Decade after Ethereum ICO: Blockchain Forensics End Double-Spending Debate

• A decade after Ethereum’s initial coin offering, debates about manipulation tactics swirl on social media.
• Magazine conducted a joint investigation to determine if the ICO included double-spending of Bitcoin.
• Investigation found no double-spending in Ethereum’s presale but illicit origins of some funds.

A decade after Ethereum’s initial coin offering, which raised $18.5 million in Bitcoin by selling roughly 60 million Ether, debates about whether different forms of manipulation tactics were involved still swirl in social media.

One theory questions whether the Ethereum founders double-spent investors’ funds to artificially inflate the success of the ICO while allowing them to close the sale with a larger share of Ether under their control.

Magazine conducted a joint investigation with Canada-based blockchain forensics experts at Gray Wolf Analytics to determine whether the ICO included double-spending of Bitcoin, an activity deemed fraudulent by the presale’s terms and conditions. The investigation specifically looked for any Bitcoin that entered the presale wallet, was withdrawn and then looped back in.

Three batches of withdrawals took place during the sale. The Ethereum team pulled approximately 3,800 Bitcoin from the ICO deposit address, also known as the exodus wallet, claiming to use them to cover operational costs and loans. Upon examination, some subsequent transactions related to these outflows appeared to create loops in which relatively small quantities of Bitcoin returned to the deposit address.

However, the investigation found that although some transactions initially displayed double-spending characteristics, further analysis determined that the funds in question did not originate from the presale address.

“We concluded with a high degree of certainty that this was not the same BTC withdrawn from the exodus address,” Chedi Mbaga, head of forensics at Gray Wolf, tells Magazine.

However, the investigation found some funds with illicit origins, suggesting that bad actors used the Ethereum ICO to launder dirty Bitcoin for clean Ether.

In 2014, it was quite easy to participate in the Ethereum ICO. All you needed to do so was have some Bitcoin and an email address.

Here’s where double-spending allegations can occur

Approximately 3,800 Bitcoin were withdrawn from the presale wallet during the 42-day ICO in three batches. The trail of one of these outflows shows Bitcoin dispersed to several wallets, and within a few transactions, a wallet is seen moving 53 Bitcoin into the exodus wallet “36PrZ1KHYMpqSyAQXSG8VwbUiq2EogxLo2.”

Additionally, there are several trails from the three batches of Bitcoin outflows that share these characteristics.

But Mbaga says that these trails could be mistaken as double-spending incidents, and blockchain records unveil an opposing narrative.

First, the “1L1JRVExeKiqBU1pmvoyzCfRzCfEP64pBJ” address is identified as the recipient address of the three batches of withdrawals. The first batch was a 1,150 Bitcoin transfer from the exodus wallet to 1L1J on August 11. From here, the Bitcoin appears to disperse to various wallets.

Most of those Bitcoin were sent to a second wallet, which then transferred 592 Bitcoin to a third wallet, and from there, 93 Bitcoin were sent to a fourth wallet.

The next transaction is where recycling allegations arise.

The following transaction by wallet four contains deposits from seven different addresses and two receiving addresses: Recipient A and Recipient B.

Recipient A is subsequently seen sending 53 Bitcoin to the exodus address. Without context, this could appear as if the 53 Bitcoin circled back into the ICO wallet.

But Gray Wolf’s analysis found that these Bitcoin trace back to the six other deposits within the transaction involving wallet four.

Meanwhile, the majority of the Bitcoin from wallet four was ultimately deposited to an Ethereum Foundation wallet through Recipient B.

“Those outflows (62.93 of the 93.313 BTC) traced from [wallet four] were deposited to an Ethereum Foundation wallet [and] we ultimately attributed the BTC deposited by [Recipient A] to different deposit paths in the backward trace,” Mbaga says.

He adds that the behavior of the funds that moved from the exodus wallet during the presale mirrors that of payments and operating costs rather than nefarious activities.

Why was the Bitcoin withdrawn?

It’s not as if the Ethereum team secretly took out some funds during the sale to cover existing costs.

In fact, Ethereum co-founder Vitalik Buterin announced the withdrawals before they happened to repay loans and operating expenses.

“The intent is to withdraw 4,150 BTC from our exodus address within the next 48 hours. We reserve the right to withdraw up to 850 BTC more if needed before the end of the 42 day duration of the sale, but at this point it is likely that the remainder of the BTC in the address will remain unused until the sale ends,” Buterin wrote in an August 8, 2014 blog post.

Blockchain transaction data shows that the Ethereum Foundation withdrew less than the announced amount (roughly 3,800 Bitcoin) during the presale period, with the 1L1J wallet used to manage the funds.

Outside of what appears to be a $3 trial transaction, 1L1J has only ever received funds from the exodus wallet during the presale. This address appears to have been created to facilitate operational outflows during the sale, as all funds were quickly emptied, and it was never used again.

Of the total 3,800 Bitcoin, Gray Wolf’s analysis found at least 1,000 Bitcoin were either parked, deposited to exchanges or transferred to Ethereum team wallets in 15 transfers. The rest of the Bitcoin continued moving beyond 15 hops.