Researchers publish forensic statistical analysis report of recent Monero transaction volume anomaly

Joint research effort of Isthmus¹, Neptune², Rucknium³, Jberman⁴ and Carrington⁵ has produced an in-depth forensic statistical analysis report⁶ of the mid-2021 Monero transaction volume anomaly⁷.

Rucknium explains the magnitude of this development, pointing out that it’s the first time in Monero history a flood incident has been documented:

Spam or “flood” transactions can be concerning since an malicious attacker could harm user privacy through their control of a large share of the recent transaction outputs. In essence, since the attacker knows which decoys (mixins) are actually fake in the ring signatures, they may be able to deduce the “real spend” and trace transactions.⁸

The report concludes:

• There’s a high probability that a single entity was responsible for the incident.
• The anomalous transactions appear to have been generated by the core wallet, or one that matches its signature.
• The responsible entity has generated an estimated 365,000 transactions for a total cost of 5 XMR (worth 1K at the time).
• The anomaly contributed somewhere in the ballpark of 700 MB, at a cost of $1.40 per MB.

If you want to get deep in the data and see exactly how the activity was analyzed, it is recommended you familiarize yourself with the concept of ring signatures as a privacy mechanism. Chapter 3 of Mastering Monero⁹ covers that topic.

Monero Meet’s recorded livestream¹⁰ from a few days ago is also relevant as it discusses the penalty area that kicks in once transaction volume gets really high and thus might give some insight into how expensive it would be to sustain an actual attempted de-anonymizing attack.

All of the analysis scripts will be made available to the public¹¹ in a couple of days, after MRL researcher Isthmus cleans up the code and pushes it to Github.

You can also take part in the next Monero Research Lab meeting¹², which will probably discuss this research report.