An Exploratory Visual for Tracking Flow of Funds on Blockchain
A visualization technique on public blockchain data yields an intriguing contrast when applied to FTX vs. Binance and more
Public blockchain offers a rich source of data. Anyone in the world can access and analyze the data for many purposes. One exciting aspect of this blockchain data is devising new analyses and visualizations to study blockchain itself. Coin Metrics recently illustrated this in a State of the Network article. They showcase a variety of visualizations from across 2022. Their article illustrates the power of blockchain data, and how richly it can be represented.
This rich data availability invites exploratory analyses and visualizations. I enjoy this realm of blockchain analysis, a kind of frontier domain. The availability of so many variables allows us to explore these new possibilities easily.
Etherscan’s very open data ecosystem offers great potential for these explorations because so much raw, transaction-level data is available. Recently, I’ve been adapting network visualizations and representing them as a function of time. In this post I share one example of this. At first glance, it’s a very simple kind of visualization. But it can be deployed in many ways, across many aspects of blockchain. I’ve been referring to this visual approach as a “stackplot,” because it starts by “stacking” different addresses on top of each other along the y-axis like layers. Stackplots can be introduced with a schema like this:
Each row represents a distinct address, and lines across rows are transactions. We can highlight special addresses with colors (like an exchange). This makes the stackplot a representation of both space and time — you see the interconnections among addresses, and when they interacted (see endnote 1 for some other assumptions here).
This little algorithm generates a wide variety of interesting visualizations. It also shows how you can preserve a lot of the structural and dynamic properties across a period of time, at a very fine granularity — a kind of exploratory “visual chain archaeology.”
To illustrate, consider some historical examples.
Illustration: Bitcoin & Ethereum
Bitcoin and Ethereum were born in very different ways. Bitcoin was at first mostly mined by Satoshi Nakamoto in very early 2009, with just a handful of transactions peppering Bitcoin’s ledger in the first several days of activity.
Because a stackplot is organized in time, it can be animated. When we order wallets by time, Bitcoin’s arrival looks quiet and very orderly. You can see the coinbase emitting 50 BTC to each mining wallet (most of them Satoshi, who used many unique addresses). You see the intriguing 6 days Satoshi waited after mining the first block, and the first transaction to Hal Finney at block #170.
Bitcoin paved the way for Ethereum, supported by an initial crowd sale in 2014, and then released in summer 2015. It rapidly accrued activity, almost 50,000 transactions shown below. It is a sign of a growing blockchain community, one primed by Bitcoin, now with existing exchanges and companies in the space, ready to engage this new ledger. Ethpool is there very early, and you can see flows from that row (address) into exchanges. Poloniex was the earliest exchange, receiving large numbers of inputs.
What about that big space in the middle? Intriguingly: That massive gap in the middle is an apparent consolidation of small amounts across many wallets, possibly related to the early attack on the ether faucet. Take a look at this block as an example. It may have been a large number of daisychain wallets to exploit the faucet.
There are also mysterious periodicities here too, beckoning for a glance.
All of these observations pop out of the visual chain archaeology.
FTX & Binance
Historical data mining is fun, but the stackplot can also starkly illustrate recent events, such as activity on two major exchanges. They show very different outcomes after users sought withdrawals in late 2022. To simplify this illustration, I chose just ETH transactions on mainnet for FTX (wallets #1 and #2) and a series of Binance wallets shown below.
In November, when potential issues with the FTT token and FTX solvency became clear, there were increasing withdrawals from the FTX platform. This is often termed a “bank run,” and you can see this in the stackplot below, made from about 100,000 transactions. FTX quickly paused withdrawals.
Curiously, a smattering of withdrawals continue, allegedly some users were permitted to remove their assets. Because of the way the stackplot works, we can infer these withdrawals are mostly to users who did not engage with the FTX exchange in this time frame (because these later withdrawal addresses incremented the y-axis rows, they are “new” addresses on this plot).
The purported attack that FTX experienced is shown at the very end, a final drain on Nov. 11 or so, at which point the wallet was emptied of its ETH balance.
Binance experienced a similar episode, though much smaller relative to its overall balance sheet. This is visible in a series of Binance wallets, and over 1,000,000 transactions shown below. Normal operations continued across early December, and indicate an interesting daily seasonality — the denser and lighter bands reflect day cycles across about a week in December. Withdrawals ramp up at the end of this week, by the 8th (during which Binance also consolidated their hot wallet, #14). But Binance did not suffer from similar solvency issues at that time. Binance wallets are a network of hot and cold wallets that adapt to demand. This is suggested by the different patterns in their transactions over time (see here for some interesting detail from Coin Metrics, too).
Conclusion
Blockchain data makes visual mining a rich area of investigation. It will be exciting to see how new dashboards across the ecosystem take advantage of such possibilities in the future. I hope the little “stackplot” idea serves as an interesting, albeit modest, example of this.
Endnotes
1. For simplicity I won’t go into detail about many other features of this approach. For example, you have to decide how to order the stack. In this post, I’ll do so chronologically from bottom to top and put labeled special addresses colored and equally spaced. But you can also stack by (say) balance or by some other arrangements. You can also plot across real time vs. block height (as noted under diagrams). Dot size can also be made proportional to the input size (ETH, BTC, etc.), and in this post I log transform value in most of the visuals. Here’s an example of the FTX 1/2 stackplot with addresses ordered by volume expressed on the plot (bottom = small volume):
2. Those interested in building a stackplot can try this little script in R, which builds the basic version with plain annotation. This calls the Etherscan API, indexes a list of addresses, then uses a vectorizing trick with NA values to plot a large number of independent lines:
data = fromJSON(etherscan_url) # see API docs; use account endpoint
addrs = unique(c(data$from,data$to))# get row (y-axis) values:
from_indices = unlist(lapply(data$from,function(x){return(which(addrs==x))}))
to_indices = unlist(lapply(data$to,function(x){return(which(addrs==x))}))sizes = data$value/10^18 # get value in ether; may want to rescale
# unfold into separate tx lines; lines won’t connect NA values
x = t(data.frame(data$blockNumber,data$blockNumber,NA))
y = t(data.frame(from_indices,to_indices,NA))
sizes = t(data.frame(sizes,sizes,NA))plot(x,y,cex=sizes,type=’b’,pch=16,
col=’black’,ylab=’Addresses’,xlab=’Block height’)
Takens Theorem was not paid for this guest post, nor does he endorse anything except, perhaps, following him on Twitter if you found this interesting.
