There are a few caveats to the data. Levin points out that the payments attributed to “Tor markets,” the term Chainalysis uses to describe darknet markets, are probably “noise” generated by his analysis, and should be ignored. The low payment amount also suggests that it’s unconnected to the ransomware. Each entity could be using thousands of addresses, and it’s Chainalysis’ job to group them accurately. For instance, Levin says that one exchange, Poloniex, uses 376,000 bitcoin addresses, all of which have been clustered by Chainalysis, allowing correct attribution.

Additionally, just because a payment is from an exchange that serves Korean or Russian customers doesn’t necessarily mean the infected users are indeed in Korea or Russia—although it’s a reasonable inference. Lastly, little is known about BTC-E, the exchange at the top of the list, except that its operators are anonymous, it’s one of the longest running exchanges in bitcoin, and it notoriously doesn’t perform the identity checks that regulated exchanges must comply with, and it deals in the ruble-bitcoin market.

Chuck Reynolds
Contributor
Please click either Link to Learn more about Bitcoin.