Author: Carol Li
Translator: Cobo Wallet Aimee
Editor: Tongtong Bee
Source: PANews
PAData cooperated with Chain.info, a one-stop data service platform for blockchain transactions, to observe the competitive landscape in the third quarter of this year, which currently included changes in balance and capital flows between more than 4 million wallets. 「4 Million Digital Wallets: The Bitcoin Network Decoded Who of the Top 3 Exchanges is Losing Control of the Bitcoin Market?」
According to PAData’s analysis, three kinds of wallets were involved in the exchanges’ transaction business: the deposit wallet, which comprised 99.9% of the total; the hot wallet; and the cold wallet. The differences in wallets between different exchanges reflect the different styles of capital flow.
The balance in wallets indicates the actual market share of the exchanges. In the third quarter of this year, the exchange with the most BTC balance was Huobi: there was 296,000 BTC in three types of wallets. Huobi was followed by Binance, which had a total of 241,000 BTC. Huobi further consolidated its position in the BTC trading market with a net inflow of more than 50,000 in the third quarter of 2019.
The transaction between exchanges is like a network of funds, similar to a stock game between exchanges. From a statistical point of view, the flow of funds between Binance, Bitstamp, OKEX and Huobi is very active. Among them, the interaction between OKEX and Huobi is the most active, but Binance lost 104,000 BTC to other exchanges.
How do you find out the exchanges’ wallets (what is the basis of our analysis)? PAData interviewed Li Zhen, the Tech Head of Chain.info, to explain the logic behind this.
Following is a record of the interview:
PAData：What is the exchange’s deposit wallet? What are the features?
Li Zhen: The user receives a deposit address after opening an account on the exchange. Currently, the deposit address provided by the mainstream exchange is non-replaceable, that is, one user has one deposit address unless the exchange uniformly replaces the deposit addresses. This type of address constitutes approximately 99.9% of the total number of addresses on the exchange.
PAData：One deposit address represents one user, so can we check how many users the exchange has based on the number of deposit wallets？
Li Zhen：There are two situations that make the two unequal. After opening an account and the user has used it only once, it is not a good idea to confirm whether it is still the actual user (active user). The other is to bypass the KYC in some way, then an actual user may have multiple deposit wallets.
PAData：What is an exchange’s hot wallet? What are the features?
Li Zhen：An exchange’s hot wallet is an online wallet. It mainly covers the transactions between the deposit wallet and cold wallet and also withdrawals. The total amount of hot wallets is between 10 to 30 but the transaction amount is large.
PAData：What is the exchange’s cold wallet? What are the features?
Li Zhen：An exchange’s cold wallet is an offline wallet. Exchanges store most of the assets in a cold wallet, which only transfer with hot wallet. The total number of transactions is small, but the total amount of single transactions is large.
PAData：How does BTC flow in the transactions between the exchange’s wallets?
Li Zhen：All transactions among the exchange’s wallets are actually changing the database of the exchange, and this cannot be monitored because the data is controlled by the exchanges. However, some user actions can be linked to the exchange, i.e., when a user deposits funds to the exchange’s wallet, the user has a connection with the deposit address. And when withdrawn, the coin would move from the hot wallet or deposit wallet. For example, Alice wants to withdraw 0.1BTC and Bob has 0.2BTC in the account (deposit wallet). It could happen that the 0.1 BTC Alice withdrew is directly from Bob’s account. BTC flows in or out of the exchange this way, but the users’ coins may not flow into the hot wallet or cold wallet.
PAData：How do you find out the identity (owner) of multiple addresses involved in one transaction according to the UTXO model?
Li Zhen：BTC is based on the UTXO(Unspent Transaction Output) model. Every UTXO is unbreakable and contained in one BTC address. However, one BTC address can contain multiple UTXOs. When withdrawn, a user uses his/her own UTXO(as input) to generate new UTXO(as output), which means the input belong to one identity. Let’s first consider the input side - we know that input addresses belong to one identity based on the flow of BTC transactions. This is the first step in searching for wallet address---vertical searching.
PAData：Under the vertical mining, could it be possible for input addresses to be owned by multiple entities?
Li Zhen：There’s a small probability through a process called “mixing” which can cause one transaction to contain addresses from multiple identities. However, we can ignore this because mixing doesn’t make sense for exchanges. It easily causes security issues, and we analyzed addresses from all exchanges, but never found addresses from two exchanges appearing in the input of one transaction.
PAData：Besides vertical searching, is there any other searching?
Li Zhen: There are two more approaches: forward mining and back searching. Front searching is based on output information from vertical searching. It mainly focuses on the change output of BTC transactions.
In front searching, the target address must be on the input side. The input addresses shouldn’t be two while output address must be two. Among them, one of the output address should contain BTC with more than 4 decimal places. We then say that this address, which is called a BTC change address, also belongs to the identity along with the input addresses. The input addresses in front searching are normally from the exchange’s cold wallet. One of the output addresses is from the exchange’s hot wallet and the others are from the exchange’s new cold wallet. This feature was refined after we sorted out the trading data of many exchanges.
In back searching, the target address must be on the output side. The input address should be one while the output address must be two. We can then confirm that the target address is from the exchange’s hot wallet according to the different features of the wallet. In the transaction, the amount sent to the target address (hot wallet address) should be more than 100 BTC. Then the three addresses involved in the eligible transaction connected to one identity and the input address is probable a cold wallet address.
PAData：Is there any order between these three approaches?
Li Zhen：Yes. Firstly, we use vertical searching to find out information on the exchange address. Secondly, according to the features of the wallet or other things, we use front searching to find out the hot wallet. Thirdly, once we confirm the hot wallet, we find out the cold wallet with back searching -- so the order is vertical, forward, backward.
PAData：Through these approaches, which kind of wallet will be found out first?
Li Zhen：The first to be found out should be the deposit wallet. When we register on an exchange as a user, we get a deposit wallet to deposit coins. We can then see the flow of the coin and find out about the hot wallet and the cold wallet.
PAData：How do you check the flow of the exchanges’ BTC without any label?
Li Zhen：It’s difficult, but still traceable. We’re now also monitoring large transactions. We trace addresses involved in large transactions once they show on the blockchain. We have already found out several exchanges, but we don’t know who they are, even though their scale does not seem small.
PAData：Coinbase is one of the biggest exchanges. Why didn’t your data searching cover its wallet data?
Li Zhen：Unlike the hot wallet of other exchanges, which is fixed as dozens, Coinbase’ s hot wallet is very interesting, which is single use. It’s now our main target to conquer.
