## 2 Public Keys and Economically Active Entities
Figure 3 shows the number of entities of a given size at different times. We can observe a strong signal for an entity size of one and many outliers for very big entities with 1000 or more public keys associated. We fitted a function of type  
\[\mathrm{number\ of\ entities}\propto\mathrm{entity\ size}^{\Gamma} \tag{1}\]  
to the data. Smaller exponents of \(\Gamma\) indicate a distribution of entity sizes that decreases more drastically, thus entities with many used addresses are quite infrequent. A less negative \(\Gamma\), on the other hand, is related to a situation where a noticeable number of large entities exists. In general, the more negative \(\Gamma\) the better: more indistinguishable entities result in a larger anonymity set for the Bitcoin network. Figure 1: Number of all public keys, used public keys and entities. The three vertical gray bars indicate three important events in the history of Bitcoin: start of public trading (leftmost), a post on Slashdot (middle) and an article on Gawker (rightmost). Figure 4 depicts the fitted slope \(\Gamma\) as a function of time. For later dates, the slope saturates, indicating that the distribution of entity sizes might have become stationary. The number of active entities in Bitcoin has a large impact on the practical privacy single users can achieve. While the overall number of entities gives a rough bound on the level of \(k\)-anonymity of Bitcoin, some of the entities may be active for only a short period of time; for example, some Bitcoin users may try the new currency but then abandon its use--nevertheless, the transactions issued by these users resulted in entities visible in the block chain. A better estimate of the \(k\)-anonymity of Bitcoin at a certain point in history is this the number of economic entities that were active in a window of time around this point (assuming that all other entities are \"dormant\" and thus do not increase the level of anonymity). When looking at the distribution of the total number of entities active for a given time (depicted in Figure 5), we can see a scale-free distribution of the number of entities as a function of active days, analogous to Equation 1. We define the activity period of an entity as the difference (in days) between the first and the last transaction in the block chain that involved any of the public keys of the entity. As evident from the figure, there are many entities that are active for only one day and many single entities that are active for a very long period of time. For maximizing both the anonymity set of Bitcoin and the unlinkability of transactions, an entity that is observable by an adversary by inspecting the Bitcoin block chain should be as small as possible (best case: single address, increasing the anonymity set) and only active for a short time (best case: single transaction, limiting transaction linkability). There can be numerous reasons why this is not achievable in practice. First of all, addresses belonging to known public entities like mining pools are of course active for a very long time and it would not be of much use to obfuscate those addresses. On the other hand, a user mining on a pool with the same payout address all the time or some entity accepting donations on a single address will weaken the privacy of those entities. Even though the Satoshi Bitcoin client generates a new address for remaining change--which should strengthen privacy--as the user still  
Figure 2: Gap (difference) and ratio between known public keys and entities. See Figure 1 for the vertical bars. receives funds on the old/original address, both addresses are likely to be used as inputs in some future transaction the users makes, which then again allows a connection between the addresses to be made. Figure 3: Number of entities (\(y\)-axis) _vs._ size (\(x\)-axis). Depicted in blue are data points and in red the fit to the blue points; gray values indicate data points ignored in the fit due to small sample size.