Norway arrests 28, claims to trace Monero Transactions

@avarice it is likely a mixture of kyc, timing analysis, coin swap metadata, and poisoned outputs. There is no new way of tracing Monero, these have all already existed. The high number though suggests that the site was overtaken as a honeypot.

@xenu If the site got taken over, then it's fairly easy.

Some sample scenarios:

-> User buys XMR from a KYC exchange
-> User sends payment from KYC exchange to compromised site's wallet

-> User buys XMR from a KYC exchange
-> User sends the amount to his own wallet
-> User sends the amount to the compromised site's wallet

-> User used Tor for the connection to the site, but used no VPN or Tor for Monero
-> User connects to malicious node and submits payment
-> IP address with timing analysis

Unless there is some form of unknown vulnerability, all of this could be broken down to misuse of Monero by the users and compromising of the site and the receiving wallet keys. The former is highly unlikely, the latter is absolutely possible.

From the glowie perspective:
-> Deploy malicious monero nodes
-> Log all connections made to the monero node
-> Poison outputs
-> Log all monero transactions
-> Acquire and trace KYC exchange withdrawals
-> Arrest the admin, get him to snitch to save himself.
-> Gain access to the site and corresponding wallets
-> Mark repetitive payments for EAE

Alone, none of these methods are definitive, but together they can defeat the privacy and plausible deniability of Monero.

How to prevent the above:
-> Use Tor or i2p for any and all connections
-> Host your own node also via Tor or i2p
-> Buy Monero P2P with cash
-> Create new accounts and wallets
-> Proxy your Monero through different accounts and wallets
-> Let your coins sit in a wallet for a while
-> Use the Monero CLI or GUI

It's also written in the article that electronic devices and wallets were seized, which adds to the evidence. Since gooners are generally retarded, I can imagine many of them made more than just a couple mistakes.

@xenu @Yuzuki thanks for the insights, especially the tips on staying safe

Any tips on a way to prevent wallets from connecting when orbot or a VPN isn't enabled?

But also my number 1 tip in life is don't be a gooner.

@avarice

But also my number 1 tip in life is don't be a gooner.

gooners can be chill, that one needs death tho

@Yuzuki An even simpler scenario if the market site itself is compromised:

• Merchant receives XMR through darknet market offer and XMR is deposited into darknet-managed wallet
• Merchants sends XMR directly to exchange/swap service to offramp

The feds would know the key image and amount of the coin inside the darknet-managed wallet, and thus could tell in which tx it was spent, then go subpeona the exchange / swap service for additional info. Even if the user sends the XMR to their own wallet with one hop, they could determine the origin of funds with high liklihood, especially if the amounts weren't broken up. This is called an EAE attack. They are thwarted after FCMP++, but the attacks are fairly powerful if you are targeted until then. Until FCMP++, they can be mitigated by churning to your wallet and slowly selling off the XMR in uniform-sized chunks, instead of dumping it all at once.

@avarice sounds bs to me to be perfectly honest. The article's purpose seems more to link xmr to pedos, than it is about any possible tracing txs. To any degree this incident did happen (as opposed to being completely fabricated, which cannot be entirely ruled out), I would bet it was an opsec issue (humans are always the weakest link in these matters), not a xmr issue.

The War on Cryptography carries on...

@nemesis Monero transactions can be traced. This isn't really up for debate. What is questionable though is whether the feds are lying, and that is quite likely lol.

@jeffro256 This is correct. The by far riskiest part of the entire process is cashing out Monero for fiat and not buying Monero with fiat. This is virtually universally true on the black market. Buying drugs is easy, but turning the dirty cash into clean taxable cash is both extremely dangerous and expensive. It is this part which also leaves a dangerous paper trail, while buying goods on the black market is relatively simple and can be handled in a relatively anonymous way.

If they attempted to cash out the Monero via a KYC exchange or some other KYC method, then it is easy to see how they got caught.

-> They earned 3 XMR through the darknet forum.
-> They withdraw 3 XMR into their private wallet from the darknet forum. (minus fees)
-> They transfer 3 XMR into the KYC exchange to cash out. (minus fees)

However, this assumes Monero is available on the KYC exchange which isn't the case in many jurisdictions. There is the other possibility of swapping the XMR for BTC or another non–privacy coin and then cashing that out. The amount is going to be similar minus the fee. There is also the possibility that the swapper was compromised. Germany especially has been going after crypto swappers and they most likely have all transaction information.

It is undeniable that there are weak links in the process, although they have nothing to do with Monero's cryptography. It is possible to trace Monero — it just doesn't work they way they want it to.

There was a separate paper on tracing crypto transaction patterns. It could be that this was utilized as well, although this seems like something that would apply more so to a large heap of transactions rather than smaller individual ones.

@xenu can it be traced though? (serious question, not saying you're wrong or anything). I mean, isnt the point of monero that it can't be? its my understanding that even the claims of btc being traced accurately are bs as well.

@nemesis In targeted circumstances anything can be traced. There is no such thing as perfect privacy. Instead it is a fluid situation with many variables, and many of those variables are outside of the control of the blockchain. So as I mentioned earlier, if you are using KYC you are already giving a ton of metadata away (time you are using Monero, amount of Monero you are withdrawing, your ip address, you monero wallet address, you user agent, etc). All of this can be collected and then compared to a compromised entity you are sending XMR to. Jeffro's writeup above is a good explanation of this with regards to poisoned outputs. Check out this video I made on how incognito market's admins was traced even though he was using a coinswap service and Monero.
You are right that Bitcoin tracings are also exaggerated and chain analysis has been completely wrong about things in the past. But in targeted situations the game changes completely.