Pseudonymity at Risk: Linkage Attacks on Blockchain Users with Off-Chain Cues
Authors: Alexander Smirnov (TU Berlin), Stefan Schmid (TU Berlin and Weizenbaum Institute), Friedhelm Victor (TRM Labs)
Volume: 2026
Issue: 3
Pages: 787–800
DOI: https://doi.org/10.56553/popets-2026-0106
Abstract: Public blockchain pseudonymity is vulnerable to off-chain cues: external information from sources such as social media or data leaks that can be linked to on-chain activity, enabling user de-anonymization. This paper provides the first comprehensive framework for systematically investigating this threat. We introduce a taxonomy of off-chain cues and propose methodologies to match such cues to blockchain data. Our empirical evaluation on the Ethereum blockchain quantifies the de-anonymization potential of both individual cues and their combinations, as well as real-world case studies such as the Celsius data leak. The results show that cue effectiveness is largely determined by uniqueness and exactness (e.g., specific transaction quantities, interactions with rare tokens), and that combining even a small number of moderately specific cues can significantly reduce anonymity sets. For users revealing multiple such cues, this can lead to the identification of a single on-chain address. In our Celsius simulation, knowledge of only the transaction day, asset, and exact quantity was sufficient to potentially identify over 85% of depositors. Our findings demonstrate the significant privacy risks posed by off-chain cues in blockchain linkage attacks to users disclosing them. Our work underscores the need for heightened user awareness and the development of effective countermeasures.
Keywords: Blockchain, De-anonymization, Linkage Attack
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
