Blockstack PBC announced on Jan. 29 the completion of its "Milestone II" that unlocked $half dozen.8 million from its 2022 initial coin offering. The project claims to have on-boarded ane million verified users, an achievement that some in the community did not believe. Cointelegraph conducted an analysis of blockchain data to see if this claim could be confirmed.

The importance of the milestone

The Blockstack initial coin offer (ICO) was conducted in November 2022 through the CoinList platform. It was notable for being "SEC-qualified," meaning that it had stronger reporting obligations to the regulators and implied that it was not at chance from getting prosecuted by the Securities and Exchange Committee. Information technology was offered to both accredited and retail investors.

The offer was likewise structured in issue-based milestones that would unlock portions of the nerveless funds. In that location were ii of these milestones, with the showtime ane requiring the successful launch of the network's mainnet by January 2022. To unlock the second milestone, the projection had to reach ane 1000000 verified users, a result that would exist checked by an ostensibly independent informational board.

Notably, Blockstack pledged to render to the investors 80% of the funds locked by each milestone if it failed to evangelize.

Blockstack's core value proposition is to provide a verifiable identity secured by blockchain, which tin can exist utilized past approved entities. This is existence used to create an ecosystem of apps that are authenticated with Blockstack ID.

Information technology stands to reason that given this system, the presence of one million verified users could be feasibly verified by analyzing Blockstack'southward blockchain information. The definition used by the advisory lath includes all possible manners of verification, including via social media accounts or government-issued ID. These should be visible on the platform's API.

How a verified account looks on the platform — note the Twitter icon. Source: Blockstack Explorer

Methodology used

While Blockstack uses Bitcoin's OP_RETURN functioning to store data on the blockchain, it is non immediately readable. Blockstack provides its own Bitcoin explorer that includes detailed information on all the usernames saved on the blockchain.

We used penetration testing tools to crawl through the entire history of Bitcoin blocks until May 25, 2022 — the appointment of the start operation recorded on Blockstack'southward wallet used for assigning names. We filtered through only the blocks that the API reported equally having "name operations," which netted a listing of 17,000 blocks.

This list was fed into another crawler that extracted 1.5 Gigabytes worth of block information, which crucially included details on all name operations.

We filtered this list to just include usernames, without any boosted information such as fourth dimension of creation.

The blockchain recorded a total of i,997,949 names, though this figure also includes duplicates from top level domains (about xv,000).

Seeking to fully confirm whether the users are verified, we set out to result API requests for each user found through this method. Nevertheless, the sheer time required to brand 1.9 1000000 requests, in add-on to eventual server restrictions, meant that we had to limit ourselves to a sample of merely 50,000 users.

Curious findings

While the research appears to at least confirm the user count reported on Blockstack's explorer homepage, a deeper await shows some peculiar characteristics to the usernames.

Specifically, many usernames have either an "fc-" or "bc-" prefix on them.

A peek into some of the usernames on Blockstack. The list is ordered chronologically, not alphabetically.

In fact, there are 1,316,894 "fc-" names and 325,356 names with "bc-" in them. Searching for these names in the block explorer yields a "no results" folio — which is distinctly different than querying for a user that really does non exist.

Given these findings, it appears that only about 400,000 of Blockstack users are really verifiable in some style through the platform. The API does return valid data for both "fc-" and "bc-" names, but subsequently more 2,000 probe requests the software did not provide verification details for a single one of these users — which led u.s. to interrupt the search.

Out of the fifty,885 users nosotros sampled from the remaining 400,000, only 1,565 had whatever mention of a verification. This is a charge per unit of approximately 3% verified users.

In a July 2022 filing with the SEC, Blockstack revealed its own figures:

"Of those 115,780 accounts, approximately 16,100 accounts had provided a "social proof" as evidence of having a man user, such as a GitHub link or Twitter message link."

The figure of verified accounts amounts to 14% of Blockstack users. This would still be well short of the necessary 50% dictated by its total user count.

Are the weird names the answer?

Blockstack used several initiatives to onboard users toward the stop of 2022. One of these is the Blockchain.com airdrop, enacted in Oct 2022. The company reported to take distributed Stacks tokens to over 300,000 users — which corresponds to the corporeality of "bc-" users. Each of those people was supposed to exist verified past Blockchain, Inc. through a full know your client (KYC) procedure.

In a phone call with Cointelegraph, Blockstack PBC CEO Muneeb Ali explained that the blockchain does non contain any verification data that would expose private user information, such equally telephone numbers or government IDs.

He confirmed that the "bc-" names are indeed resulting from the Blockchain, Inc. airdrop. Every bit for "fc-" names, Ali did not wish to disclose their origin, only he mentioned that they are function of a user acquisition strategy that "the company will announce in the coming weeks," while emphasizing that all of them are verified.

Is Blockstack guilty of wrongdoing?

Commenting on the debacle, Ali believed it was a misunderstanding, proverb that "people are under the impression we claimed to have one million active users."

He explained that the milestone was defined in 2022 according to a very specific legal definition, which required users to be registered on the blockchain. All the same, information technology did not specify how they were supposed to be verified — this was at the discretion of the company.

An SEC filing reveals that Blockstack paid Blockchain, Inc. upwards to $iii.85 million for the airdrop. Fifty-fifty though they were paid for, the KYC requirement ensures that all of the airdrop participants are real people — something that the social verification organization does not guarantee.

Ali noted that the company largely moved away from social verification, precisely because information technology could exist easily falsified. He also revealed that the team is working on creating blockchain signature records for other types of verification.

Ali emphasized that the milestone was a self-imposed requirement, which he described as a testament to Blockstack'south transparency.

While at that place is some ongoing uncertainty over the origin of the "fc-" names — which will hopefully exist cleared soon — Blockstack could have easily created an army of false social media accounts that would have passed a superficial blockchain test.

It likewise probably would have been cheaper than paying Blockchain, Inc. for an airdrop that only took it i third of the way.