<p>Maybe a more specific example would help:</p>

<p>Senator Doe buys 100 BTC at Ed's Exchange, where his ID is required.  He then withdraws those coins to his own address <code>1qwerty</code>.  Wearing a trench coat and dark glasses, he uses those 100 BTC to make a purchase at Frank's Embarrassing Merchandise Emporium, sending them to Frank's freshly generated address <code>1abcxyz</code>.</p>

<p>He thinks he's safe: </p>

<ul>
<li><p>Ed knows that <code>1qwerty</code> belongs to Senator Doe, and that Doe transferred them to the address <code>1abcxyz</code>, but only Doe and Frank know that <code>1abcxyz</code> belongs to Frank.  It was randomly generated, and just looking at the address doesn't reveal anything about whom it belongs to.</p></li>
<li><p>Frank knows that he sold something embarrassing to the owner of the address <code>1qwerty</code>, but doesn't know the true identity of the disguised person who came into his shop.</p></li>
</ul>

<p>So, thinks Doe, nobody knows that in fact it was Doe who made the embarrassing purchase.</p>

<p>But if Ed and Frank are cooperating, or are secretly the same person, then they can share their knowledge and learn that it was Doe that made the embarrassing purchase.  Now they can inform the newspapers and/or blackmail Doe.</p>

CC BY-SA 4.0
2018-10-09T02:48:34.927Z
2018-10-09T02:48:34.927Z
Nate Eldredge
<blockquote>
  <p>I (as attacker) already know the owner of address B, don't I? why I
  need trap site?</p>
</blockquote>

<p>You're right, if you sold the bitcoin and sent it to an address, and you know the identity of the person to whom it was sold (from KYC, for example), then you can associate that person that address. Since it is publicly verifiable on the blockchain, you don't need a trap site in order to see when that bitcoin is spent, but if you run a trap site, you can determine what they spent the Bitcoin on.</p>

CC BY-SA 4.0
2018-10-08T16:07:50.540Z
2018-10-09T02:05:05.470Z
2018-10-09T02:05:05.470Z
JBaczuk
<p>There is an problem shown in bitcoinwiki:</p>

<blockquote>
  <p>Someone runs both a money
  exchanger and a site meant to trap people. When Mr. Doe buys from the
  exchanger and uses those same coins to buy something from the trap
  site, the attacker can prove that these two transactions were made by
  the same person. The block chain would show:</p>
  
  <p>Import coins from address A. Send 100 to B. Authorized by (signature).</p>
  
  <p>Import coins from address B. Send 100 to C. Authorized by (signature).</p>
  
  <p>Bitcoin transactions do not have a "from" address, but if the attacker
  believes that address B is controlled by Mr. Doe because the attacker
  received $5 from Mr. Doe's PayPal account and then sent 100 BTC to
  that address then they can infer the identity of the party sending to
  C. This assumption is not always correct because address B may have
  been an address held on behalf of Mr. Doe by a third party and the
  transaction to C may have been unrelated.</p>
</blockquote>

<p>I can't understand several issues. Is "someone who runs both a money exchanger and a site meant to trap people" attacker? If so, than I (as attacker) already know the owner of address B, don't I? why I need trap site?</p>

<address><security><privacy><tracking>
Can't understand specific problem of Bitcoin anonymity
O. Shekriladze
# Can't understand specific problem of Bitcoin anonymity

(Asked by: username_0 on 2018-10-08)

There is an problem shown in bitcoinwiki:

> Someone runs both a money
> exchanger and a site meant to trap people. When Mr. Doe buys from the
> exchanger and uses those same coins to buy something from the trap
> site, the attacker can prove that these two transactions were made by
> the same person. The block chain would show:
>
> Import coins from address A. Send 100 to B. Authorized by (signature).
>
> Import coins from address B. Send 100 to C. Authorized by (signature).
>
> Bitcoin transactions do not have a "from" address, but if the attacker
> believes that address B is controlled by Mr. Doe because the attacker
> received $5 from Mr. Doe's PayPal account and then sent 100 BTC to
> that address then they can infer the identity of the party sending to
> C. This assumption is not always correct because address B may have
> been an address held on behalf of Mr. Doe by a third party and the
> transaction to C may have been unrelated.

I can't understand several issues. Is "someone who runs both a money exchanger and a site meant to trap people" attacker? If so, than I (as attacker) already know the owner of address B, don't I? why I need trap site?

**Tags:** address, security, privacy, tracking


---

## 2 answers

### Answer by username_1 on 2018-10-09. Score: 1 | Accepted answer

Maybe a more specific example would help:

Senator Doe buys 100 BTC at Ed's Exchange, where his ID is required. He then withdraws those coins to his own address `1qwerty`. Wearing a trench coat and dark glasses, he uses those 100 BTC to make a purchase at Frank's Embarrassing Merchandise Emporium, sending them to Frank's freshly generated address `1abcxyz`.

He thinks he's safe:

* Ed knows that `1qwerty` belongs to Senator Doe, and that Doe transferred them to the address `1abcxyz`, but only Doe and Frank know that `1abcxyz` belongs to Frank. It was randomly generated, and just looking at the address doesn't reveal anything about whom it belongs to.
* Frank knows that he sold something embarrassing to the owner of the address `1qwerty`, but doesn't know the true identity of the disguised person who came into his shop.

So, thinks Doe, nobody knows that in fact it was Doe who made the embarrassing purchase.

But if Ed and Frank are cooperating, or are secretly the same person, then they can share their knowledge and learn that it was Doe that made the embarrassing purchase. Now they can inform the newspapers and/or blackmail Doe.


---

### Answer by username_2 on 2018-10-08. Score: 1

> I (as attacker) already know the owner of address B, don't I? why I
> need trap site?

You're right, if you sold the bitcoin and sent it to an address, and you know the identity of the person to whom it was sold (from KYC, for example), then you can associate that person that address. Since it is publicly verifiable on the blockchain, you don't need a trap site in order to see when that bitcoin is spent, but if you run a trap site, you can determine what they spent the Bitcoin on.


---

