• Corpus ID: 246240376

On How Zero-Knowledge Proof Blockchain Mixers Improve, and Worsen User Privacy

@article{Wang2022OnHZ,
  title={On How Zero-Knowledge Proof Blockchain Mixers Improve, and Worsen User Privacy},
  author={Zhipeng Wang and Stefanos Chaliasos and Kaihua Qin and Liyi Zhou and Lifeng Gao and Pascal Berrang and Benjamin Livshits and Arthur Gervais},
  journal={ArXiv},
  year={2022},
  volume={abs/2201.09035}
}

• Zhipeng Wang, Stefanos Chaliasos, +5 authors Arthur Gervais
• Published 22 January 2022
• Computer Science
• ArXiv

One of the most prominent and widely-used blockchain privacy solutions are zero-knowledge proof (ZKP) mixers operating on top of smart contract-enabled blockchains. ZKP mixers typically advertise their level of privacy through a so-called anonymity set size, similar to k-anonymity, where a user hides among a set of k other users. In reality, however, these anonymity set claims are mostly inaccurate, as we find through empirical measurements of the currently most active ZKP mixers. We propose five heuristics that, in combination, can increase the probability that an adversary links a withdrawer to the correct depositor on average by 51.94% (108.63%) on the most popular Ethereum (ETH) and Binance Smart Chain (BSC) mixer, respectively. Our empirical evidence is hence also the first to suggest a differing privacypredilection of users on ETH and BSC. We further identify 105 Decentralized Finance (DeFi) attackers leveraging ZKP mixers as the initial funds and to deposit attack revenue (e.g., from phishing scams, hacking centralized exchanges, and blockchain project attacks). State-of-the-art mixers are moreover tightly intertwined with the growing DeFi ecosystem by offering “anonymity mining” (AM) incentives, i.e., mixer users receive monetary rewards for mixing coins. However, contrary to the claims of related work, we find that AM does not always contribute to improving the quality of an anonymity set size of a mixer, because AM tends to attract privacy-ignorant users naively reusing addresses.