In traditional tumbling, let's say you have ten people who all want to intermingle their funds. So you have ten inputs and ten outputs, and now there's some plausible deniability added because you don't know which particular one of the ten any given output corresponds to. But you do know it belongs to one of the ten, which is still significant information. And, most importantly, the vast majority of Bitcoiners do not use tumbling services.

With mining, however, you are intermingling with the activities of an entire mining pool. It is WAAAY harder to trace. Let's say I want to launder 1,000 BTC, and I have a sympathetic mining pool that will launder it for me. So I sign a 1,000 BTC transaction that gives it all away as a transaction fee, and they include it in their next mined block, eating the full bonus.

Then, separately, either before or after, and possibly far separated in time chronologically, they issue a series of transactions to a set of separate virgin receiving addresses I have created that total up to, say, 999 BTC (they keep 1 BTC as their mixing fee). As a key point, these transactions do NOT spend the output of the 1,000 BTC reward block, but rather, block generation rewards from previous blocks they've mined. They are indistinguishable from standard mining reward payouts, which any pool goes through a huge number of every day.

Those 999 BTC I now have spread across my addresses are way more anonymized than anything I could get with a traditional mixing pool.

This does not serve as a tumbling mechanism because the participants aren't peers. The coins went all one direction from source to many destinations. If those many destinations don't, in turn, pay the source back in some way you've just lost the money not laundered it.

I don't understand your objection. The mechanism I explained works to launder and obscure the auditable trail of Bitcoin. All I figure is that you're pointing out some there is some risk inherent in the mining pool simply walking away with the money. OK, sure. There's lots of trust involved in the Bitcoin ecosystem. Every time I buy something on the Internet with Bitcoin I'm trusting the retailer to send me what I ordered rather than walking away with my money. Every time I transfer BTC to an exchange in order to sell it I'm similarly trusting that they won't instead simply screw me over.

No, you're not describing something like A (typical tumbling) is risky, and B (paid back by miners) is better but with somewhat more risk.

A is I give you a million dollars, you give me the deed on your house. There is risk, there is trust involved, but we both are peers and bare equivalent risk.

B is I give a small portion of a million dollars to hundreds or thousands of people and ask that they pay a new account some large portion of it.

B is 100% risk. It is in fact guaranteed not to work in the aggregate. The problem is that none of the individual miners have a stake, as I said they are not peers. In fact it's worse then that, they would incur unnecessary risk of their own to payback the money rather than just keep it because of the danger of being implicated in a money laundering scheme.

With tumbling every participant shares risk equally since every participant puts funds into the system. In your scenario weather it's 10 miners or 10000 miners NONE of them are putting up any money at the same time, AND you must trust every single individual.

It simply doesn't work. It is not a lauding scheme of any kind.

I think you are misunderstanding how mining pools work. It's only the pool operator that needs to know the valuable fee transaction in order to launder Bitcoin via block rewards. The individual miners that are in the pool are just hashing over a hash of the merkle root of all of the transactions that the pool has selected, along with several other fields. More details here: https://en.bitcoin.it/wiki/Block_hashing_algorithm

The individual miners don't know, and have no control over, the transactions in the tree that they are hashing. The only person you need to trust is the person in charge of the pool. So this part is wrong:

> In fact it's worse then that, they would incur unnecessary risk of their own to payback the money rather than just keep it because of the danger of being implicated in a money laundering scheme.

The miners have no option to pay back or keep the money. They just submit valid hashes of what is essentially nonsense to them (other hashes), and get paid out for doing so. They have no control over the mining pool operator, no control over what they're hashing, and no way of defecting other than by withholding valid hashes, which is disincentivized because it costs them money.

To use an example, AntPool is currently sitting at ~30% of the network hash rate. That works out to about 50 blocks per day, more than enough to do lots of laundering if they were so inclined. If I had, say, 1,000 BTC I wanted to launder, all I would have to trust is the main technical person at AntPool. I'd give them fifty different transactions, each with a block fee of 20 BTC, and they could launder it over a day, then give me back most of that 1,000 BTC in transactions to unrelated addresses from unrelated sources at their leisure. I literally only have to trust a single person at AntPool to do this -- I don't understand where you think these thousands of other people come in. It's certainly not doomed to fail.

The only real risk I can see is that a lot of mining pools (but not all) include transaction fees in the block reward bonus to be distributed to miners, after the mining pool rake is taken anyway. You'd simply have to calculate the fees differently. Currently miners might be paid out for, say, 95% of the value of a total block transaction fee summing up to around ~0.25-0.5 BTC. You'd continue paying that out for normal transaction fees, but then also add in, say, 1% of non-P2P transaction fees (the money-laundering ones), with another 1% being taken by the pool and the other 98% ultimately going back to the source in untraceable transactions. This would actually create a lot of incentive to use the pool that is doing the money laundering, because they'd be paying out more per found block since they have a second income stream!

I do know how mining pools work. One could indeed do what you are saying.

What I am saying, however, is that one wouldn't.

It does not make any sense economically or in terms of risk of arrest.

Either you have pissed off miners ("Hey! What happen to all the money from that fee?"), or they are all collaborating which means "grand conspiracy".

Without the miners participation you have an easy to trace transaction chain that goes like this: bad guys, suspicions fee transaction, pool operator, new address. Trivial to trace.

In point of fact the fees in this case went to every participating miner. All conceivable cases that lead to any definition of tumbling requires that the actual funds are sent to all the miners. The event horizon argument which is the basis of the article is simply wrong. You seem to agree since you don't make a case for that.

Simply put: the fee is just as traceable as any transaction.

The best that could be done to balance the economic motivations and risk in your scenario is to generate pre-signed multi party transactions in advance of the initial fee payment for every minor, perhaps they only become valid once the fee is paid (one of the inputs to the transaction), and only at some point in the future (to obscure the direct relationship). In this case you'd have at least one new transaction from every participating miner creating a large number of outputs that become difficult to trace. Though it is still only one round of tumbling, and so compromising even a single participant would be enough to trace at least the value of that one participants laundering contribution directly to the source.

Even that solution requires a set of completely traceable colluding participants namely the entire set of miners who should have been paid the fees but aren't. And each of them would have to express there intent to collude via the pre-signed transaction in advance of receiving any benefit.

So at absolute best you have a poor quality, high risk, error prone, tumbling / mining service.

Which... they historically are not that unlikely to do.

Well you are laundering money (which is likely illegal depending on your reason for doing so), so it'd be unreasonable not to expect there to be some risk. You're just trading off risk from government for risk from mining pool. But if you do the laundering over a series of transactions spread out in time, you are limiting your potential losses. Say you do it in fifty blocks over a week -- if the miner betrays you your maximum loss is 2%. If you don't tell the miner how much you're laundering through them (they'll just know when you are finished), and you give them an acceptable cut (say, 3%), it would be in their vested interest not to betray you because the expected value of more laundering from you is greater than what they could make by eating any one given attempt.

Also, if they are doing laundering as a service, then trust in them is very important, and screwing over one customer at the cost of potentially losing all future customers is not worth it. For instance, let's say I'm selling $5K of Bitcoin. I'm not worried too much that any given exchange is going to screw me over and eat it, because the big exchanges are doing many millions of dollars in business a day, and stand to lose a lot more from a hit to their reputation from stealing from me than they do to gain from eating my money. The only worry is if an entire exchange goes down (a la MtGox), but you can minimize that risk by not keeping money in an exchange.

You are correct in that tracing a transaction fee is equivalent to tracing any kind of transaction. There is no event horizon for transaction fees as implied by the article. New coins have no history because they are new, the coins for the fee are not new, they are simply added to the reward total for successfully mining them.

---

That being said the bitcoin metaphor is misleading in the details as metaphors always are. There are no bitcoins, in that there are no IDs that are kept in an inventory that represent every individual bitcoin. Instead bitcoins are represented as ledger entries only. The traceability, or lack thereof, comes from the ability to trace the ledger entries. It goes something like this:

Miner: "Everyone agrees I now have 25 bitcoins in account M1. Because I'm a winner!"

Miner: Tx :: Send 25 bitcoins from M1 account, to P2 (Person 2's public key)

Person 2: Tx :: Send 5 bitcoins from P2, to P3.

Balances

M1: 0

P2: 20

P3: 5

P3's bitcoins can be traced to P2, and then M1. Now P2 sends a transaction with a high fee (up to now no fees were paid).

Person 2: Tx :: Send 1 bitcoin from P2, to P4, with a tx fee of 19.

Miner 2: "Everyone agrees I now have 44 bitcoins in my M2 account. Because I'm a winner!"

Balances

M1: 0

P2: 0

P3: 5

P4: 1

M2: 44

M2's bitcoins can be traced to 25 new coins, 19 fee coins given by P2, who go them form m1. P3 is not involved in the transaction history, and every transaction is traceable.

Yes tumbling is much more secure if your goal is to anonymise your money. MML is much more easily traceable as you just look at the guy who mined the block and send the authorities to go and speak with him. Especially if the large mining operations are well known.

The usefulness to a launderer seems more the simplicity of exchanging a large amount of coins for fiat currency in a single transaction, rather than going through an exchange or sending lots of complex small transactions through a mixer and figuring out how to exchange all of that back without going through an exchange w/ KYC

> MML is much more easily traceable as you just look at the guy who mined the block and send the authorities to go and speak with him.

Well that's easier said than done. There are a large number of blocks for which the miner is not known. The only reason the miner is known for as many blocks as it is is because several of the largest mining pools tag every block that they mine as a form of accountability to their miners (and of course bragging rights).

OK but you know the account that got the "laundered" money. So whatever you were going to do with the BTC before laundering (like cash them in), you still can't do. The previous identity flows.

I think the article is simply wrong.

No you don't know where the laundered money ends up. See my other longer comment in this thread, but the gist of it is that the pool will use the transaction fee to pay their mining rewards out of, and pay out rewards from previous blocks to a series of separate virgin addresses controlled by the original party in a way that looks indistinguishable from mining reward payouts.

I will grant you that the article didn't fully explain the process, and elided important details.

Most of the "important details" aren't, as far as I can see. The only big thing that the pool adds is plausible deniability: everything else can be simulated by sufficiently complex tumblers; it's just that the vast majority of mining payouts are untainted that gives this a mixing effect. (You can delay payments and pay back in installments to multiple addresses that are not the source address but are owned by that person, via either mechanism.)

Running some numbers, it looks like about 98% of Bitcoin's hashrate seems to be held in the top 10 mining pools; assuming this isn't a common service provided by those top pools then a mining pool which launders too will have, say, 1% of the network hashrate at most. That's actually a nice place to be in; it means you get a payout roughly every 1000 minutes of 25 BTC (~$400) plus what looks like typically 1500 transactions or so paying you about a nickel apiece -- so let's optimistically say you get a payout of $600 total every 16 hours, or $900/day. Maybe you can keep plausible deniability going even when 25% of your revenues come from laundering transactions, so that means they can launder about $300/day. That's not too bad, about $100k/year, but it's not a massive chunk of the money laundering happening worldwide either, which usually is quoted in at least terms of billions of dollars -- so 4-5 orders of magnitude larger. Even considering how much the network as a whole could maybe launder if they were crazy about it (100x more participation in laundering, 10x more revenues from laundering transactions) you're still only 1-10% of total global money laundering by this mechanism before you have no presumption of "most of this money is clean so the laundered money is properly hidden."

So e.g. if you wanted to launder $1m within a year using our example pool then you'd have to pay in $2700/day and the legitimate transactions of the pool would only be 900/3600 = 25%; I'm not claiming that this is insecure -- but rather that a normal tumbling system could do this too, purchasing 25% of the money-to-be-laundered from a BitCoin exchange, gradually paying out over a year, and reselling the surplus 25% back on the exchange, for no real difference in security (but potential gains in speed and volume). If you charge a 10% laundering fee then this is an investment of $250k to gain $350k over the course of 550 installments in the year, so if I'm doing the math right that's a return rate of 0.13094%/installment or a nominal rate of 72%/year -- plenty enough to cover whatever risks there are in the currency, inflation, opportunity cost, etc. So it wouldn't be prohibitively much to ask the laundering network to invest, if I'm doing these numbers right.