The documents reveal that although the NSA was interested in other top cryptocurrencies, their main objective was to locate Bitcoin users, even stating that “Bitcoin is [the] #1 priority.”
According to The Intercept, a secret internet surveillance program called “OAKSTAR” was used to do the tracking.
OAKSTAR represents multiple corporate partners that allowed the NSA to spy on conversations and intercept data directly from the fiber optic internet connections.
MONKEYROCKET, a subdivision of OAKSTAR, was necessary to identify Bitcoin users. It is a VPN-like service that tapped into network equipment in order to intercept data from Asia, South America, the Middle East and Europe.
In the report, the NSA describes MONKEYROCKET, which was launched in 2012, as a “non-Western internet anonymization service in support of counter-terrorism.”
According to the document, “Currently there are approximately 16,000 registered users, and the site is generating about 2,000 events per day […] Iran and China are two of the countries with a significant user base.”
“[The} long term strategy [was] to attract targets engaged in terrorism, to include Al Qaida COMSEC security that the NSA can then exploit,” the NSA states.
This allowed the NSA to obtain Bitcoin user data, including passwords, browser history, and even MAC address of their devices. This information enabled them to identify the owners of Bitcoin addresses.