Computational Tools for Blockchain Forensics

Hello, everyone, my name is Peter Sanchez from the Warframe Blockchain Group. And in this presentation we're going to show you some of the tools we have for interacting with blockchains and getting information that can be used for analytics and in this case, blockchain forensics. Okay, so let's start with WolframAlpha. We are soon adding blockchain data to WolframAlpha so you can use natural language to make queries. Here we have a preview of how that will look like. In this case, it's getting the last block for the bitcoin blockchain. Here you can see some of the properties for the block, like the block number timestamp, the number of transactions. This block has some cryptographic information like the Merkle root and the hashtag, and a list of transactions. Okay, so you can even see one of those transactions more in detail if we make a query for a transaction. And here you can see more properties for this particular transaction, like a size, the confirmations, the total inputs and outputs. These are bitcoin transactions. So we have inputs and outputs. In this case, one input and two outputs here. Okay, so we already have an integration between ChatGPT and Wolfram. And once we add this blockchain data to Wolfram Alpha, we're going to be able to use ChatGPT to make blockchain real time queries. So this is how that would look like in this case. We're using ChatGPT and make it the same request I just showed you from Warframe Alpha. Here you can see the this block and some of the properties for the block. And similarly for the transaction, you can see all the properties of this particular transaction. Okay, so now let's focus on warframe language. In Warframe Language, we have a set of blockchain functions that we can group in two different groups for reading functions and writing functions. Here I'll talk about the reading function. First, we can use blockchain data to get information, general information about the blockchain and blockchain block data to get data on one particular block. Blockchain transaction data to get information about one particular transaction. So these three reading functions make requests to direct requests to nodes we have for each of the blockchains. And we also have internal databases. These internal databases allow us to make more complex requests like blockchain address data and blockchain token data. Okay, so if we want to interact with the blockchain and make a new transaction, we can also do that. We use here blockchain QM code. This is a utility Function to make our own addresses. And we can use blockchain transaction to create a transaction object, a blockchain transaction sign to sign that object digitally with our private key and then submit it using blockchain transaction. Submit is these three writing functions here on the right. You can see which blockchains are supported currently. And we're planning to add more blockchains in the future. So let's see in more detail one of these reading functions. For example, here you can see blockchain data for Bitcoin. We get some information about the latest block height, the latest block hash, and some information about the fees. And if we want to see a particular block, we use blockchain block data. Here's a list of all of the properties we show. You'll see that these are similar to the ones I already shown in WframAlpha. Right? And if we see the transaction list of a block, we can take any one of these and then use blockchain transaction data to see more of the properties here. Properties like the timestamp, the confirmations, and each of the inputs. Here you can see this is how one input looks. And this one has six outputs here. Okay, so yeah, these outputs and inputs have addresses in them. And we can use blockchain address data to get information about a particular address, the balance, the total transaction, and also a list of transactions that involve this address. Here you can see this is similar to the blockchain Explorers Online. Okay, so now for a writing example, in this case, I want to create a new address and send some bitcoin to that address. We're using here, the bitcoin testnet. This is not real money. This is just for testing purposes. So we have four steps here. Blockchain key and code, Blockchain transaction, sign and submit. I think doesn't look quite here, but let's start with blockchain key encode. So we have to generate new keys and an address. This case, we use this cryptographic function, generate asymmetric keeper, specifying the bitcoin argument here. And we can get this particular set of private keys. These are new and we have to store them this somewhere. And we can use blockchain king code to encode this public key into an address with the format that this particular blockchain accepts. This is the bitcoin testnet. We use blockchain based to specify which blockchain. So this is how that address would look. And this address is not part of the blockchain yet. We just create that locally. So if we want to send some bitcoin to it. We have to use an address that already has some balance. So in this case I'm just going to put a set of keys from the sender keys that will create a sender address. Here. This address already has some bitcoin. And here you can see below the UTXO Bitcoin is a UTXO model blockchain. This means unspent transaction output. So basically this means that in this transaction ID and index, that's where my bitcoin are stored. And if we want to then spend in this new transaction, I have to make a reference to this and this is how much I'm spending right now. So this sender address is going to create a new transaction. We have to decide on a fee. We want to use the amount that we're going to send to the new address and just calculate the change that's coming back to that same address. So now with this I can create the transaction object blockchain transaction object, specifying as the input that UTXO that I shown before where my money is coming from. And then as the outputs I have two, One is for the new address, the receiver address that I created, and the other one is just back to the same address as change, right? And then specify the blockchain base. And this is how it looks. It looks like an object that has inside different properties related to what I give. So this is not signed yet. We need to sign it to prove that we own those bitcoin. So to sign it we use blockchain transaction sign. We just specify here our private key, right? The one related to the sender of that input and then we just need to submit it. So we use blockchain transaction submit and we should get as a result that transaction id. This is not part of the blockchain yet. We have to wait a bit for a miner to pick this transaction. But once we wait for a while, we can review this transaction using our ream functions. So another way of visualizing this here I have a custom function that I made that uses blockchain transaction data and also the graph function to make a graph of this particular transaction. I don't think you can see it very well. Let me. Yeah. Okay. So here in this graph, these square vertices are the transactions. You can see what I hover over them, the transaction id. So this is the main transaction I just sent, right? Once it's already added to the blockchain. So this transaction has the inputs, those are the edges coming in like this one, this orange one. It has one input Coming from this address. This was a sender address and then it has two outputs. One that goes to the new address here of this amount and one that goes back as change. This is the second output that goes back as change for the sender address. Here you can see just where this address got its money from. It's a previous transaction, it's just the source transaction of this main transaction. So now both of these outputs are new unspent transaction outputs that can be used later. So now the balance of this address that I just created should be just the sum of all of its UTXOs. So in this case just this. So here we can see this was just the simple transaction I made. Here's an example of how to visualize some more complex transactions. In this case it's just one that has a lot of more outputs, right? I believe it's 6 outputs. Also you can see the change and how the source transaction and also destination transactions where it goes and even more complex transaction here. Right. So you can use these tools to get a more visual an image of this transaction and if you can even make the function so it goes further to the past or to the future if you need to. Okay, so now I'm going to stop sharing my screen so Alec can start sharing his.

Hello, my name is Alec, I'm also part of the blockchain team. I'm going to be sharing to you a different case. Now that we've seen how to visualize and work with Bitcoin. We're going to try something different with Ethereum. And for that we're going to look at a particular thing that happened in Ethereum. FTX was a cryptocurrency exchange firm that operated on Ethereum. It issued token called with symbol FTT. It had a total supply of 350 million. And I'm going to show you a workflow of the computational tools that one can use to to for forensic the forensic analysis of what happened in the blockchain. To do this we're first going to need to know who's who. So to do that we first scrape Etherscan and to see which addresses correspond to which real life entities. For example, if we take the 10 addresses ranked by volume, the top 10 addresses we get different name tags that correspond to the real life entities. The two main entities that we're going to focus on are SFTX and Alameda. And by the way, this volume is over a period of time which is from April 2019 to December 2022. We can do a similar thing now and plot these addresses by volume. We can see that FTX was clearly the real life entity that did with more volume transactions for the token in the blockchain. But right next to that is Alameda, right here. And first we can try to a greedy approach to to plot all the transfers that happen in the blockchain in this period of time. In this case, the vertices are addresses and the edges are transfers. The color of an edge is how many tokens were sent in that transfer. The more red it is, the higher the amount. But we can sort of see that this is a little bit too greedy because although we see some global interpretation of this and we can see some centralization going on, we're going to need something a little bit more nuanced to actually understand what's going on. So for that we're going to apply a filter under a threshold for start under a filter of taking the transfers that are more than 1% of the total supply. So, so that would be all the transfers that had more than 3.5 million tokens. We can see the behavior in this graph. Now in this case the vertices are colored and the edges aren't not as the previous graph. And the edges simply represent that there was a transfer in there. So it has a problem there in the sense that we still need to capture how many tokens were sent over that period of time. And for that we're going to introduce this definition that comes off aid, which is a transactional pathway. A transactional pathway is an asymmetric relation between two addresses. So for example, if you have Alice and Bob and at least sends one token to Bob in one point of time and then another token to Bob in a different point of time. We can sort of consider that transactional pathway as a single instance and edge aggregate. And consider this as a single edge with an edge weight corresponding to how many tokens were sent from Alice to Bob. Now do bear in mind that this is asymmetric, so the direction is important. So in the case that Ali sends one to Bob and Bob sends one to one to Alice, we don't edge aggregate. Now, equipped with that definition, we can make this graph that has an edge thickness proportional to the edge weight. And we can see that a particular loop pops up right here. If we query the top five transactional pathways, this loop is comprised of the bottom three transactional pathways by volume. And we're going to focus on this loop and see what happened there. So first of all, this loop first goes from FTX to the ICO contract and then to Alameda and then back to ftx. This chart right here corresponds to the first transactional pathway in the loop, which is FTX sending to the ICO contract. We can see that it sent different amount of tokens over time. But a particular transaction pops UP which sent 200 million tokens is about more than 70% of available tokens from the total supply. So this is a big chunk of the tokens. The next transactional pathway has a similar behavior. We can see that it sent 173 million on September 28th. And if we dig deeper into this transaction, we can see which events actually happened in the transaction. And we can see that the contract defines this event type called tokens released, which means that tokens were released from that contract and they were immediately sent to Alameda, that same amount of tokens. And next up in the transactional pathway, we have another transaction that happened a few hours later with the same amount of 173 million back to FTX. So, in summary, we have seen that FTX transferred 250 million tokens to the FTT ICO contract on the 4th of August. And then we have also checked that FTX released 173 million from the ICO contract, which were immediately sent to Alameda. And then a few hours later, that was sent back to ftx. These items of interest were also found by Lucas Nuzzi. And it's interesting to find that these computational tools can be used to provide a forensic analysis of and an overview to find little portions of behavior inside the blockchain. So we can move on now to any questions. Okay, well, Peter, do you have anything to comment?

Okay, yeah, no, if there's no more questions, or. I mean, we can stay maybe a minute more if there's any questions, but I think I answered one. They asked me if there is a handout. We don't have one right now, no. But all of our functions are documented and can be used to make this kind of analysis and just to also submit your own transactions. If you want to test in writing, there are some guides also for that. Okay, I believe there's no more questions, so I'll just end the presentation right now. Thanks, everyone.

Thank you. Bye.