holding the buyer's money and paying the vendor only after the terms of the sale have been met; the buyer must mark the order complete for payment to be released to the vendor.
Multiple Signature Escrow (Highly Secure) This payment method is the most secure, as multiple keys are generated for the bitcoin transaction and payment release process. The multisig can be 2/2 or 2/3, where 2 of 3 provides the most security for three keys, the market’s key, the vendor’s key and the buyer’s key. The keys for each option are:
- 2-of-2 Multisig: Market public key, vendor public key
- 2-of-3 Multisig: Market public key, vendor public key + customer public key
Once the goods or services have been received, the buyer signs off on the transaction using their key, at which time the market signs in with their key and releases the funds to the vendor. The market can mediate the transaction and use its key if the buyer doesn’t communicate with the vendor and enough time has passed to reasonably presume the buyer has received their order.
As we explained in our first cryptocurrency blog post, a blockchain is a public ledger in which all virtual transactions are indexed and recorded. Because all bitcoin transactions are recorded, and thus tied to a traceable blockchain in this manner, many cryptocurrency enthusiasts are entering the bitcoin mining market to further obfuscate their transactions.
By utilizing methods such as "double spending" and "hashing" (more on that later), it is possible to reap the monetary benefits of bitcoin rewards by creating a new blockchain hash. To review, a blockchain is basically a string of multiple “blocks” each correlating to a bitcoin transaction. The blockchain starts with the initial block, known as the genesis block, and subsequent transactions and solved hashes add new blocks after this genesis block, creating the chain.
Hackers with enormous processing power can create "orphaned blocks," with which an attacker can attempt to take complete control of the blockchain ledger by manipulating the blocks in the ledger. The most recent example of this is known as the "51% attack."
Another common tactic for taking advantage of cryptocurrency is known as bitcoin mining. Bitcoin mining involves procuring specialized hardware that is used to compile a few hundred transactions from the blockchain ledger and turn them into a mathematical puzzle. Miners can then try to solve this puzzle once it is released back to the network. The first participant to solve the puzzle gets to place the next block on the block chain and claim a reward called a “block reward."
In less than a decade, bitcoin mining has evolved from individuals solving complex hash puzzles on their personal laptop computers in their houses to huge clusters of networked, parallel computers utilizing specialized application specific integrated circuits (ASIC) mining processors running at unprecedented speeds and consuming considerably less electricity and energy. Mining benefits the entire bitcoin community by validating and verifying transactions, securing the blockchain network and keeping the system synchronized.
With cryptocurrency, like any darknet related commodity, there is the ever-present risk of being scammed or subject to fraud. Cloud-based bitcoin mining has been particularly fraught with scammers. Even seemingly legitimate bitcoin mining hardware manufactures, such as Active Mining and Ice Drill, have reportedly conned the darknet, purportedly raising money to make ASICs and share the profits from them, but never delivering on these profits, and instead disappearing with hundreds of victim’s bitcoin investments.
A Last Note
Keeping cryptocurrency and identities secure while transacting on the darknet can be challenging. We encourage everyone to do their due diligence while exploring this area of the darknet to avoid being scammed out of valuable, digital currency.