Taint Propagation on an Account Chain: FIFO, LIFO, Poison, and Haircut

When stolen funds pass through a busy addressA public identifier, derived from a key pair, at which an account receives funds and is looked up on-chain. Anyone can view an address's history, but only the matching private key can spend from it. TRON addresses are 34-character Base58Check strings beginning with "T"., some later withdrawal carries the dirty value onward — and someone has to decide which withdrawal, and how much of it. Every tracing tool, exchange compliance desk, and court that has confronted commingled crypto funds has faced that decision, and the answer is always one of a small set of formal rules.

Those rules — poison, haircut, FIFO, LIFO — were developed for Bitcoin, where each coin carries a verifiable ancestry. TRON is built on a different foundation. An account holds a single balance that inbound transfers merge into, and that difference changes what “taintAn accounting approach that marks value as tainted when it traces back to a known illicit source — theft, scam, or sanctioned entity — and defines how that mark spreads through subsequent transactions. Because most ledgers merge funds, propagation needs an explicit rule: treat everything a tainted input touches as tainted (poison), pass on only the proportional fraction (haircut), or follow an ordering convention such as first-in-first-out. Not to be confused with address poisoning, an attack on wallet users; the taint "poison rule" is an accounting convention.” can even mean.

This chapter covers the models themselves and what survives of them on an account chain. The practical hop-by-hop trace lives in Following the Money; this is about the arithmetic underneath any such trace.

Taint is a percentage with real-world teeth

Exchanges have acted on taint since the earliest thefts, and the community that coined the term meant something precise by it. Möser, Böhme, and Breuker’s 2013 study of Bitcoin laundering tools records the working definition: taint “refers to the percentage of bitcoins, that come from a known theft or scam and have been blacklisted by popular exchange markets.” The same passage records the consequence — in 2012, Mt.Gox froze customer accounts holding coins that could be directly related to such an incident.

Two things follow for an investigator. A taint judgment is a quantity, so any tracing method has to say how that quantity divides when tainted and clean value meet in one transactionA signed instruction ("tx" for short) that changes on-chain state — transferring value, calling a contract, or updating an account's settings. Once it is included in a block and that block reaches finality the record is permanent: later transactions can supersede its effects, but the entry itself can never be edited or deleted. Before finality, a freshly included transaction can still be reversed if its block is reorganized out.. And because exchanges freeze on taint, the choice of division rule is not academic — it decides whose funds get stopped.

The coin-lineage assumption underneath every model

The classical models work because a Bitcoin coin carries its own ancestry. The Bitcoin whitepaper defines it directly: “We define an electronic coin as a chain of digital signaturesA cryptographic proof, produced with a private key over a transaction's exact contents, that the key holder authorized that transaction and no other. Nodes verify the signature before accepting the transaction, so a valid signature is definitive evidence the key was used — though not of who was holding it at the time.. Each owner transfers the coin to the next by digitally signing a hashA fixed-length fingerprint computed from data of any size by a one-way function: the same input always produces the same output, but the output reveals nothing about the input and no practical method finds a second input that matches it. Transaction IDs and block IDs are hashes, and each block embeds the previous block's hash — which is what makes tampering with history detectable. of the previous transaction and the public keyA mathematically linked pair — a private key that signs transactions, and a public key (with the address derived from it) that lets anyone verify those signatures. Whoever holds the private key controls the address: on a blockchain, ownership is key control, whatever any off-chain record says. "Keypair", "private key", and "public key" all refer to parts of this same structure. of the next owner.” Holdings exist as unspent transaction outputs (UTXOs) — discrete pieces of value newly created from a transaction’s inputs, each with a verifiable history.

The hard case, as Tironsakkul, Maarek, Eross, and Just put it in their comparison of taint-analysis methods, arrives “when the targeted inputs are combined with other unrelated inputs into new output(s)” — it becomes difficult to say how the tainted value distributes across the new outputs. Every taint model is a rule for resolving that ambiguity at the level of individual coins.

The four rules, side by side

Each model is one sentence long, and the differences between those sentences are the whole subject.

Poison. Any tainted input taints every output, completely. Anderson, Shumailov, and Ahmed’s worked example in Making Bitcoin Legal: a transaction with three stolen bitcoin and seven good bitcoin as inputs “has an output on ‘poison’ of ten stolen bitcoin.” Taint spreads explosively and never dilutes. (The “poison” here is a taint-propagation rule — it has nothing to do with the address-poisoning lookalike-address attack covered in Address Poisoning.)

Haircut. Taint spreads proportionally: each output inherits the tainted fraction of the input mix. The same transaction yields “ten bitcoin each of which is marked as 30% stolen.” Nothing escapes, but everything dilutes.

FIFO. First-in, first-out: each withdrawal is matched against the earliest unspent deposit. Where poison and haircut are spreading rules, FIFO is an ordering rule — it assigns specific outgoing value to specific incoming value by sequence.

LIFO. Last-in, first-out: the mirror ordering, matching each withdrawal against the most recent deposit.

Until FIFO was proposed for blockchainA shared ledger maintained by many independent computers, in which transactions are grouped into blocks and each block cryptographically references the one before it. Because rewriting any past entry would break every link after it, the record is effectively append-only — new entries can be added, but history cannot be quietly altered. tracing, poison and haircut were the only two algorithms in use, as Making Bitcoin Legal notes. The model space keeps growing — Tironsakkul et al. also evaluate TIHO (“taint-in, highest-out”), which pushes taint onto the highest-value outputs and leaves smaller ones clean — but the poison/haircut/FIFO/LIFO quartet is the working vocabulary.

The model choice changes the answer by orders of magnitude

These are not four routes to roughly the same result. Anderson, Shumailov, and Ahmed replayed well-publicised Bitcoin thefts across the whole blockchain and measured the spread under each rule. The 2014 Flexcoin hack tainted 18,208 accounts by 2016 under FIFO — and 1,429,794 under haircut. The 2012 Linode theft of 46,653 bitcoin tainted 371,544 addresses (about 0.67% of the total) under FIFO, against 2,694,051 (almost 5%) under haircut. Overall, they found most Bitcoin accounts carried zero taint under FIFO, while under haircut fewer than 24% escaped taint entirely.

The rules also differ in what they preserve. FIFO tracking is reversible — you can run it forward from a reported theft or backward from a coin you have been offered — so it leaves an audit trail. Haircut keeps none: it loses information and cannot be run backwards.

There is a cost to precision, and the same authors name it: efficient coin tracing damages fungibility, the property that one unit of a commodity can replace another. A chain where every unit carries a taint history is a chain where units are no longer interchangeable. That tension is why taint models are contested at all. On an account chain it barely arises — the units were never separable to begin with.

FIFO was born in a bank account

The oldest of these rules predates Bitcoin by nearly two centuries, and it was designed for precisely the situation TRON presents. In Devaynes v Noble — Clayton’s Case, decided in 1816 — the Court of Chancery had to untangle good and bad funds commingled through a running bank account after the bank collapsed, and the outcome depended on which deposits were matched against which later withdrawals. Sir William Grant, Master of the Rolls, set the rule:

Grant’s own framing is the point: “Upon that principle, all accounts current are settled, and particularly cash accounts.” FIFO was invented for a mutable running balance with no coin identity — an account — and was only later borrowed into UTXO coin-tracing, where Making Bitcoin Legal re-imported it as a taint algorithm. An analyst applying FIFO to a TRON account is not stretching a Bitcoin technique; they are returning the rule to its original habitat.

What survives on a single mutable balance

TRON’s protocol is account-based: an account holds balances of TRXThe native coin of the TRON network. TRX settles value directly (no contract call needed), is staked to obtain Energy, Bandwidth, and voting power, and is burned to pay fees when staked resources fall short. Its smallest unit is the sun: 1 TRX = 1,000,000 sun. and tokensA unit of value recorded inside a smart contract rather than in the chain's native ledger — the contract keeps the balance table, and moving tokens means asking the contract to update it. Not to be confused with a coin, which is the chain's built-in asset (TRX on TRON) used to pay for the network itself., and a transfer credits the recipient’s balance. There is no set of discrete outputs, no signature chain per unit of value — the properties the whitepaper’s “chain of digital signatures” definition supplies, and the properties poison, haircut, and coin-level FIFO consume, are absent by design. (The mechanics of the account model itself are covered in The TRON Account Model.)

The direct consequence is that comminglingMerging funds from different sources into a single balance so that outgoing transfers can no longer be attributed to particular incoming ones. It happens routinely and legitimately — exchange consolidation wallets pool thousands of customers' deposits — and deliberately, as a laundering technique. Commingling is the reason taint-propagation rules exist: once value is pooled, any claim about which outflow carries which inflow is a convention, not a fact. is not something an adversary has to arrange. Three deposits into one TRON address merge into a single number the moment they land. Deliberate commingling as a paid obfuscation service is its own subject — When the Trail Goes Cold — but on an account chain the balance itself is the commingler, present in every busy address with no adversarial intent required.

So what remains of taint when there is no coin to follow? Three handles, each already visible in the models above:

• Proportion. The haircut logic survives intact, because it never needed coin identity — only amounts. If a balance received 30% of its value from a flagged source, a proportional share of any withdrawal can be attributed accordingly. This is taint in Möser’s original percentage sense, applied to a balance instead of a coin.
• Ordering. FIFO and LIFO survive as assumptions imposed on the deposit/withdrawal sequence — exactly what Clayton’s Case did to a bank ledger. The chain records the order of credits and debits precisely; what the analyst chooses is the matching rule, and that choice must be stated, because it is a convention rather than a fact of the ledger.
• Confidence. Because the matching rule is an assumption, the output is an estimate that degrades hop by hop as balances re-commingle. An account-chain taint judgment is a statement of proportion and confidence, not a coin-level proof — and it should be presented that way.

The honest form of an account-chain taint finding is therefore explicit about all three: what share, under which ordering assumption, with what confidence remaining after how many hops. And whatever the arithmetic says, it attaches to addresses and the entities behind them — the ceiling on turning that into a claim about a person is the subject of From Finding to Evidence.

The models are worth knowing even where they cannot run natively. They are the shared vocabulary of every compliance desk and tracing report an investigator will encounter, and the Flexcoin and Linode numbers are a permanent caution: when a report says funds are “tainted,” the first question is which rule produced that word.

Sources

• Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System” — the primary definition of a coin as a chain of digital signatures, the lineage assumption all coin-level taint models depend on.
• Möser, Böhme & Breuker, “An Inquiry into Money Laundering Tools in the Bitcoin Ecosystem” (IEEE eCrime 2013) — peer-reviewed source for taint as a percentage traceable to a known theft or scam, and the 2012 Mt.Gox account freezes.
• Anderson, Shumailov & Ahmed, “Making Bitcoin Legal” (Security Protocols Workshop XXVI, Cambridge, 2018) — primary source for the poison/haircut worked examples, the FIFO proposal and its Clayton’s Case grounding, the Flexcoin and Linode taint-spread measurements, FIFO reversibility, and the fungibility tension.
• Tironsakkul, Maarek, Eross & Just, “Probing the Mystery of Cryptocurrency Theft: An Investigation into Methods for Taint Analysis” (arXiv:1906.05754) — working paper (preprint, under review as of December 2019) giving the systematic definitions of poison, haircut, FIFO, LIFO, and TIHO; the core definitions are independently corroborated by Making Bitcoin Legal.
• Devaynes v Noble (Clayton’s Case) (1816) 1 Mer 529, 35 ER 781 — judgment reproduced in Lightman KC & Comiskey, “The rule in Clayton’s Case,” Butterworths JIBFL (Serle Court) — Sir William Grant MR’s verbatim first-in-first-out rule for commingled running accounts, the legal origin of FIFO.
• TRON Developer Hub, “Accounts” — primary protocol documentation of TRON’s account/balance model, in which accounts hold TRX and token balances rather than discrete spendable outputs.