5
  1. I buy BTC on Coinbase, let's assume that my BTC wallet address is publicly tied to my real identity.
  2. I use ShapeShift to convert the BTC to XMR.
  3. I receive the XMR in a wallet I've never used before on MyMonero
  4. I send the XMR to someone else using MyMonero 'medium' privacy settings.

Is there any reasonable way someone could tell that the final XMR transaction was connected to me and if they could, how much would they know about who I sent it to and how much I sent?

6

If "someone" doesn't have access to any of the services, there's no way he can tell that the final TX is connected to you.

If "someone" had access to only ShapeShift data, he'd know to which Monero address you withdrew, and how much. He could suspect when you move those funds elsewhere but never be sure if it was you or it just so happened that someone else used your output as "decoy". Even if he assumed that you moved the coins, he'd have no way of telling to which address or how much. He'd just see that you maybe moved those (or part of, he can't tell) coins somewhere.

If "someone" had access to only MyMonero data (or forced MyMonero to collect whatever data it can), they wouldn't know from where your balance came. They wouldn't know who "you" are. The source and your ID would remain hidden. When sending, MyMonero could know the amount. If sending to a non-MyMonero user, they wouldn't know the destination address. If sending to a wallet also registered at MyMonero, they could also know the destination address.

If "someone" had access to both MyMonero and ShapeShift, they'd know who you are, how much you received and how much you sent. If sending to a non-MyMonero user, they wouldn't know the destination address. If sending to a wallet also registered at MyMonero, they could also know the destination address.

If "someone" got access to only recipient data, they wouldn't be able to trace it back to you. If they got the recipient data and ShapeShift data, they'd have a loose link but wouldn't be able to prove anything.

If "someone" got access to recipient, MyMonero and Shapeshift data, they could establish the link.

The only way to protect against someone coercing all involved services is to use an independent wallet instead of MyMonero and do some "churning" before sending to final destination. That way, even if someone had the recipient and ShapeShift data, you'd have fuzzed the trail enough to erase any suspicion.

  • What's the right way to churn as of April 2019? – stone.212 Apr 5 at 9:35
3

When you send BTC to shapeshift, shapeshift can see your Bitcoin wallet address. If shapeshift were to get hacked, and if shapeshift keeps records, then this means the XMR outputs that shapeshift sends to you can be tied to your Bitcoin wallet address and therefore to your real world identity.

However, this does not matter. As soon as you send the outputs on to someone else, a ring signature is created. This means no one that observes the transaction knows which outputs were actually being sent.

The bottom line is: no matter who knows your identity when you receive XMR from someone, when you send it on the link is broken. Even if your Monero wallet address was publicly known because you'd told the world, no one can tell when you spend your Monero that the Monero came from your wallet.

The amount of your transaction is unknowable, as is the destination wallet address of your transaction. Wallet addresses are never disclosed on the Monero blockchain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.