NightShade Vendor: CoinJoin Mixer De-Anonymization
“An illicit dark web vendor operating under the moniker 'NightShade' conducted multi-stage Bitcoin laundering via Wasabi/Samourai CoinJoin mixing pools. Deconstruct the peel-chains and multi-input clustering to trace the illicit funds.”
ASCWG{...}Following stolen cryptocurrency isn't just “clicking the next address” on a block explorer. A competent launderer splits the pot dozens of ways, sends decoy value in every direction, and finally pushes the remainder through a crypto mixer.
This lab focuses on tracing illicit funds from a dark web vendor alias (“NightShade”). We utilized a deterministic peel-chain methodology known as the TRACE-7 Protocol to track the primary stolen pot, cut through the noise, and de-anonymize the threat actor.
Stage 1 & 2: The Peel-Chain Walk
💡 THE BEGINNER BREAKDOWN (The Criminal's $100 Bill)
When a criminal steals $100,000, they rarely spend it all at once. They will send $99,000 to a new wallet, and spend $1,000 on a fake ID. Then they send $98,000 to another wallet, and spend $1,000 on server hosting. This leaves a trail of “peels” (the small spends) and the “pot” (the main bulk of money moving forward). In blockchain tracing, we ignore the peels and relentlessly follow the biggest pot.
Q: How do we separate the “peel” from the “pot”?
A: Always follow the output with the greatest integer satoshi value.
[ SHOW METHODOLOGY: Esplora API Automation ]▼
Manual clicking through block explorers fails against highly active wallets. We automated the TRACE-7 walk using a Python script interacting with the Esplora REST API:
- Paginate through the entry address history using
/api/address/{addr}/txs/chain. - Find the transaction that drains the most satoshis from the target.
- Recursively fetch the
/api/tx/{txid}/outspendsto trace the maximum output value forward automatically.
import requests
import hashlib
# TRACE-7 Peel Chain Walker using Esplora API
def trace_largest_pot(start_address):
curr = start_address
print(f"[*] Starting Peel-Chain Walk from: {curr}")
# 1. Fetch address transactions
url = f"https://blockstream.info/api/address/{curr}/txs"
txs = requests.get(url).json()
# 2. Select transaction with maximum outflow (The Pot)
max_tx = max(txs, key=lambda tx: sum(vout['value'] for vout in tx['vout']))
print(f"[+] Identified Main Pot Tx: {max_tx['txid']}")
return max_tx['txid']
# Concatenate evidence tokens T1-T6 to formulate final SHA-256 flag
tokens = "TOKEN1_TOKEN2_TOKEN3_TOKEN4_TOKEN5_TOKEN6"
flag_digest = hashlib.sha256(tokens.encode()).hexdigest()[:32]
print(f"🎉 Final Flag: ASCWG{{{flag_digest}}}")python -c "import hashlib; print('ASCWG{' + hashlib.sha256('T1_T2_T3_T4_T5_T6'.encode()).hexdigest()[:32] + '}')"Stage 3: CoinJoin De-Anonymization & Multi-Input Clustering
Eventually, the target transaction entered a CoinJoinA collaborative Bitcoin transaction where multiple users mix their funds into identical outputs, obscuring ownership.. The mix was identified mathematically by finding $\ge 5$ inputs and $\ge 5$ identical outputs (the denomination d).
💡 THE MIXER ANALOGY
A CoinJoin is like 10 people throwing identical $100 bills onto a table, shuffling them around, and each taking one back. If you tracked a criminal's $100 bill to that table, you have no idea which of the 10 bills he walked away with.
But... what if the criminal walked away with two of those $100 bills, and went to buy a $200 TV with them? By spending them together, the criminal just proved to the whole world that those two specific bills belong to the exact same person. The disguise is ruined!
The Fatal Operational Security Flaw
A Bitcoin transaction can only be cryptographically signed by the party holding the private keys to all of its inputs. The NightShade vendor subsequently spent multiple identical outputs from the CoinJoin within a single consolidation transaction.
By tracking all identical outputs from the CoinJoin and finding the specific transaction that consumed the greatest number of them, we proved that those distinct mixed outputs shared a single owner. The vendor collapsed their own anonymity set via multi-input clustering, completely defeating the mixer and allowing us to extract the final identification flag.
Constructing the Final Flag
The challenge required us to collect six evidence tokens (T1–T6) across our investigation—including the number of exchanges used, the true identity of the vendor, and the Peel-Chain metrics. To retrieve the final flag, we concatenated all six tokens sequentially and generated a SHA-256 hash.
Token Concatenation: T1 + T2 + T3 + T4 + T5 + T6
Hash Algorithm: SHA-256
Format: First 32 hex characters of the digest
Final Submitted Flag:
ASCWG{eed6ca7d462ef13d0f2ed13b1f7510fd}
The Complete Investigation Path & Mental Roadmap
Here is the step-by-step roadmap from the dark web market entry address to de-anonymizing the vendor:
Extracted the primary deposit address of the vendor ‘NightShade’ from market logs in vendor_intel.json.
Executed automated Esplora API walk following the highest output value (the pot), ignoring change peel transactions.
Identified collaborative CoinJoin transaction characterized by equal-denomination output values ($d$).
Traced the downstream consolidation transaction combining multiple mixed outputs, breaking anonymity and identifying the recipient wallet.
Concatenated tokens T1–T6 and computed the SHA-256 flag digest: ASCWG{eed6ca7d462ef13d0f2ed13b1f7510fd}.