REFERENCES[1] S. Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, 2008. [Online]. Available: hxxp://bitcoin.org/bitcoin.pdf[2] C. Dwork and M. Naor, Pricing via Processing or Combatting Junk Mail, in Proceedings of the 12th Annual International Cryptology Conference on Advances in Cryptology (CRYPTO'92). Springer, 1992, pp. 139147.[3] A. Back, Hashcash  A Denial of Service Counter-Measure, 2002. [Online]. Available: hxxp://www.hashcash.org/papers/hashcash.pdf[4] The Economist, Digital Curriencies  Bits and Bob, June 2011. [Online]. Available: hxxp://www.economist.com/node/18836780[5] H. Cavusoglu, H. Cavusoglu, and S. Raghunathan, Emerging Issues in Responsible Vulnerability Disclosure, in Proceedings of the 4th Annual Workshop on Economics of Information Security (WEIS'05), 2005.[6] K. Lewis, J. Kaufman, M. Gonzalez, A. Wimmer, and N. Christakis, Tastes, Ties, and Time: A New Social Network Dataset using Facebook.com, Social Networks, vol. 30, pp. 330342, 2008.[7] W. Dai, B-Money Proposal, 1998. [Online]. Available: hxxp://www.weidai.com/bmoney.txt[8] R. Fugger, Money as IOUs in Social Trust Networks A Proposal for a Decentralized Currency Network Protocol, 2004. [Online]. Available: hxxp://www.ripple-project.org/decentralizedcurrency.pdf[9] K. Saito, i-WAT: The Internet WAT System  An Architecture for Maintaining Trust and Facilitating Peer-to-Peer Barter Relationships, Ph.D. dissertation, Keio University, 2006.[10] V. Vishnumurthy, S. Chandrakumar, and E. Sirer, KARMA: A Secure Economic Framework for Peer-to-Peer Resource Sharing, in Proceedings of the 1st Workshop on Economics of Peer-to-Peer Systems. [Online]. Available: hxxp://www2.sims.berkeley.edu/research/conferences/p2pecon/index.html[11] B. Yang and H. Garcia-Molin, PPay: Micropayments for Peer-to-Peer Systems, in Proceedings of the 10th ACM Conference on Computer and Communication Security (CCS'03), V. Atluri and P. Liu, Eds. ACM Press, 2003, pp. 300310.[12] F. Stalder, Failures and Successes: Notes on the Development of Electronic Cash, The Information Society (TIS), vol. 18, no. 3, pp. 209219, 2002.[13] N. Kichiji and M. Nishibe, Network Analyses of the Circulation Flow of Community Currency, Evolutionary and Institutional Economics Review, vol. 4, no. 2, pp. 267300, 2008.[14] M. Nishibe, Chiiki Tuka No Susume (in Japanese), Hokkaido Shokoukai Rengou, 2004.[15] Where's George? hxxp://www.wheresgeorge.com.[16] D. Brockmann, L. Hufnagel, and T. Geisel, The Scaling Laws of Human Travel, Nature, vol. 439, no. 26, pp. 462465, 2006.[17] L. Backstrom, C. Dwork, and J. Kleinberg, Wherefore Art Thou r3579x?: Anonymized Social Networks, Hidden Patterns, and Structural Steganography, in Proceedings of the 16th International Conference on World Wide Web. ACM, 2007, pp. 181190.[18] D. Crandall, L. Backstrom, D. Cosley, S. Suri, D. Huttenlocher, and J. Kleinberg, Inferring Social Ties from Geographic Coincidences, Proceedings of the National Academy of Sciences, vol. 107, no. 52, p. 22436, 2010.[19] A. Narayanan and V. Shmatikov, Robust De-anonymization of Large Sparse Datasets, in Proceedings of the 29th Symposium on Security and Privacy. IEEE, 2008, pp. 111125.[20] R. Puzis, D. Yagil, Y. Elovici, and D. Braha, Collaborative Attack on Internet Users' Anonymity, Internet Research, vol. 19, no. 1, pp. 6077, 2009.[21] A. Clauset, C. Shalizi, and M. Newman, Power-Law Distributions in Empirical Data, SIAM Review, vol. 51, no. 4, pp. 661703, 2009.[22] H. Simon, On a Class of Skew Distribution Functions, Biometrika, vol. 42, pp. 425440, 1955.[23] A. Barabasi and R. Albert, Emergence of Scaling in Random Networks,Science, vol. 286, no. 5439, pp. 509512, 1999.[24] A. Anderson, D. Cannell, T. Gibbons, G. Grote, J. Henn, J. Kennedy, M. Muir, N. Potter, and R. Whitby, An Electronic Cash and Credit System. American Management Association, 1966.IMAGES QUICK REFERENCEFig 1[http://xfq5l5p4g3eyrct7.onion/view.php?image=dace8ebeadcfa54e5289a8936964d892.png]Fig. 1. Screen capture of a tweet from WikiLeaks announcing their acceptance of anonymous Bitcoin donations'.Fig 2[http://xfq5l5p4g3eyrct7.onion/view.php?image=bf958d16c38b37a71d699d677b5a91ac.png]Fig. 2. An example sub-network from the transaction network. Each rectangular vertex represents a transaction and each directed edge represents a flow of Bitcoins from an output of one transaction to an input of another.Fig 3a[http://xfq5l5p4g3eyrct7.onion/view.php?image=63cb036e59a6acd0fb2de8efe5181a94.png]A log-log plot of the cumulative degree distributions.Fig 3b[http://xfq5l5p4g3eyrct7.onion/view.php?image=6432821a1d5b2b35b3c47142fbf29a02.png]A log-log plot of the cumulative component size distribution.Fig 3c[http://xfq5l5p4g3eyrct7.onion/view.php?image=4039fca3b7e4f80d08927794a9249eb4.png]A temporal histogram showing the number of edges per month.Fig 3d[http://xfq5l5p4g3eyrct7.onion/view.php?image=39db011b9b99adf9a32a25adb83ad7b8.png]A temporal histogram showing the density per month.Fig 3e[http://xfq5l5p4g3eyrct7.onion/view.php?image=b3791ef283f4fddb00fca2dd93e051d3.png]A temporal histogram showing the average path length per month.Fig. 3. The degree distributions, component size distribution and monthly edge number, density and average path length of the transaction network.Table I[http://xfq5l5p4g3eyrct7.onion/view.php?image=24a4676d2c39811e69c4804c84324983.png]TABLE I. THE DEGREE, IN-DEGREE AND OUT-DEGREE DISTRIBUTIONS OF T.Fig 4a[http://xfq5l5p4g3eyrct7.onion/view.php?image=4680fac4bf366e462dfaef33bef322b8.png]A log-log plot of the cumulative degree distributions.Fig 4b[http://xfq5l5p4g3eyrct7.onion/view.php?image=4ae3e48a4dd675f54056d2c4d72826bc.png]A log-log plot of the cumulative component size distribution.Fig 4c[http://xfq5l5p4g3eyrct7.onion/view.php?image=cb827e7ec0ed8f6f5b4c82e1fafa8940.png]A temporal histogram showing the number of edges per month.Fig 4d[http://xfq5l5p4g3eyrct7.onion/view.php?image=43243de825558f71c24de95d7c534d70.png]A temporal histogram showing the density per month.Fig 4e[http://xfq5l5p4g3eyrct7.onion/view.php?image=227c712edfc1b2cabf635225e61fce88.png]A temporal histogram showing the average path length per month.Fig. 4. The degree distributions, component size distribution and monthly edge number, density and average path length of the user network.Fig 5[http://xfq5l5p4g3eyrct7.onion/view.php?image=369c4784b78f232839fc582aa803168b.png]Fig. 5. An example sub-network from the imperfect network. Each diamond vertex represents a public-key and each directed edge between diamond vertices represents a flow of Bitcoins from one public-key to another.Table II[http://xfq5l5p4g3eyrct7.onion/view.php?image=7da8bce391a3ce2d780c9894f04e1388.png]TABLE II THE DEGREE, IN-DEGREE AND OUT-DEGREE DISTRIBUTIONS OF U.Fig 6[http://xfq5l5p4g3eyrct7.onion/view.php?image=0270c9edf7bd649aa2e7be5fd4768385.png]Fig. 6. An example sub-network from the user network. Each circular vertex represents a user and each directed edge between circular vertices represents a flow of Bitcoins from one user to another. The maximal connected component from the ancillary network that corresponds to the vertex u1 is shown within the dashed grey box.Fig 7a[http://xfq5l5p4g3eyrct7.onion/view.php?image=e8fef72c6cd7367afe720f915fc7fc32.png]A map of geolocated IP addresses associated with users receiving Bitcoins from the Bitcoin Faucet during a one week period.Fig 7b[http://xfq5l5p4g3eyrct7.onion/view.php?image=fa7261d4ed068e01ca1e5dd68f9a09c4.png]A map of a sample of the geolocated IP addresses in Fig. 7(a) connected by edges where the corresponding users are connected by a path of length at most three in the user network that does not include the vertex representing the Bitcoin Faucet.Fig. 7. We can use the Bitcoin Faucet to map users to geolocated IP addresses.Fig 8a[http://xfq5l5p4g3eyrct7.onion/view.php?image=38de9ade128d1f42053f7d21f0b68020.png]The receipts and payments to and from WikiLeaks' public-key over time.Fig 8b[http://xfq5l5p4g3eyrct7.onion/view.php?image=0b36a3abca78951c7a45e3fcd6ebb3ff.png]The number of transactions involving WikiLeaks' public-key over time.Fig 8c[http://xfq5l5p4g3eyrct7.onion/view.php?image=de6486f78608157f4d45a10dbd77995e.png]The receipts and payments to and from the creator of a popular Bitcoin trading website aggregated over a number of public-keys.Fig. 8. Plots of the cumulative receipts and payments to and from Bitcoin public-keys and users.Fig 9[http://xfq5l5p4g3eyrct7.onion/view.php?image=7b21bc2ab2a3edc3452e0f5e4407b217.png]Fig. 9. An egocentric visualization of the vertex representing WikiLeaks' public-key in the imperfect user network. The size of a vertex corresponds to its degree in the entire imperfect user network. The color denotes the volume of Bitcoins  warmer colors have larger volumes flowing through them. The large red vertices represent a Bitcoin mining pool, a centralized Bitcoin wallet service and an unknown entity.Fig 10[http://xfq5l5p4g3eyrct7.onion/view.php?image=78445f58c5aa31572e494e82cd9d5e49.png]Fig. 10. A visualisation of all users identified in Sect. V-A and all shortest paths between the vertices representing those users and the vertex representing the MyBitcoin service in the user network.Fig 11[http://xfq5l5p4g3eyrct7.onion/view.php?image=f3920e6e34813c03f65e750728a3d904.png]Fig. 11. An egocentric visualization of the thief in the imperfect user network. For this visualization, vertices are identified through their colors in the text, edges are colored according to the color of their sources and the size of each vertex is proportional to its edge-betweeness within the egocentric network.Fig 12[http://xfq5l5p4g3eyrct7.onion/view.php?image=c09719f66ccd763e567f1595eb5e7265.png]Fig. 12. An interesting sub-network induced by the thief, the victim and three other vertices. The notation is the same as in Fig. 11.Fig 13[http://xfq5l5p4g3eyrct7.onion/view.php?image=ad1d87c301c4c64bb3b0ae909e5a8f48.png]Fig. 13. Visualisation of Bitcoin flow from the alleged theft. The left inset shows the initial shuffling of Bitcoins among accounts close to that of the alleged thief, during which all transfers happen within a few hours of the incident. The right inset shows detail on the events of several subsequent days, where Bitcoin flows split, and then later merge back into each other, validating that the flows found by the tool are probably still controlled by a single party.Fig 14[http://xfq5l5p4g3eyrct7.onion/view.php?image=65fb7ba22346e301db7b73ce8a64a73e.png]Fig. 14. The Bitcoins are transferred between public-keys along the highlighted paths very quickly.