Mike McCabe, 0xbow | What Your Crypto Card Shows the World

Hi everyone. As announced, my name is Mike. I am the product lead at Oxbow. Thank you all for coming to my talk here. At Oxbow, we build privacy tooling such as privacy pools, and we also build compliance tooling to support set privacy.

Um So, yeah, we're here at Stable Summit today, and we're obviously all very excited about stablecoins, as am I. Um one thing that I'm that I'm curious about is that I'm guessing a lot of you have have one of these as well. This is a Gnosis Pay card, which is essentially a self-custodied um crypto debit card. And so, I use my quite frequently. I'm a I'm a big fan of the product.

Um But I think, yeah, there's also some design choices we need to make about these these kind of products [clears throat] that I think we can kind of improve on a little bit. And today, with this talk, I'm looking to demonstrate why we should think about this quite carefully. Um Yeah. So, let's take a look at Gnosis Pay in and of itself. So, it has over 31K weekly payments.

It has 3,500 active card holders. It does 2 million in weekly volume. These are not huge numbers, but you can see there's also 420% year-on-year growth, which is really quite significant. And well, with all the hype around stablecoins, we can kind of expect this to increase. And so, every one of these transactions is permanently stored.

This is all public data on a blockchain living forever. There is no opt-out. There is no I mean, where in Europe, there's no GDPR requests stuff for removal. And so, this is public forever. And so, what can we do with that, right?

Um why is this a problem? So, let's first take a look at how Gnosis Pay works. Um what happens is you tap your card at a merchant, and Visa sends an off request to Gnosis Pay, which then triggers an on-chain transaction from your uh Gnosis Pay account to the Gnosis Pay settlement safe, which is a public transaction. And then, that settlement safe um balances out with Visa, and that happens off-chain. Uh so, what happens here, right?

Like, what can we what can we learn from this? Well, we can see the exact amount in euros. We can see the exact timestamp. We can see your wallet address, your current balance, and your entire transaction history. Um what we don't know is the actual merchant, the purchase category, and the geographical location.

Um but in all honesty, we we don't really need that, and I'm going to show you why. So, first, um what I did here is is I created a Dune dashboard, to which I'll share a link at the end of this presentation. Uh and what I did first was identifying all Gnosis Pay card holders. So, as I mentioned previously, this all links back to a single settlement safe. So, as soon as you find that, you basically find all transactions coming into there, and thus all accounts.

So, here is some sample data. As you can see, um there are active accounts here with a lot of transactions that spend, you know, quite a large amount of money. Um so, yeah, let's dive in. What can we what can we learn? I pick one wallet from this list, uh and I have to give a small disclaimer here.

I I used a hypothetical wallet because I I felt a bit um bad about really doxing someone like this. So, um this is fake data. I will share the query to the Dune dashboard if you want to snoop yourself. Uh, you can see all of this. Um, so, well, let's look at let's look at a average Tuesday, right?

Um, we can see there are around eight transactions happening here. First one is at 7:42 in the morning. I mean, it's a free dollar uh, free euro 80 transaction. We're making an assumption, maybe it's a morning coffee. Uh, next one we have maybe a public transport ticket.

Then we see lunch and the list goes on. There's quite a few transactions here from different amounts. So, we can take a few guesses at what's actually happening. Um, so, from one day, right? We we don't know anything for sure, but but we can make some assumptions here.

We can assume this person for instance lives in CET time zone. Um, that it, you know, has a 9-5 job. Uh, it has a lunch break at 12:30 and it takes public transport, wakes up kind of early. Um, so, yeah, as I said, this is one day. It's guesswork, but once we start diving into the bigger picture by for instance looking at all the transaction history from this account, uh, we can create a far more granular picture.

Um, so, what if we multiply that this this one day by 365 days and look at a year in the life of this wallet? Well, we can see very clear spending patterns and we can create a very accurate financial fingerprint. Um, as you can see, we observe a very consistent pattern with regular activities across basically your Monday 9-5. Um, and on the weekends there seems to be a lot of social activity in the evenings. Uh, we can see that most transactions here are pretty small between like the zero and five euros and then it gradually decreases uh, as the amount gets higher.

Um, so, such a financial fingerprint is really is really quite unique. Um this is very sensitive and valuable data and it can really be used to create a pretty detailed picture of your life, of how you behave and what you do. Um Yeah. So, we can go uh a bit further, too, right? Because this is all on the spending side.

Uh we can see, for instance, uh there is a 99 uh recurring payment every month. It's probably a subscription. 39.99 as well, probably also a subscription. And we know you like to get a daily coffee.

So, this is on the spending side. However, the income side is public, too, right? Like we're assuming this user uh uses Gnosis Pay as their primary payment method and it also receives their salary there. Um so, then we see an monthly transaction coming in of approximately €3,000. We can trace that back and now we know this user's employ employer as well, especially if that employer is identifiable for like I N E N S or something like that.

Um we can see that there is another wallet giving infrequent transaction into this safe. And so, we can also know, okay, this is probably your your crypto wallet that you use for um well, your crypto life. And we can also see you top up from Binance from time to time. So, we know you trade on Binance, too. And so, these are all little puzzle pieces through which, you know, we can really uh start to paint a picture of who this user is and um what their what their habits are.

Um Yeah. This is this is one user, but we can do this for the entire Gnosis Pay user set. Um you can profile all these people that are in the in the Gnosis Pay list all at once. You can see it paints uh quite an accurate picture of of what kind of users Gnosis Pay has. It's got 4% of users that that spend a lot of money and they average more than 100 euros per payment and more than 5,000 per month.

We have 22% of users that are daily spenders. It's quite a high amount. It's quite impressive, actually. Uh we have a few people that only use it on the weekends. We have other people that only use it um during weekdays.

So, they probably only use it for their business. Um then you have people like me, tourists, visitors. I usually use my Gnosis Pay account when I'm traveling. So, I would fall into that bracket myself. And um I've assumed because I've only looked at um your e-transfers.

So, I've kind of assumed that everyone that is that is in this bracket is is uh located in CET. So, then final category, we have some people that for some reason only use it at night. Um yeah. Now, you can see um I know all of this just for like five simple Dune queries. Um this is a lot of information.

This is a lot of competitive intelligence. Um yeah, so not all crypto cards are equal. Um we've now looked at self-custodied wallets and self-custodied wallets are probably the most exposed right now. You can also, of course, use a centralized exchange crypto card. I'm not a big fan of centralized exchanges myself.

Um but in this case, they do definitely provide more privacy um than the alternatives. And you can also, obviously, still just use your regular TradFi uh payment card. Um yeah, I mean if you look at TradFi, you really have quite a lot more protection than than you have in crypto now, you know? Like banks are supposed to protect all of this by law, whereas here if in your self-custody card, everything is basically on chain. And so, this is all fun and games uh this presentation here, but I want to I want to make it a bit more uh relatable in the sense that, you know, like this data truly is very sensitive, and people are looking at this data right now.

Um we obviously have like the chain analysis, TRM Labs, Elliptic, your your blockchain analytics firms who offer this as a commercial service. Uh they have probably indexed every one of these users as well, and what I personally think is is pretty scary thought, too, is that hackers and scammers uh also see all of this. And you can imagine that like, well, we obviously have loads of data breaches in crypto from centralized exchanges to KYC providers. Um if your data is compromised in any of that, and that is then linkable to your Gnosis Pay wallet, um you you are a target, realistically. And so, you really have to think about um yeah, designing these kind of things.

Um then data brokers look at it, your employers, partners. I mean, this is open to anyone. Um yeah, so how do we solve this? How do we fix this? I'm going to do a little bit of shilling here.

Uh we are going to release privacy pools V2 on testnet basically this week. Um our goal is to create privacy uh for consumer fintech products such as Gnosis Pay. Um essentially what we do is we use zero-knowledge proofs to break the link between uh deposits and withdrawals, transfers, all these kind of things. So, um how this would work in the case of Gnosis Pay is a user would simply deposit into privacy pools. So, that deposit part is still going to be public.

However, you're not going to be able to see who received that money. So, you just see money going into the vault, and you cannot link it to a recipient anymore. So, it's already a little a little better. Um then if you spend money at a merchant, you make a private transfer to the private settlement fold, and so nobody sees anything. Um, yeah.

I think privacy is extremely important. Um, the way that public blockchains are designed is is great for some use case, and I think it's truly one of their their strongest capabilities, but I don't think it's great for everything. Privacy isn't isn't a feature, it's really a right. I think that especially when it comes to things like stablecoins, payments, consumer products, uh, we should really think about how we can embed privacy by default, and, um, yeah, ensure that we don't leak our clients' sensitive information publicly to anyone on the internet. That was my talk.

Thank you very much. And, yeah, if you're interested, you can scan the QR code to see the June dashboard for yourself and do a little bit of snooping.