Skip to content

GraphSense Actors

mdragaschnig edited this page Jul 20, 2023 · 9 revisions

In many cases, GraphSense-TagPacks can be linked to a well-defined real-world actor, e.g. an exchange like Binance.

Since GraphSense version 23.03, Actors are supported as first-class entity. This elevates the investigative power of GraphSense: the ability to follow financial flows is now complemented by being able to follow the activities of well-defined Actors to gain additional insights.

Adding Actors to TagPacks

TagPack providers can extend tag information by providing an optional actor field.

Values for the actor field can be chosen from the publicly available ActorPack. Additional Actors can be defined in (private) ActorPacks, if desired.

The actor field is added either in the header

title: Tornado.cash
creator: GraphSense Core Team
category: mixing_service
label: tornado.cash
actor: tornado
is_cluster_definer: false
confidence: authority_data
source: https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220808
description: Addresses related to Tornado.cash mixer
currency: ETH
lastmod: 2022-08-10

or for individual tags:

- address: 35hK24tcLEWcgNA4JxpvbkNkoAcDGqQPsP
label: Huobi.com
actor: huobi

ActorPack

ActorPacks are defined in their own schema. The file layout is similar to that of TagPack files.

Header

The header format is short, with the mandatory fields title and creator, and the optional fields description and the boolean is_public to control access to the actor information.

title: Graphsense Actors
creator: Graphsense Core Team
description: A curated list of cryptocurrency actors.

List of actors

Next in the file is the list of actors.

Mandatory fields are a unique id, a label string, a URI and the date of last modification

- id: binance
label: Binance (US, DEX)
uri: binance.com
lastmod: '2023-02-17'

It is also mandatory to list applicable categories from the respective taxonomies:

categories:
- organization
- defi_dex
- exchange
- mining_service  	

Optional fields

Using the additional optional fields, a wide range of information can be collected for an actor.

Jurisdiction countries are defined in a list of ISO 3166 country codes:

jurisdictions:
- MT
- CA
- US
- FR
- LT
- PL
- AE
- BH
- CY
- AU
- NZ
- IT
- KY
- ES
- KZ
- ZA

The context field serves as de-facto notepad where any additional information can be collected, for example the context below collects meta data for the actor binance:

context:
	uris:
	- www.binance.us
	- www.binance.com
	coingecko_ids:
	- binance_dex_mini
	- binance_us
	- binance
	defilama_ids:
	- binance-us
	- binance
	- binance-cex
	refs:
	- api.coingecko.com/api/v3/exchanges/binance_dex_mini
	- www.crunchbase.com/organization/binance
	- api.llama.fi/protocol/binance-us
	- api.coingecko.com/api/v3/exchanges/binance_us
	- api.llama.fi/protocol/binance-cex
	- api.coingecko.com/api/v3/exchanges/binance
	- www.walletexplorer.com/wallet/Binance.com
	- cer.live/exchange/binance
	- cer.live/exchange/binance_us
	- reddit.com/r/BinanceUS
	- reddit.com/r/binance
	- instagram.com/binance_us
	- linkedin.com/company/40797589
	- facebook.com/BinanceUS
	- facebook.com/binanceexchange
	- medium.com/binanceexchange
	- btc.com/stats/pool/Binance%20Pool
	- www.binancezh.sh/en
	- pool.binancezh.sh/en
	notes:
	- 'cryptostats: binance US in the US. Binance at Cayman islands. Cryptowisser: malta'
	images:
	- assets.coingecko.com/markets/images/52/small/binance.jpg?1519353250
	- assets.coingecko.com/markets/images/469/small/Binance.png?1568875842
	- missing_small.png
	- icons.llama.fi/binance-us.jpg
	- icons.llama.fi/binance-cex.jpg
	twitter_handle: BinanceUS,binance,binancezh
	legal_name: Binance Holdings Limited
	active: true

Although the context serves as a free form field to collect arbitrary context data, the tagpack tool expects a certain structure for a couple of reserved keys. We refer to the schema definition file for actor packs for the current list of reserved keys actorpack-schema

Promoting fields to header level

Fields can also be promoted to header level if suitable, to avoid duplicate field entries

title: Case 987 Actors
creator: Investigator B
description: Defendants XY and RR
lastmod: '2023-02-17'
categories:
- scam
- dark_web
uri: xy.market
jurisdictions:
- GE
actors:
- id: defendant_xy
label: Defendant XY
- id: defendant_r
label: Defendant RR    	

Actorpack validation and insert

The graphsense-tagpack-tool provides support for validation and insertion of ActorPacks into a TagStore.