The dangers when Bitcoin services use blockchain analytics

[Wind_FURY]

Giacomo Zucco's Bitcoins were confiscated by Volet - a service that "helps you send, receive, spend, and exchange" your Bitcoins.

Why were his Bitcoins confiscated? Because they are "dirty" and "tainted", but that's merely according to Volet and the blockchain analytics they hired.

Details:
While I dislike and generally avoid KYC off-ramps, preferring p2p exchange whenever it's feasible, for reasons of convenience I did use this one on a few occasions. The first few transactions to fund a USD Mastercard went fine, but a few weeks ago their support desk refused to credit a couple of thousands USD worth of Bitcoin deposit, and they are currently refusing to give me back my money either. The "condition" they require, in order to return the loot, is an impossible chainanal challenge: giving them on-chain "proof of origin" of any single output involved in the tx graph of my funding transaction. My suspicion is that the "task" is intentionally designed to be impossible to comply with, in order to rug-pull users.

I'll keep you updated in the coming weeks.

https://x.com/giacomozucco/status/1810646144868921590?s=12&t=fx2RmsbaS0qNJTJTdpNu2w

BUT what did Volet do to those "dirty" and "tainted" Bitcoins? They mixed them with there own customers Bitcoins. Their customers Bitcoins are currently "dirty" and tainted"?

So about those "dirty" coins that are so "dirty"
@VoletCom
 can't send them back to
@giacomozucco
...

Turns out
@VoletCom
 spent them, mixing them together with other customer deposits! 😂😂😂

Like, OMG, now all their customer funds are CONTAMINATED!!!

TELL
@VOLETCOM
 YOU DON'T WANT
@GIACOMOZUCCO
'S FILTHY COINS SPLOOGED ALL OVER YOUR MONEY!!!

https://x.com/peterktodd/status/1811682324448256077?s=12&t=fx2RmsbaS0qNJTJTdpNu2w

That's like what was debated in Wasabi's topic. If users can't be given an opportunity to prove that the blockchain analytics' evaluation is false, then those analytics companies' evaluations are not based on logic and science. They merely can say that your UTXOs are tainted because "reasons".

[HeRetiK]

That's like what was debated in Wasabi's topic. If users can't be given an opportunity to prove that the blockchain analytics' evaluation is false, then those analytics companies' evaluations are not based on logic and science. They merely can say that your UTXOs are tainted because "reasons".

It's almost as if there's money to be made by preemptively confiscating coins without offering any reasonable way of recourse. Given the lack of crime having occured it's not like Volet will forward the confiscated coins to law enforcement, so chances are they end up in their "safekeeping" indefinitely (assuming they don't return his coins after all).

BUT what did Volet do to those "dirty" and "tainted" Bitcoins? They mixed them with there own customers Bitcoins. Their customers Bitcoins are currently "dirty" and tainted"?

That's how you ensure that you'll have "dirty" coins to confiscate in the future

[Catenaccio]

When accept to use centralized services that are either banks, centralized exchanges, payment processors, e-shops, people have to accept risk that all of their data, IP address, locations, transactions history and personal identity can be sold to government or other companies.

They can believe in trustworthy of companies but it's unrealistic to bet it on a third party entity. Wasabi wallet cooperated with Chainalysis even they claimed that their product is for privacy. The story you shared is another red flag and I think further about decentralized exchanges that have many data of users. They can cooperate with governments and share their user dada base if they feel no other choices to avoid sanctions from governments.

[franky1]

LEGALLY a service that is regulated cannot just confiscate coins without going through a process.. when regulated they have to follow a process
the regulations are clear on this and worth a read to learn the process, to learn how to avoid situations and learn the loopholes and ways to handle situations

what normally happens is that a service has to analyse/investigate its depositors funds and give it a suspicion rating based on red flags and guidelines on certain activities listed by regulators whereby the service(if at threshold) then reports it to regulated authorities in a SAR for further investigation. the authorities then do a more indepth investigation to see if it reaches a higher threshold to get a court order to seek further information beyond the SAR report and if it meets a certain criteria then the courts can issue a warrant to request the service to seize the funds

without a court order a business can freeze an account of its internal services such as exchanging or purchase or delivery of goods, but it has to allow the customer to withdraw funds to then ban/close the account

in short to seize funds and not allow withdrawal the service needs to receive a court order from authorities after an investigation..

regulated businesses without a court order to seize funds, should allow the customer to continue as normal, not informing them they are under investigation. or freeze/postpone access to its internal services and request the customer to withdrawal funds if the business wants to ban the customer.

as for unregulated/ghost(hidden behind tor/proxy/vpn/po boxes) services
many businesses try to put terms and conditions into its users agreements pretending it can seize funds without authorities/court permission, but this is meaningless words as you can sue them.. the only issue here would be is if the service is hiding behind po boxes/proxies to not know where to serve the business a court claim on/to not be able to take them to court. so be careful when using ghost services with bad terms and condition

[NotATether]

Details:
While I dislike and generally avoid KYC off-ramps, preferring p2p exchange whenever it's feasible, for reasons of convenience I did use this one on a few occasions. The first few transactions to fund a USD Mastercard went fine, but a few weeks ago their support desk refused to credit a couple of thousands USD worth of Bitcoin deposit, and they are currently refusing to give me back my money either. The "condition" they require, in order to return the loot, is an impossible chainanal challenge: giving them on-chain "proof of origin" of any single output involved in the tx graph of my funding transaction. My suspicion is that the "task" is intentionally designed to be impossible to comply with, in order to rug-pull users.

I'll keep you updated in the coming weeks.

https://x.com/giacomozucco/status/1810646144868921590?s=12&t=fx2RmsbaS0qNJTJTdpNu2w

DAMN!

You know what, somebody's gotta make such a service that solves these "source of funds" challenges like they are captchas. I don't care much about whether people like this kind of service, more than I care about these challenges being solvable in all jurisdictions.

[Darker45]

I'm afraid this gimmick will become more common in the near future. Aside from suddenly locking accounts and freezing funds due to "suspicious activity", this "tainted coin" alibi will become another easy source of revenue for these scammers.

Volet feels so entitled in their responses. They sound so arrogant, playing the role of judge, jury, and executioner. Volet is bringing us back to the old Wild Wild West.
 

https://x.com/petrijaervinen/status/1811364680616837573/photo/1

Anyway, the more common this kind of stealing becomes, the more reason Bitcoin users avoid regulated platforms, thereby boosting the role of decentralized and peer-to-peer options. Just thinking of the silver lining.

[NotATether]

I'm afraid this gimmick will become common in the near future. Aside from suddenly locking accounts and freezing funds due to "suspicious activity", this "tainted coin" alibi will become another easy source of revenue for these scammers.

Volet feels so entitled in their responses. They sound so arrogant, playing the role of judge, jury, and executioner.
 

https://x.com/petrijaervinen/status/1811364680616837573/photo/1

Institutions (or whoever has a bunch of lawyers) feel entitled to do whatever they want without regards to the law, especially if it's about holding other people's money.

The prospect of seizing people's funds arbitrarily is just so enticing to many a bad actor.

[348Judah]

Am only much concerned here about the innocent users on some exchanges because things like this will affect them the most, and the only way they can hide is to mixed the tainted coins with other users assets on exchanges, while knowing that the exchanges have every of the informations required for them to track any user on their own personal interest or request, its better we start realizing how we could achieve the said privacy without allowing some to implicate our innocent being, if possible to stop with the use of an exchange.

[buwaytress]

Yeah OP, too lazy to dig up my own post history but years and years ago, the blockchain analytics firm (today still pretty much the Google ranked one, yeah Chainalysis) had its own whistleblower admit as much -- they know what their data says, but they don't really know what it means for sure.

Apart from Chainalysis, there is one I've used in the past, automated (it's a paid service now) and it just ran a semi-useful report. The false positives are the problem, as are the "taint". Taint is not linkage.

This alone is no basis for action, unless a direct link is found to a sanctioned person. Otherwise, a report must, as franky1 says, be submitted to the relevant authority. The user would be informed in such a case.

[tranthidung]

Yeah OP, too lazy to dig up my own post history but years and years ago, the blockchain analytics firm (today still pretty much the Google ranked one, yeah Chainalysis) had its own whistleblower admit as much -- they know what their data says, but they don't really know what it means for sure.

Apart from Chainalysis, there is one I've used in the past, automated (it's a paid service now) and it just ran a semi-useful report. The false positives are the problem, as are the "taint". Taint is not linkage.

Andreas Antonopoulos explained about taint, tainted coins in his Bitcoin Q&A series
https://www.youtube.com/watch?v=BILcJ3WtdLQ

They used to not apply to strict criteria to identify tainted coins but with some cases recently against Binance, Kucoin, Paxful for example, centralized exchanges and companies have been enforcing to apply stricter criteria to save their 'asses' first. They definitely don't want to be another Binance, Kucoin or Paxful so neither their CEOs.

By whatever criteria, there will be false results for sure like DOJ, by some mistakes like with Sinbad's sanctioned address list.

[BlackHatCoiner]

If users can't be given an opportunity to prove that the blockchain analytics' evaluation is false, then those analytics companies' evaluations are not based on logic and science.

No, the burden of proof lies with the chain analysis companies. This principle aligns with the presumption of innocence. If someone accuses you of being a criminal, it is their responsibility to provide evidence, not yours to disprove a negative claim.

The conviction that certain bitcoins are tainted is the one and only successful attack on Bitcoin. Do not let it go unchallenged.

[Darker45]

If users can't be given an opportunity to prove that the blockchain analytics' evaluation is false, then those analytics companies' evaluations are not based on logic and science.

No, the burden of proof lies with the chain analysis companies. This principle aligns with the presumption of innocence. If someone accuses you of being a criminal, it is their responsibility to provide evidence, not yours to disprove a negative claim.

Well, the stealing has been happening for years. So far, it seems regulators are contented with how these centralized platforms are doing their nutty job. They didn't order exchanges to stop freezing funds with a mere we've detected suspicious activity in your account as a reason. They didn't reprimand exchanges when they lock accounts for being under investigation.  

And so the stealing continues. Easy money keeps flowing in. When their arbitrary actions are exposed publicly, they could easily just respond like Volet.


https://x.com/VoletCom/status/1811428392161386977

Thanks to regulators, stealing couldn't be any smoother for exchanges.

[NotATether]

I just realized that Volet used to be Advcash - https://advcash.com

They used to have a really good e-wallet back in the day (think Payoneer type)

Can't tell you what it was like though since they have a strict ban on Americans.

[Lucius]

Unfortunately, this is something that any of us can face at any time, and I think that this is just one of the methods by which some want to discourage others from having any contact with Bitcoin at all. Imagine what kind of impression is created in the head of someone who wants to invest in BTC when he reads this kind of news?

Realistically speaking, the only pure BTC is the one that is the result of block mining, and everything else has been mixed so many times that probably each of us has some coins that were once part of something that someone would consider dirty.  In any case, what they are doing is really malicious, because if the system is going to be set up that way, then let them analyze every banknote that is in the system - and then let them punish the banks for keeping dirty money.

The lesson of the story is to be very careful to whom you send your BTC, because it is obvious that there are those who try to steal it from you in a "legal" way.

[Apocollapse]

I hope after people read this thread understand the lesson we can get from this case.

It's not avoid to use Volet, but choose to use PayPal, Binance etc, those are still a centralized site which would take your coins in the future. Even Giacomo Zucco as someone who has a reputation and popularity can get this problem, if you're an Average Joe, it's over.

So, use no KYC P2P or DEX that listed on kycnot.me

[Casdinyard]

Giacomo Zucco's Bitcoins were confiscated by Volet - a service that "helps you send, receive, spend, and exchange" your Bitcoins.

Why were his Bitcoins confiscated? Because they are "dirty" and "tainted", but that's merely according to Volet and the blockchain analytics they hired.

Details:
While I dislike and generally avoid KYC off-ramps, preferring p2p exchange whenever it's feasible, for reasons of convenience I did use this one on a few occasions. The first few transactions to fund a USD Mastercard went fine, but a few weeks ago their support desk refused to credit a couple of thousands USD worth of Bitcoin deposit, and they are currently refusing to give me back my money either. The "condition" they require, in order to return the loot, is an impossible chainanal challenge: giving them on-chain "proof of origin" of any single output involved in the tx graph of my funding transaction. My suspicion is that the "task" is intentionally designed to be impossible to comply with, in order to rug-pull users.

I'll keep you updated in the coming weeks.

https://x.com/giacomozucco/status/1810646144868921590?s=12&t=fx2RmsbaS0qNJTJTdpNu2w

BUT what did Volet do to those "dirty" and "tainted" Bitcoins? They mixed them with there own customers Bitcoins. Their customers Bitcoins are currently "dirty" and tainted"?

So about those "dirty" coins that are so "dirty"
@VoletCom
 can't send them back to
@giacomozucco
...

Turns out
@VoletCom
 spent them, mixing them together with other customer deposits! 😂😂😂

Like, OMG, now all their customer funds are CONTAMINATED!!!

TELL
@VOLETCOM
 YOU DON'T WANT
@GIACOMOZUCCO
'S FILTHY COINS SPLOOGED ALL OVER YOUR MONEY!!!

https://x.com/peterktodd/status/1811682324448256077?s=12&t=fx2RmsbaS0qNJTJTdpNu2w

That's like what was debated in Wasabi's topic. If users can't be given an opportunity to prove that the blockchain analytics' evaluation is false, then those analytics companies' evaluations are not based on logic and science. They merely can say that your UTXOs are tainted because "reasons".

Funny how in cases like these there will be people who would look towards the government for justice and recompense, and while that certainly is possible it seems like a lot of us here forget that we settled with choosing to not have to do anything with governments and their centralized currencies, but oh well.

A massive misplay on Volet's end. You can't just add it to the pool of your customer's coins. Even binance doesn't do that lol. Best course of action here is to freeze such assets until investigation is completed determining whether Zucco is guilty of dabbling with dirty crypto or not, till then they can't and shouldn't do shit with it no matter what.

All the more reasons for me to stick with Binance and exchanges that I already acquainted myself with. If they can do this to someone as famous as this guy (honestly don't know him but who cares) then think about what they can do to the average voiceless bloke out there.

[buwaytress]

They used to not apply to strict criteria to identify tainted coins but with some cases recently against Binance, Kucoin, Paxful for example, centralized exchanges and companies have been enforcing to apply stricter criteria to save their 'asses' first. They definitely don't want to be another Binance, Kucoin or Paxful so neither their CEOs.

I think it's not so much strict criteria (which requires more thorough analysis, which requires actually more subtle, less direct considerations, as well as multi-layered and thorough KYC). But a matter of simply removing the need for this criteria by completely de-risking. Traditional finance does this too, but fintech and now crypto firms are simply derisking, rather than managing risk, at the cost of overcompliance.

Not sure comparable to Binance -- who knowingly aided or facilitated criminal activity, rather than being negligent (itself having degrees leading up to criminality).

[franky1]

i have not researched if volet is regulated.. but the regulations are clear, volet should release funds unless court ordered to seize funds
infact if regulated volet should not even inform a customer they are being investigated and just continue its service until court ordered.
it cannot just hold funds "until analysed/investigated".

and policies and procedures of how regulated businesses should operate is actually public information.
take some examples

https://www.fincen.gov/sites/default/files/shared/MSB_Exam_Manual.pdf
(page 92 of 159)

Identifying underlying Crime
MSBs are required to report suspicious activities above prescribed dollar thresholds
that may involve money laundering, BSA violations, terrorist financing,61 and certain
other crimes. However, MSBs cannot be expected and are not required to investigate or
confirm the underlying crime (e.g., terrorist financing, money laundering, tax evasion,
identity theft, or fraud). Investigation is the responsibility of law enforcement. When
evaluating suspicious activity and completing the SAR-MSB, MSBs should, to the best of
their ability, identify the characteristics of the suspicious activity.

(page 97 of 159)

prohibition of sar-Msb disclosure
No MSB that reports a suspicious transaction, or any director, officer, employee or agent
of the MSB, may notify any person involved in the transaction that the transaction has
been reported. Additionally, no officer or employee of the Federal Government or of
any state, local, tribal, or territorial government within the United States, who has any
knowledge that such report was made, may disclose to any person involved in the
transaction that the transaction has been reported, other than as necessary to fulfill
the official duties of such officer or employee

a msb is not suppose to inform their customer they are under investigation nor prevent the customers activity until they have been ordered by a court.
the most a MSB can do is without explaining reason, inform the customer the business no longer wants the customer to be a customer and allow them to withdraw funds to then ban the customer
(its really worth reading MSB manuals and procedures to learn how laws actually work)
by volet also considering the funds return as being a "refund" instead of a withdrawal.. it appears that volet is pretending that funds received are purchases where funds become volets on receipt. rather than volet being a custodian of users owned funds on deposit

volet is not actually following regulations to the fullest nor having a adequate policy of servicing its users. so i doubt they are compliant if they are regulated. too many fishy rotten processes that volet has mentioned in its tweets
also.
there is actual supreme court case law that has been tested that suspicion/curiosity alone is not a crime. the authorities need to articulate suspicion of a crime for it to be suspicious when doing a SAR, so there are thresholds for reporting and investigating. they cant just dislike a customer and treat them as a suspect 'coz suspect', they have to meet certain standards
(identify the characteristics of suspicious activity)

this is why even blockchain analysis companies cant just tag any address as suspicious without actually articulating its linkage to WHY its suspicious. again they cant just tag "suspicious" and think that is good enough to trigger investigations via authorities and MSB's
(identify the characteristics of suspicious activity)


..
there are many manuals and guidelines from FATF, SEC, Fincen about procedures regulated MSB's have to follow. and it appears volet is not following them or lying about its own processes if its regulated

[The Sceptical Chymist]

That's how you ensure that you'll have "dirty" coins to confiscate in the future

I've always thought of "tainted coins" as a BS concept unless someone has just pulled off a huge hack and then tries to exchange them (or some similar scenario where there's little doubt someone has coins they shouldn't have access to).  And I've also wondered if there's going to be a point at which most of the bitcoin out there is going to be related to dirty coins, no matter how many degrees of separation there might be.

I've never heard of Volet or this particular case, but it certainly reeks of bullshit and looks like a straight-up scam.

Can't tell you what it was like though since they have a strict ban on Americans.

That figures.

[franky1]

I've always thought of "tainted coins" as a BS concept unless someone has just pulled off a huge hack and then tries to exchange them (or some similar scenario where there's little doubt someone has coins they shouldn't have access to).  And I've also wondered if there's going to be a point at which most of the bitcoin out there is going to be related to dirty coins, no matter how many degrees of separation there might be.

when authorities create a blacklist of spent utxo's related to a crime.. or/and create a taint path of the unspent utxos, to show origins/ancestry of spent utxos that were blacklisted, those coins can be cleaned after authorities have declared them clean

they can do this by realising after an investigation they are not related to a crime so remove them from a list. or if due to investigation of a crime the civil process of courts then claimed the coins as custody of the authorities and then later the authorities released the coins via government auctions, etc would declare them as clean

.. in short.. in the end.. to launder(to clean) coins.. the government and its delegated MSB become the launderers


on the flip side
the laws and regulations are clear, coins cant just be treated as dirty "coz suspicious" they need to articulate a suspicion of a crime. meaning it has to meet certain standards/thresholds/criteria related to a crime