[PAXOS+COINJOIN]Your privacy is a threat to exchange business?#deletepaxos

[fillippone]

A very interesting thread surfaced on Twitter:

Wtf?? Apparently you are not allowed to do what you want with your bitcoin once you own the keys. Fortunately that's not how Bitcoin works, but the level of chain analysis here is alarming. What is a correct response?
@MartyBent
 
@matt_odell
 
@vandrewattycpa

https://twitter.com/RonaldMcHodled/status/1222172084610027523?s=20

He later added a few detail

For the record, I'm not trying to evade anything by mixing and sending elsewhere to sell...long term cold storage only. Also nothing in their T&Cs about mixing post withdraw. Wondering if anyone else who isn't breaking any rules has received a message like this.

https://twitter.com/RonaldMcHodled/status/1222172088170975233?s=20

Apparently, the user withdrew his Bitcoins from the exchanges and, after several hops, put some of those bitcoins in his wallets (wasabi, one of the best privacy oriented wallets). The exchange then contacted him waring of imaginary Term of Service violations and threatening further actions.
The user was not intimidated and exposed this to the community.

This triggered @giacomozucco amongst the others:

If your exchange spies on you AFTER withdrawal & AGAINST its own ToS:
1) immediately take out all your remaining funds,
2) tell them to delete your account & to go back to fiat money, where they belong,
3) expose them on social media,
4) don't use anymore, ever.

https://twitter.com/giacomozucco/status/1222300652795256832?s=20

5) if you know a very friendly lawyer who will help you for a beer, have them sent a C&D letter & file report against them to any competent privacy authority (this is an optional step: using the Government to try & solve problems is almost always a waste of time & money).

https://twitter.com/giacomozucco/status/1222301584396255233?s=20

It might be considered a media stunt for the conference he is speaking at next month (www.unconfiscatable.com in Vegas, end of February), but if I know him well, he is sincerely triggered by this.

The point is: do not use services like Paxos (or Coinbase, as far as we know) who spy their users with arbitrary and sub-optimal heuristic techniques to track their coins, banning them for having used standard privacy practices to protect their own anonymity set.

Of course they are doing this tracking effort for a very valid reason: doing chain analysis, using very weak heuristic logic driven analysis, by the way, something would never hold in a trial, their aim is to trade their ability to do business wit the privacy of their own users, selling those data to government agencies, who are by definition very much interested in those kind of data.

Coinjoin is a Bitcoin best practice. Modern wallets allow users not only to create transactions with many outputs sent to many different users (something usually referred to as batching, think of a transaction exiting from an exchange sending coins to many users) but also creating transactions with many inputs from many users (a technique called Coinjoin)  This is one of the most secure and efficient use to use Bitcoin, further weakening the link between inputs and outputs.
Users should do Coinjoin in every transaction to maximise the fungibility of their UTXO (of their "Bitcoins").

[Dabs]

Reply:

I deny that the funds have been sent to any mixing service. The funds have been sent to my own wallet.

[fillippone]

Reply:

I deny that the funds have been sent to any mixing service. The funds have been sent to my own wallet.

The point is they shouldn't follow your fund after such funds leave their wallets. This is totally out of their scope.
The user said he sent some of his Bitcoins to a Wasabi wallet after a few steps.
Anyway, just stop using such services (and let them die)  is the correct answer.

[Dabs]

I'm not sure of the exact details, but following a few hops AFTER withdrawing the coins is sketchy. What I would try, as an experiment, is to send it to a new address 3 times, spaced a few days apart. Maybe split the coins into more addresses after every other hop. Then, and only then, do I send to to Wasabi or other Coin Join wallet.

One thing we know for sure, they don't like Coin Join. Would they care if you sent it to a centralized mixer service... then from there you use Coin Join ... they would never see the connection, especially not after a week since the withdrawal.

[fillippone]

I'm not sure of the exact details, but following a few hops AFTER withdrawing the coins is sketchy. What I would try, as an experiment, is to send it to a new address 3 times, spaced a few days apart. Maybe split the coins into more addresses after every other hop. Then, and only then, do I send to to Wasabi or other Coin Join wallet.

One thing we know for sure, they don't like Coin Join. Would they care if you sent it to a centralized mixer service... then from there you use Coin Join ... they would never see the connection, especially not after a week since the withdrawal.

I don't like them not liking best practice in bitcoin transactions.
So I don't use them.
No regrrets in doing them.
Advising other peoplle to follow the same reasoning.
Spreading the knwoledge.

[Dabs]

Exchanges might want to know where your coins came from BEFORE they get it, but you can always mask that a bit too. Them trying to find out where it went AFTER a withdrawal should be none of their business, and in fact, they should welcome it so they can claim it's not their fault, that's how the blockchain works.

They'll stop doing this when Coin Join is made much easier and more than enough transactions do it. I don't know how much "more than enough" is, but I'd say a sizable percentage would be maybe 10% of the daily transaction volume would be big enough.

IF, a hardware wallet provider includes it (even if its optional) as something a user can do, then ... might be something huh... Imagine if all trezors and all ledgers do Coin Joins, even a third of the time ... ...

So Wasabi is one that does it on purpose, imagine if it's something the Core wallet (or Electrum) can do as well.

[hatshepsut93]

This is worrying, because if it will become a major trend among the exchanges, it would be quite hard to deal with. DEXs are not ready to handle all the users, as they are still in development, and liquidity would greatly suffer, because bank transactions have high fees, especially if they are international, and also have all this AML stuff when amounts are large enough.

I think a lot of Bitcoin's success can be attributed to the fact that it can easily be swapped for fiat money, now imagine Bitcoin economy nearly fully isolated from fiat - that would be seriously bad.

[stomachgrowls]

Exchanges might want to know where your coins came from BEFORE they get it, but you can always mask that a bit too. Them trying to find out where it went AFTER a withdrawal should be none of their business, and in fact, they should welcome it so they can claim it's not their fault, that's how the blockchain works.

Thats how it should be where they should focus nor being concern on where those coins came from before being deposited to the platform

and as part of their ToS then its quite understandable but for withdrawal or to know on where those coins are sent from? then thats an another story.

By using up platforms then its not that really surprising when it comes on being tracked but this one goes overboard.

[2double0]

That same kind of thing happened with users who used Wasabi Bitcoin wallet when Binance denied the withdrawals to mixing services. Full story -  https://www.cryptopolitan.com/binance-blocked-wasabi-withdrawals/

How can an exchange have the power to do that? It is our money and we have the right to withdraw it through any means we can, who is Binance or any other exchange to stop us from using a mixer? Doesn't complying with rules get you on your knees when trying to do something that is not illegal 'if the actual purpose is not illegal and you have already completed your KYC there'.

[gentlemand]

How can an exchange have the power to do that? It is our money and we have the right to withdraw it through any means we can, who is Binance or any other exchange to stop us from using a mixer? Doesn't complying with rules get you on your knees when trying to do something that is not illegal 'if the actual purpose is not illegal and you have already completed your KYC there'.

In that case it was down to the rules imposed on Binance by Singapore.

I reckon this is going to become one of THE major issues in the near future. If exchanges continue down this road then it's going to end in gridlock. If Bitcoin gets improved on chain privacy then most people will naturally want to use it. If LNs take off then that's another layer of mystery.

Also I can't be bothered to figure out how Wasabi works but it's clearly totally identifiable to all which doesn't help either.

[2double0]

How can an exchange have the power to do that? It is our money and we have the right to withdraw it through any means we can, who is Binance or any other exchange to stop us from using a mixer? Doesn't complying with rules get you on your knees when trying to do something that is not illegal 'if the actual purpose is not illegal and you have already completed your KYC there'.

In that case it was down to the rules imposed on Binance by Singapore.

So, those rules are limited to Singapore users of Binance and those who live outside Singapore can still withdraw BTC from Binance on mixing websites if that specific country they belong to, has not imposed any such AML rules?

If Bitcoin gets improved on chain privacy then most people will naturally want to use it. If LNs take off then that's another layer of mystery.

On chain privacy? I guess how BTC would have been if the Blockchain had come mixed up already like in XMR? Can't our developers do anything or fork BTC to a new privacy based chain and let the users decide which one or both to be used? And about LN, I am not a fanatic nor do I know a lot about it so cannot comment on how it maintains privacy.

[gentlemand]

So, those rules are limited to Singapore users of Binance and those who live outside Singapore can still withdraw BTC from Binance on mixing websites if that specific country they belong to, has not imposed any such AML rules?

Dunno.

This is what a Binance person said in an emailed statement about it - “Binance SG operates under the requirements as set forth by MAS and our MAS regulated partner, Xfers. Hence there are AML CFT controls set in place for the Binance SG and the user triggered one of its risk control mechanisms,”

https://www.coindesk.com/binance-blockade-of-wasabi-wallet-could-point-to-a-crypto-crack-up

Going on that it's anyone on Binance SG. I don't know if that only serves Singapore residents.

[Dabs]

Well, how does Binance block a withdrawal without knowing where it will go to first? If you withdraw to your own wallet (and not yet Wasabi), then it gets a confirmation, then you spend that to Wasabi (or any other mixer for that matter), no one can roll back the chain after that point.

Perhaps they can block future withdrawals, which is what I think happened when they suspended the user's Binance account temporarily. Notice it was restored as soon as news got out when the user tweeted about it. Exchanges want to be complaint to regulations, but at the same time they don't want the negative publicity that such actions bring on them.

There is no way to prove that any one or two addresses belong to the same user after it has been sent from an exchange.

Also, I think not too many people use Wasabi for very small value mixing, so in the future, perhaps users can do a couple of spend transactions first that look normal and split the coins that were withdrawn, and then after a day or two, is when they forward those all to Wasabi / Coin Join / Join Market / Shuffle / Huff / Fog / Chips / whatever.

I'm also speculating that exchanges don't look at the trail after a certain number of hops or a certain amount of time has passed. So if you're really out to put your coins that you withdrew into cold storage, a few days shouldn't be too difficult to move your coins around before mixing them.

Imagine this:

Binance withdraw to address A.
Coins stay in address A for a day.
Spend coins from address A to address B, half goes to C. Or change.
Coins stay in address B and C for a couple of days.
Spend coins from address B and C, send them to address D, E, F, G in separate transactions.
Coins stay in those addresses and do not move for 2 or 3 days.
A week passes ... then you send from each of those addresses to Wasabi one at a time, maybe one day at a time or maybe even a few hours apart.

Is the exchange going to do something to your account when it realizes all the coins a week or two weeks later get Coin Joined with hundreds of others? They probably don't want it happening within 5 minutes of the withdrawal (or probably within the same day.) But 3 or 4 hops and a few days later?

Understandably, it can still be all automated and flagged.

[fillippone]

@Giacomozucco wrote a very good essay on why you shouldn't use this kind of exchange who try to steal your privacy.

This is a very long and informative read about your Privacy.
Definetly worth a read:


A Treatise On Bitcoin And Privacy Part 1: A Match Made In The Whitepaper

How one’s focus can shift in just two weeks! While today everybody in the Bitcoin space seems more concerned with price fluctuations in response to the global financial panic (understandably so), it’s important to remember perennial issues that never go away, like the importance of maintaining your privacy when you transact in bitcoin. Throughout this month especially, we’ve been hearing reports of KYC/AML-compliant exchanges freezing user accounts due to suspected use of CoinJoin software (more on that later), followed by yet another case of a famous and respected early Bitcoin proponent promoting his new illiquid altcoin as something that “will replace Bitcoin, which isn’t private enough!”

If you want to take a short break from global pandemics, financial meltdowns and price volatility, here’s an attempt at analyzing claims, facts and context of this latest “Bitcoin drama.” To begin with, in Part 1 of this two-part series, we’ll start by looking at the fundamental relationship between Bitcoin and privacy by going back to the beginning with the whitepaper. Then, in Part 2, we’ll focus on some the ways that Bitcoin privacy is being maintained and improved upon — and strike down a few “red herrings.”

A Treatise On Bitcoin And Privacy Part 2: Don’t Be Misled By Red Herrings

In Part One of this treatise, we examined the fundamental relationship between Bitcoin and privacy by going back to the beginning with the whitepaper. In spite of some excellent privacy preserving options  that have been available to users since those early days, we seem to have taken a few wrong turns. But to fix it, in order to make Bitcoin’s privacy “great again,” we must be able to distinguish between real privacy and red herrings that can only lead us further off the path.

[Lucius]

I think we all know why crypto exchanges behave that way, and it's not because they want it (it's just an extra expense), but because they've been given such guidance or are aware that one day it will become a business requirement. I have never misled myself that Bitcoin can be anonymous, and on the other hand accepted by governments and their real masters (banks), and that they will try in every possible way to introduce as much transparency as possible.

I admit that it is quite worrying that they are already doing this today, and that in the future any transaction is very likely to be analyzed in such a way that any trace of a possible mixing or any other illegal action by them will mean that you will not be able to trade or spend such coins.

If that's what Paxos, Coinbase and Binance do today, is this an indicator of the direction the entire exchange industry is heading?

[fillippone]

I think we all know why crypto exchanges behave that way, and it's not because they want it (it's just an extra expense), but because they've been given such guidance or are aware that one day it will become a business requirement. I have never misled myself that Bitcoin can be anonymous, and on the other hand accepted by governments and their real masters (banks), and that they will try in every possible way to introduce as much transparency as possible.

I admit that it is quite worrying that they are already doing this today, and that in the future any transaction is very likely to be analyzed in such a way that any trace of a possible mixing or any other illegal action by them will mean that you will not be able to trade or spend such coins.

If that's what Paxos, Coinbase and Binance do today, is this an indicator of the direction the entire exchange industry is heading?

What can we do about it?
For sure select the exchanges that don't track you before and after the exchange transaction.
This is not a requirement for the moment (for the future, nobody knows), so Paxos is just taking an extra precaution and spending money without any legal requirement to do so.
Second, we can use tools to protect our privacy.
Like mixing, coinjoins and whirlpools.
These are not illegal practices, but state of the art practises that are now being embedded in more and more wallets, and available to more and more users, while they should have been used since the beginning.

In addition to that, bitcoiners used the "all is public, all is tracked" story at the beginning, when they were trying to pass bitcoin as nothing illegalto the regulators.
Now this rhetoric is backfiring. This is bases on some kind of heuristics that were acceptable in the beginning, where the main objective was to have the bitcoin ecosystem tolerated by regulators.
But now these are not satisfactory anymore and we all should use state of the art techniques who can mitigate those heuristics used by chain-analysis firms.

Hope you read the attached treatise, as many of those points are well explained and analysed.


EDIT:
Luckily, more and more people are getting aware of the situation:



Source: Samourai : Whirlpool CoinJoin Stats - WhirlpoolStats.com


PS. Sorry out of merits.


 

[Del137]

Centralized companies always will be against privacy and this is a good example of it

[TheGreatPython]

Well, we all love bitcoin and how privacy oriented it is and how it is decentralized and not really anyone's business but the owner to do whatever they want with the bitcoins they own. However you are forgetting that these companies are a business and these business' all have legal things they have to follow.

Now if they are doing this for their own reasons that means they are quite wrong and shouldn't do it, however if they are asked by the authorities to put certain wallets at a "no no list" so that nobody withdraws there, it actually makes sense. Think about it, normally you would be against KYC very much as well if it was the exchanges who wanted it personally and not the governments, but governments force exchanges for KYC so we kinda accept it and move on, same could apply here as well, we don't know.

[fillippone]

Well, we all love bitcoin and how privacy oriented it is and how it is decentralized and not really anyone's business but the owner to do whatever they want with the bitcoins they own. However you are forgetting that these companies are a business and these business' all have legal things they have to follow.

Now if they are doing this for their own reasons that means they are quite wrong and shouldn't do it, however if they are asked by the authorities to put certain wallets at a "no no list" so that nobody withdraws there, it actually makes sense. Think about it, normally you would be against KYC very much as well if it was the exchanges who wanted it personally and not the governments, but governments force exchanges for KYC so we kinda accept it and move on, same could apply here as well, we don't know.

No government is forcing exchanges to trace you before and after your transaction with them.
Did you take your time to read the linked treatise?
There is nothing wrong about doing a conjoin.

[fillippone]

Paxos hitting the news again.
One of the worst exchange partnering with another bad actor, Revolut, who tried to smuggle a shitty CFD on Bitcoin as Bitcoin.

Here is the news:
Revolut partners with Paxos to bring cryptocurrency trading to the US

Users in the U.S. can now buy, hold and sell Bitcoin and Ethereum from the Revolut  app. The feature is going to be available in 49 states as there are some regulatory issues in Tennessee. If you have USD or other currencies in your Revolut account, you can exchange manually whenever you want.

These are actually CFD:

Revolut made some changes to its cryptocurrency feature recently. While you now technically own your cryptocurrencies, you can’t send and receive cryptocurrencies from third-party wallets. The feature is all about trading — buying, holding and selling.

EDIT:
Jameson Lopp adding his tough on the Revolut “BTC”:

If you can't withdraw, you can't HODL. https://twitter.com/CoinDesk/status/1283340694468333569?s=19

https://twitter.com/lopp/status/1283348325715107841?s=21

In addition to that, I opened a thread to give more visibility to Zucco’s Treatise on Privacy: it’s clearly explained why actors as Coinbase and Paxos are bad for bitcoin, their clients and even those interacting with those subjects.