> automatic custodial exchange are a thing, no user initiated withdrawal may have been necessary

It would have been necessary whenever the amount he deposited into the second exchange differed significantly from the amount he deposited into the swap service. I grant that the first time he did it, it's plausible that he did not withdraw the money; the amount he swapped was identical to the amount he deposited at the second exchange, so perhaps he just entered the second exchange's address as the recipient for his swap.

But if that is what he did, he clearly wisened up, because in the other three cases, he made the amounts vary a bit: once he sent a bit extra to the second exchange, the other times he sent a bit less. Indicating that he withdrew the money to a separate wallet first. So in all cases except possibly the first one, a user initiated withdrawal *was* necessary.

> whether there was an intermediate wallet or not, they nowhere claim to have visibility into any "withdrawal."

They mention the exact XMR amounts he received via the swap. That is insight into the withdrawal that they should not have had.

> it is not mentioned at all

Here it is:

Question: how did they know exactly how much he received via the swap? It wasn't the same amount he deposited into the second exchange. So they must have gotten that info from somewhere else. I think the first exchange *told* them how much money he received via the swap. Which means they got data they shouldn't have.

> nobody contests there was timing analysis done, but seeing Bitcoin go in and Monero come out isn't "tracing monero."

Seeing bitcoin go in is clearly tracing bitcoin. Seeing monero come out is clearly tracing monero.

> there is no "monero tracing" when their only monero data point is seeing coins arrive on the CEX

That's not the only data point. They saw the amount and time of two different monero transactions: the withdrawal from exchange A and the deposit to exchange B. That's not one data point, it's two.

> and if you dont like the word "apprehend", we'll use your word "find".

nowhere do they claim they "found" him by "tracing monero" (as they dont claim to trace monero at all).

They found him to be the launderer by means of this trace. The term used is the correct one. But if I change "they found the admin of Incognito Market by tracing his monero" to "they traced the monero of the admin of Incognito Market in order to identify him as a money launderer" will that be an improvement in your eyes?

Reply to this note

Please Login to reply.

Discussion

to be clear

you're saying that LE supposedly getting his tx data from the swap service,

which is not part of the evidence but implied for the reasons you gave,

then comparing that to tx data from his exchange account and seeing these close matches constitutes "tracing monero?"

I do claim that, except I disagree with the part that says implications are "not part of the evidence"

well they dont say they got any information from the swap

so that's not part of the evidence, its your guesswork and worth noting.

but I agree its a reasonable guess.

Replace Monero with Lightning in this scenario. How would this have changed anything? It wouldn't have. The problem is obviously with the chokepoints which are the exchange and swap services where they can see this extra data that isn't revealed on the network themselves.

Unless you would define that as "tracing" Lightning too, if so, fair enough but not sure I would agree this was tracing Lightning itself.

I agree that if the admin had done the exact same action with lightning the timing analysis would have worked against lightning too

You may not want to call that tracing but I think it is the accurate term