It is the one. How the “Transparent blockchain” de-anonymizes crypto users

The Russian financial intelligence unit (Rosfinmonitoring (Federal Financial Monitoring Service) has seriously decided to engage in blockchain investigations. The agency has big plans for 2025: to connect Russian banks to the Transparent blockchain service and to create a register of suspicious cryptocurrency addresses and transactions. GetBlock AML Research explains what the Transparent blockchain is and how it will de-anonymize cryptocurrency users from across the CIS.

Brief timeline

The year 2020. Rosfinmonitoring, in cooperation with the Lebedev Physical Institute, developed a prototype system for tracking cryptocurrency transactions in the bitcoin blockchain. The project was named “Transparent blockchain” and was included in the federal project “Artificial Intelligence”. The development of the system was estimated at 760 million Russian rubles (RUB): 440 million RUB in 2021, 230 million RUB in 2022, and 90 million RUB in 2023.

The year 2021. The “Transparent blockchain” started working. The head of Rosfinmonitoring, Yuri Chikhanchin, reported on the first criminal cases thanks to the system of tracking crypto transactions. The Russian government, with the participation of the Ministry of Digital Development, Communications and Mass Media, took control of the project. Rosfinmonitoring began to cooperate in tracking cryptocurrency transactions with Belarus, Malta, Liechtenstein, Luxembourg, and Finland. These countries may have gained access to the Transparent blockchain.

The year 2023. The “Transparent blockchain” was finalized together with the Bank of Russia and VTB. In addition to bitcoin, the system received support for more than 30 digital assets (the specific list is unknown). Active use of the system by law enforcement agencies has begun. The head of financial intelligence reported the use of the “Transparent blockchain” in closing down the darknet marketplace Hydra jointly with foreign colleagues. The system monitors “thousands of transactions” with cryptocurrency, 120 investigations have been conducted, and 60 criminal cases have been opened. Several criminal cases were brought to trial with the assistance of the “Transparent blockchain.” The most high-profile one is a contract killing, paid for with cryptocurrency. Facts of payment for terrorist acts with digital assets have been discovered. Central Asian countries have started to join the system (it is not known which ones). A database of gray addresses has been created, and more than 19 thousand of them have been recorded.

The year 2025. The financial intelligence has reported on plans to connect Russian banks to the “Transparent blockchain” by the end of the year to enable them to conduct real-time compliance and link money transfers with cryptocurrency transactions. More than 12 000 users (law enforcement officers and foreign anti-money laundering intelligence units) are connected to the system. The creation of a register of suspicious cryptocurrency addresses belonging to Russians has begun.

How cryptocurrency transactions are tracked

The blockchain is truly transparent. In other words, all information about its work is public and available to everyone, without exception. Tracking transactions in the blockchain is carried out in several steps.

Step 1: Collecting all available data

An extensive database is created, which tracks several blockchains in real time and unloads all available data from them. Special attention is paid to metadata (timestamp, transfer amount, etc.).

The table of transactions on the Ethereum network

Step 2: Graph generation and tracing

Based on the collected data, transaction routes are created in the form of graphs (graphical diagrams showing the movement path of assets). The graph shows the relationship of addresses on the blockchain. The graphical representation of the connections simplifies the process of tracking the movement of cryptocurrency.

Representation of cryptocurrency transactions as a graph. Data: Arkham

Step 3: Clustering, pattern identification, and address labeling

First of all, addresses are identified whose data can be publicly available: wallets of crypto exchanges (Binance, ByBit, and others), decentralized applications (e.g., Uniswap), exchangers, asset issuers (Tether, Circle, Paxos), etc. This is already enough to cover more than 80% of all cryptocurrency transactions and partially identify them. The addresses of exchangers and exchanges can be used as entry/exit points (buying or selling cryptocurrencies for fiat).

Labeled addresses (BlackRock, Coinbase, etc). Data: Arkham

It is worth remembering that large trading platforms pass data about their clients to law enforcement agencies, including Russian ones. This is done at their request. According to Reuters, Russian law enforcement agencies (in particular, the FSB) received from the Binance exchange a full database of its clients from Russia. The exchange denied this information. But immediately after that, the head of Binance in Russia, Gleb Kostarev, moved to another position and began to supervise the activities of the exchange in Eastern Europe, and his place was taken by Vladimir Smerkis.

Screenshot from the “Transparent blockchain” presentation for the United Nations Office on Drugs and Crime (UNODC)

Step 4: Risk assessment

Based on the links, each address is assigned a risk level. Legal cryptocurrency services are assigned a low risk level (green). Addresses of unknown origin are assigned a medium risk level (orange). A high risk level (red) is assigned to addresses that have been used in hacking and cryptocurrency theft, fraud and extortion, gambling, darknet purchases, mixing cryptocurrency using special services (mixers) and addresses included in sanctions lists.

Risk labeling table

How an individual is identified

The “Transparent blockchain” can identify personal data of Russian and CIS residents who buy and sell cryptocurrency. This is done by detecting links between cryptocurrency transactions and bank transfers. In this process, the collected metadata from the blockchain is exactly what is needed. These are matched with metadata collected from banking organizations.

It works like this:

• The system detects a transaction on the blockchain;
• The exact time of the transaction, the participants, and the transfer amount are recorded;
• The system then searches for similar bank transactions, taking as a basis the amount of the transfer (converted to rubles for Russian banks), the time of the transaction, and other metadata;
• If a similar bank transaction is detected, the system will have personal data of the parties to the trade, which it will use to mark cryptocurrency addresses in the future.

Recently, crypto exchanges have started to split fiat payments into multiple transactions as one way to bypass the tracking system. But this method is ineffective, as the “Transparent blockchain” and similar services are able to analyze all entry/exit points, i.e., find the connection of a transaction in the blockchain with several bank points at once.

A common practice among crypto exchangers is the mass use of so-called drops, bank accounts opened for third parties. In this way, exchanger administrators hide their own personal data and circumvent limits on the volume of bank transfers.

It is the one

The “Transparent blockchain” mechanism is technically as good as similar analytical services like Chainalysis, Elliptic, TRM Labs, and others. But some nuances make the “Transparent blockchain” a unique system. Unlike the analytical services listed above, the Russian development is state-owned and has a direct link to the banking infrastructure. Thanks to this, the “Transparent blockchain” is able to identify in real time Russians and residents of neighboring countries who use non-cash money to buy and sell cryptocurrencies.