Tracking of Suspected Addresses in Elliptic & BitOK claims

0xHaM☰d
5 min readOct 30, 2023

Introduction

In the wake of the WSJ’s article, both Chainalysis and Elliptic have raised questions regarding the accuracy of the reporting. This research project delves into a critical evaluation of the WSJ’s claims and the implications outlined in Senator Elizabeth Warren’s letter. Drawing upon the resources provided and additional information, our aim is to replicate and expand upon the work conducted by Elliptic and BitOK. Leveraging chain analysis tools and conventional reporting techniques, the focus lies on ascertaining verifiable facts. This endeavor seeks to debunk specific details of the story, establish an independent and fact-based account of the events, create data visualizations and graphics to address the WSJ’s reporting.

Methodology

We initiated our data retrieval process by compiling a list of 26 Tron addresses specified in seizure order AO 34/23. These addresses were the focal points of our investigation.

Next, we collected raw transfer transactions directed to these addresses, making sure to exclude self-transfers, focusing solely on external transactions. Our filters honed in on transactions involving USDT and TRX, mirroring Elliptic’s methodology.

To assign monetary values to these transactions, we tracked daily TRX prices from Coingecko and averaged daily prices for USDT and USDC from Ethereum.

This comprehensive data collection forms the basis for our analysis, enabling us to delve into the financial movements accurately. With this solid foundation, we can now scrutinize discrepancies and gain a clearer understanding of the situation.

Analysis

As we delve into the data, a striking observation emerges — the cumulative USD transferred to the 26 addresses, as reported by Elliptic, presents a variance. Elliptic’s figures indicated a total of approximately 93 million USD, while my analysis reveals a slightly lower amount, around 83.87 million USD.

Digging deeper, I considered transfers occurring between these addresses, and even then, the cumulative transfer value I derived was approximately 96 million USD. This figure remains noticeably higher than the initial 93 million USD reported by Elliptic.

These disparities in the reported figures prompt us to delve further into the data, seeking a comprehensive understanding of the transactions and their implications. The story of these discrepancies unfolds as we continue our investigation, shedding light on the intricacies of these financial movements.

A notable disparity emerges in the data comparison. Elliptic’s graph displays a peak in May 2022, indicating a transfer value of almost 10 million USD. In contrast, my analysis reveals a lower figure, around 5.6 million USD for the same month. This discrepancy prompts a closer examination, potentially uncovering nuances in the transactions and their accuracy during that specific period.

Notably, there are disparities in both the monthly transfer values and transaction counts when comparing the data with Elliptic’s findings. For instance, while my analysis reveals a maximum transfer count of 4.43k in January 2023, Elliptic’s reports show multiple months with transaction counts exceeding 10k. These discrepancies raise questions about the accuracy and interpretation of the data, warranting further investigation.

The chart below illustrates transfer types categorized by inflow and outflow directions across suspended addresses.

Image Created Link

In ASO 15/22, the results are mostly aligned with BitOK’s claims. They asserted that approximately 35.3 million USD was transferred to the specified addresses. My analysis reveals a close figure, around 33.6 million USD in USDT and 11,000 USD in TRX.

However, it’s worth noting that BitOK did not specify the tokens they considered in their analysis. In contrast, my approach focused exclusively on USDT and TRX transfers, potentially accounting for the slight variance in the findings.

In ASO 19/23, the results closely align with BitOK’s claims. BitOK asserted that approximately 5.584 million USD was transferred to the specified addresses. My analysis reveals a total transfer value of 5,584,394 USD in my table, which is remarkably close to their reported figure of 5,584,000 USD. The minor variance can be attributed to the conversion of USDT to USD. Overall, this finding can be considered a match with BitOK’s claim.

We’re closely monitoring the top 20 wallets that sent USDT to the compromised addresses.

Among them, the leading sender stands out, having transferred a substantial 22.7 million USDT, emphasizing their significant involvement in these transactions.

We’ve identified the top 20 wallets that received the most substantial USDT transfers from the compromised addresses.

Noticeably, the leading recipient received a significant 11.38 million USDT, underscoring their central role in these transactions.

Considering the substantial volume and frequency of transfers, coupled with notable connections to addresses labeled as centralized exchanges (CEX), it’s highly likely that some, if not most, of these addresses were included without comprehensive analysis.

Examining intra transfers, which are transactions occurring between two reported addresses, reveals strong connections among them.

Notably, over 12 million USDT was transferred from one address to another in a total of 142 transactions, highlighting a substantial and recurrent link between these addresses.

In our efforts to determine the approximate geographical locations of the suspicious addresses, we relied on a novel approach.

While pinpointing the exact geographic location of crypto users through their addresses remains elusive, we utilized the block timestamp of their transactions to estimate their time zones, offering valuable insights into their potential regions.

Based on our timezone calculations using transaction timestamps, a significant number of these addresses appear to be located in Dubai, United Arab Emirates.

In conclusion, our analysis of the data related to the specified addresses has revealed significant insights:

  1. Discrepancies and Matches: We observed both disparities and alignments in our findings compared to external claims and analyses. While some results closely matched reported figures, others varied, necessitating further scrutiny and clarification.
  2. Intricate Financial Web: Our examination highlighted the intricate network of financial transactions between these addresses. Notably, strong connections were evident, particularly through intra transfers, underscoring the depth of their involvement in this ecosystem.
  3. Geographical Insights: Our attempts to estimate approximate geographical locations using transaction timestamps pointed to a concentration of activity in Dubai, United Arab Emirates. This suggests potential regional origins for these addresses.
  4. Data Quality: The study raises questions about the accuracy and comprehensiveness of the data. Some addresses may have been included without thorough analysis, emphasizing the importance of rigorous data collection and evaluation.

In summary, this research underscores the complexities of analyzing cryptocurrency transactions and the critical need for precise and reliable data to ensure accurate insights into these financial activities. Further investigation is imperative to address the remaining disparities and gain a more comprehensive understanding of these addresses and their roles in the crypto ecosystem.

References:

  1. https://app.sollinked.com/AqsKuYXToEGneeKLFAxuXyPKHE4RCmgbXS4anj6NEfpr/p/AntonidassHAMASDataset-11c8689b
  2. https://flipsidecrypto.xyz/sam/verifying-elliptic-bit-ok-claims-verifying-elliptic-bitok-claims-VpBJs2

--

--