Wasabi Wallet - Open Source, Noncustodial Coinjoin Software

[Pmalek]

Do you hold UTXOs that were sent from Sinbad's sanctioned wallet? Why not do a small experiment, "for the science".

Everyone that participated in the Signature campaign does. The authorities sanctioned the escrow address that held and still holds the signature campaign payments to the OFAC sanctions list. I am not sure what the other sanctioned address is, but it never held any real value on it. One could rightly ask, what's with the hundreds of millions of allegedly laundered and mixed coins from hacks and the addresses connected to those exploits. Are they sanctioned?

Why not do a small experiment, "for the science".

After everything that has been said and done concerning Wasabi and zkSNACKS, I don't want to use their wallet.

[1714718594]

1714718594

[1714718594]

1714718594

[1714718594]

1714718594

[1714718594]

1714718594

[1714718594]

1714718594

[Wind_FURY]

Do you hold UTXOs that were sent from Sinbad's sanctioned wallet? Why not do a small experiment, "for the science".

Everyone that participated in the Signature campaign does. The authorities sanctioned the escrow address that held and still holds the signature campaign payments to the OFAC sanctions list. I am not sure what the other sanctioned address is, but it never held any real value on it. One could rightly ask, what's with the hundreds of millions of allegedly laundered and mixed coins from hacks and the addresses connected to those exploits. Are they sanctioned?

What exploits?

But if you mean addresses that received outputs that were mixed through Sinbad, it's probably better to assume that they're being monitored.

I believe it would also be better to send those UTXOs to yourself through the Lightning Network. Those outputs would be left in one of the relay nodes.

Why not do a small experiment, "for the science".

After everything that has been said and done concerning Wasabi and zkSNACKS, I don't want to use their wallet.

Don't take it personally, Wasabi is just one of the tools that you could choose, or not to choose, to use in Bitcoin. Plus just do it as an experiment merely to know if it works.

[Pmalek]

@Wind_FURY
Exploits as in the hacked money the authorities claim went through the mixer. Have they sanctioned and traced where those funds went? It doesn't seem like it. It looks like sloppy work putting an escrow address of a signature campaign on a sanctions list and patting yourself on the shoulders, saying that you made a difference somehow.

[Wind_FURY]

@Wind_FURY
Exploits as in the hacked money the authorities claim went through the mixer.

OK, I thought you were talking about system vulnerabilities/security flaws.

Have they sanctioned and traced where those funds went? It doesn't seem like it. It looks like sloppy work putting an escrow address of a signature campaign on a sanctions list and patting yourself on the shoulders, saying that you made a difference somehow.

That's the point that I have been trying to emphasize. I don't have any problem if the authorities/law enforcement do their jobs. But we need refutability against their claims because how do we truly verify if they're doing their jobs properly, or not.

I also don't have any problem if a company decides to hire the services of a blockchain analysis company. As a centralized entity it's their decision and it's not illegal. BUT as a community I believe as a matter of ethics, they should always give their users the benefit of the doubt.

[Kruw]

Wasabi made 610 Bitcoins anonymous with a single coinjoin transaction: https://mempool.space/tx/fb596c9f675471019c60e984b569f9020dac3b2822b16396042b50c890b45e5e

Number of inputs: 327
Number of outputs: 279
Value: 610.74252451 BTC
Fee rate: 50.53 sats/vbyte
Input anonset: 4.48
Output anonset: 7.15

[Kruw]

So is this a paid service/wallet?

The wallet is free to use, coinjoining costs a 0.3% service fee in some cases.

How conveniently you appeared right after the ban on mixers, 🤔

Wasabi didn't just appear, it's been around since 2018, and was a winner of Bitcointalk's coinjoin development bounty:

Congratulations to the Wasabi and JoinMarket developers! JoinMarket pioneered a lot of CoinJoin science (and BTW, belcher wrote an excellent & comprehensive wiki article on privacy), while Wasabi is the first wallet that implements CoinJoin in both a highly-usable and sound way. As both a signer and a donor to the CoinJoin bounty fund, I'm thrilled that these two pieces of software exist!

For everyone looking to improve their privacy, I highly recommend checking out Wasabi, especially over centralized "mixers".

please note that I'm all for catching the criminals, but since there are some accusations against you, and the timing of your appearance, I say this is a honeypot obviously, but after reading the post about the accusation, it seems you guys helped to catch scammers and hackers. Which I would say works in your favour, but not if the goal was to catch more scammers and criminals for a long time.

This should be an indication that open source world is a dangerous place for both criminals and law enforcements equally, that's what I love about such a world. 😉

The accusations are completely false, there has never been any help provided to catch scammers or hackers.  No such help is possible because your data is never shared with Wasabi's developers or coinjoin coordinator.  Period.

[Poker Player]

The accusations are completely false, there has never been any help provided to catch scammers or hackers.  No such help is possible because your data is never shared with Wasabi's developers or coinjoin coordinator.  Period.

I understand that it's best to defend yourself against all kinds of accusations, but I wouldn't waste too much time with digaran, unless you're having fun doing it or something. Between him saying nonsense, making up things, and mixing lies with truths you can drive yourself crazy if you try to answer him seriously repeatedly.

[Kruw]

The wallet is free to use, coinjoining costs a 0.3% service fee in some cases.

So you are getting a fee, now my question is, can people use this wallet without involving you? Like some kind of fork?

Yes, every line of code including the backend coordinator is completely open source so anyone can fork it and run their own (for profit, or for free): https://github.com/zkSnacks/WalletWasabi

I can't take your words for it, sorry. Unless of course peers that I trust have a review and audit your software to give the green light for me to use, or I spend my time to do the review myself. But it would be easier to verify the claims against you, if in fact those hackers/scammers used your services before getting caught, then that would mean the end of you and anyone who vouched for you as an expert to claim that your service is %100 safe.

Like I said, the accusations of arrests are completely fabricated.  It's yet another made up lie by the disgraced Samourai Wallet: https://twitter.com/yahiheb_/status/1661926227572060161

Repeated dishonesty from Samourai have barred them from ever receiving a payout from the bounty as far as I am concerned: I will not be signing a transaction paying them. Evaluating the privacy of systems is difficult even when the involved parties are honest and easy to work with, it is far too difficult when they are actively misleading.  Personally, I would urge my friends to not use that wallet.

[examplens]

@Wind_FURY
Exploits as in the hacked money the authorities claim went through the mixer. Have they sanctioned and traced where those funds went? It doesn't seem like it. It looks like sloppy work putting an escrow address of a signature campaign on a sanctions list and patting yourself on the shoulders, saying that you made a difference somehow.

Well, it's a bit unreal, Sinbad was accused of a huge amount of money, but in the end all that was found was an escrow address from the Bitcointalk forum that was refilled a few days earlier.

Do you hold UTXOs that were sent from Sinbad's sanctioned wallet? Why not do a small experiment, "for the science".

I am. And I sent those funds and I still haven't received any questions about the origin of those coins. I didn't use Wasabi for those transactions if that's what you're getting at.

Like I said, the accusations of arrests are completely fabricated. 

Can someone tell me what the accusations are?
A long time ago, I was testing the Wasabi wallet, after that I saw a couple of times that a negative connotation was associated with it, but I did not investigate in detail what it was about.

[Kruw]

I understand that gmaxwell is one of the main developers of coinjoin technology, he just loves to suggest great innovations and then watch the world fighting over his inventions. But did he ever officially vouch for wasabi?

He, theymos, and Pieter Wuille awarded Wasabi (and JoinMarket) the coinjoin development bounty.

Besides, if the accusations are true, it could mean you did something wrong and not the software itself, but the quote from him in 2 posts above, states something about another software, however I would love to read theymos and Maxwell's official opinions regarding the recent accusations, after all if we can't rely on our experts, who should we rely on, eh?

If you want to hear more experts comment on the accusations against Wasabi and the fraud being perpetrated by Samourai, here is a recent interview with Peter Todd about the subject: https://www.youtube.com/watch?v=oPNFdhZUGmk

Can someone tell me what the accusations are?
A long time ago, I was testing the Wasabi wallet, after that I saw a couple of times that a negative connotation was associated with it, but I did not investigate in detail what it was about.

The accusations revolve around Wasabi users reusing their addresses.  You should always generate a new address for every transaction you receive, because when you reuse an address, it provides a 100% link between transactions it participates in, even if you coinjoin.  Samourai's false attempts to convince people that there is a "flaw" in Wasabi's coinjoins because people are reusing their addresses.  This is reverse accusation tactic deployed by Samourai's developers because Samourai Wallet has had multiple bugs in their wallet where their coins were automatically sent to addresses that were already used:

https://medium.com/@thepiratewhocantbenamed/samourai-wallet-address-reuse-bug-1d64d311983d
https://twitter.com/SamouraiWallet/status/1283145015124996098
https://twitter.com/brian_trollz/status/1559018534675644418
https://web.archive.org/web/20231025112815/https://code.samourai.io/wallet/samourai-wallet-android/-/issues/462

[Pmalek]

Well, it's a bit unreal, Sinbad was accused of a huge amount of money, but in the end all that was found was an escrow address from the Bitcointalk forum that was refilled a few days earlier.

It's the same escrow address that was also used earlier to send payments to campaign participants. The last filling of the address only happened because there wasn't enough coins in it.

I am. And I sent those funds and I still haven't received any questions about the origin of those coins. I didn't use Wasabi for those transactions if that's what you're getting at.

I am curious, where did you send them? If it wasn't to a popular CEX, then I am sure it's fine. Some Binance users reported issues after being connected to coins coming from that escrow address, so they are checking and taking note.

[kayirigi]

Evidence for Wasabi's 132 arrests all listed here... https://bitcointalk.org/index.php?topic=5480440.msg63442503#msg63442503

Kruwed can cry and carry water for his BC analysis masters, but evidence is clear... https://bitcointalk.org/index.php?topic=5480440.msg63442503#msg63442503

Wasabi is a government honeypot.

[Kruw]

Evidence for Wasabi's 132 arrests all listed here... https://bitcointalk.org/index.php?topic=5480440.msg63442503#msg63442503

Kruwed can cry and carry water for his BC analysis masters, but evidence is clear... https://bitcointalk.org/index.php?topic=5480440.msg63442503#msg63442503

Wasabi is a government honeypot.

You never provided any proof of arrests.  "132 arrests" is a fake accusation made up by Samourai, you just reposted it without verifying it:  https://twitter.com/yahiheb_/status/1661926227572060161

You can verify yourself that Wasabi is not a government honeypot since all of the code is entirely open source.  Your data never leaves your device: https://github.com/zkSNACKs/WalletWasabi

[n0nce]

You can verify yourself that Wasabi is not a government honeypot since all of the code is entirely open source.  Your data never leaves your device: https://github.com/zkSNACKs/WalletWasabi

I want to reiterate (not for you, there is no hope to make you see the truth by now; I'm writing for new readers):

We can read the wallet source code, but there is no way to verify what code actually runs on zkSNACKs' servers, which is the default this wallets connects to. Furthermore, zkSNACKs confirmed multiple times in writing that they do work with blockchain analysis companies, and can deny access to the service.

It is easy to see that this is a 'point of failure', where governments or anyone else, could apply pressure to either deny someone access to mixing, or actually just receive data from the company and trace coins back to someone's real-life identity through.. well, good ol' blockchain analysis.

I understand that gmaxwell is one of the main developers of coinjoin technology, he just loves to suggest great innovations and then watch the world fighting over his inventions. But did he ever officially vouch for wasabi?

He, theymos, and Pieter Wuille awarded Wasabi (and JoinMarket) the coinjoin development bounty.

If I remember correctly, that was quite a while ago, right? Handing someone a development bounty has nothing to do with vouching for their business decisions years down the road.

[Kruw]

I want to reiterate (not for you, there is no hope to make you see the truth by now; I'm writing for new readers):

We can read the wallet source code, but there is no way to verify what code actually runs on zkSNACKs' servers, which is the default this wallets connects to. Furthermore, zkSNACKs confirmed multiple times in writing that they do work with blockchain analysis companies, and can deny access to the service.

It is easy to see that this is a 'point of failure', where governments or anyone else, could apply pressure to either deny someone access to mixing, or actually just receive data from the company and trace coins back to someone's real-life identity through.. well, good ol' blockchain analysis.

It's disgusting to see you coming back to a new thread to deceive new readers, you've already been exposed as a lying BASTARD on this exact point already: https://bitcointalk.org/index.php?topic=5286821.msg62780404#msg62780404

If you claim my statement is a lie, you have to claim that zkSNACKS does not collaborate with blockchain analysis companies, which they themselves admit publicly, repeatedly!! Cheesy This is getting hilarious.

Please provide one instance of zkSNACKs publicly admitting they provide data to blockchain analysis companies.

3 PROHIBITED ACTIVITIES and COIN FILTERING
==========================================

    You agree that You will not use the Services to perform any type of illegal activity of any sort or to take any action that adversely affects the performance of or the provision by the Service Provider of the Services. Furthermore, You agree that You will not use the Services on Bitcoin that is created, received or given in exchange for, or as a result of, any type of illegal activity.
    Use of the Services in a manner contrary to local law is generally prohibited.

    The prohibition of this paragraph includes, but is not limited to, the following prohibited activities:
     - sales of narcotics, research chemicals or any controlled substances;
     - items that infringe or violate any intellectual property rights such as copyrights, trademarks, trade secrets, or patents;
     - ammunition, firearms, explosives (including fireworks), or weapons regulated under applicable law;
     - transactions that show the personal information of third parties in violation of applicable law;
     - transactions that support pyramid, Ponzi, or other "get rich quick" schemes;
     - provide credit repair or debt settlement services;
     - explicit sexual content;
     - money laundering or any support thereof.

    You agree that You will not engage in any of the following activities via the Services, nor will You help or facilitate a third party to engage in any such activity:
     - attempt to gain unauthorized access to our Coordinator;
     - make any attempt to bypass or circumvent any security features;
     - violate any law, statute, ordinance, regulation or court order;
     - engage in any activity that is abusive or interferes with or disrupts our Services.

    If You find any reason to violate the law during Your transaction (for example, in a transaction with a third party), please let us know at one of the contacts listed at the end of this document.
    The Service Provider shall assist the investigation in any case, if so instructed by an authorized body, a final court judgment or a final regulatory decision.

    COIN FILTERING

    zkSNACKs Ltd. may execute illicit activity checking and control via a contracted third party solely in its CoinJoin coordination services. zkSNACKs Ltd. may suspend your UTXOs’ access to the CoinJoin services, with immediate effect for any reason - including but not limited to illicit or prohibited activities, applicable sanctions programs, or any crime or money-laundering activity - at its sole discretion and is under no obligation to disclose the details of its decision to take such action with you. In this case you are not permitted to use the relevant/high-risk bitcoin UTXO to reach the CoinJoin services.
    You acknowledge that zkSNACKs Ltd.'s decision to take certain actions, including suspending for any reason at our sole discretion, may be based on confidential criteria that are essential to zkSNACKs Ltd.'s risk management and security protocols. You agree that zkSNACKs Ltd. is under no obligation to disclose the details of its risk management and security procedures to you.
    Your access with the relevant bitcoin UTXOs to the CoinJoin services will be permanently suspended.

I find it funny that you, nopara and others have tried to fight for us to separate between Wasabi (wallet) and zkSNACKS (company), meanwhile they put legal disclaimers that theoretically refer only to the company and their own coordinator, in the actual wallet's source code...

So you were proven to be lying when you claimed that the zkSNACKS coordinator submits data to blockchain analysis companies since you were not able to provide even a single instance of zkSNACKs collecting data. You skipped right past the zkSNACKs privacy policy that explicitly says they cannot collect any data:

=========================================
II. PRIVACY POLICY
=========================================

    This policy describes the ways zkSNACKs collects, stores, uses and protects personal information. The purpose of this policy is to ensure that zkSNACKs complies with applicable European Union (EU) and other statutory data protection laws and regulations, and ensures that users are provided privacy protection.
    Data protection laws are generally relevant in case any processing of personal data is concerned. The terms used within the scope of this data protection declaration are defined in and by the General Data Protection Regulation of the European Union. As such, the wide definition of "processing" of personal data means any operation or set of operations performed on personal data.

Personally Identifiable Information
===================================

    “Personally identifiable information” (“personal information”) is any information that can be directly associated with a specific person and can be used to identify that person. A prime example of identifiable information is a person’s name.

Handling Information
====================

   Since we are working on privacy, and our mission is to regain personal privacy, our Services are designed to be used without indication of any personal data. For this reason we do not have any kind of data collecting solutions built into our products. There may only be one personal data processing in our Service, for customer support in case of technical problems: visitors may, indicate their email addresses voluntarily to get notifications in case of any potential technical problems or other inquiries. These e-mail addresses are solely used to answer users’ questions and are erased after 100 days. In this case, the processing of the data is based on a freely given consent to Article 6 (1) (a) of the GDPR and is aimed at the effective handling of the complaint.
    We use GitHub as the main platform for users’ technical questions and issues, and we do not retain any data that can be subsequently identified / associated with the user.
   We expressly declare that we do not manage or store any other personally identifiable information.
    By visiting the Website and using our Services, You agree with this policy, in accordance with Section 1.2 of the Terms and Conditions

All User Information is Confidential
====================================

   Because we cannot link Your wallet and Your personal information (such as Your name and IP address) provided under the Service, Your personal information is safe and cannot be accessed by our staff or third parties.
    zkSNACKs will protect processed data in the customer Service process adequately against unauthorized access (of third parties) in accordance with the provisions of the legal framework of Republic of Seychelles. We will only process data which are essential to provide our Services. Data will not be used or stored by other means than set out in this document and are made accessible only to a restricted and necessary number of persons. We do not transfer any personal data to third parties.
    All employees of zkSNACKs have been informed about applicable data protection provisions as well as data security measures and are bound to our privacy practices. All staff are bound by confidentiality agreements.

Use of Cookies
==============

    A cookie is a small piece of data that a website asks Your browser to store on Your computer or mobile device. The cookie allows the website to “remember” Your actions or preferences over time.
   We expressly declare that we do not use cookies.

Of course, you never have to trust zkSNACKs that they do not collect any data since the Wasabi client itself prevents any coordinator from collecting any data, which you can verify since it is entirely open source, just like Bitcoin itself!

Since you already proven to be a LIAR in the previous thread, why did you return to this thread to try to deceive new users into thinking they are trusting zkSNACKs with any data when they are not?  I don't understand how you didn't feel enough shame from being proven wrong in the first thread that you would come back to a new thread just to get humiliated AGAIN for propagating completely false information to new users?

[Kruw]

you are here talking about privacy, lol unless the quotes above are wrong?

Yes, I am here talking about privacy.  Did you read the privacy policy I quoted?  I'll post it again so everyone is clear that there is absolutely no data collected whatsoever by zkSNACKs:

=========================================
II. PRIVACY POLICY
=========================================

    This policy describes the ways zkSNACKs collects, stores, uses and protects personal information. The purpose of this policy is to ensure that zkSNACKs complies with applicable European Union (EU) and other statutory data protection laws and regulations, and ensures that users are provided privacy protection.
    Data protection laws are generally relevant in case any processing of personal data is concerned. The terms used within the scope of this data protection declaration are defined in and by the General Data Protection Regulation of the European Union. As such, the wide definition of "processing" of personal data means any operation or set of operations performed on personal data.

Personally Identifiable Information
===================================

    “Personally identifiable information” (“personal information”) is any information that can be directly associated with a specific person and can be used to identify that person. A prime example of identifiable information is a person’s name.

Handling Information
====================

   Since we are working on privacy, and our mission is to regain personal privacy, our Services are designed to be used without indication of any personal data. For this reason we do not have any kind of data collecting solutions built into our products. There may only be one personal data processing in our Service, for customer support in case of technical problems: visitors may, indicate their email addresses voluntarily to get notifications in case of any potential technical problems or other inquiries. These e-mail addresses are solely used to answer users’ questions and are erased after 100 days. In this case, the processing of the data is based on a freely given consent to Article 6 (1) (a) of the GDPR and is aimed at the effective handling of the complaint.
    We use GitHub as the main platform for users’ technical questions and issues, and we do not retain any data that can be subsequently identified / associated with the user.
   We expressly declare that we do not manage or store any other personally identifiable information.
    By visiting the Website and using our Services, You agree with this policy, in accordance with Section 1.2 of the Terms and Conditions

All User Information is Confidential
====================================

   Because we cannot link Your wallet and Your personal information (such as Your name and IP address) provided under the Service, Your personal information is safe and cannot be accessed by our staff or third parties.
    zkSNACKs will protect processed data in the customer Service process adequately against unauthorized access (of third parties) in accordance with the provisions of the legal framework of Republic of Seychelles. We will only process data which are essential to provide our Services. Data will not be used or stored by other means than set out in this document and are made accessible only to a restricted and necessary number of persons. We do not transfer any personal data to third parties.
    All employees of zkSNACKs have been informed about applicable data protection provisions as well as data security measures and are bound to our privacy practices. All staff are bound by confidentiality agreements.

Use of Cookies
==============

    A cookie is a small piece of data that a website asks Your browser to store on Your computer or mobile device. The cookie allows the website to “remember” Your actions or preferences over time.
   We expressly declare that we do not use cookies.

[n0nce]

you are here talking about privacy, lol unless the quotes above are wrong?

Yes, I am here talking about privacy.  Did you read the privacy policy I quoted?  I'll post it again so everyone is clear that there is absolutely no data collected whatsoever by zkSNACKs:

zkSNACKs specifies that they may blacklist your coins, e.g. if you're trying to use it for 'illicit' activities (their definition of what that is exactly, can be argued about, too, but it's a different story).

zkSNACKs Ltd. may execute illicit activity checking and control via a contracted third party solely in its coinjoin coordination services. zkSNACKs Ltd. may suspend your UTXOs’ access to the coinjoin services, with immediate effect for any reason - including but not limited to illicit or prohibited activities, applicable sanctions programs, or any crime or money-laundering activity - at its sole discretion and is under no obligation to disclose the details of its decision to take such action with you. In this case you are not permitted to use the relevant/high-risk bitcoin UTXO to reach the coinjoin services.

You acknowledge that zkSNACKs Ltd.'s decision to take certain actions, including suspending for any reason at our sole discretion, may be based on confidential criteria that are essential to zkSNACKs Ltd.'s risk management and security protocols. You agree that zkSNACKs Ltd. is under no obligation to disclose the details of its risk management and security procedures to you.

Your access with the relevant bitcoin UTXOs to the coinjoin services will be permanently suspended.

How can they censor your UTXOs if they don't 'collect any data'? You need some kind of basis to decide whether a transaction is connected to an 'illicit or prohibited activity' or not.

Besides that, one of Bitcoin's core reasons of existence is not to censor any transactions, regardless of what business they're involved in.

[Kruw]

How can they censor your UTXOs if they don't 'collect any data'?

Because they buy that data from someone else, obviously.

[NotATether]

How can they censor your UTXOs if they don't 'collect any data'?

Because they buy that data from someone else, obviously.

So you're saying the data is not real-time?

While I don't expect anyone here to know the rate at which zksnacks updates their blacklisting database, or even whether it is updated periodically, I am fairly sure that if something comes up as in an event where somebody is conducting a major hack or dirty money movement and the blockchain analysis firms have tracked it, they should have some kind of notification to update their database, no? If not trigger it automatically?

[Kruw]

So you're saying the data is not real-time?

When an input registers, a query with that input's address is sent to an analysis company in real time.  The analysis company replies with a risk category associated with that address (e.g. credit card fraud), if there one was reported for that address.

they should have some kind of notification to update their database, no? If not trigger it automatically?

If an address is blocked for suspicious activity, the ban lasts for 30 days.  If there was an update to the database that cleared that address of a false positive flag, they would be able to coinjoin it then.