Deposited coins are sent and mixed in different ways on the way to the withdraw wallet and thats where withdraws are sent from. The system keeps track of the coins original owner and will never send coins originaly deposited by the same user.
TheClarifier would like some clarification on this point.
- Does this mean that if I were to deposit 10 BTC today, and let them sit there for one year and then withdrawal them after a year, they will be more 'mixed'?
- Can you tell us a little bit about what sort of cryptographic solution you use to track every sincle coin and fraction of a coin that a user has originally owned so they will never receive it again?
- Can you tell us some statistics about what the maximum length of time a single coin, or fraction of a coin, has remained on the tumbler before finally being tumbled out?
- Do you mean to say that if User A deposits 1 BTC into Deposit Address A, that User B who withdrawals 0.5 BTC will receive half of the 1 BTC from Deposit Address A? Is this the minimum amount of tumbling?
This raises an additional question:
- Can you tell us anything about your reserves or volume of BTC, approximate or exact that you use for tumbling? Greater coin count means great obfuscation. Bitmixer.io historically had their coin count total freely listed.
- If you can't tell us, citing a security reason, can you tell us what the security issue would be? I've never consider how showing total volume is a concern.
Quickmix and automatic withdraw is not the same thing. Automatic withdraw is a feature registered users can choose to activate, the withdraws created by automatic withdraw have a forced randomized delay between 1-18 hours, it has a high randomized delay to prevent that. The problem with the automatic withdraw feature is that users set their addresses there once and then don't seem to change them often, so it encourages address re-use which is bad for anonymity.
I don't feel like my question was thoroughly answered, and forgive me if I'm mistaken.
- I asked about how often the 'QUICK MIX' withdrawals are made and at what times of day. You stated on your website that they happen 'four times a day'. Does this mean it's the same four times a day; i.e. 0636, 0911, 1758, 2325? And each day is the same time, or each day is a different time of day?
If you don't mix more often than maybe once a week your old coins would have been sent out from the mixer by then anyways.
This references a question I asked above.
- Does this mean that the oldest coin, or fraction there of, in your tumbler is never more than a week old?
- Do you believe that depositing 10 BTC and waiting a very long time to initiate a withdrawal will improve the obfuscation?
As long as a part of your coins are still in the mixer wallet I keep track of them, each UTXO is marked as belonging to a specific user or several users
My concern here is not how the coins are tracked while in the tumbler, but how they are tracked if returning to the tumbler.
- What about a coin that later returns to the tumbler, because another user has brought it back? Perhaps a bot who can register and manage hundreds of users and intentionally redeposits old funds to destroy the ability to successfully obfuscate funds, thus partially deanonymising your users funds.
- What would a database solution look like for tracking the entire life of a coin? This doesn't seem feasible. Is there a compromise somewhere to tracking it at least for a year?
Thats why I have built my own taint analysis tool into the mixer, it is similar to the one blockchain.info used to have.
Now below, you reference something that caters to my above two questions. However, it leaves me concerned. Are you saying that your tool is effective and your tumbler uses this tool? Would you be willing to open source this tool?
I suppose the limits you've discussed are the practical limits of the system and we're left with these limits.
I want to propose a final hypothetical to you: let's propose that I've fancied hacking myself an exchange or two and I've come across 100.000 BTC at the current market value. The BTCs are split between four wallets, unevenly. All four wallets are known to my adversaries. What method would you suggest to pass through 100.000 BTC through your tumbler, or other tumbler also?
Finally, can you tell us anything about how your service is hosted? I'm confused as to how you have a clearnet detached from the onion. Does this mean your clearnet has absolutely no link to your onion? Different hosting providers, different countries, and different server architectures to prevent fingerprinting and surely different TTPs to administrate them both?