Bitcoin - The founders of Samourai Wallet arrested!

The two founders of the popular bitcoin wallet Samourai and the Coinjoin service Whirlpool have been arrested this Wednesday.

Hara-Kiri

Keonne Rodriguez and William Lonergan Hill were picked up in Portugal and Pennsylvania by order of the United States Department of Justice.

The servers located in Iceland, as well as the website domain name (https://samourai.io/), have been seized. The app – downloaded more than 100,000 times – is no longer available on the Google Play Store in the United States.

The two developers are charged “with conspiracy to commit money laundering and conspiracy to operate an unlicensed money transmitting business”.

The charges focus on the Coinjoin service (Whirlpool).

A Coinjoin is a transaction that brings together multiple participants. The aim is to obscure the trails so that an outside observer can no longer tell who owns which bitcoins.

The New York court reveals that more than 2 billion dollars of “illegal” transactions passed through Whirlpool, which is said to have facilitated “over 100 million dollars in money laundering transactions from illegal dark web markets such as Silk Road and Hydra Market”.

According to the Department of Justice, Samourai collected the equivalent of 3.4 million dollars in usage fees for its Whirlpool service and 1.1 million dollars for its Ricochet service.

Money laundering and… complicity?

At the center of the accusation are the invitations to criminals of all kinds, including neo-Nazis.

“While presenting Samourai as a ‘privacy protection’ service, the defendants knew that it was a haven for criminals who engage in large-scale money laundering and the evasion of sanctions”, says the indictment.

NeoNazis are welcome to use Samourai to send & receive transactions that cannot be tracked by Twitter mobs & bots. https://t.co/tcNhzr2pAt

— Samourai Wallet (@SamouraiWallet) September 4, 2017

The complaint specifically points out that Keonne Rodriguez publicly invited Russian oligarchs to circumvent American sanctions.

Another service implicated is “Ricochet”. This tool allows for intermediary transactions (known as “hops”) between the sending and receiving addresses.

“Ricochet can prevent exchanges from detecting if bitcoins come from addresses affiliated with criminal activities”, explains the DoJ.

Note that the investigation team was able to access private messages on X.

This message from William Lonergan Hill is highlighted:

“We probably have different views on some basic tenets of bitcoin, you and I – so to each his own so to speak. At Samourai we are entirely focused on the censorship resistance and black/grey circular economy. This implies no foreseeable mass adoption, although black/grey markets have already started to expand during covid […]. “

Will Coinjoins be unraveled?

The co-founders face a prison sentence of 25 years. William Lonergan Hill (65 years old) could end his days in prison.

The question is therefore: Will he cooperate to mitigate his sentence by communicating the users’ “xpub”? Explanation:

There are two schools for conducting a Coinjoin transaction. It can either involve many participants, as done by the Wasabi wallet. Or involve very few participants. Whirlpool does the latter.

The problem with small coinjoins is that they require a preparation transaction. It serves to create several utxos of the same amount and to isolate the “doxxic change” in a distant branch of the wallet.

However, this process requires users to reveal their xpub. In other words, Samourai was able to know all the addresses and the total amount of a user’s wallet (unless one has his own “dojo“).

All this to say that coinjoins conducted with the Samourai wallet could be unraveled in the event of cooperation with the Justice.

This aged like… idk, you tell me. pic.twitter.com/YqrsBlyMFV

— ₿itMan #FixTheFilters (@BitMan_PoW) April 24, 2024

If you’ve used Whirlpool, assume that your xpub is compromised, that all your Coinjoins have been undone, and that the US government knows all your past, present, and future transactions.

Attention now turns to Wasabi and Trezor, both of which offer coinjoin coordinated by the zkSNACKs company. However, this company filters out addresses affiliated with criminal activities using Chainalysis. So it will not be disturbed.

Community Reactions

The founders of Samourai have a controversial reputation and have not made friends over the years. @alpacasw states, for example:

“Bitcoin is not under attack. A pair of arrogant and incompetent developers who openly courted criminals and operated in a way to be easy to be caught, antagonized law enforcement, and jeopardized the safety of their users are under attack. Know the difference.”

GrassFedBitcoin, co-founder of the Ocean pool, echoes this sentiment @GrassFedBitcoin:

“Been called a spook by Scamourai for years along with anyone else that pointed out the flaw in their design. Now you have to trust them not to share the data with the feds that they should never have had in the first place. My sympathy lies with the people they scammed.”

However, there are more messages of support. Like the one from @jessicasolce:

“At no time did Samourai take control of users’ money. They facilitated the transfer of $0.”

Let’s finish by hammering the point that money laundering and privacy are not the same thing. Keeping one’s finances confidential is a fundamental right offered by Coinjoins.

Money laundering is different. It concerns money linked to criminal activities.

Coinjoin coordinators whose code is open-source should not be held accountable for the origin of the bitcoins. Samourai’s mistake was to publicly solicit “crime” money.

Here is a guide to recover your bitcoins that may be blocked on the Samourai wallet.