snapshot samplings of the bitcoin transaction network and analysis of cryptocurrency ... · 2021....

Snapshot Samplings of the Bitcoin Transaction Network andAnalysis of Cryptocurrency Growth

Lambert T. LeongDepartment of Computer ScienceUniversity of Hawaii at Manoa

Honolulu, Hawaii, [email protected]

ABSTRACTThe purpose of this work was to perform a network analysis on therapidly growing bitcoin transaction network. Using a web-socketAPI, we collected data on all transactions occurring during a sixhour window. Sender and receiver addresses as well as the amountof bitcoin exchanged were record. Graphs were generated, using Rand Gephi, in which nodes represent addresses and edges representthe exchange of bitcoin. The six hour data set was subsetted into aone and two hour sampling snapshot of the network. We performedcomparisons and analysis on all subsets of the data in an effortto determine the minimum sampling length that represented thenetwork as a whole. Our results suggest that the six hour samplingwas the minimum limit with respect to sampling time needed toaccurately characterize the bitcoin transaction network.Anonymityis a desired feature of the blockchain and bitcoin network however,it limited us in our analysis and conclusions we drew from ourresults were mostly inferred. Future work is needed and being doneto gather more comprehensive data so that the bitcoin transactionnetwork can be better analyzed.

KEYWORDSBitcoin, Blockchain, Cryptocurrency, Network Analysis, Social Net-work Analysis

1 INTRODUCTIONThe invention of the internet has helped to provide a new platformfor the exchange of money by providing the framework to connectindividuals from all around the world. Most monetary exchangesover the internet occur with the help of third party entities suchas banks or credit card companies. These third party entities of-ten have oversight over all transactions and are responsible forverifying the integrity of transactions [12]. Exchange protocols,which require a verifier, have become the conventional methodof exchanging money over the internet. While these conventionalexchange methods account for a good amount of the daily trans-actions around the world, there are a few draw backs that presentproblems to many users. Third party verifiers constantly receivea high volume of transactions which need to be verified beforemoney is permanently moved from one individual to another. Dif-ferent companies and banks have different methods of prioritizingthe order in which transactions are verified. A high number oftransactions verifications by a small number of third parity entitiesleads to a bottle-necking effect which can leave recipients waitingfor payments to clear and be received. In an effort to reduce thevolume of transactions many third party verifiers require minimum

transactions amounts and, in some cases, a small transaction fee.While this may help to mitigate the volume of transactions thatneed to be verified, it limits the financial freedom of those whoparticipate in conventional exchange methods.

Bitcoin (BTC) is a cryptocurrency that offered a solution to theshortcomings present in conventional exchange methods. Inventedby Satoshi Nakamoto, bitcoin is a peer-to-peer payment systemin which payments are validated by math rather than trust [9].In other words, instead of trusting a potentially nefarious thirdparty entity, transactions are verified by a proof of work algorithmwhich involves block hashing [9–11]. A public ledger, known asthe blockchain, is created as a result of the hashing algorithm andit contains every transaction in the history of the network. Newblocks are hashed about every 10 minutes and transactions areverified and added to the ledger indicating a successful transfer ofbitcoin from one individual or entity to another [9]. Anonymity ispreserved by keeping user addresses separate and abstracted awayfrom personal information. In addition, there are some instanceswhere a particular user’s wallet can generate new sending andreceiving addresses to further maintain a level of anonymity [2, 9].

Since its genesis, bitcoin has gained popularity and traction.As a result, the number of bitcoin addresses and the number oftransactions have continued to increase at an exponential rate asseen in Figures 1. In this paper, we analyze different snapshots ofthe growing bitcoin network. Since the bitcoin network is currentlylarge and continuously growing, we are interested in investigatingthe appropriate network sampling time frame. Network and graphanalysis have been performed on the bitcoin network however, itsrapid growth may indicate a need for a better way of characterizingthe network at a specific point in time [6]. Determining a samplingcriterion would allow analysis to be done on a smaller sub-graphfrom which, conclusions can be drawn and extrapolated to thenetwork as a whole. Running a network analysis on a representativesub-graph would be more efficient and computationally favorablethan the whole, growing, bitcoin network.

The remainder of the papers is as follows: in Section 2we describehow data is collected, how we generate graphs from that data, andhow we use specific tools to analyses the network. In Section 3 wereport our finding at different sampling intervals. Lastly, we discussour findings and conclusion in Section 4.

2 METHODSBTCs are constantly being exchanged and moving throughout thenetwork and as a result the numbers of transactions are ever grow-ing. The number of users and addresses are also constantly increas-ing. Every transaction involving BTC is public and every transaction

arX

iv:2

003.

0606

8v1

[cs

.SI]

13

Mar

202

0

, , Lambert T. Leong

(a) Number of transactions over time grows as an exponentialfunction

(b) Number of unique Bitcoin addresses growth over time

Figure 1: Growth in the number of transactions and uniqueaddresses imply the growth in bitcoin users and popularity

since BTCs inception in 2009 is recorded on a public ledger. This is aunique feature of BTC and every node participating in the networkhas a copy of this public ledger. This ledger is constantly beingupdated as new transactions are confirmed. Updates occur on everyledger on every node participating in the network and thus everynode is in consensus with each other on the current status of theledger.

2.1 Data CollectionWhile we could have joined the blockchain network and down-loaded a copy of the public ledger to build our network graph, wefelt that it would not be an efficient method of evaluating the cur-rent status of the BTC network. As a result, we decided to utilizea web socket API from BlockChain.Info. This API allowed us to

stream live transactions as they were on their way to be confirmed.Each transaction came in as a JavaScript Object Notation (JSON) fileand a script was written to extract and parse out the sender address,receiver address, and the BTC amount variables. These variableswere stored as a comma separated file (.csv). The web socket ran fora total of six hours and separate csv files were generated at the onehour, two hour, and six hour time points; hence the snapshots. Oneof our objectives was to investigate possible changes in networkcharacteristics with different sample sizes and durations. In otherwords, we are interested to see if any network metrics change asthe network grows within our sampling snapshots. It is importantto note that the web socket performed a continuous data collectionand was not interrupted when the one hour and two hour sampleswere taken. The resulting one hour and two hour samples are subsets of the six hour sample with the one hour sample also being asubset of the two hour sample.

2.2 Graph GenerationThe csv files for the one, two, and six hour samplings were importedinto Gephi [4] to generate a graph of the sampled BTC network. Thecsv files were imported as edge list where the sending address cor-responded to the “source” and the receiving address correspondedto the “target”. The amount was converted from Satoshis to BTCs,1 BTC = 1x10−8 Satoshi, and stored as a float, an edge attribute.Graph files were exported as .graphml for further data processing.

2.3 Network AnalysisGraph metrics were analyzed with R utilizing the igraph, poweRlaw,and linkcomm packages [5]. Transitivity, average degree, averagedistance, reciprocity, degree distribution, and maximal cliques weremeasured for each snapshot graph and compared to each other. Thelargest connected components were also extracted from each of thethree sample graphs and metrics were computed with igraph. Thesix hour connected graph was further evaluated for the presence ofcommunities. Using the linkcomm package and the getlinkcommu-nities, by Alex T. Kalinka, we were able to generate community’snodes that linked to every node of a particular community [5].Investigating community structures in the giant connected com-ponent may reveal BTC user financial behavior; in particular whoexchanges money with whom.

3 RESULTSThere was a positive correlation between the sampling time and theamount of observed transactions. As mentioned previously in Sec-tion 1, the numbers of transactions are increasing at an exponentialrate. We plotted the number of edges, obtained in our sampling,over the duration of six hours. Transactions are indicated by anedge in the resulting graph of the networks sampled for one, two,and six hours. The increase or growth of the network resulted inan increase in both the number of transactions, indicated by thenumber of edges, and the number of active addresses, indicated bythe number of nodes. These results are shown in Figure 2.

The trend line would indicate that the number of transactionsare growing at a logarithmic pace rather than an exponential one.R2 values for logarithmic best fit lines for nodes and edges are0.997 and 0.996 respectively This is contradictory to what was

Snapshot Samplings of the Bitcoin Transaction Network and Analysis of Cryptocurrency Growth , ,

Figure 2: As we take longer samples, the network grows.Nodes (BLUE) indicate new addresses, and edges (RED) indi-cates new transactions. R2 values for best fit lines for nodesand edges are 0.997 and 0.996 respectively

expected however, this discrepancy may be due to the amountof data and sample size. Blockchain.info reports an exponentialgrowth in the number of transactions over the whole life span ofBTC [1]. Our sampling window could be the limiting factor andperhaps, we would start to see an exponential growth trend for alonger sampling duration.

The number of transactions since the inception of BTC has anoverall general exponential growth trend but the transaction rateseems to fluctuate if observed form the perspective of weeks andmonths. There is a level of volatility when it comes to the prices orexchange rate of BTC [13]. Price volatility could correlate to thesefluctuations and periods of lower transaction volumes. A six hoursampling window does not appear to be a long enough time frameto model the overall network growth. Since transactions rates canfluctuate for periods of time ranging from days to months, it is bestto look at the entire transaction history in order to draw conclusionsabout the overall growth rate of transactions. A smaller samplingwindow, such as the 6 hours for which we took our samples, maybe useful when analyzing how the network is growing in the nearor short term.

3.1 Snapshot Network Analysis Results andComparisons

Network analysis was performed on all three graphs with the pur-pose of investigating changes as the time and the size of the samplenetwork increased as well as for comparison to previously reportedfindings. Analyzing the difference in resulting graph metrics wouldhelp in determining an appropriate sampling window that wouldyield a sample graph that is representative of the network as awhole. Table 1 contains the metrics calculated for all three networkgraphs.

Across all three sample graphs, reciprocity, global transitivity,and mean degree were consistent. These metrics changed only

Table 1: Graph metrics for one, two, and six our samplingsnapshots calculated using igraph and R

Sampling Duration 1 Hour 2 Hour 6 HourNodes 18654 52312 95209Edges 11262 33408 62635

Diameter 12 19 39Max Cliques 3 3 3

Dyads 10943 32512 61122Tryads 2 8 34

Reciprocity 0.00 0.00 0.00Transitivity (global) 0.00 0.00 0.00Transitivity (average) 0.00 0.00 0.00

Mean Degree 1.21 1.28 1.32Mean Distance 1.31 1.90 5.37

slightly as the graph grew over the 6 hours. Transitivity was lowfor all three graphs, which was to be expected. Transitivity wouldincrease when, for example, someone sent BTC to two separatepeople and those two people exchanged BTC with each other. Thisis not a likely event and this is why we expected it to be low. Allthree graphs had a low mean degree with the largest mean degreevalue being 1.32 for the six hour sample graph. A low mean degreewould help to explain a low transitivity since a low mean degreeindicates that the majority of the nodes in a graph have only oneedge. Nodes need a minimum of two edges for transitivity. Themean degree values for each graph indicate that most addressesexecute only one transaction. The number of dyads implies thatthe graph is primarily composed of pairs of nodes that share onlyone edge. For each sample graph, dyads account for the majority ofnodes in the network. Triads make up a significantly lesser portionof the graph. We did not expect to see many triads or cliques duringour sampling. In the short term, it is unlikely that triads formbecause it would mean that some money comes back to the originalsender implying that some portion of that transaction should nothave been sent out in the first place. However, goods or servicescould have been exchanged among the triad which would explainits formation. The network is built only on BTC transactions andthus we do not know the exact motive behind each transaction.A longer sampling would probably have led to more triads andpossibly greater maximal cliques. However, it is just as likely thatthe number of pairs of nodes would have increased at a similar rate.

Reciprocity was also low. This was expected for this type ofnetwork. It is unlikely that a node would reciprocate an edge be-cause that would be like person A sending 1 BTC to person B inthe first transaction then person B sending back, to person A, agiven amount of BTC in a second transaction. The first and sec-ond transaction can be combined into one and the net amount, thedifference in the amount between the first and second transaction,should be sent to the appropriate person which would eliminate anedge in one direction. The reciprocity value is small for all graphs


(a) Graph sampling after one hour (b) Graph sampling after two hours (c) Graph sampling after six hours

Figure 3: Visualizations of one, two, and six hour sample graphs, from left to right. Graph density increases as collection timeincreases

Figure 4: Log-Log degree distribution of one, two, and six hour networks, from left to right.

but it is not zero which means that there are instance of recipro-cating edges. The instances where a user sends the wrong amountto another user who, is kind enough to correct the transaction andsend it back to the person it originated from may be an instance forreciprocation. Returning goods and getting a refund on somethingbought with BTC is another instance that may warrant reciproca-tion. Reciprocation can also be the result of gambling sites where,gamblers gamble in BTC and earn their winnings in BTC too. Theseinstances are rare and small in comparison to the vast number oftransactions constantly being received. The rarity of reciprocity isreflected in the zero value obtained for all sample graphs.

Visual representations of each samples size graph, density, andconnections are show in Figure 3. The density of the graph increaseas sampling time increases. Dark black spots are star like structuresconsisting of clusters of nods around a single node with a highdegree. As time goes on, more nodes form edges to these centralnodes which increase the size of the black spots. However, it doesnot appear that links are formed from one high degree node toanother. Nodes with high degree seem to increase their degreeas more nodes join the network which exhibits characteristics of

preferential attachment and implies a possible scale free network [3,7].

Scale free networks are characterized by having a power-law de-gree distribution.We investigated the degree distribution in Figure 5.Here we see that the degree distribution for all sample networksis heavily tailed to the right which is characteristic of power-lawdistributions.

The degree distributions for each graph was plotted in conjunc-tion with exponential, log normal, power law, and Poisson best fitlines. Results in Figure 6 would indicate that the one hour and twohour graphs do not fit any particular trend. However, when Xminwas set at 4, the six hour distribution seemed to fit the power lawdistribution. Kolmogorov-Smirnov test results in a p value of 0.46which indicates that we cannot reject the hypothesis that the sixhour distribution fits a power law [5].

Evidence of a power law distribution were seen in our largestgraph which was sampled for the longest period of time. It wouldappear that smaller samplings of the network do not resemble ascale-free network however, the largest sampling started to show


Figure 5: Lin-Lin degree distribution of one, two, and six hour networks, from left to right.

Figure 6: Plot of one, two, and six hour network degree distributions with exponential(Red), log normal(Green), power-law(Blue), and Poisson(Orange) best fit lines, from left to right.

evidence of a power law distribution which is indicative of a scale-free network. It is likely that a longer sampling window would yielda larger graph in which a power law is more apparent.

Although the graphs are mainly composed of pairs of nodes, wewere interested in the presence of communities. We extracted thelargest connected component from the sample graphs. This left uswith graphs that excluded the many isolated pairs of nodes. Metricswere calculated and are shown in Table 2.

3.2 Analysis of Six Hour Snapshot GiantComponents

Directedness was not taken into account when extracting the gi-ant components from each graph. Each sub graph is significantlysmaller than its original graph implying again that the graphs areprimarily made up of isolated pairs of nodes. This means that, dur-ing the sampling window, addresses only sent one transaction. Forthe giant component subgraphs, the metrics were not consistentacross all giant component subgraphs, as seen in the original graphs.

Our analysis showed that the six hour graph showed to be thebest representative sample network. Therefore, we chose to run

community detection on the six hour giant component subgraph.The resulting graphs can be viewed in the appendix. Figures 7 aresub graphs of the graph, Figure 8, in the appendix.

Both graphs represent the two biggest communities contained inthe six hour giant component graphs and they have slightly differentstructure. Figure 7a illustrates a community in which many nodesshare edges with one central node. This creates a star like structureseen in most of the other communities. The second community inFigure 7b does not contain a single node with a high degree. Mostof the nodes have the same degree and yet they form a community.This would imply that the nodes are more interconnected to eachother, as there is no distinct hub or authority. Figure 7b representsmore of a decentralized community.

Community structures provide clues as to what types of individ-ual or entity may be contained within a network. For communitiesthat resemble that of Figure 7a, it is possible that the high degreenode may be a type of vendor or a spender depending whether ornot there is a high in-degree or out-degree. A high in-degree wouldmean that one address is receiving a lot of transactions while ahigh out-degree would mean that an address is paying a lot of other


Table 2: Graphmetrics for giant component subgraph calcu-lated using igrap

Connect ComponentSampling Duration 1 Hour 2 Hour 6 Hour

Nodes 238 3028 9052Edges 243 3193 9698

Diameter 4 19 39Max Cliques 2 3 3

Dyads 2 3172 9582Tryads 0 3 20

Reciprocity 0.00 0.00 0.00Transitivity (global) 0.00 0.00 0.00Transitivity (average) 0.00 0.00 0.01

Mean Degree 2.04 2.11 2.14Mean Distance 1.29 3.04 6.67

individuals. Figure 7b resembles a different type of community. Itis difficult to draw conclusions about the nature of the nodes inthis community. Gambling is one possible instance in which manytransactions occur among a community of individuals. However, itis also likely this community is a bunch of nodes doing businesstogether. Given that it was a six hour window, it is unlikely thatbusiness would execute that many transactions with each other.Further analysis is needed to determine the nature of the individualsbut community detection is a good starting point.

4 CONCLUSIONThe six hour sample graph seemed to provide a sample graph thatwas most representative of the reported nature of the bitcoin trans-action network [8]. Modeling the network growth with the one,two and six hour subgraphs did not seem to be a reliable means ofevaluating long term growth of the network. Growth fluctuationsare experienced in the short term and thus any short term networkgrowth sampling may not be indicative of the network’s overallgrowth.

Sample graphs yielded metrics that we expected to see. Our sixhour sample graph showed evidence of a possible power law degreedistribution which suggest that we cannot dismiss the possibilitythat our network is scale-free. The emergence of such correlationwas only seen in the six hour graph and not in the two hour orone hour graphs. Further investigations should consider a longersampling window in order to get a better snap shot of the network.A longer sample window may be beneficial and provide a moredefinitive distribution.

4.1 Possible Future WorkA deeper investigation into the owners of each address would aid ina more comprehensive analysis of the bitcoin transaction network.Certain security feature most likely lead to some level of skewnessin the data set. The feature which allows users to change the sending

(a) Large community in which many nodes share only one edgewith one of the two main nodes

(b) Large community which has a more decentralized shape

Figure 7: Two of the largest communities from the six hoursample. Nodes are sized by the number of edges. Biggernodes have more edges. Green colors indicate that a higherin degree (receiving BTC)while pink represents a higher outdegree (sending BTC)

and receiving address is a powerful security feature but it couldlead to a misrepresentation of the amount of actual bitcoin usersparticipating in the network. Since all transactions are kept on apublic ledger, addresses associated with a transaction involving a


lot of bitcoin may become targets of malicious attacks. Some bitcoinwallets allow users to generate new public addresses in order tomaintain a level of anonymity on the network. This feature mayexplain the large number of pairs of nodes in our network samples. Itcould be that individuals change their address for every transactionand a new address is used for subsequent transactions. Situationsare present where an address cannot be changed or it would beinconvenient and this is whywe see nodeswith high degrees despitethe fact that an address can be changed. For example, if a vendoraccepts bitcoins as payment it would be inconvenient for the vendorand patrons if the vendor constantly changed addresses becausepatrons, especially “regulars”, would have to constantly check thatthe address is current and that they are sending money to the rightaddress.

Individuals are allowed to have multiple bitcoin wallets just assomeone may have multiple bank accounts or credit cards. Mul-tiple wallets per individual would lead to a similar phenomenonto generating new addresses however; one more thing needs tobe considered. Money can be sent from one wallet to another wal-let but one individual may have ownership to both wallets; it islike transferring funds between two bank accounts you own. Toacknowledge this transfer the, the network needs to verify it andthus it would show up as a transaction in the network.

Community detection may help to investigate ownership of aparticular address because multiple addresses in a particular com-munity may belong to one individual. Combining these addresseswould lead to a better resolution of the network. The way it standsnow, our network primarily resembles the movement of bitcoin.

Building a transaction network in which the nodes represent asingle individual or entity rather than a single address would re-sult in a network that would resemble how people spend bitcoin.Separating the identity from the bitcoin address was in the originaldesign of the network to protect individual

REFERENCES[1] [n.d.]. Bitcoin Charts & Graphs - Blockchain. https://www.blockchain.com/

charts[2] Andreas M Antonopoulos. 2014. Mastering Bitcoin: unlocking digital cryptocur-

rencies. " O’Reilly Media, Inc.".[3] Albert-László Barabási et al. 2016. Network science. Cambridge university press.[4] Mathieu Bastian, Sebastien Heymann, and Mathieu Jacomy. 2009. Gephi: an open

source software for exploring and manipulating networks. In Third internationalAAAI conference on weblogs and social media.

[5] Gabor Csardi, Tamas Nepusz, et al. 2006. The igraph software package forcomplex network research. InterJournal, complex systems 1695, 5 (2006), 1–9.

[6] Michael Fleder, Michael S Kester, and Sudeep Pillai. 2015. Bitcoin transactiongraph analysis. arXiv preprint arXiv:1502.01657 (2015).

[7] Dániel Kondor, Márton Pósfai, István Csabai, and Gábor Vattay. 2014. Do therich get richer? An empirical analysis of the Bitcoin transaction network. PloSone 9, 2 (2014).

[8] Philip Koshy, Diana Koshy, and Patrick McDaniel. 2014. An analysis of anonymityin bitcoin using p2p network traffic. In International Conference on FinancialCryptography and Data Security. Springer, 469–485.

[9] Satoshi Nakamoto. 2019. Bitcoin: A peer-to-peer electronic cash system. TechnicalReport. Manubot.

[10] Fergal Reid and Martin Harrigan. 2013. An analysis of anonymity in the bitcoinsystem. In Security and privacy in social networks. Springer, 197–223.

[11] Dorit Ron and Adi Shamir. 2013. Quantitative analysis of the full bitcoin trans-action graph. In International Conference on Financial Cryptography and DataSecurity. Springer, 6–24.

[12] Don Tapscott and Alex Tapscott. 2016. Blockchain revolution: how the technologybehind bitcoin is changing money, business, and the world. Penguin.

[13] David Yermack. 2015. Is Bitcoin a real currency? An economic appraisal. InHandbook of digital currency. Elsevier, 31–43.

https://www.blockchain.com/charts

https://www.blockchain.com/charts


Figure 8: Communities from the six hour sample. Nodes are sized by the number of edges. Bigger nodes have more edges.Green colors indicate that a higher in degree (recieving BTC) while pink represents a higher out degree (sending BTC)

snapshot samplings of the bitcoin transaction network and analysis of cryptocurrency ... · 2021....

Documents