Do Bitcoin Users Really Care About Anonymity? An Analysis of the Bitcoin Transaction Graph

The pseudonymous nature of Bitcoin has sparked the twin rivaling researches in Bitcoin community, that is, either protecting or attacking anonymity. In spite of this intense battle, the answer to a primary question is absent – Do Bitcoin users themselves care about anonymity? This paper demystifies this doubt via analyzing the Bitcoin transaction graphs with the following three contributions: 1). We outline three representative metrics that can signify whether users concern about anonymity. 2). We examine the collective trend of anonymity concerns from a macroscope. 3). We pay particular attention on critical addresses in a microscope to unveil their anonymity concerns.This paper arrives at both expected conclusions and unexpected surprises. In particular, the expected ones are: rich addresses concern more about anonymity than poor ones. Miner addresses start caring about anonymity when exchange rate soars. Stock addresses never hide their intent of jump-and-dump. The surprises are: the majority of the users show weak concerns on anonymity. One can easily find both hot and cold wallet addresses owned by big organizations.


I. INTRODUCTION
When Satoshi Nakamoto first introduced Bitcoin blockchain technology [1] to the world in January 2009, the twin radical components of Bitcoin have affirmed its taken off, that is, decentralization and anonymity. It is important to mention that the only target of digital currency is to avoid doublespending without a centralized trusted verification institution, such as banks. Toward that end, Bitcoin relies on a collection of decentralized miners to check whether the ongoing transactions comply with all previously approved ones, such as whether current payer has sufficient budget for this transaction. All the validated transactions are further grouped together in a block and chained together into a public ledger. The process of creating transaction blocks will result in Bitcoin generation which attracts a collection of miners [1] to verify the transactions.
While decentralized miner requires all the transaction data to be publicly announced for verification purposes, exposing the real world identities of the Bitcoin practitioners is unacceptable. Bitcoin thus adopts pseudonyms to conceal the information of Bitcoin participants. The bad news is anonymity can also evolve into the major vehicle for criminals, such as money laundering [2] and human trafficking [3]. Consequently, anonymity becomes a key battleground in Bitcoin research and commercialization.
On one hand, there exist four directions of deanonymization endeavors as follows: 1). Interacting with Bitcoin users to track the Bitcoin. For instance, [4] studies the Coinjoin (i.e., for the purpose of mixing Bitcoin) for antimoney laundering analysis. 2). Crawling third party information. For instance, [5], [6] introduce BitIodine, an open blockchain analytical framework which uses a set of web scrapers that automatically collect and update the lists of Bitcoin addresses belonging to known identities. 3). Tweaking Bitcoin client software to uncover the network address of the users. Biryukov et al. [7], Koshy et al. [8], [9] work on de-anonymizing the users Internet Protocal (IP) address in the Bitcoin Peer-to-Peer (P2P) network. 4). Analyzing the Bitcoin transaction graph. Meiklejohn et al. [10] group Bitcoin wallets based on shared authority in order to cluster criminal or fraudulent Bitcoin addresses. Reid et al. [11] exploit context discovery and flow analysis of the Bitcoin graph to trace the alleged theft of Bitcoins. A recent work [12] uses graph learning to identify yet unknown entities based upon given training structures on the transaction graph.
On the other hand, researchers also attempt to enhance the anonymity of Bitcoin. [13] redesigns the P2P network of the Bitcoin with the first priority on strengthening the anonymity of the Bitcoin. There are several Bitcoin mixing protocols which claim to provide trustless, low cost and low time overhead like [14], [15]. In particular, [15] proposes a protocol to improve the anonymous payment in Bitcoin with concepts of cryptographic accountability and randomized mixing fees. Bitcoin core developer Gregor Maxwell introduces the concept of Coinjoin [16] operation which can avoid the changes toward Bitcoin protocol. JoinMarket [17], Coinsuffle [14] are the existing Coinjoin implementations. We also observe an array of emerging Alternative coins (i.e., Altcoin) like Dashcoin [18] and Monero [19] that are developed for improving the anonymity.
Despite such an intense battle atop Bitcoin anonymity, no one attempts to answer a key quest -Do Bitcoin users themselves concern about anonymity? To unveil that intent, this work conducts a systematic analysis on the Bitcoin transaction graph that spans for more than nine years with nearly 400 million addresses and 321 millions transactions. Our findings contain both surprises and expected conclusions. Below we discuss our designs, without which, the conclusion cannot arrive at.
First, we introduce three metrics to formally signify whether a Bitcoin address concerns about anonymity. The first metric links the extent of anonymity concern with reuse frequencies, that is, lower reusage flags higher anonymity concerns. The second metric -zero balance -finds that address turns to zero balance tends to concern about anonymity. Last but not the least, we find the intention of an address is also relevant to anonymity. That is, if an address rarely hides its intention or the type of organization it belongs to, it is less concerned about anonymity. We also explore the dynamics of anonymity by collectively analyzing the former two metrics.
Second, we exploit the macroscope analysis on Bitcoin transaction graphs to reveal the collective anonymity concern trend of all Bitcoin addresses. In this analysis, we approximate the diameter of the Bitcoin transaction graph at different time points with iBFS [20] and unveil that whether new transactions bringing in new addresses is the key for diameter dynamics. In particular, the increment of diameter is caused by the addition of new addresses, signifying more concerns about anonymity. For instance, our statistics exhibit higher new addresses additions than old addresses re-usage from 2011/January to 2012/March, which results in the swelling of Bitcoin graph diameters. Further, we categorize the addresses into rich and poor addresses on the basis of Bitcoin balance and observe rich addresses concern more about anonymity.
Third, we summarize the representative features of critical Bitcoin addresses, which allows any of us to hunt for the key addresses quickly and precisely. In particular, we find strong correlations between stock addresses and Bitcoin exchange rate which perfectly matches stock buyers' jump-and-dump nature [21]. We develop algorithms that can reap the key addresses (hot and cold wallet addresses) from big organizations like miners, gambling sites and exchange centers. Notably, that algorithm obtains both tagged key addresses and untagged ones. We believe those untagged ones are the key addresses that are intentionally hidden by certain organizations. Further, as the major force that drives the success of Bitcoin, miner's intention is also studied. We find they start concerning about anonymity only when the Bitcoin price begins to climb.
Evidence. It is important to note that those aforementioned expected and unexpected insights are evident by real-world facts. In particular, for macroscope analysis, Benjamin et al. [22], a parallel work to this paper, interview 125 active Bitcoin users and reveal that majority of them understand the risk of de-anonymizing in Bitcoin, indicating that they disregard anonymity not because of unaware of the penalty. Toward microscope analysis, our intention-based de-anonymization analysis on critical addresses matches the real examples which are crawled from popular blockchain forums [23], [24]. Further detailed discussions about these examples can be found in Table III and IV, and Figure 10 of Section VI.
The rest of this paper is organized as follows: Section II presents the landscape of the background and related works for Bitcoin. Section III discusses the proposed anonymity metrics. Section IV describes the datasets and processing tools we used for the analysis. Section V understands the overall anonymity concerns of Bitcoin addresses. Section VI zooms into the anonymity analysis of the critical addresses. Section VII concludes the paper.

II. BACKGROUND
This section presents the background of cryptocurrency and blockchain technologies, as well as privacy and anonymity features. Further, we discuss the related work surrounding anonymity of blockchain currency.

A. Bitcoin and Blockchain Currency
Assuming Alice is purchasing some products (i.e., transferred by the truck) from Bob, Alice will send a certain amount Bitcoin to Bob for this transaction. In particular, this Bitcoin transfer process is comprised of two steps: preparation and verification. In the first step, Alice needs to provide three types of addresses, that is, which set of output addresses from which set of transactions will she uses to pay the Bitcoin 1 , the addresses used to receive the changes 2 , and the addresses Bob used to receive that transfer. Figure 1 plots the workflow of the second step -verification. In particular, Alice will initialize this transfer with the three types of addresses and her "private key" to the source addresses through her wallet like Bitcoin Core software [25]. Since Bitcoin follows Peer-to-Peer (P2P) network communication, this software will broadcast the transaction on the entire network. Subsequently, miners will race to validate this transaction. If the transaction is valid, the miner will insert this transaction in a block. The miners need to perform proofof-work (PoW) [1] in order to mine a block. Once the block is mined it is linked to the most recently approved block in the block chain (in the middle of Figure 1). After that block is dipped (i.e. followed by other blocks) sufficiently (normally 6 and 7 blocks depth) inside the blockchain [26], the transaction, which is very unlikely to reverse, is confirmed. Then Bob can confirm the transaction and ship the goods to Alice. 1 Note, the amount of Bitcoin of each address is not immediately clear. This is the value-blindness feature of Bitcoin. 2 The change address can be provided by a user or wallet software does that for the user.
Note, Bitcoin is also referred to as a type of Blockchain currency stemming from the fact that all the transactions are packed into "blocks" and "chained" together. In particular, each block contains approximately 2,020 transactions that consumes ≤1 MB space.
Incentives are provided to compensate the miners that volunteer to verify the transactions. To avoid Sybil attack that may subvert the previously approved transactions, Bitcoin adopts one-CPU-one-vote instead of one-IP-address-one-vote paradigm. That is, one needs significant CPU power to conduct the PoW fast enough in order to combat the other miners and subvert the prior transactions. In this setting, as long as more than 50% of the miners are legitimate, Bitcoin can guarantee the legality [27]. Eventually, the longer chain will stand out while the other forks will be dumped away.
Bitcoin is pseudo-anonymous. Since Bitcoin encourages decentralized miner, all transactions are publicly accessible. To protect the privacy of Bitcoin users, anonymity is engaged. That is, Bitcoin uses SHA-256 [1] to generate key pairs in order to represent virtual users. In each key pair, the public key serves as the address in Bitcoin currency while the private one is kept by the owner. One user can own arbitrary amounts of such pairs of addresses, all of which can further be managed by a wallet software. In order to conduct transactions with an address, such as transferring money from an address to another, a private key is required to digitally sign, i.e., authorize, this transaction. We refer the readers to [28] for more details regarding how the transactions are generated, validated by the miners and confirmed by the receiver.

B. Related Work
Bitcoin community has officially acknowledged that "current implementation of Bitcoin is not very anonymous" [29], which is evidenced by an array of attempts that successfully revealed the real world identities of the Bitcoin addresses. While certain users with more concern on anonymity can shift to altcoins according to [30], we argue Bitcoin still deserves this analysis stemming from the fact that Bitcoin occupies the largest market in cryptocurrency. This section summarizes the de-anonymization efforts on Bitcoin platform.
Interacting with Bitcoin users. One can act as a buyer in Bitcoin transaction and learn the address of the merchant. If an adversary wishes to know the public address of an organization or merchant, he/she can buy some goods from them. By doing that the merchant should give him/her an address that belongs to them. Meiklejohn et al. [10] conduct this kind of interaction with merchants like Silk Road [31] and Mt. Gox [32]. Likewise Moser et al. [4] study the anonymized transaction by participating in the Coinjoin service.
Crawling third party information. Every type of cryptocurrency, including Bitcoin, often comes with a collection of communication forums. For instance, [33], [34], [35], [36] are the Internet-based discussion forums. Fleder et al. [37] develop a system for extracting Bitcoin addresses from public forums. An adversary can get the public address of users which are leaked or made public by crawling from these sites. Besides, certain merchants and organizations are also publishing their Bitcoin addresses to accept donations, such as WikiLeaks [38] which relies on an array of address to receive donations. Ron and Shamir [39] are able to find out that there are at least 83 addresses owned by the Wikileaks for such a purpose. Obviously, digesting the information of these sites will help reveal the real world identities of the addresses.
Network addresses. In Bitcoin P2P communication network, the payer/buyer will be the one who initializes the communication. By analyzing the communication time stamp and pattern, one can reveal the IP addresses of the source of the Bitcoin transaction. Further associating network addresses to the real world identities can be achieved via linking IP address with geographical locations. Koshy et al. [8] are the first one that attempts to map the Bitcoin address to an IP address by continuously listening to the transactions made by the nodes in the Bitcoin P2P network. They develop their own Bitcoin client called CoinSeer to record the IP addresses.
Analyzing transaction graph, which perform graph computations on the Bitcoin transactions for anonymity analysis, is closely related to this work. Reid and Harrigan [11] pioneer this effort. In particular, they exploit multi-input, change address and behavior based clustering heuristics to create oneto-one mapping between address and user. [10] uses this mechanism to identify unknown addresses through linking which to known ones. Later, Ron and Shamir [40] exploit this method to analyze the transactions related to Ross William Ulbricht (a.k.a. Dead Pirate Roberts in Bitcoin), owner of online black market known for illegal drug trade and money laundering.
Moser et al. [4] brings up the concept of change address, which is most likely the output address with smaller amount of Bitcoins. As a comparison, Ortega [41] suggests a change address of a transaction should have more decimals. It is also worthy of noting Ober et al. [42], which analyzes all the transactions occurred before January 2013, and discover that the Bitcoin anonymity is reduced in the last 12 to 18 months due to the entity sizes and the overall pattern of usage becoming more stationary.
Instead of how to compromise or strengthen the anonymity of Bitcoin users, we focus on whether users care about anonymity. We believe this is the very first question that we need to discuss before blindly fighting for decreasing or increasing the anonymity of Bitcoin, since changes on anonymity will draw non-trivial efforts. Towards that end, we deduce three topological dynamics surrounding the Bitcoin transaction graph that can indicate the anonymity concerns of the users (Section III). To the best of our knowledge, this is the first work to find out the collective anonymity concerns reflected by all the Bitcoin addresses (Section V), as well as the critical addresses (Section VI) over a period of nearly ten years.

III. ANONYMITY METRICS
This section takes the inspiration from Section II-B and goes further by introducing metrics that can indicate the extent of anonymity and privacy concerns expressed by each address. In particular, we extract two types of directions, that is, whether the address attempts to cover its real world identity and intention.
Claim 1 (Reusing Frequency). The reuse frequencies of an address, especially those re-usage for receiving money, can signal whether an address concerns about anonymity.
Explanation. For a user to be considered as anonymity concerned, he/she is unlikely to reuse old addresses 1 to receive Bitcoins. If one address is repeatedly used to receive Bitcoins, the chance of associating this address to its real world identity will soar [43], [44], [1], [45], [42], [39]. In particular, assuming the probability of seizing the real world identity of an address from one transaction is p, N transactions will increase the probability to N · p. The following twin methods are proven solutions to identity the users: 1) Transacting with the address of interest [4], can improve the probability of tracing the coins through Coinjoin operations. 2) IP address association [8]: Intercepting the Bitcoin network can help reveal the IP address of the source Bitcoin address. The in-degree of an address signifies how frequent the address is used to receive Bitcoin. If a user uses an address to receive Bitcoin only once, then reduce the balance of the address to zero, meaning the reusage frequency is low. In this case, we assume the user is serious about anonymity. Note this is different from typical Coinjoin operations which attempt to mix various Bitcoins for, potentially, the purpose of money laundering [4].
Claim 2 (Zero Balance). Addresses with zero balance concern about anonymity.
Explanation. We consider an address to be zero balance if the Bitcoin accumulated/associated to the address is zero. There are two anonymity concern cases that produce zero balanced addresses: 1) Change address: In each transactions, all the Bitcoin is spent from the input addresses and the changes are deposited to new addresses, called change address. Note, 1 Old Address: If an address already appeared as output address in at least one of the transactions before in the blockchain. New Address: If the address appears for the first time as an output address in the entire blockchain history users can also choose an existing address to receive the changes. Using new addresses for changes means the user is serious about anonymity [46]. 2) Intentional Bitcoin transfer: This includes the combining and splitting [1] of the Bitcoin. The splitting activity is mostly motivated by the anonymity concern as it splits large amount of Bitcoin for safety. The combining, which happens very rarely, is driven by dust Bitcoin [47], that is, users combine a collection of addresses with small amount of Bitcoin for the convenience of Bitcoin management. While a non-zero balance address turning to zero-balance can indicate this address starts concerning anonymity, an address may also become zero balance due to all Bitcoin is spent. In that case, a user who is not concerned about anonymity may reuse that address in the near future. Figure 2 thus studies this doubt. In particular, we find that the reuse percentage of zero balance addresses through all Bitcoin history stay very low -5.2% -with minimum and maximum as 0% and 18%. This implies that a zero balance address is unlikely to be reused, indicating majority of the addresses becomes zero balance due to anonymity concern.
Nevertheless, one interesting observation is high in-degree addresses may also turn to zero balance. This represents the sudden change of anonymity concerns. That is, high indegree means unconcerned about anonymity while turning to zero balance means serious about anonymity. Figure 3 studies this contradictory. In particular, we separate the zero balance addresses into three categories based upon in-degrees -(0, 1], (1,15] and (15, +∞). Table I presents the statistics summary of Figure 3. The trend shows that the change of anonymity concerns is possible. But the possibility of changing from lower in-degree is larger than that from higher in-degrees. While revealing the real world identity of an address is useful, exposing the intentions of certain addresses are of equivalent importance. For instance, searching the identity of an address takes non-trivial efforts, knowing their intentions would help cybercriminal fighters narrow down the searching

IV. DATASETS AND TOOLSETS
This section details the specifics of the Bitcoin transaction graph, as well as, the graph algorithms that are used to analyze this graph in order to extract insights.

A. Datasets and Machines
We download the publicly available Blockchain raw data using Bitcoin Core v0.16.0 [25]. This file consists of the transactions for 9.5 years, ranging from January 3, 2009 to June 7 2018. The size of this dataset is 230 GB. We exploit the popular rusty-block-parser [49] script to decrypt and parse the encrypted blocks and transactions. The output of this process contain several comma-separated value (CSV) files that consists of the information of each block, including the timestamps, hash of blocks, transaction IDs, output addresses in a transaction and inputs as reference to the previous transaction output. The collective size of these files hikes to 441 GB.
With the available transaction and address information from the tool, we create mappings from transactions and addresses to numerical vertex IDs. Since each edge in the graph always connects to one address and one transaction, this graph is thus a bipartite graph [50]. Further, to conduct time evolving analysis of the transaction graph, we select vertices based upon their timestamps. In total, the amounts of transactions and addresses are 321,043,952 (321 million) and 399,344,697 (399 million), respectively, as well as edges are 1,692,308,191 (1.6 billion).
We build the analytical toolset (from Section IV-B) and edge list generator with approximatey 2,000 lines of C++ code and use the compressed sparse row (CSR) tool from [51] to store the graph. Further, we leverage the Bridges supercomputer from Extreme Science and Engineering Discovery Environment (XSEDE) [52] to preprocess, store and execute the analysis. In particular, each Bridges server features quadsocket Intel(R) Xeon(R) CPU E7-8880 v4 @ 2.20GHz CPUs, 3TB memory and 14 TB LUSTRE filesystem [53].

B. Graph Algorithms
We leverage a variety of graph algorithms and heuristics to analyze the Bitcoin transaction graph and deduce whether the Bitcoin addresses are serious about anonymity. In particular, the following four graph algorithms are used to examine the Bitcoin transaction graphs. Below, we explain the design of these algorithms with our intent of using them.
Connected component [54] of an undirected graph is a subgraph where each vertex can reach the others. On analysis of the connected component of the graph, we aim to find out the amounts and sizes of connected components in Bitcoin transaction graph. Since each miner reward address, mostly new ones, will introduce a new connected component, the reason behind being a separate and small connected component could indicate the miner addresses lack anonymity concerns.
Diameter detection [55]. The diameter is the longest path of all the shortest paths in the graph. Ideally, one has to calculate the shortest path from every vertex in order to find the perfect diameter of a graph. Given the graph consists of 720 million vertices and 3.38 billion undirected edges, it will take days to compute the diameter for one timestamps [20]. In this context, we approximate the diameter of the Bitcoin graph with iBFS [20]. Note BFS is equivalent to single source shortest path (SSSP) in this transaction graph because the Bitcoin flow on the edge is not weight. As shown in Section VI), we exploit the change of diameter over time to deduce the anonymity concerns of the users. It should be noted that we consider the diameter of the main connected component as that of the entire graph because this component consists of more than 99.9% of the vertices.
In-degree analysis [56]. The number of incoming edges to a vertex is the in-degree. In Bitcoin transaction-address graph, this parameter stands for the number of times an address is used to receive Bitcoin. In contrast to in-degree, out-degree represents the amounts of times an address is spending the Bitcoin. The transaction inputs have to refer the unspent Bitcoin from the outputs of prior transactions in the Blockchain which suggests the in-degree analysis already covers that of out-degree. Besides the low out-degree of an address doesn't necessarily mean that the address is reused infrequently. Consequently, we only cite in-degree as the evaluation metric.
Flow analysis [57] is necessary because Bitcoin is a valueblind cryptocurrency [58]. However, one can analyze the flow of Bitcoins on the transaction edges to arrive at the amount of Bitcoin accumulated at each address, as well as the amount of Bitcoin involved in each transaction. We find this tool to be particularly useful for analysis on rich and poor, and hot and cold wallet addresses.

V. MACROSCOPE ANALYSIS
This section explores the collective anonymity concern from all Bitcoin users. In addition, we study the anonymity concern differences between rich and poor addresses. The diameter dynamics in Figure 4 can be summarized into five ranges, as shown in Figure 4. The diameter remains stable during ranges I and V. It climbs in range II. Afterwards, we observe the diameter collapse in range III. A slight diameter fluctuation happens in range IV.

B. The Cause of Diameter Dynamics
Taking the inspiration from [59], we arrive at the conclusion that the diameter will either swell or remain unchanged when new transactions also bring in new addresses. In contrast, when new transactions only happen between old addresses the diameter tends to remain or shrink. Figure 5 exemplifies both cases. Let us suppose, transactions T1, T2 and addresses A1, A2 and A3 already exist in Figure 5(a) -(d) with the diameters to be four. Figure 5(a) and 5(b) assume the new transaction happens between the new and old addresses while 5(c) and 5(d) suppose transactions happen only between old addresses.
As shown in Figure 5(a), an old address A2 sends Bitcoin to A4 in transaction T3. Although the address A4 is new, the diameter of the graph remains the same. But this may not happen all the time. Using Figure 5(b) as an instance, when  address A3 sends Bitcoin to a new address A4 in transaction T3, the diameter of the graph increases to 6. Figure 5(c) and 5(d) outline the cases when new transactions happen between existing addresses. In Figure 5(c), the new transaction between the addresses A2 and A3 will not change the diameter but the transaction between the addresses A1 and A3, as shown in Figure 5(d), shrinks the diameter of the graph to three. We refer the readers to [59] for the reasons what cases of transactions with new addresses may increase the diameter.
This analysis suggests that more Bitcoin users are concerning about anonymity in range II while fewer of them are concerning in the period of range III. The initial period of range I and range II were mostly dominated by the bitcoin enthusiast and the cryptographers who used new addresses to receive the Bitcoin [60] . The rest of time ranges, when diameter remains unchanged, demand more analysis on the graph to unveil whether users are concerning about anonymity or not. Note, according to Section VI, because miners are trying to mine the blocks without normal business transactions that can link the transaction, the diameter of Bitcoin graph in range I remains small. The spike of range IV is potentially caused by new addresses keep attaching to the tail/head of the existing transaction graph, analogous to a repeated case of Figure 5(b). Afterwards, some of those newly generated addresses start transacting with existing old addresses like Figure 5(d). A real case of the spike can be found in Case II of Figure 10.

C. New vs Old Addresses to Receive Bitcoin
The reuse of old addresses to receive the Bitcoin from a transaction is significantly high and most of the time exceeds the use of new addresses. Below we will explain why this leads to unchanged diameter in the transaction graph. Figure 6 shows the number of old and new addresses used to receive the Bitcoin in a transaction. Despite new addresses maybe caused by newly joined users or old users added for anonymity concern purpose, the number of old addresses used to receive Bitcoin is generally higher than that of new addresses for most of the time. This signifies most of the transactions happening in Bitcoin do not take anonymity as a serious concern. Of the total amount of addresses that is used to receive Bitcoin in transactions, on average, the use of old address is 55.25% and the new addresses is 44.75%.
It is important to note that the diameter may also increase as long as new addresses are added, albeit the number of new addresses is smaller than the reuse of old addresses. Our further observation negates this doubt. That is, those new addresses consist of considerable stock buyer address thus are directly connected to exchange centers which are at the center of the graph, resulting in zero impact to the diameter.
We will only use two real world events to explain the hikes of the addition of new addresses, leaving the rigorous analysis to Section VI. For instance, in around 2011, the establishment of exchange centers [61] during those periods causing more users to join the Bitcoin, this also explains the sudden spike of new addresses used to receive Bitcoin. Second, the period between Jan 2017 and December 2017 is the time when the Bitcoin price was continuously climbing to reach a peak value. During this time, the use of new addresses is more than the old addresses to receive Bitcoin. The number of old address use again surpasses the new address use in 2018-3-28 which is the time when Bitcoin price plunged into the amount of around 10,000 USD from 19,000 December/2017-January/2018 [62]. That should have discouraged new users buying Bitcoins (joining the network). There exist significant number of users who own Bitcoin as an investment [63]. Since Section VI-A specifies there are significant number of Bitcoin users joining Bitcoin for investment, we can offset these new addresses from Figure 6. This will further reduce the actual number of new addresses that are introduced for the concern of anonymity.

D. Rich vs Poor Addresses
The difference between rich and poor always draws attentions [64]. This Section studies their anonymity and privacy concerns differences. In particular, we regard the addresses with top 25% Bitcoin addresses across all nonzero balance addresses as rich and the rest as poor. Along with the dynamics of the Bitcoin distribution among addresses we also update our threshold (i.e., third quartile Bitcoin among the addresses with non zero balance) in order to retain the updated rich and poor addresses. With in-degree (Claim 1) and zero balance (Claim 2) heuristics along with flow analysis, we find out which kind of addresses is more concerned about anonymity. Figure 7 shows that more rich addresses concern about anonymity. Here, we use Claim 2 to indicate whether an address concerns about anonymity. Overall 65% of the addresses that are seriously concerned about anonymity are rich addresses and the remaining are poor addresses. Below, we explain the trends. 1). Initially, most of the addresses belong to miner and have high amount of Bitcoin. Virtually all transactions are created for mining purpose -transferring Bitcoin from one address to another. This explains why only rich addresses concern about anonymity at early stage. 2). From mid 2010 to mid 2011, the Bitcoin exchange rate starts to climb, more and more miners begin to merge Bitcoin (Case I in Figure 10) in order to sell it for profits. That said, the swelling ratio of poor addresses from mid 2010 to mid 2011 in Figure 7 does not mean poor addresses concern more about anonymity. 3). The spike of Bitcoin exchange rate has also attracted hackers [65]. This encourages the rich addresses to start concerning about anonymity and security. Toward that goal, the rich users are likely to use new addresses as change addresses even in normal business transactions or simply split/combine Bitcoin to remain anonymous.
In summary, Figure 7 concludes that the rich addresses are more concerned about anonymity than the poor counterparts.

VI. MICROSCOPE ANALYSIS
This section further studies the privacy concerns of those four types of addresses from Table II and concludes majority of them do not hide their intentions.

A. Stock Address
Since the day of its start, Bitcoin has experienced ups and downs in the exchange rate. Following typical jump-anddump stock market phenomenon [21], this price fluctuation has attracted a number of Bitcoin stock buyers. In particular, stock buyers likely purchase Bitcoin, i.e., creating new Bitcoin addresses, at the climbing Bitcoin price as an investment, hoping this trend can bring in profits. In contrast, falling price will draw fewer investment, thus fewer Bitcoin addresses will be created by stock buyers.
Stock address features. Inspired by the aforementioned observation, we find the innate traits of the stock addresses are two folds: 1). They are those addresses that accumulate Bitcoins and don't spend (a.k.a. 0 out-degrees) 2). The amounts of emerging stock addresses are immediately influenced by the exchange rate of Bitcoin. Figure 8 plots the dynamics of stock addresses and Bitcoin exchange rate. Based upon the first feature, we first obtain 21.7 million (21,747,636) addresses by June 7 2018 are non-zero balance addresses, ∼17.8 million of which are never used as inputs in any transactions. From Figure 8, one can easily notice the trend, peak and valley correlations between the amount of stock addresses and Bitcoin exchange rates. In particular, the exchange rate hikes of Bitcoin immediately added many new stock addresses. Such a close correlation is perfectly reflected by Figure 8, such as the highlighted x -|. On price reduction during the start of 2018, the number of the new stock addresses are also reduced. The number of addition of stock buyer almost remain constant during start to the mid of 2010 when the Bitcoin has almost no value.
Note, this analysis of stock address also contains some of the reported lost Bitcoin addresses which is caused by forgetting the wallets passwords, or simply discarding the wallets (storage containing private keys) when exchange rate is low. Whereas these cases only happen at the early stage when Bitcoin has very little value.

B. Key Addresses From Big Organization
Big Bitcoin organizations, e.g., exchange centers and gaming sites, often maintain a twin-address for business, that is, hot wallet and cold wallet addresses stemming from the security reasons. In particular, hot wallet addresses are used to receive/send Bitcoins. To avoid security breach [66], hot wallet addresses will transfer their amassed Bitcoin to cold wallet addresses. Suggested by its name, cold wallet addresses maintain their private key offline for security purposes. When hot wallets run out of Bitcoin, cold wallet will transfer some Bitcoin back to maintain the business.
Hot wallet addresses often come with three features. 1). The hot wallet addresses of big organizations normally have extremely high in-and out-degrees. 2). The amount of Bitcoin flowing through these hot wallet addresses is extremely high. However, 3). The balance of hot wallet addresses is low.
These three-pronged features can be instantiated as degree ≥ 50, 000, f low ≥ 150, 000BT C and balance ≤ 10BT C at June 7 2018. As shown in the bottom of Table III, we retain, in total, 60 addresses, 31 of which are tagged as hot  wallets from [23]. Most of these hot wallet addresses belong to the organizations like mining pools, gambling sites and the exchange centers. Some of the addresses are untagged but present similar characteristics as the tagged ones. This implies that these untagged ones should also be hot wallets from some big organizations, except that these organizations attempt to hide the ownership. Now, our analysis can help uncover them.
Cold wallet addresses also come with three potential features. 1). Cold wallet addresses will be close, in terms of edge distance, to hot wallet addresses. 2). Cold wallet addresses should govern comparably smaller degrees than the hot wallet addresses they link to. 3). The balance of cold wallet addresses will be high. Table IV, which follows the above extracted features, identities seven cold wallet addresses. In particular, we conduct the BFS traversal with depth of two from some of the hot wallet addresses and filter out the vertices whose accumulated Bitcoin is greater than 10,000 BTC. The degree of the cold wallets are relatively lower than that of the hot wallet addresses. As expected, four out of those seven cold wallets are tagged as cold wallets by [24]. Again, we also capture some suspicious cold wallets that are untagged. Again, regardless whether this is intentionally or unintentionally untagged, our tool can help unveil similar cold wallet addresses.

C. Miner Address
Of all the critical addresses, miner address presents the most distinguishable feature. That is, a transaction without input addresses will be the rewarding transaction. And the output addresses from those transactions are the miner addresses. This nature yields an interesting graph relevant phenomenon -the transaction and output address vertices may yield a new connected components as long as the output address is disconnected from prior connected components. Figure 9 thus studies the #connected components in Bitcoin transaction graph. In particular, the count increases from the beginning, reaches peak at around April of 2011 and gradually comes to a stable number of around 34,000. The connected component count soars before 2011 because the almost negligible Bitcoin exchange rate leads to the mined Bitcoins left unused. But after the establishment of exchange centers around 2010 (Mt. Gox) and 2011 (BTCChina, BTCe) [61], these inactive connected components spring back to transacting with the main connected components (most likely selling Bitcoins to exchange centers), causing the number of connected components in the graph to shrink till today.
A closer look at miner address, as shown in Figure 10 which presents the real intentions of several miner addresses, further extracts two interesting facts. In Case I 2 , where the Bitcoin is untouched since 2010, the miner accumulates its three mined Bitcoin addresses into one address. Back in 2010 the rate of Bitcoins is low, this behavior is perceived as merging Bitcoin for ease of management. In Case II 3 , we notice the miner is dividing the rewards into smaller amounts of more new addresses. Even though for the Bitcoin that is mined back in 2010, we observe division of them in December 2017 which is the time of peak Bitcoin exchange rate. This shows that the anonymity and security concern is strongly correlated to exchange rate.

VII. CONCLUSION
This paper examines the Bitcoin transaction graphs to answer two critical yet unanswered questions concerning anonymity and privacy: Do typical Bitcoin users care about anonymity? Do critical users care about anonymity? The first analysis is a macroscope investigation and finds majority of the addresses enjoy the remarkable simplicity of Bitcoin and disregard the anonymity concerns. The second exploration arrives at the conclusion that the hot wallets, Bitcoin stock buyer and miner addresses are, also, not caring about anonymity on the basis of their intention. In conclusion, the value of the Bitcoin (i.e., amount and rate) governs whether Bitcoin users concern about anonymity.