Over $60M in Tornado Cash Deposits from 1000 Wallets Alone: Do Frequent Users Drive High-Value Transactions?

Tornado cash is a decentralized protocol for private transactions on Ethereum. It was sanctioned by the US Department of Treasury in 2022 due to its alleged usage in money laundering. In this article, we’ll investigate the correlation between the top deposits and the wallets frequently used with some of the Tornado Cash contracts.

We analyze the top deposits and frequency transactions in the following tornado contracts:

• 0.1 ETH: https://etherscan.io/address/0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc

• 10 ETH: https://etherscan.io/address/0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF

• 100 ETH: https://etherscan.io/address/0xa160cdab225685da1d56aa342ad8841c3b53f291

Top Deposits

Query

We first found the “deposit” calls to the above contracts and ordered them by Transaction Value (in USD). The full query can be viewed here: https://ide.bitquery.io/Tornado-Cash-Top-100-Deposits

To get the first 100 deposits, we set the limit: {count: 100}. For the next 900 items, limit: {count: 900, offset: 100}, and so on.

query MyQuery {
  EVM(dataset: archive, network: eth) {
    Calls(
      limit: {count: 9000, offset: 1000}
      orderBy: {descending: Transaction_ValueInUSD}
      where: {Transaction: {To: {in: ["0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF", "0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc", "0xa160cdab225685da1d56aa342ad8841c3b53f291"]}}, Call: {Signature: {Name: {is: "deposit"}}}}
    ) {
      sum(of: Transaction_ValueInUSD)
      Transaction {
        Hash
        From
        To
        ValueInUSD
      }
    }
  }
}

Deposits Split

We calculated the total deposit value using our python script.

We see that there are a total of ~17k deposits, with the maximum $-worth of deposits in the 1k-10k range.

Frequent Wallets

Query

Subsequently, to find the most frequently used wallets, we use this query: 

https://ide.bitquery.io/Tornado-Cash-frequent-wallets

In the above query, we adjust the limit and offset to fetch the data for the desired range.

Transactions Split

The transactions for frequent wallets and their aggregate transaction count was calculated as shown here.

Frequent Depositors

Query

We use this query to fetch the frequent depositors: https://ide.bitquery.io/Tornado-Cash-frequent-depositors

We added a filter to the previous query to just fetch the deposit calls.

Deposits Split

The transactions for frequent depositors and their aggregate transaction count was calculated as shown here.

Analyzing the Transaction Counts

All of the calculations and data is available in this repo: https://github.com/rajgoesout/tornado-data/blob/main/script.py

In our list of top deposits, we calculated the number of transactions where the wallet used was present in the frequent wallets lists. This is what we found:

• In the top 100 deposits, just 1 transaction (1%) involved a wallet present in the top 100 frequent wallets.

• In the 100-1k deposits range, 48 of the 900 transactions (5.3%) involved wallets present in the 100-1k frequent wallets.

• In the 1k-10k deposits range, 2116 of the 9000 transactions (23.5%) involved wallets present in the 1k-10k frequent wallets.

• In the 10k-17k deposits range, 1867 of the 6748 transactions (27%) involved wallets present in the 10k-100k frequent wallets.

We also calculated the number of transactions where the wallet used was present in the full frequent wallets list (0-100k):

• In the top 100 deposits, 13 of the 100 transactions (13%) involved wallets present in the 100k frequent wallets.

• In the 100-1k deposits range, 286 of the 900 transactions (31.78%) involved wallets present in the 100k frequent wallets.

• In the 1k-10k deposits range, 2413 of the 9000 transactions (26.81%) involved wallets present in the 100k frequent wallets.

• In the 10k-17k deposits range, 2952 of the 6748 transactions (43.74%) involved wallets present in the 100k frequent wallets.

We did the same for the case where the wallet used was present in the frequent depositors lists (the transactions with the deposit call):

• In the top 100 deposits, just 1 transaction (1%) involved a wallet present in the top 100 frequent depositor wallets.

• In the 100-1k deposits range, 44 of the 900 transactions (4.89%) involved a wallet present in the 100-1k frequent depositor wallets.

• In the 1k-10k deposits range, 2118 of the 9000 transactions (23.53%) involved a wallet present in the 1k-10k frequent depositor wallets.

• In the 10k-100k deposits range, 1814 of the 6748 transactions (26.88%) involved a wallet present in the 10k-100k frequent depositor wallets.

We did the same for the case where the wallet used was present in the full frequent depositors list (0-100k):

• In the top 100 deposits, 15 of the 100 transactions (15%) involved a wallet present in the 100k frequent depositor wallets.

• In the 100-1k deposits range, 297 of the 900 transactions (33%) involved a wallet present in the 100k frequent depositor wallets.

• In the 1k-10k deposits range, 2556 of the 9000 transactions (28.4%) involved a wallet present in the 100k frequent depositor wallets.

• In the 10k-100k deposits range, 3175 of the 6748 transactions (47.05%) involved a wallet present in the 100k frequent depositor wallets.

Conclusion

Based on our dataset, we conclude that high-value deposits were driven by wallets that had lesser frequency (and number) of transactions. This is the same even in the case of deposit transactions (based on our calculations from the frequent depositors queries). So, in general, frequent users did not tend to drive high-value transactions - in fact, they are inversely related.