Can the IRS and the DHS Trace Monero Effectively?

Government agencies in the U.S. want to track and trace Monero—but is it actually possible to do so?

Monero is the most popular privacy coin, offering a way to make crypto transactions truly untraceable. However, new efforts from the U.S. government aim to change that: the Internal Revenue Service (IRS) and Department of Homeland Security (DHS) plan to trace Monero in order to prevent tax evasion and prevent crypto-related crimes.

Compared to other cryptocurrencies, Monero is especially private because it obscures virtually all transaction data, including transaction amounts and destinations. This means that only transaction participants (senders, recipients, or those with certain “view” keys) can view transaction data. Monero is enhanced by the fact that its privacy features are largely mandatory and applied by default.

By contrast, Bitcoin and many other cryptocurrencies only provide near anonymity (or pseudonymity). Anyone can view any Bitcoin transaction simply by visiting a block explorer. Though real-world identities are not directly attached to Bitcoin transactions, it is perfectly possible for analysts to deduce the identity of a Bitcoin address holder based on the accounts it has previously transacted with.

Bitcoin’s limited privacy is useful for governments: the IRS has been able to detect tax evasion among Bitcoin investors since 2015. Now, it is attempting to do the same with Monero—a much tougher task given the coin’s stronger privacy features.

In September, the IRS spent $1.25 million and awarded two contracts to firms that are now tasked with building a Monero tracing prototype.

The tax agency split the funds between two companies. The first is Chainalysis, one of the most famous blockchain analytics firms. The second is Integra FECT, a forensic data analysis company that has also done work in the blockchain industry. Those two companies were selected from a total of 22 candidates.

It’s not clear exactly what sort of tool the contracted companies will attempt to design, as no involved party has outlined any technical plans. The IRS’s original request only notes that it is seeking a tool that is capable of tracking transactions based on inputs and outputs, with minimal involvement from external vendors.

So far, Chainalysis’ Monero-tracing efforts have been minimal, and it has said little about the coin apart from noting that it is sometimes used in illegal transactions and “darknet” purchases. It is not clear if Chainalysis has any conceptual plan for tracing Monero. The company almost certainly has obtained Monero-related data from cryptocurrency exchanges, though, which could serve as a starting point.

Prior to this, the DHS obtained a separate Monero tracing tool from CipherTrace. The analysis firm announced that tool at the end of August.

CipherTrace claims that its tool is capable of tracing Monero transactions. It promises that the tool provides “transaction search, exploration, and visualization tools for Monero transaction flows.” CipherTrace’s tool uses a technique called decoy elimination to deduce the possible owners behind Monero transactions; however, it also appears to depend on information from exchanges and third-parties as well.

The effectiveness of the tool has been questioned by Monero developers. Monero researcher Sarang Noether has suggested that CipherTrace’s claims are largely unproven: “Saying that this is a 90% or not 90% [for example] likelihood of signing depends entirely on the metrics you are using—it’s very subjective.”

Even CipherTrace CEO Dave Jevans has admitted that tracing Monero is more about probabilities rather than certainties. But regardless of the effectiveness of this tool, Ciphertrace says that the U.S. government has already used it in investigations. As such, critics should not ignore it entirely.

It’s clear that nobody has broken Monero’s basic privacy features. Analysis firms cannot trace Monero in the same way that they can trace Bitcoin. At a minimum, nobody can view your Monero transaction details as long as you keep your view keys safe.

However, it is clear that analytics firms and government agencies have plenty of data to work with. Exchanges, public forums, and social media have undoubtedly provided CipherTrace and Chainalysis with plenty of Monero-related data. Combined with other types of investigation, investigators may truly find Monero tracing tools useful.

As such, Monero users should not automatically assume that their transactions are completely private. Instead, they should take additional steps to stay private. Among other things, they should buy Monero from an exchange that does not require identity documents, store Monero outside of an exchange, and run a full node rather than a light wallet. Monero users should also be careful about what they post on public forums.

However, most users will not need such an extreme level of privacy. It is reasonable to store Monero on an exchange like Coinbase and use it for everyday purchases and trading, especially if no privacy is desired.