I presume the legal process would be something along the lines of

  1. Get IP address from blockchain.
  2. Get ISP to tell you whose that is or was at the time.

So I expect that this would normally require some legal warrant in most countries for ip address to user mapping, which of course can be made difficult.

Are mobiles client easier to trace?

What about an illegal but still pragmatic process?

  • 3
    There's no IP address in the block chain. And even if there was, that wouldn't identify a human. That would identify the computer that submitted the transaction to the Bitcoin network, possibly after receiving it over some other network such as Tor. Nov 15, 2011 at 18:53
  • 1
    Ok cool I thought it was possible to find the originating ip. However I think that denying you used the computer that you own and have the password to would probably not stand up in court though. Perhaps I should edit the question to draw the focus away from ip addresses as what I'm trying to determine is the real world process of finding out who someone is. Motivations may be good or bad
    – barrymac
    Nov 15, 2011 at 22:32
  • 1
    Every computer in the Bitcoin network processes every transaction. It's not that you deny using the computer, it's that you deny originating the transaction. Our computers handle information we didn't originate all the time. Nov 15, 2011 at 23:00

2 Answers 2


The block chain doesn't report the IP address and the IP address isn't passes by nodes. Any entities knowledge of Bitcoin network is limited to the connections it has. If you get a transaction from a specific IP address you can't know that IP address originated the transaction you simply know it came from that IP address. It was either originated or relayed by that node.

The more connections you have to the network the more information you would have about where an transaction originated. However no matter how many connections you have you can never know you have a connection to every single node, thus all you can know when you see a specific transaction is that node at IP address X is where the transaction was first seen.

You can never be 100% sure of the originating node as you can never be 100% sure you have connections to ever node in the network.

Someone concerned about privacy could restrict the nodes they send transactions to only nodes they trust. This would ensure that at most (unless they trusted you) you could only find the node that relayed the transaction not the originator.

Someone concerned about privacy could also route their transactions via VPN which would add another layer. The connection couldn't be traced further back than the VPN gateway without the assistance of the VPN providers which likely would require a court order. If the VPN provider was located in another country that would make enforcement even more difficult.

Using both trusted nodes (using web of trust like fature), and VPN which doesn't keep logs in a foreign country would make tracing the source of the transaction very difficult.

I find it unlikely that many courts would issue a warrant based on only the IP address of the "node transaction was first seen" as it really is proof of nothing. The actually originator could be that node, a node which relayed it to that node, or a node which is x hops further down the chain.

Lastly a transaction is simply a sequence of bits. There are websites which act as dropboxes where a user can post a transaction in text form and the website will relay it to the rest of the network. While this isn't particularly secure one could create a similar service on Tor and possibly require transactions to be encrypted with a public key of trusted operator reducing the likelihood of tracing the transaction back.

Of course the drop box method could be combined with trusted nodes, VPN access, and using a public internet wifi location to further obfuscate the source. It really depends on how paranoid the sender is.

  • Lots of great information there much appreciate! What I'm trying to determine is the actual steps required (challenges like those you've mentioned are a bonus!) for a non techy or uneducated user who takes the technology as it is currently to be traced.Still having the mitigation strategies is good info too!
    – barrymac
    Nov 15, 2011 at 22:28
  • 1
    You also can't have a connection to every node because many nodes don't accept incoming connections. Nov 16, 2011 at 3:31

Tracking on the network layer is not how this would be done (because of the reasons outlined by DeathAndTaxes).

If an investigator wanted to track down who is behind a certain Bitcoin address (NOT IP address, more like a Bitcoin bank account number), they'd need to find out companies or individuals that have done business with that address (i.e. exchanged coins with it).

Usually, these companies would know something about the person they were transacting with. For example, a wallet site will have some user account information. An investigator could have leverage to force these companies to disclose their records.

So this is where you lose anonymity in Bitcoin: Because it is not really anonymous, but rather pseudonymous, if you let anyone find out who is behind your Bitcoin address, they will be able to associate the coins going through that address with you. And if someone can gather a lot of these associations, they can draw a great many conclusions.

Because of that, you are advised to create new addresses for every trading partner.

(This is maybe an area where using Green Addresses has a real disadvantage, because now you can easily determine that a certain wallet service has been involved in a transaction, giving investigators a place to start digging).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.