One of the defining features of a cryptocurrency is that its ledger, containing all transactions that have ever taken place, is globally visible. As one consequence of this degree of transparency, a long line of recent research has demonstrated that even in cryptocurrencies that are specifically designed to improve anonymity it is possible to track funds as it changes hands, and in some cases to de-anonymize users entirely. Tornado Cash has put this to the test. Tracking the movement of funds can be quite a challenging task for some users, luckily there are tools such as CertiK’s SkyTrace which is an intelligent wallet tracing and visualization tool to help you access security insights and follow the flow of funds. This tool displays and analyzes movements for Ethereum and BSC wallets, enabling you to track suspicious activity and reduce the risk of fraud.
If you follow CertiK’s new twitter, CertiKAlert, chances are you have seen a post about stolen funds going into Tornado Cash. Yahoo! Finance reported that, “over the past year, Tornado Cash serviced over $10 billion worth of crypto transactions according to Anchain, with a rising number of criminal cases being managed by Fang's firm involving the protocol.” Seems like most hackers and bad actors use this, so what is Tornado Cash?
What is Tornado Cash
Tornado Cash is a mixer (or tumbler), which is a service that mixes different streams of potentially identifiable cryptocurrency. This improves the anonymity of transactions, as it makes crypto harder to trace.
Tornado Cash is a non-custodial privacy solution for the Ethereum network based on zkSNARKs technology. The protocol ensures that users can break a link in on-chain activity for the purpose of improving transaction privacy between the recipient and destination address. Acting as a complex token mixer, Tornado Cash utilizes smart contracts that accept deposits made in ETH that are then withdrawn to other addresses. Since the withdrawal is made from the project’s smart contract liquidity pools, there is no way of knowing who the original sender is. This hides the flow of funds and makes it harder to track the funds.
There have been privacy solutions that have been launched in the past decade, with Monero and ZCash being notable examples. But both projects have their own chains, and there is no way for them to cover privacy on other blockchains as well. This is where Tornado Cash comes in. Tornado Cash generates a secret hash every time a user deposits assets. The smart contracts accept the deposit along with the hash, called a commitment. The purpose of the commitment is to identify the real sender and prove during the withdrawal process that the user in question owns the assets. By inputting the hash upon making the request, the user essentially confirms their identity while remaining anonymous on-chain to everyone else. Unlike the other tools created to ensure privacy, Tornado Cash is completely owned and governed by its own community. This was made possible in May 2020 when the development team of the platform waived authority atop the protocol’s multi-signature online wallet in a trusted setup ceremony. After that turnover, even the founders along with the developers have absolutely no control over Tornado Cash and the platform can be considered to have been completely decentralized. Roman Semenov, one of three founders of Tornado Cash, told Bloomberg “We don’t have more access to it than any other users.. There’s not much we can do.”
How Does it Work?
The fundamental principle behind Tornado Cash is that privacy is a human right, and the more everyone adopts privacy measures, the more secure it is for all of us. Tornado cash, at a high level, works by creating a cryptographic disconnection between a deposit and a withdrawal. To achieve privacy, Tornado Cash uses smart contracts that accept tokens deposits from one address and enable their withdrawal from a different address. Those smart contracts work as pools that mix all deposited assets. Once the funds are withdrawn by a completely new address from those pools, the on-chain link between the source & the destination is broken. The withdrawn crypto-assets are then anonymized. Anonymity mining is another innovative feature introduced by Tornado Cash that rewards users who support the project’s privacy features by providing liquidity. In Anonymity Mining, users will be able to receive TORN through a two-stage shielded liquidity mining system, which fully preserves user privacy. Users of Tornado Cash receive points for their anonymity as they further interact with the protocol. There is a shielded account in which these points are deposited and once they are sufficiently accumulated, the users can choose to convert them to TORN tokens. The TORN token is an ERC-20 token with a fixed supply that allows for holders to make proposals and vote for changes within the protocol.
Can the Funds be Tracked?
When tokens are either deposited or withdrawn from Tornado Cash, there is no link between that address and the new one. For this reason, you can request your funds to be sent to Tornado Cash, and withdraw them into your non-custodial wallet. When this happens, the link between the initial sender is then severed, thus ensuring your financial privacy on a public blockchain like Ethereum. For example, if Alice wanted to hide her funds, Alice would submit her Ethereum tokens to a Tornado.cash smart contract where it gets commingled and mixed up with other people's tokens, then re-sent back to Alice at a separate address. The Tornado Cash tool allows you to remain anonymous on-chain. However, if the tool is used without protecting oneself upstream and downstream, there is no point and the anonymity would only be partial. There are practices to avoid this, as Tornado Cash points out. They recommend using a VPN to prevent third parties from knowing that you are using Tornado Cash, deleting data from browser/extensions, being patient as withdrawing your funds immediately after depositing them makes it easier to link your deposit to your transfer using correlation probabilities, and using multiple addresses.
How SkyTrace Can Help
As mentioned above, one of CertiK’s new products, SkyTrace can help users track funds through different wallets. SkyTrace displays and analyzes movements for Ethereum and BSC wallets, enabling you to track suspicious activity and reduce the risk of fraud. This gives users the same access to the wallet insights tool that CertiK's security researchers use to inspect suspicious and fraudulent activity. While Tornado Cash is seen as an “end all be all” and the funds disappear, this is not always the case and there are ways to still figure out where they went in some cases. For example, if a large amount of ETH is deposited into Tornado Cash, you can monitor large amounts of ETH going out and into certain wallets. This is one of the reasons Tornado Cash recommends being patient and using multiple addresses. Using tools like CertiK’s Skytrace, you can track funds and see which amounts going out to various wallets match the amount that went into Tornado Cash. So while Tornado Cash is a good tool for hiding funds, it is not the end of the road always. With innovative tools like CertiK’s fund and wallet tracking, there is still a chance to catch bad actors.
