ㅤ

[n0nce]

As soon as an entity (Wasabi) has the ability to pick and choose who is and is not allowed to spend their money in certain ways, then your system is centralized, is not private, is not censorship resistant, and is not free. This is what Wasabi have created here.

The list of things they have admitted they will censor for is bad enough. It won't be long before that list grows, and there will definitely be other things not on that last that they will censor for and just not tell anyone about.

To their credit; I wouldn't say 'Wasabi created this'. Censoring and blacklisting, as well as Chainalysis existed before and was applied mostly on centralized exchanges. But the fact that now a presumably privacy-friendly wallet that even claims to improve your privacy, implements censorship and blacklists, apparently came like a bit of a 'wake up call' for a lot of people. Which I think is great! This very important topic (as a whole - not only related to Wasabi) was mostly ignored as far as I can tell and it's great that people's eyes are now progressively opened.

I hope we can raise more awareness and maybe cause an effect (or support / use / build / improve actual privacy-improving projects and technologies) due to this whole story!

If someone (o_e_l_e_o or someone else) comes forward with a Wasabi fork that completely removes the coordinators and employs a network similar to Bisq, then I'm all for it! I'd love to see more competition / innovation / options to choose from in this space!

It's possible, but not so easy to create in reality.
Bad comments and criticism about new 2.0 wasabi I saw was ere coming from ex wasabi developer @nothingmuch so I was talking about him, and I am sure there are more like him.
Let's see how everything will work now, maybe we can use wasabi in some cases and test if it's working with coins coming from mixers and gambling, or it will be rejected.

I'd love to see some experiments about this. Even though they'll only give a snapshot in time (i.e. they could allow gambling at the time of your experiment and ban it the day after).

I'm also interested in the scenario (which will definitely happen sooner or later) where someone is allowed to mix their coins and then afterwards Wasabi decide that their inputs were tainted and they shouldn't have been allowed to mix them at all, since the document linked to above also invites you to inform them of any illegal transactions and states that they will fully cooperate with any investigations.

Question is will other centralized exchanges now accept coins coming from Wasabi wallet, or they will add second layer of censorship on top of Wasabi 

I believe the idea is that if you use Wasabi, and they have the same 'source for taint definitions' as the centralized exchanges; then whatever was accepted by zkSnacks, will also be accepted by the exchange. Therefore it should (if this Chainalysis cooperation actually works) guarantee deposits on exchanges. This is the only 'upside' (if you can call it that) of this update.

Just to make sure: compared to exchanges, which may freeze 'tainted' coins (after you sent them), does Wasabi CoinJoin also freeze blacklisted UTXOs or does it 'just not accept them into a CoinJoin' (so you still have the option to move them to Bisq or wherever)?

would you recommend wasabi to someone who are not really up to censor anyone or someone who wil eventually want to send his coin to an exchange?

it does really have a good feature for privacy, this is useful but could also backfire when youre about to sell for profit because the exchanges may potentially freeze your coin.

I don't think you understood what's going on here. Wasabi can censor you. It's not about you wanting (or not wanting) to censor someone.

If you're worried (which is reasonable) about an exchange freezing your funds, mixing of any type won't help you; sell those funds in a P2P way, either via forum (escrow), in person or through https://bisq.network/.

[1713503115]

1713503115

[1713503115]

1713503115

[1713503115]

1713503115

[1713503115]

1713503115

[Pmalek]

Just to make sure: compared to exchanges, which may freeze 'tainted' coins (after you sent them), does Wasabi CoinJoin also freeze blacklisted UTXOs or does it 'just not accept them into a CoinJoin' (so you still have the option to move them to Bisq or wherever)?

I don't think they will freeze the coins in the sense that they will take them from you. They will just restrict you from taking part in the coinjoins with that set of tainted UTXOs. That's how I understand the below explanation they made:

zkSNACKs Ltd. may execute illicit activity checking and control via a contracted third party solely in its coinjoin coordination services. zkSNACKs Ltd. may suspend your UTXOs’ access to the coinjoin services, with immediate effect for any reason - including but not limited to illicit or prohibited activities, applicable sanctions programs, or any crime or money-laundering activity - at its sole discretion and is under no obligation to disclose the details of its decision to take such action with you. In this case you are not permitted to use the relevant/high-risk bitcoin UTXO to reach the coinjoin services.

You acknowledge that zkSNACKs Ltd.'s decision to take certain actions, including suspending for any reason at our sole discretion, may be based on confidential criteria that are essential to zkSNACKs Ltd.'s risk management and security protocols. You agree that zkSNACKs Ltd. is under no obligation to disclose the details of its risk management and security procedures to you.

Your access with the relevant bitcoin UTXOs to the coinjoin services will be permanently suspended.

https://github.com/zkSNACKs/WalletWasabi/blob/master/WalletWasabi/Legal/Assets/LegalDocumentsWw2.txt

I guess that still doesn't mean that those UTXOs would also be blacklisted on centralized exchanges, but the chances of that happening are surely greater. Each CEX can have their own algorithms and methods to determine what is taint to them. That's why all this nonsense is so dangerous. Depositing to one CEX might get your coins and account frozen, but doing the same on a different CEX might work without any problems. The simplest solution, don't use any of them.

[pooya87]

The simplest solution, don't use any of them.

The best solution is to create better and decentralized solutions so that people start abandoning the centralized anti-privacy solutions such as Wasabi and make them go bankrupt and die on their own. Otherwise as long as there isn't any alternative we keep seeing the same nonsense continue with anti-privacy companies growing richer and more powerful.

[dkbit98]

Just to make sure: compared to exchanges, which may freeze 'tainted' coins (after you sent them), does Wasabi CoinJoin also freeze blacklisted UTXOs or does it 'just not accept them into a CoinJoin' (so you still have the option to move them to Bisq or wherever)?

I don't think they can freeze coins even if they want to do it, but it's possible they will report transaction was attempted and some fees will probably be charged.
However, this is just my speculation so I would like to hear from Wasabi developers or maybe icopress can ask them about this.
We can collect a bunch of question related with this and he can forward them directly to wasabi team.

[ABCbits]

Bitcoin Magazine's Shawn Amick writes up some comments on Wasabi's Wallet 2.0:

https://bitcoinmagazine.com/business/wasabi-wallet-2-contains-new-features-for-optimizing-bitcoin-coinjoins

Besides privacy problem which already discussed, there's also concern about "auto-coinjoin" feature. I expect few user wont even realize their coin is mixed and blocked when they deposit it on CEX. It's also weird user no longer can choose UTXO for coinjoin process.

Let's see how everything will work now, maybe we can use wasabi in some cases and test if it's working with coins coming from mixers and gambling, or it will be rejected.
It's something like litmus paper test for coins

Great idea! I'll probably build a review campaign based on this idea.

It'd be interesting how reviewer react about "auto-coinjoin" feature.

[DireWolfM14]

Just to make sure: compared to exchanges, which may freeze 'tainted' coins (after you sent them), does Wasabi CoinJoin also freeze blacklisted UTXOs or does it 'just not accept them into a CoinJoin' (so you still have the option to move them to Bisq or wherever)?

I don't think they can freeze coins even if they want to do it, but it's possible they will report transaction was attempted and some fees will probably be charged.
However, this is just my speculation so I would like to hear from Wasabi developers or maybe icopress can ask them about this.
We can collect a bunch of question related with this and he can forward them directly to wasabi team.

This would make sense if we're talking about a non-custodial wallet like Bisq, which uses multi-sig to "escrow" fund for trades.  Any UTXOs that aren't locked up in a multi-sig transaction are completely under the  user's control.  How does CoinJoin (or JoinMarket, for that matter,) differ?  Isn't Wasabi supposed to be a completely non-custodial wallet?  In technical terms how is the wallet able to prevent someone from sending tainted funds to the join pool?  Does the pool just send those funds back to the address from whence it came?

[BlackHatCoiner]

This would make sense if we're talking about a non-custodial wallet like Bisq, which uses multi-sig to "escrow" fund for trades.

Note that Bisq doesn't have this model anymore, which was a 2-of-3 multi-sig, in which the arbitrator held the third key, because this gave way too much power to the third party. The arbitrator could pretend to be a simple user and steal the funds without question.

Instead, since v1.2.0, it uses 2-of-2 multi-sig, wherein if the trader and the maker don't find consensus, and neither does the mediator help, the money are sent to the arbitrator after a specific period, which is the worst case scenario.

Isn't Wasabi supposed to be a completely non-custodial wallet?

It is completely non-custodial wallet, in the sense that you have access to the private keys and that it's open-source.

In technical terms how is the wallet able to prevent someone from sending tainted funds to the join pool?

The wallet doesn't prevent anything; it's the coordinator server that does.

Does the pool just send those funds back to the address from whence it came?

The coordinator probably just refuses to include you to the CoinJoin.

[PrivacyG]

The coordinator probably just refuses to include you to the CoinJoin.

There is no other way around for them, is there?  I was thinking, is it possible for them to somehow accept UTXO's for Coin Joins and then freeze them until your victim client provides further information?  I suppose there is no way unless Wasabi becomes a custodial wallet and starts requiring accounts?

This is scary.  In my mind, the more this topic is discussed over here, the more the idea of new surveillance supporting Wasabi starts getting contoured as a honeypot and the more it distances itself from the idea of being a 'private' wallet.

-
Regards,
PrivacyG

[BlackHatCoiner]

There is no other way around for them, is there?

Well... Assuming the Wasabi Wallet continues having a github repository, where the source code is there to check, compile and run yourself, no.

I was thinking, is it possible for them to somehow accept UTXO's for Coin Joins and then freeze them until your victim client provides further information?

No, because there's no information transferred other than your inputs.

I suppose there is no way unless Wasabi becomes a custodial wallet and starts requiring accounts?

Although, it's already pointless to use Wasabi, "upgrading" it to a custodial service would make it further pointless. I don't hold my breath.

This is scary.

Integrity is, admissibly, important for everything in life. In this case, for the development of a project.

[DireWolfM14]

Isn't Wasabi supposed to be a completely non-custodial wallet?

It is completely non-custodial wallet, in the sense that you have access to the private keys and that it's open-source.

That's what I thought.  IIRC, it is a bip39 compatible HD wallet, correct?

Does the pool just send those funds back to the address from whence it came?

The coordinator probably just refuses to include you to the CoinJoin.

This is what I don't get, and I apologize for my ignorance.  I should download the new version and play around with it so I can become more familiar with the way it works.  Don't you have to send a transaction to the Join Coordinator server, and if so and it's rejected, what happens to that transaction?

[BlackHatCoiner]

That's what I thought.  IIRC, it is a bip39 compatible HD wallet, correct?

Yes.

Don't you have to send a transaction to the Join Coordinator server, and if so and it's rejected, what happens to that transaction?

When you coinjoin, the server you use, which works as a portal for those who want to mix, requires you to send it your UTXOs, that will be used as inputs for the coinjoin transaction. So, it's down to the server. If the server doesn't agree to pass your UTXOs, you won't participate in the coinjoin. You don't sign nor broadcast any transaction until you get the "OK" from the server.

[witcher_sense]

The first Wasabi 2.0 CoinJoin transaction: https://blockchair.com/bitcoin/transaction/d31c2b4d71eb143b23bb87919dda7fdfecee337ffa1468d1c431ece37698f918

[n0nce]

Does the pool just send those funds back to the address from whence it came?

The coordinator probably just refuses to include you to the CoinJoin.

This is what I don't get, and I apologize for my ignorance.  I should download the new version and play around with it so I can become more familiar with the way it works.  Don't you have to send a transaction to the Join Coordinator server, and if so and it's rejected, what happens to that transaction?

I'm pretty sure when you 'send your UTXOs' you don't actually 'send' them in the sense that you create and sign a transaction (unlike when depositing into an exchange). You send the identifiers of those UTXOs; then the coordinator sends them to Chainalysis, waits for their answer, then it tells the client whether they're good or bad. If they're good, you can sign the transaction. Something like that.
I haven't tried it, nor checked the code, but I'll investigate on this later.

The first Wasabi 2.0 CoinJoin transaction: https://blockchair.com/bitcoin/transaction/d31c2b4d71eb143b23bb87919dda7fdfecee337ffa1468d1c431ece37698f918

How do we know it's Wasabi 2.0 CoinJoin? Did they announce it?

Edit: It was announced on Twitter.

Behold the first Wasabi Wallet 2.0 coinjoin #Bitcoin
https://blockstream.info/tx/d31c2b4d71eb143b23bb87919dda7fdfecee337ffa1468d1c431ece37698f918

There is a single comment.

Thanks, but no thanks.

This is what Wasabi wants people to believe..

it does [coin control] automatically to max out best privacy, if u give people control, they will most likely fuck it up
(Im not on the team btw, I just watched their vids)

I just jumped through this recent live chat they had going on and found this nugget for you guys:

So i think that you should have confidence in wasabi wallet in the same way that you have confidence in Bitcoin Core.

Wooow that's some next-level shit right there! They want us to trust a centralized coordinator that openly and voluntarily works with Chainalysis, just as much as we trust the most secure, open and decentralized project in the world?

Another one:

Um so you know for for the most part i think the average person who's using the product especially if you're not in a situation where you're your life depends on it and there's a large government organization that's well funded that's looking to to find you and hunt you down if you're not in that extreme situation then wasabi provides an incredible amount of privacy

This is not how privacy works.. 'Yeah it's incredibly good... as long as you're not in an extreme situation'. This man cannot be serious! ^{[but he is]}

Shortly after he says 'Maybe there's a little more privacy in LN'. Even myself, a big LN proponent, would rate Lightning's privacy lower than the one of a good mixer! So he's right now saying their privacy is worse than just using Lightning? Then why not just use Lightning?! It's really easy to set up and use, you know. Throw all that coordinator and complex codebase out the window; if you can just install Core Lightning and achieve better privacy than Wasabi, at lower cost and faster transaction speed...
This was a pretty embarassing few statements from a Wasabi developer, wow. Not a bad look, if you ask me.


I'm already way too deep in this Twitter rabbit hole, so I'll stop now. But a very last one:

Wanna become part of the first ever Wasabi 2.0 main net CoinJoin?

There’s no UTXO filtering, the minimum amount to join is 0.00005 BTC, small amounts don’t pay a coordination fee.

Imagine 'there is no UTXO filtering' is used like some sort of 'goodie' or 'specialty' *just today!*-type deal.. Of a privacy wallet. Sir, I can send any UTXO to anyone, on any day of the week (not just when Wasabi is holding a 'special event'), by just using a different wallet. You're living in a different universe.

[DireWolfM14]

~

~

Thank you both for your answers, that clarifies things.  

There is a single comment.

Thanks, but no thanks.

Lol, and what's up with that tweet?  What are they celebrating exactly, their dwindling download rates?  You're not going "to the moon" like that.  Four hours since the announcement of their first transaction, and the retweets and likes aren't mooning either.

[n0nce]

Lol, and what's up with that tweet?  What are they celebrating exactly, their dwindling download rates?  You're not going "to the moon" like that.  Four hours since the announcement of their first transaction, and the retweets and likes aren't mooning either.

I don't know; but I know that at roughly 1:57:00, a guy jumped in and asked very specific, technical questions. He seems like a proponent of Monero and he managed to make the Wasabi guys pretty uncomfortable.. It was fun listening to such a group call where someone chimes in, challenging the founders' statements and swiftly replies 'no, that was wrong!' when they explain something incorrectly; I really enjoyed listening to the discussion. Much better than other such calls where there's nothing but self-praise and advertising.

[witcher_sense]

It's also weird user no longer can choose UTXO for coinjoin process.

The automatic CoinJoin feature is a privacy problem by itself because it enables chain surveillance firms to analyze in batches all the UTXOs-candidates for a CoinJoin transaction. Once you sent coins to your Wasabi wallet and enabled this function, you basically agreed that all information about your transactions would be shared with third parties. If it were possible to choose UTXOs manually, as in the case of the old version of Wasabi Wallet, a chain surveillance firm would have to do blockchain analysis each time a new CoinJoin round starts, which is very inconvenient and time-consuming. With automatic CoinJoins, however, all UTXOs are being "filtered" in advance.

nopara73 prove me wrong.

[o_e_l_e_o]

Leo is pointing out obvious issues (like everyone else here) and I don't even know if he's a developer.

Damn it Jim! I'm a doctor, not a developer!

would you recommend wasabi to someone who are not really up to censor anyone or someone who wil eventually want to send his coin to an exchange?

I wouldn't recommend Wasabi to anyone. There is no good reason to use it.

I believe the idea is that if you use Wasabi, and they have the same 'source for taint definitions' as the centralized exchanges; then whatever was accepted by zkSnacks, will also be accepted by the exchange.

Maybe. Maybe not. Some exchanges accept gambled coins, some don't. Some exchanges accept mixed coins, some don't. Some exchanges accept coinjoined coins, some don't. It's a complete toss of the coin. Using Wasabi first does not guarantee your coins will be accept by any given centralized exchange by any means.

Wooow that's some next-level shit right there! They want us to trust a centralized coordinator that openly and voluntarily works with Chainalysis, just as much as we trust the most secure, open and decentralized project in the world?

As we discussed previously in regards to the single candle picture, all of Wasabi's core team seem to have delusions of grandeur about the status of their wallet.

Also note the next thing he says here:

Any sort of, you know, malicious or unfair thing would, would be, you know, openly discussed

So openly discussed that we will deliberately not mention it even once on our website, and indeed put a bunch of info in to our FAQs to make it sound like we would never do such a thing.

[ABCbits]

Lol, and what's up with that tweet?  What are they celebrating exactly, their dwindling download rates?  You're not going "to the moon" like that.  Four hours since the announcement of their first transaction, and the retweets and likes aren't mooning either.

I wonder if they hire PR people who don't have much idea about Wasabi Wallet or privacy.

It's also weird user no longer can choose UTXO for coinjoin process.

The automatic CoinJoin feature is a privacy problem by itself because it enables chain surveillance firms to analyze in batches all the UTXOs-candidates for a CoinJoin transaction. Once you sent coins to your Wasabi wallet and enabled this function, you basically agreed that all information about your transactions would be shared with third parties. If it were possible to choose UTXOs manually, as in the case of the old version of Wasabi Wallet, a chain surveillance firm would have to do blockchain analysis each time a new CoinJoin round starts, which is very inconvenient and time-consuming. With automatic CoinJoins, however, all UTXOs are being "filtered" in advance.

nopara73 prove me wrong.

Even without blacklist and surveillance on their coordinator, it's still questionable decision. Good software should enable both beginner have easy time (automated UTXO selection) while letting intermediate/advance user have control (manually choose UTXO). If they have concern user choose UTXO poorly, they better show warning and optionally show link to article/research about that subject.

[o_e_l_e_o]

Good software should enable both beginner have easy time (automated UTXO selection) while letting intermediate/advance user have control (manually choose UTXO).

You are right, of course, but you need to remember that the average user is no longer Wasabi's target audience. Everything they have done over the last few months has been designed to shift their target audience away from regular people and towards large institutions. They only care about regular users insofar as they provide liquidity to institutions looking to coinjoin.

If the average user loses privacy because they can't select specific UTXOs, too bad. If the average user pays additional fees from UTXOs they didn't want to coinjoin being automatically enrolled, too bad. Automatically enrolling everyone's coins in to coinjoins means that institutions will always have a nice pool of liquidity in which to coinjoin, which is exactly what Wasabi want. They don't care if the average user suffers, as has become blatantly clear by them spying on and censoring said users.

[n0nce]

Leo is pointing out obvious issues (like everyone else here) and I don't even know if he's a developer.

Damn it Jim! I'm a doctor, not a developer!

Ohh right Mr. McCoy, you're a doctor, you repeat it all the time!

I believe the idea is that if you use Wasabi, and they have the same 'source for taint definitions' as the centralized exchanges; then whatever was accepted by zkSnacks, will also be accepted by the exchange.

Maybe. Maybe not. Some exchanges accept gambled coins, some don't. Some exchanges accept mixed coins, some don't. Some exchanges accept coinjoined coins, some don't. It's a complete toss of the coin. Using Wasabi first does not guarantee your coins will be accept by any given centralized exchange by any means.

Right; I was trying to give them the benefit of the doubt and trying to come up with some plausible use case. As you can tell, I don't use such centralized entities so I could only guess, but I was wrong. Thanks for clearing that up!

Wooow that's some next-level shit right there! They want us to trust a centralized coordinator that openly and voluntarily works with Chainalysis, just as much as we trust the most secure, open and decentralized project in the world?

As we discussed previously in regards to the single candle picture, all of Wasabi's core team seem to have delusions of grandeur about the status of their wallet.

The way they speak and the things they say, do make it seem like there's some delusions of grandeur, I'd tend to agree ^{[this is ironic with small download and like numbers on Twitter]}. For instance, when asked / challenged about advantages over Monero, as it's a direct competitor to their product, they should know exactly how it works and be able to explain how their product is better. If it's not, and the only advantage is that you can use BTC privately without swaps, they should honestly say so. But it appeared to me they actually didn't even thoroughly read about Monero (neither did I - but again I'm not a developer for a Bitcoin privacy solution) and got some things wrong.

Also note the next thing he says here:

Any sort of, you know, malicious or unfair thing would, would be, you know, openly discussed

So openly discussed that we will deliberately not mention it even once on our website, and indeed put a bunch of info in to our FAQs to make it sound like we would never do such a thing.

Good spot! I heard it too, but already had so many quotes.

If the average user loses privacy because they can't select specific UTXOs, too bad. If the average user pays additional fees from UTXOs they didn't want to coinjoin being automatically enrolled, too bad. Automatically enrolling everyone's coins in to coinjoins means that institutions will always have a nice pool of liquidity in which to coinjoin, which is exactly what Wasabi want. They don't care if the average user suffers, as has become blatantly clear by them spying on and censoring said users.

Of course, auto-coinjoin also means they can boast about high CoinJoin numbers to investors, even though people don't even use the wallet and let the funds sit in there without user action.

I must say, the poor community support on Twitter and low GitHub download numbers give me the impression their actual real userbase (and thus anonymity set) may be pretty small.


For full transparency: icopress contacted me and he kindly offered me to send him a concise list of questions which he'd directly forward to the Wasabi CEO.
I'm partly speculating myself in this thread, but also gave Wasabi the benefit of the doubt in some cases and generally try to be as objective as I can. Therefore I thoroughly read everything you guys are writing and will summarize a list with the 'top questions'..