eXch - instant exchange BTC / LN / XMR / LTC / ETH / ERC20

[eXch]

Today we were COMMANDED to appear before the GRAND JURY, however, unfortunately all our customers data was lost in the boating accident during transportation of our servers over a river just right before the receipt of that subpoena. Reportedly.

Code:

Exhibit A

Transaction Hashes                                                 Receiving Addresses                        Amount
0x980954ec2a0b7e78e9601c5a4006ef472ef8be99fa294a6416e21815a791e991 0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123 20000 DAI
0x3f4878860ed422ac1756a08c20edd1e9757d948a3a5e55425e421b678b87c0ae 0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123 10000 DAI
0xb66e3b0be33732466a76ef336630c6bcb13bbaa02ee4d733b7d1e485f50327a4 0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123 25650.668859937550803616 DAI
0x308e6f4d790ad68a432022ca2be1129db8b4a8a720e1a5c03ffb1be7beaa2259 0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123 10000 DAI
0x05ca43e2563d217e71e5a131d2ce19b9dc052192f65e84e2ad6ee6fed1686ad1 0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123 2000 DAI

Our legal team is on its way to New York already!

[icopress]

Eyewitness Photography  

[eXch]

Eyewitness Photography  

Fortunately the operators survived  :-)

[GazetaBitcoin]

I don't know why the sensation is that the subpoena is not such a big deal but I am worried about eXch. What will you do? Are you going to face them on November 16th...? Or... are you going to be absent and see what happens...?

Besides, I see in that paper that it's stated that it should not be made public... What if they will find about the post from the forum?

Other than that, eXch please don't forget about my previous post, in case you missed it.

[eXch]

I don't know why the sensation is that the subpoena is not such a big deal but I am worried about eXch. What will you do? Are you going to face them on November 16th...? Or... are you going to be absent and see what happens...?

Besides, I see in that paper that it's stated that it should not be made public... What if they will find about the post from the forum?

Is it a big deal for mixers who certainly received many of them already but without a public disclosure? You know the answer, therefore the same applies here. I have purposely linked this post https://bitcointalk.org/index.php?topic=5466272.msg62858665#msg62858665 in the subpoena post to demonstrate that it's an ordinary situation for us to handle, however, I will quote the relevant part from that post here:

Now, in regards to law enforcement requests:

eXch was built with an idea to make operators identity disclosure practically impossible so the service can be resistant to law enforcement. Operational security was our priority #1 from the first steps of the project creation.

We have very strict data retention policies that can be compared to most mixers on this forum. We do not log IP addresses (having .onion domain is a proof for that) or any other user metadata and delete order database records 15 days after order completion. We also provide users with an option to request data deletion immediately after order completion which can be done by pressing the "Delete data" button at the order's page (you can find more information at https://exch.cx/tos).

Keep in mind that we don't differ from any mixer on this forum in regards to risks associated with unwanted data disclosure, since any mixer is also a centralized entity that uses the same database technology as we do and a single database can become a weak point of any service anytime, independently of how many times their marketing speech repeats the words "privacy" and "anonymity". We don't use these words much and instead we use full disk encryption on all our servers to prevent any unwanted situations as much as possible. An unexplained reboot of some server is a sign that a server was compromised and it's a clear attempt to compromise our LUKS keys with a modified bootloader.

We do not cooperate with law enforcement nor have to do so, since we are an anonymous entity that works with cryptocurrency only. A few events that could serve as a proof:

• A notorious blockchain analysis company SlowMist listed eXch as a mixer after Tornado Cash in their 2023 mid-year report https://www.slowmist.com/report/first-half-of-the-2023-report(EN).pdf because we haven't handled any data to them when they were providing assistance to some law enforcement agency in an investigation. SlowMist is a contractor of many LE agencies and if we were their friends who provide all the data, this is how they would treat us: https://twitter.com/MistTrack_io/status/1699926525229863003 (Nitter link)

In the first half of 2023, users deposited a total of 9,983 ETH (approximately $17.72 million) into eXch, and deposited a total of 6,608,354 ERC20 stablecoins (approximately $6.6 million) into eXch.

(Note: they were only able to gather these statistics on the Ethereum blockchain, since we use a single aggregation address 0xf1da173228fcf015f43f3ea15abbb51f0d8f1123 for all Ethereum & ERC-20 exchange operations)

• We have rejected all the data disclosure requests from LE regarding this particular event - https://twitter.com/MistTrack_io/status/1626786730392305664 (Nitter link) - then the same entity comes back because they know we haven't disclosed anything - https://twitter.com/MistTrack_io/status/1701608380941717938  (Nitter link)
• Rejected to disclose any information to LE regarding this event: https://twitter.com/MistTrack_io/status/1698665043288834502 (Nitter link)
• None of the countless LE requests addressed to us were satisfied since our platform launch, because we know what we are doing and why we are here

Note that it's not the first subpoena we have received and published, nor it it will be the last, since we know how to handle such situations. You shouldn't worry about eXch, but should worry about mixers instead.
Note also that Twitter discloses subpoenas to their affected users independently whether there is a gag order or not, because it's their company policy:



[Twitter link] [Nitter link]

Our policy is to do the same, except producing information related to exchanges since we don't have it nor obligated to have it, because we do not operate with any financial instrument according to the current legal definitions of cryptocurrency.

Other than that, eXch please don't forget about my previous post, in case you missed it.

I am fine with all kind of translations in case there is some interest in doing so. This is a community after all.

[dkbit98]

They may not look so popular here on this forum but apparently outside this forum they indeed are, judging by their volume

Very nice volume, and it's not such a bad thing to be under the radar for some people
I didn't hear about eXch from bitcointalk forum, someone recommended it to me and I saw ratings on kycnot.me website.
So far I didn't have a single complain after using eXch for a while, and that is not something I can say for other exchanges I used in past.

Today we were COMMANDED to appear before the GRAND JURY, however, unfortunately all our customers data was lost in the boating accident during transportation of our servers over a river just right before the receipt of that subpoena. Reportedly.

Sorry to hear about terrible boating accident 
It's going to be interesting to see what happens after November 16...

[JollyGood]

It cannot be an easy situation when any individual/organisation (including yourself) receive a Court document demanding various things. Any form of Court summons cannot be taken lightly but from what you have written it seems you have prepared plans. Basically, if you do not have any data on hand because it gets deleted upon user request (or automatically deleted after 15 days), it means there is not much data you have on hand to give to those demanding it.

As you are not obliged to retain information, it seems to be another plus point to use the exchange alongside a no KYC policy.

Our policy is to do the same, except producing information related to exchanges since we don't have it nor obligated to have it, because we do not operate with any financial instrument according to the current legal definitions of cryptocurrency.

[GazetaBitcoin]

I am fine with all kind of translations in case there is some interest in doing so. This is a community after all.

Please find here the Romanian translation in the topic: eXch – schimbă instantaneu BTC / LN / XMR / LTC / ETH / ERC20.

Other than that, I am looking forward to see what will happen on November 16th.

[examplens]

However it's not the first time we receive a court order and provide no data with a reference to our ToS, so I doubt anything will happen at all. Once the process is concluded, it should be publicly available at their .gov site, so we'll just grab some popcorn and read it.

Have some of the previous processes already been concluded or are they still open?
If they were linked for similar charges, can we know the epilogue? Guilty, innocent, some specific penalty or what?

[Etranger]

I believe that the forum is still the fastest and easiest way to find out about new or updated services. It is much more convenient to search here then just google it and wade through the multitude of results in search of what really interests you.

I think this is subjective because you are here and thousands of people have probably never even heard of this iconic place. I also do not agree that Bitcointalk is the best way to learn about something new... if I may, I would rephrase it in the spirit of “Bitcointalk is the best way to learn about some reliable and trusted service.” In the end, my opinion is also subjective. 

Sure, I cannot argue that there are thousands of people who have never even heard of this forum. Actually, nobody from my acquaintances in the "real world" knows about it, and when I tell them, they are quite surprised. But then again, only very few of them made some efforts to learn more after my introduction.

However, i can conclude from my observations by being here, that forum users tend to come here for new pieces of information. They discuss updated and releases here, that is why I believe, they perceive bitcointalk as the fastest way to find out something new. And of course they learn about some reliable and trusted services here as well.

[eXch]

Have some of the previous processes already been concluded or are they still open?
If they were linked for similar charges, can we know the epilogue? Guilty, innocent, some specific penalty or what?

eXch was not charged with anything up to this date. We got one subpoena from a court in Germany 3 months ago and another one from U.S. Secret Service delegated by a court 7 months ago. We weren't notified about any outcome. It indicates that the cases were either archived or are still being elaborated. In any case, these orders assume requesting data from us in a role of a service provider, not the heist originator, therefore it's doubtful they will come with any enforcement action addressed to our service at all since our service is not even USA/Germany based, nor we have any entities that could be exposed to extradition risks.

Apart from that, we had many other requests this year coming from different police departments around the world related to cybercrime investigations.

No data was disclosed from our end to any of these.

We are also working on creating a /transparency section at our website that should be live this month where we will publish each received LE request.

We are very proud to be able to fight for the cryptocurrency neutrality and provide resilient services aiming to countermeasure censorship.

[examplens]

eXch was not charged with anything up to this date. We got one subpoena from a court in Germany 3 months ago and another one from U.S. Secret Service delegated by a court 7 months ago. We weren't notified about any outcome. It indicates that the cases were either archived or are still being elaborated. In any case, these orders assume requesting data from us in a role of a service provider, not the heist originator, therefore it's doubtful they will come with any enforcement action addressed to our service at all since our service is not even USA/Germany based, nor we have any entities that could be exposed to extradition risks.

Apart from that, we had many other requests this year coming from different police departments around the world related to cybercrime investigations.

No data was disclosed from our end to any of these.

We are also working on creating a /transparency section at our website that should be live this month where we will publish each received LE request.

We are very proud to be able to fight for the cryptocurrency neutrality and provide resilient services aiming to countermeasure censorship.

Thanks for sharing this. Honestly, I am quite surprised that there is so much pressure and demand for data, and I am glad that there are still services that will take care of the privacy of their users.
Can you refer to GDPR compliance and care for the personal data of your users when not providing them in such cases?

[GazetaBitcoin]

However it's not the first time we receive a court order and provide no data with a reference to our ToS, so I doubt anything will happen at all. Once the process is concluded, it should be publicly available at their .gov site, so we'll just grab some popcorn and read it.

What happened during previous Court orders? Did you present there? Did you come with a lawyer...? Did a lawyer go there in your name...? Care to share more details about what happened in the previous situations?
Similar, now... are you going to user a lawyer's services for this order?

We are very proud to be able to fight for the cryptocurrency neutrality and provide resilient services aiming to countermeasure censorship.

People like you are so rare... You are a rara avis, eXch!

[OmegaStarScream]

I'm curious as to what's the motive behind adding RUNE? Are you planning to implement Thorchain for cross-chain trading for all pairs? or just RUNE ones? I also want to know, if you're going to use Thorchain directly, or simply use Thorswap?

[dkbit98]

The worst of what potentially can happen is our clearnet domain name seized, in which case we will just switch to some other domain without interruption of operations.

I don't see this a big problem since I already recommend using of onion link anyway.

...which in our case is a nearly impossible task as they will have to break various cryptography standards and decentralized systems in order to reach at least one of our physical ends.

Maybe, unless you have some weak link and leaks from inside your team
I hope nearly impossible is good enough, since we know you are facing powers with unlimited financial sources on the other side.

[eXch]

What happened during previous Court orders? Did you present there? Did you come with a lawyer...? Did a lawyer go there in your name...? Care to share more details about what happened in the previous situations?
Similar, now... are you going to user a lawyer's services for this order?

Answering all your questions would reveal some business details containing information that should remain off-the-record at least till the current subpoena is cleared. However, I would gladly answer your questions via private E2EE communication channels.

I'm curious as to what's the motive behind adding RUNE? Are you planning to implement Thorchain for cross-chain trading for all pairs? or just RUNE ones? I also want to know, if you're going to use Thorchain directly, or simply use Thorswap?

We consider Thorchain's native token (RUNE) a reliable coin since its network brings a lot of benefits to the cryptocurrency ecosystem.

Recently we have launched an experimental feature of ETH/BTC swaps via the Avalanche Bridge, since we had some requests from users who have volumetric ETH/BTC swap requirements that eXch couldn't satisfy and since the Avalanche's Bridge can only be used from a privacy-hostile app called 'Core', we have enabled this optional functionality for them to provide 'rails' that automate the whole process of swapping between native BTC and ETH via Avalanche Bridge. During the development of that feature, we have found out that the Avalanche Bridge is far from being decentralized and that their nodes responsible for bridging BTC and ETH are closed-source and are fully controlled by Ava Labs. We have found that Ava Labs have implemented AML screening (https://medium.com/@AvaLabsOfficial/updates-to-the-avalanche-bridge-dc0d33b1b475) in their BTC and ETH bridging mechanisms that are used to selectively stop certain coins from bridging in order to confiscate these funds (or traditionally speaking - to scam their users). We have also found that they have already confiscated 85 BTC from someone without returning it (https://forum.avax.network/t/why-i-use-core-bridge-has-been-sent-btc-but-i-didnt-received-my-btc-b/1157/3) and out of curiosity reached that victim and chatted with them about this, confirming that their 85 BTC are still being held by Ava Labs without any reason. After creating a disposable Discord account just for research purposes since such communities reside there, we have found that there are more victims who lost their funds to Ava Labs selective scamming. This made us wonder whether providing Avalanche Bridge on our service was a good decision and afterwards found out that their AML screening mechanisms do not affect amounts below 5 BTC, which we have implemented as a limit for these. However, later we have found that there is another network that provides native BTC/ETH swaps with considerable liquidity - Thorchain. After a rigorous research performed by us, we have concluded that it's truly decentralized and makes Avalanche Bridge obsolete, since Thorchain's native swap functionality makes part of the network consensus and its code is fully open-source. We have since decided to replace the Avalanche Bridge rails we provide with Thorchain which will be released this week. We have also found Thorchain useful to rebalance our own liquidity when needed without relying on unsafe and unreliable Web3 ecosystem and codebase that is constantly exposed to dependency supply chain attacks.

Please note that Thorswap doesn't make part of Thorchain at all and as it's just a privacy-hostile frontend for Thorchain, thus, eXch could be used as an alternative frontend to Thorswap (however, for now, limited only to the coins and tokens that we support).

Maybe, unless you have some weak link and leaks from inside your team
I hope nearly impossible is good enough, since we know you are facing powers with unlimited financial sources on the other side.

Our opsec is much better than Bestmixer's, Chipmixer's or Whirlwind's altogether and we haven't made any mistakes in our opsec any close to such were made by them, apparently from the beginning of their existence, as some court data and other events revealed about some of them afterwards. eXch is run by people specializing in infosec since around 2000 that are also cypherpunk culture adepts that follow military-grade standards and guidance to protect their projects digitally and physically, therefore, it's very unlikely that our platform will be smashed due to rookie mistakes similar happened to the platforms I mentioned and some others I didn't. There is always a lot to learn from every privacy-oriented service shutdown (including darknet markets) and we are certainly not next.

[GazetaBitcoin]

Answering all your questions would reveal some business details containing information that should remain off-the-record at least till the current subpoena is cleared.

Oh -- I understand. Perhaps after November 16th you can share some more details about how things took course at the Court? (Obviously, only if the situation will allow you to do it).

[eXch]

Oh -- I understand. Perhaps after November 16th you can share some more details about how things took course at the Court? (Obviously, only if the situation will allow you to do it).

In that particular case it should become available publicly after conclusion, but if we have anything earlier from our lawyer we'll share it. At this time it's not even clear whether they addressed their request correctly, since our legal company name isn't specified in the request. They have addressed a court order to a string "exch.cx" which makes unclear whether it was addressed to a domain name, a website, a host or someone wearing a T-shirt with "exch.cx" written on it.

[Etranger]

At this time it's not even clear whether they addressed their request correctly, since our legal company name isn't specified in the request. They have addressed a court order to a string "exch.cx" which makes unclear whether it was addressed to a domain name, a website, a host or someone wearing a T-shirt with "exch.cx" written on it.

Isn't this an incorrect, even carelessly drafted statement, and therefore it is possible not to give an official answer at all and not to go to court on completely legal grounds? I mean, if they were interested in this, they should have made it clear, whom exactly the addressed to.

[eXch]

Isn't this an incorrect, even carelessly drafted statement, and therefore it is possible not to give an official answer at all and not to go to court on completely legal grounds? I mean, if they were interested in this, they should have made it clear, whom exactly the addressed to.

That's correct. We have already requested clarifications from them but no reply was provided to us. I must also mention that going to any court physically is out of question for us since our team is currently located on a desert island which was the closest habitable location after a boating accident and there are currently no transportation options available for getting to the mainland. Thanks satellite broadband and autonomous energy sources we will be able to remain here for some time. It's a nice place after all.