Tornado Cash Analysis - Draft

Documenting data related to activity observed around Tornado_Cash_100eth on the ethereum blockchain network

Cosmograph | App Work with network graphs consisting of hundreds thousands nodes and edges right on your laptop. https://cosmograph.app/run/?data=https://raw.githubusercontent.com/cipher-rc5/supreme-spork/refs/heads/main/tornado-sample_data.csv&meta=https://hackmd.io/@cipher/tornado_cash_100eth_analysis&source=tc_withdrawal_recipient&target=tc_recipient_freq,round_mana_ratio,trace_value_eth,tx_type&gravity=0.15&repulsion=1.5&repulsionTheta=1.5&linkSpring=0.5&linkDistance=20&friction=0.85&renderLabels=true&renderHoveredLabel=true&renderLinks=true&linkArrows=true&nodeSizeScale=1.3&linkWidthScale=1.5&linkArrowsSizeScale=1&nodeSize=size-default&nodeColor=color-column%20type&linkWidth=width-default&linkColor=color-default&

USDT_Tron_Blacklist_Clusters

Dune analytics query utilized to monitor tron usdt blacklist activity, query linked here: dune_analytics_query_5305128

with tron_usdt_blacklisted as (
    select
        to_unixtime(evt_block_time) as unix_time
        , evt_block_time
        , substring(cast(evt_tx_hash as varchar), 3) as txn
        , to_tron_address(_user) as usdt_blacklisted_addr
        , chain
        , 'tether-usdt' as token
    from
        tether_multichain.tether_usd_evt_addedblacklist
    where
        chain = 'tron' and evt_block_time >= from_unixtime(1740114000)
),
tron_usdt_removed as (
    select distinct
        to_tron_address(_user) as removed_addr
    from
        tether_multichain.tether_usd_evt_removedblacklist
    where
        chain = 'tron'
)
select *
from tron_usdt_blacklisted
where usdt_blacklisted_addr not in (
    select removed_addr from tron_usdt_removed
)
order by evt_block_time desc

nushell_script_to_extract_relevant_data

http get --headers [X-Dune-API-Key $env.DUNE_NU_API] 'https://api.dune.com/api/v1/query/5305128/results?limit=1000'
| get result.rows
| get usdt_blacklisted_addr
| uniq
| chunks 150
| each { |chunk| "https://intel.arkm.com/visualizer/entity/" + ($chunk | str join ",") }
| str join "\n\n"
| to text

• usdt_tron_blacklist_cluster_1
• usdt_tron_blacklist_cluster_2
• usdt_tron_blacklist_cluster_1
• usdt_tron_blacklist_cluster_3
• usdt_tron_blacklist_cluster_4
• usdt_tron_blacklist_cluster_5

Cluster Correlations

correlations observed in [usdt_tron_blacklist_cluster_2]

Tornado Cash 95_Day Analysis

with relevant_transactions as (
    select distinct ethereum.logs.tx_hash
    from ethereum.logs
    inner join ethereum.transactions on ethereum.logs.tx_hash = ethereum.transactions.hash
    where
        ethereum.logs.contract_address = 0xa160cdab225685da1d56aa342ad8841c3b53f291
        and ethereum.logs.topic0 = 0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931
        and ethereum.transactions.success = true
        and ethereum.logs.block_time > current_timestamp - interval '95' day
        and ethereum.transactions.block_time > current_timestamp - interval '95' day
),
filtered_traces as (
    select 
        ethereum.traces.tx_hash 
        , ethereum.traces.value
        , ethereum.traces."to"
    from ethereum.traces
    where 
        ethereum.traces.tx_hash in (select tx_hash from relevant_transactions)
        and ethereum.traces."from" = 0xa160cdab225685da1d56aa342ad8841c3b53f291
        and ethereum.traces.input = 0x
        and ethereum.traces.call_type = 'call'
        and ethereum.traces.block_time > current_timestamp - interval '95' day
)
select    
    to_unixtime(ethereum.logs.block_time) as unix_ts
    , ethereum.logs.block_time as block_ts
    , ethereum.logs.contract_address as tc_address
    , ethereum.logs.tx_hash as transaction
    , varbinary_substring(ethereum.logs.data, 13, 20) as _recipient
    , ethereum.logs.tx_from as _relayer
    , count(*) over (partition by (varbinary_substring(ethereum.logs.data, 13, 20))) as tc_recipient_freq
    , (varbinary_to_uint256(varbinary_substring(ethereum.logs.data, 65, 32)) / 1000000000000000000.0) as tc_fee_eth
÷    , ethereum.transactions."from" as tx_from
    , ethereum.transactions."to" as tx_to
    , ethereum.transactions.value as transaction_value
    , (cast(filtered_traces.value as double) / 1000000000000000000.0) as trace_value_eth
    -- , filtered_traces.value as trace_value_wei
    , ethereum.transactions.type as tx_type
    , ethereum.transactions.nonce as nonce
    , round((cast(ethereum.transactions.gas_used as double) / cast(ethereum.transactions.gas_limit as double) * 100), 3) as mana_ratio
    , round((cast(ethereum.transactions.gas_used as double) / cast(ethereum.transactions.gas_limit as double) * 100), 1) as round_mana_ratio
    -- , ethereum.transactions.gas_limit as mana
    -- , ethereum.transactions.gas_price as mana_price
    -- , ethereum.transactions.gas_used as mana_used
    -- , ethereum.transactions.max_fee_per_gas as max_fee_per_mana
    -- , ethereum.transactions.max_priority_fee_per_gas as max_prio_per_mana
from ethereum.logs
inner join ethereum.transactions on ethereum.logs.tx_hash = ethereum.transactions.hash
left join filtered_traces on ethereum.logs.tx_hash = filtered_traces.tx_hash
where
    ethereum.logs.contract_address = 0xa160cdab225685da1d56aa342ad8841c3b53f291
    and ethereum.logs.topic0 = 0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931
    and ethereum.transactions.success = true
    and ethereum.logs.block_time > current_timestamp - interval '95' day
    and ethereum.transactions.block_time > current_timestamp - interval '95' day
order by ethereum.logs.block_time desc