  Ethereum is the largest public blockchain by usage. It applies an
account-based model, which is inferior to Bitcoin's unspent transaction output
model from a privacy perspective. Due to its privacy shortcomings, recently
several privacy-enhancing overlays have been deployed on Ethereum, such as
non-custodial, trustless coin mixers and confidential transactions. In our
privacy analysis of Ethereum's account-based model, we describe several
patterns that characterize only a limited set of users and successfully apply
these quasi-identifiers in address deanonymization tasks. Using Ethereum Name
Service identifiers as ground truth information, we quantitatively compare
algorithms in recent branch of machine learning, the so-called graph
representation learning, as well as time-of-day activity and transaction fee
based user profiling techniques. As an application, we rigorously assess the
privacy guarantees of the Tornado Cash coin mixer by discovering strong
heuristics to link the mixing parties. To the best of our knowledge, we are the
first to propose and implement Ethereum user profiling techniques based on
quasi-identifiers. Finally, we describe a malicious value-fingerprinting
attack, a variant of the Danaan-gift attack, applicable for the confidential
transaction overlays on Ethereum. By incorporating user activity statistics
from our data set, we estimate the success probability of such an attack.
