How Did Dread Pirate Roberts Acquire and Protect his Bitcoin Wealth?

Abstract

The Bitcoin scheme is the most popular and talked about alternative payment scheme. One of the most active parts of the Bitcoin ecosystem was the Silk Road marketplace, in which highly illegal substances and services were traded. It was run by a person who called himself Dread Pirate Roberts (DPR), whose bitcoin holdings are estimated to be worth hundreds of millions of dollars at today’s exchange rate. On October 1-st 2013, the FBI arrested a 29 year old person named Ross William Ulbricht, claiming that he is DPR, and seizing a small fraction of his bitcoin wealth. In this paper we use the publicly available record to trace the evolution of his holdings in order to find how he acquired and how he tried to hide them from the authorities. In particular, we trace the amounts he seemingly received and the amounts he seemingly transferred out of his accounts, and show that all his Silk Road commissions from the months of May, June and September 2013, along with numerous other amounts, were not seized by the FBI. This analysis demonstrates the power of data mining techniques in analyzing large payment systems, and especially publicly available transaction graphs of the type provided by the Bitcoin scheme.

Appendices

Appendix A: The Identities of Some of the Addresses in Fig. 3

We list below the identities of the addresses appearing at the bottom of Fig. 3. The first one is the one with the 144,336 DPR Seized Coins. The next 19 are the addresses from which $89.6\,\%$ of the above amount was received. In the figure, these 19 addresses are grouped (from left to right) in four subgroups of 15,1,1 and 2 addresses as listed below.

DPR Seized Coins	1FfmbHfnpaZjKFvyi1okTjJJusN455paPH
1/15	1M2TBBkAESfiyKsmqDKsLxD6oC4bvM8WQx
2/15	1JwL9bWB4RJ29Cc3ccW6M1mWA8hrfidPzm
3/15	1NfvKnqRk8wSutfWitJdMSF1cAMfG4Q9sG
4/15	1FAVjwR4ZRRUYuZKdGwbWhDrfASP5Vg5vk
5/15	1B6UsR4HK5Zn7ggN4pUZkhwJt8c65Th67G
6/15	19XmwMdRspwNN55eYLincbf1xDenNajU8R
7/15	1Fdi7uUBiYQogFEgTEsPCQZv2qC8WRLwGD
8/15	1Nt6HwcysgRMehHHwoKV9KkswmBQSLmicQ
9/15	1HGVEWBZ4MBEUw9VGf6AbQNMtoCZ8BUyj3
10/15	1KQoi5wAq6zCuQmL67adAMipWZ8apui6hP
11/15	1Pt42pTpy1i4D1XfFtvuvL7CMLMo4tVF8v
12/15	1AG6FDBg934ikpGPeeik3rabnSea8r6wGJ
13/15	1FvxZn2dkbz8AQnBkEgRq8ttH6czwADwQW
14/15	17YqeNog4t5YgbKLgh99UwSjUQAFEjuFtN
15/15	14xCmiFcddLuiTfeH6r1vgLUjro2qskCzp
1/1	19GUoeGq7hf9KyYfRVLx68SA4NJ4uDDQRF
1/1	1Az2kHto3AqCQmmnFAXtcPkGdLqNWRxnSV
1/2	1EdsvQfKkV8dWo179AgHMH52XAZ4gccoz2
2/2	1Bbwcvmtx3xd1GDLJopCX4PgftT5PkqDfa

Appendix B: The Identities of Some of the Addresses in Fig. 5

We list below the identities of the addresses marked with a brown cloud in Fig. 5. There are 10 addresses which are grouped (from left to right) in four groups of 1,3,1 and 5 addresses. In the forth group there is actually only one interesting address, the one from which 8,000 BTCs were moved prior to the FBI’s action. These six relevant addresses are listed below.

1/1	1NnqM24fFeAGf7NWxmhhFkQAciPqeWo3L
1/3	1Gx49gkDDeGvPGuWNdzwvVz7pP984VX1wf
2/3	14xrNSxfQ2FwmsaQNKAYY4ENMsrDnhQW4x
3/3	1FpzHKV3yeK1jh21VG1cq5emVPuSz63wSS
1/1	1Esg7ZoXh1oytd7GwJagHoq3AijfSbAeLg
1/5	1HBxVRovvUW17wn8L9JGkxVeb5ibTU1bjs