About a year ago I used the Ethereum Kovan testnet to test an application I was developing at the time. It required getting some testnet ETH(KETH) using the Kovan faucet to create transactions and test the application.

First result on google leads to the Kovan faucet on gitter

The way Kovan faucet works is as follows:

1. Join the Kovan testnet/faucet room on gitter using your GitHub account login.

2. Post your Ethereum address to which you would like to receive the testnet funds.

3. The funds are sent to your address on the Kovan network.

Messages on the gitter public chat show addresses and GitHub account

Extracting the data

At the time this got me thinking about my privacy and how this public gitter chat could be used to map my real identity to my Ethereum address through my GitHub account by anyone with some basic coding skills and some spare time.

Time passed by and lately I started to take interest in Blockchain data analytics, and I remembered the Kovan faucet idea I had. I wondered how hard it could be to create a mapping of all the Kovan faucet chat.

Turns out it isn’t complicated and requires only some basic coding skills. I will briefly describe how this can be done. A first version of my code is publicly available at my GitHub ‘identifyEth’ repository. Just to clarify, creating the mapping does not require any hacking or scraping, it is all public information which is easily accessible using the gitter API. Here’s how it can be done:

1. Sign in to gitter developer and register your application.

2. Clone the gitter demo application, and follow the steps found in the README.md

3. Open your web browser and open http://localhost:7000 then sign in, allow and save your Bearer token that appears on the screen.

4. Identify “kovan-testnet/faucet” roomId using curl from your terminal: curl -X POST -i -H “Content-Type: application/json” -H “Accept: application/json” -H “Authorization: Bearer YOUR_TOKEN” “https://api.gitter.im/v1/rooms" -d ‘{“uri”:”kovan-testnet/faucet”}’ extract the room id from the response.

5. Fetch all the chat messages using a loop and the following endpoint GET /v1/rooms/:roomId/chatMessages?limit=50 . Note that this only retrieves the last 50 messages. Use pagination as described in the gitter API documentation to get all the other previous messages.

My initial code is available in my ‘identifyEth’ repository, however I also developed an extended version which extracts more data and integrates with several APIs and provides additional information.

Sample data

*identifying information was removed

sample of the data

Dataset applications

In some of the cases, the user was aware about privacy and used a one-time address, specially created one time GitHub account using a one-time email address. In other cases, when the person shares personal information such as name, email address, LinkedIn account, etc, looking at the GitHub/Twitter account could expose the REAL identity of the address/wallet owner, Furthermore, if the same address was used in mainnet, this could expose the address owner’s crypto financial activity, along with other owned addresses by using some advanced methods. We can probably assume that Microsoft (GitHub), and Twitter can access metadata related to their users, the IPs from which the account was created, and other interesting user related data. This information could be used by malicious actors such as scammers or even government backed hackers, companies, governments and law enforcement agencies.

Breakdown of the data

Total of 278,090 records extracted. 126,823 unique addresses. 39,287 unique addresses with positive balance on mainnet.

The total amount of ETH held on these addresses is 19,318.

The total amount of USDT held on these addresses is 10,560,961.

The total amount of USDC held on these addresses is 34,938,658.

The total amount of DAI held on these addresses is 2,881,050.

The total amount of WBTC held on these addresses is 88.70257.

Excluding any other token and NFT’s and other chains such as BSC, Polygon, etc. Meaning — at least 110,328,886$ based on the current ETH price of 3008$ and BTC price of 43286$.

The holdings of some of the largest accounts are:

1. 0x4b85a658bd606ba20745fdc644a109eba9abe553 1025.64814ETH(3,622,220$) + 2,476,512.22$ worth of tokens.

2. 0x331B898B738146E3Fc55385216DD46a2CdE9462f 630.143ETH(2,223,656.53$)

3. 0xb1dB3e730dF1833983222130cF95139f6b563578 612.122ETH($2,161,416.76) +10,950,304.38$ worth of tokens

A quick check shows that at least one of these address owners is identifiable using the dataset.

Example

Let’s dive into one of the records from the data set:

2021–09–07T01:04:39.836Z,0x6773ec31aa7719b30a02a3ab151a2b578ef17842,XXXos,AAAAAA BBBBB,https://avatars2.githubusercontent.com/CCCCCCCCCCC,github,0.008869738068446203,0,0,0,0

I made sure to remove any identifying data, but this is an example of how this data could be used.

The record provides us the date in which the faucet request was submitted, The GitHub username, Real full name (First and Last) and the user avatar.

GitHub account of XXXXos

As you can see, we can extract the users’ Gmail, LinkedIn account, which basically disclose his real identity (Which we already have anyway from the dataset).

Now lets take a look at the users Ethereum address on the Kovan testnet explorer:

0x6773Ec31Aa7719b30A02A3Ab151a2b578eF17842

We can see that the address owner, initially received some funds from the faucet, and then he created some contracts and sent some funds to the Kovan Chainlink contract(oxa36…). Which indicates that the user is probably learning or developing an application.

Now lets take a look at the same address on the Ethereum mainnet:

The address owner used the same address on testnet for his mainnet activity, which now discloses some of his real life financial activity. We can see that he own 34.44$ worth of Ethereum and 152.01$ worth of some other tokens in the current market price. The Ethereum owned in this address was most likely purchased on an exchange(based on the activity of the input address in the first transaction) and withdrawn to this address. The address owner than tried to make an interaction(which failed due to lack of gas) with OpenSea the largest NFT market place, and eventually swapped some of the ETH to SPANK token using Metamask .

This is a simple example, but on the data set you could find accounts which expose large portfolios and activity and can be mapped to real identities.

De-anonymize other cryptocurrency address owners

A simple google search for “gitter faucet” shows that the same technique could be used for okexchain and evannetwork(Which i am not familiar with…).

“gitter faucet” on google

Of course, how it can be leveraged depends also on the properties of the blockchain. In Ethereum, testnet and mainnet addresses will be generated in the same manner, thus exposing a testnet address will expose the mainnet activity of the same address. In Bitcoin, knowing the testnet address, you would like to reverse the process of address generation to get the public key, from it you could generate the corresponding mainnet address. However reversing this process is not possible because SHA-256 is a one way function and cannot be reversed.

Airdrops as a risk factor

A known way for new Defi protocols of testing their protocols, is deploying the dApp to testnet with an incentive campaign called an airdop. Such campaigns attract users to “play around” in the testnet environment and perform some actions in the new protocol before it launches to mainnet.

The addresses that were active in the testnet during the incentivized testnet campaign later receive some governance or utility tokens of that protocol as a reward for their participation. This method forces users to use the same address on both testnet and mainnet. This increases the risk of exposing their real mainnet activities.

Conclusions and further discussion

Clearly, Blockchain/Crypto developers must be aware of their privacy as most of the ledgers are public and different techniques could be used to de-anonymize their activity. However, requiring users to link their address to their online identity in faucets is at best a poor design for such a system.

Some of the possible methods to avoid identification using faucets are: Using a proxy, creating new accounts, avoiding the usage of Testnet wallet on Mainnet, using privacy enhancing crypto solutions.

Faucet analytics — Exploring the dataset shows that there was a massive spike in the faucet activity at the end of March after which Ethereum price spiked to an ATH at mid April.

Other unique patterns such as same address being used by multiple different accounts allowes mapping teams working on the same project.

ABOUT ME

I am a Blockchain Developer at the Applied Research group in J.P. Morgan. I am a Computer Science graduate from Ben Gurion University.

Links

Github repository: https://github.com/alexstolr/identifyeth

Linkedin: https://linkedin.com/in/alex-stoliar-6a6416a4

Email: alexstolr@gmail.com

Any views or opinions expressed are my own