Hacker News new | past | comments | ask | show | jobs | submit login

At Poloniex, we quickly blacklisted this address. Prevents all of our users from sending money to them. Many exchanges likely can do the same thing.



If anybody here ever finds themselves in the same dilemma, use Morphtoken over TOR to swap to XMR, a completely different blockchain.

This makes all the chain analysis companies and the armchair blockchain sleuths simply follow transactions on the bitcoin blockchain forever, thinking they are doing something productive with their lives, while you have hopped over to another chain that they can't track assuming they even noticed that you swapped.

That was a viable last decade solution and is unfortunately centralized, this decade in 2020 you can also use the decentralized renBTC to permissionlessly lock up and mint your bitcoin as an erc20 token on the Ethereum blockchain. So now you are really liquid and have access to the entire decentralized finance economy.

But again, if you really want to get government bucks and an unlinked trail, you need to sell the renBTC token for Ether and move that Ether into either Tornado.cash for a little while, or go back to the centralized solution like Morphtoken and swap the Ether for XMR as XMR has an inherently stronger anonymity set than anything else.

Peace.


Just to be clear, this is a step by step process for how to launder money, right?


No, as it doesn't detail necessary reintegration into the economy. You will need to offer a service for crypto which you report taxes on. Your "customers" either pay directly in XMR which there is no trail on, or they swap the XMR back for a more likely used cryptocurrency like bitcoin or Ether, and pay you with that. So now it is.

In any case as your lawyer might tell you: if the origin is illicit it is money laundering. If the origin is not illicit then its not money laundering.

The irony being that it is the onus of the accuser to determine the origin, and if you do it right that is not possible to know in any scenario. Typically money laundering then is a tacked on charge, after other clear evidence is already known, to help ensure a conviction.

But really at this point, its probably better if your public resources weren't spent on flagging transactions in the first place, and if the private sector was not burdened with doing this work for the state.


What should someone do if they want to turn legal funds into anonymous crypto? Do you think BTC->XMR is a sketchy thing to do if the BTC is linked to your identity?

I'd like to have some anonymous money just in case the future gets really dark, but I'm not sure if it's wise to flag myself as a BTC purchaser that changes to XMR.


Define sketchy? Many of us buy and sell XMR under our real identities regularly, and don't have any problems.

Of course, if the future is dark enough for a list of everyone who has ever bought XMR to be compiled, then your name would be on it, along with mine.

If you're worried about that, I suppose you could distribute the XMR to a bunch of different addresses over some length of time. (All addresses you control, unbeknownst to the authorities.) Then if they do hunt you down you have a plausible story that you spent it all.


is that how you really think?

stop using surveillance coins to begin with and just use Monero natively instead of as a conduit

In the mean time pollute the pool by doing more lawful transactions in monero, monero is half as old as bitcoin and has only been used on darknet markets for half of that due to its older user experience challenges

Just swap to the more fungible asset. Its a flight to liquidity the market always chooses that.

The state just figured out how to use transparent blockchains as a tool a decade late and the market has already moved on


You have the right ratio of technical knowledge and command of language to potentially make anything you write, believable. Do you have a blog of sorts?


I'm glad to read that, I just hope it is enough information for everyone reading this to be able to independently corroborate, without any further knowledge of my credentials.


Best way is to find someone on a service like local bitcoins who can meet you in a public place and sell you btc for cash. You can wait a bit to get a couple confirmations.


It's too time-consuming and/or dangerous to do any meaningful amounts, and it is monitored. You would probably have to wear a mask at the drop as well and things like that. Safer to just coinjoin + mix + xmr.


Buy mining equipment and start mining.

The ROI won’t be great but you’ll have virgin coins to do what you want with.


^ this right here if you're patient and only need to break even.

even in hot climates where power isn't cheap enough, buying digital asset mining computers to breakeven or even take a 5-8% loss is the best way to convert any amount of money from that local economy into the global digital economy.


For small amounts, to pay for VPNs or whatever, find an exchanger who you trust, and ~anonymously mail cash to them. Then anonymize the cryptocurrency. For Bitcoin, mix multiple times, via Tor (Whonix) and using a different wallet and mixing service for each mix. If you lose some, it's no big deal.

For real money, hire someone who knows what they're doing.


> If the origin is not illicit then its not money laundering

It is if done for purposes of e.g. avoiding taxes or purchasing illicit goods.

That said, obfuscation per se is not illegal in most jurisdictions.


so like an illicit origin? :)

yes, people need to be aware of the universe of illicit origins. When I was working for the US government most of the people indicted under these laws (structuring, avoiding reporting thresholds, and then obfuscation so money laundering) were not terrorists or drug dealers. They were people like landlords freaking out because a tenant was suing them and they wanted to move their money without triggering a real or imagined $10,000 threshold. Whoops structuring is illegal straight to jail and we’ll take the money too! Tenant lawsuit still pending lol.

All while HSBC completely undermined the ‘purity’ of the licit financial system in the tune of billions over many years on behalf of the LITERAL CARTEL. Guys, 9/11 wasn’t that expensive to pull off, and today’s compliance measures wouldnt have flagged those wire transfers, so who is this for?

Stigmatizing the whole concept of having money and moving money has been an expensive and unnecessary and fruitless exercise. While increasing the costs of offering a financial service.


Also obfuscating money can be important for an individual's safety. For example for victims of domestic abuse or human rights activists in repressive countries.


Also the safety of individuals against government overreach, like people living in Xinxiang or Hong Kong.

Non-political checks on the power of the state, like cash and its electronic corollary, private digital currencies, are needed in case of the failure of the political system to prevent the state from becoming oppressive.

An institution like physical cash can be powerful/deeply-embedded enough to survive totalitarian governments.


> so like an illicit origin?

No. The obfuscation of licitly-acquired funds used for illicit purposes is still money laundering.


I doubt that is the case world-wide, right?


In the US, "tax avoidance" is a term which describes procedures that are always legal. When you stated "avoiding taxes" I believe you really meant "tax evasion".


> That said, obfuscation per se is not illegal in most jurisdictions.

And it can't be, as long as fiat money exists. There's no tracing involved in passing notes around. The only times fiat transactions become suspicious is if you try and cross a border with a lot of cash or valuables on hand, which is where crypto comes in because it knows no borders. This makes law enforcement nervous.

I'm sure that besides crypto there's many ways to move large amounts of money or valuables across borders though. The rich do it, they just set up shell companies and pay licenses for intellectual property, paying a token amount of corporate taxes.


> The irony being that it is the onus of the accuser to determine the origin

Not really, you need to be able to justify to the tax authority how you got in possession of any amount of assets you have and prove you pay taxes on it.

So if a large amount of money eventually show up in your bank account (or you buy a house or any other "visible" asset) and it is not compatible with your previous tax returns it is likely the tax authority will notice it and at that point you are fried


That’s the point of reintegration.

Reread that paragraph and dont skip it this time.

You run a very successful fly-by-night VPS service paid for only in crypto. There is a decent sized market for that by the way. Too bad most of your customers are fake, anyway be diligent and actually mimic your customer behavior over TOR.

Run a subscription service.

Figure it out. Some to all of your customers will be fake because it will just be you making more accounts and paying yourself.

Report taxes on your wildly successful SaaS cloud business.

Assuming you even want govbucks, you deposit the clean crypto into your business and personal bank accounts.

No different than cash based services except its online/digital native and not constrained by local market liquidity and brick and mortar overhead.


How do you explain your business suddenly failing after you're done transferring your old funds into it?

And isn't it easier to simply cash out XMR you've allegedly mined back in 2014? Long-term held. cost basis zero, capital gains rate 20% max in the US. That's even better than the 21% corporate income tax.


You are right; also I would imagine the tax authority does not even care too much about where the money came from, they just want to make sure you paid enough taxes. Criminal investigation agencies of course do care.


The IRS has a criminal enforcement department, and they absolutely investigate criminals and press charges that have nothing to do with tax evasion. Often they work with other branches, but they are fully fledged FBI agents and can prosecute any crime they want.

Usually they do that when they stumble upon them during tax/laundering investigations, but they'll prosecute anything.


I's a guide on how to pay privately with cryptocurrencies. You should still report and pay tax for private cryptocurrencies.

Privacy and tax evasion are not identical..


correct, if the origin is illicit it is money laundering. If the origin is not illicit then its not money laundering.

the licit private transactions are indistinguishable from illicit


Illicit money that you pay taxes on is generally not problematic, at least to the IRS. You probably still need to worry about other three letter agencies, though, depending on how it is illicit.

Edited to add: I’ve heard of drug dealers doing it. Whether it’s true or not I can’t say.


how exactly would one do that (pay taxes on illicit $)? are there public examples of it?


According to the IRS[1] "income from illegal activities, such as money from dealing illegal drugs, must be included in your income on Schedule 1 (Form 1040 or 1040-SR), line 8, or on Schedule C (Form 1040 or 1040-SR) if from your self-employment activity." So I guess you'd just count it as "other income" on your 1040.

[1] https://www.irs.gov/publications/p17


Thats a trap my guy, you are incriminating yourself when reporting that

That’s the point of criminalizing all options


Are you?

Or just avoiding an easy conviction under tax evasion laws?


paying taxes on illicit activities = relying on admitting the illicit activities either directly on the tax form or in an audit = FAIL

not paying taxes on illicit activities = tax evasion and likely discovery of illicit activity in criminal investigation = FAIL

money laundering = illegal if the government has determined the source is illicit = FAIL

those are the options and deterrents.

if you money launder with proper obfuscation, you wind up with money that you do pay taxes on and will never trigger an investigation.


Indeed. As the old saying goes, Al Capone got nailed on tax evasion. As I understand it, the IRS is more interested in the amount than where it came from.


Capone got nailed for evasion because his brother got nailed for evasion and he got scared so he tried to preemptively normalize his own tax situation but in doing so indirectly admitted that he hadn't paid taxes, so they busted him with no further evidence required.

But they also were trying to bust him for evasion because he declared zero income and lived a visibly lavish lifestyle. The government was gathering evidence on his spending to estimate his income and how much he evaded.

You can't sustainably solve that problem by simply paying lots of tax on magic illegal money, especially not in today's interconnected world. Laundering is core to the solution.


Isn’t that the purpose of money laundering, to create an income stream so that you can pay taxes on it? I don’t know tax law in depth, but it seems like if one could just report to the IRS anonymous money it would largely obviate the need for money laundering at all. Of course there’s the question of other gov agencies.


You can always cash out "Bitcoin you [allegedly] bought back in 2010", or Monero you mined back in the day so there's no way to even prove its source, and declare that to the IRS. With a cost basis of almost zero, you'll pay long term capital gains tax, 15% or 20%.

BTW when you declare your crypto gains, the IRS not only does not care about the source, there's not even a place on the forms to list the source.

That might change in the future though.


But also don’t do that

You want to unlink the transactions


There are other reasons why someone would want financial privacy other than to commit financial crime, just as there are other reasons why someone would want communication privacy other than to conspire to commit a crime.


"Yes"


“Yesnt”


Coinbase apparently did also: https://news.ycombinator.com/item?id=23852054

I'm betting Gemini also blacklisted that BTC address, especially considering that they were in the first wave of fake tweets.

Really wondering now just how much BTC the attacker effectively left on the table by reusing a single wallet address, especially considering that lots of people who deal in crypto use just a handful of exchanges to send it. Would be pretty difficult to quantify, though.


You should also make the users that try to send money take a mandatory class in detecting obvious scams before continuing to use your service.


One of my former employers used a security company to regularly send out very well designed phishing emails with personalized links. Clicking a link or opening an attachment got you a call with IT plus a mandatory class in how to avoid phishing.

The success rate of those simulated attacks dropped drastically after the first few tries. Maybe if more companies did this it would also help fewer people to fall for it outside of work.


The sad thing is that people probably stopped clicking them because they think "Its another dumb IT trick". I guess it works well enough though.


I remember a debate in the 90’s on if consumers should have to get licensed (like ham radio operators) to use a personal computer on the internet.

Maybe eternal September wouldn’t have happened...


Just do a coin join transaction. These kind of blacklisted addresses can be easily bypassed.


They can whitelist again for a certain amount.


While this is a good measure, what does it mean to the decentralization promise of Bitcoin?


People who use exchanges are traders (retail or professional) and hodlers who don't want to deal with the intricacies of managing 100+ coins on 50+ blockchain networks. The decentralization of cryptocurrencies is not an all-or-nothing proposition - users can choose the level of decentralization they would like based on their preferences.

What I like most about decentralization is that anyone in the world can create a new crypto business on the blockchain rails, integrate with everyone else, and attract users. Of course there are real-world repercussions if your physical entity is in a locale with laws that you violate, but it is orders of magnitude easier to start a crypto exchange than a traditional bank.


Won't this end up like email, though? Sure, anyone can set up their own business... however, 90% of people will be on a few large providers, and those providers will end up blocking transactions coming from unknown new providers (to prevent scams). Decentralization doesn't stop consolidation.


It is much easier to set up your own cryptocurrency wallet than it is to set up your own trusted email server. Your metaphor is similar but off by a large amount. The major difference is that blockchain deals primarily with money, so email spam (useless worthless messages) is inherently less worthy of sending because doing so actually pays me, in addition to the fees you pay the network.


It used to be pretty easy to run your own email server, back when a lot of people did it. If someone is worried about a future where most cryptocurrency runs through a small number of providers, as email does today, I don't think they should find your comparison heartening.


I see what you are saying, I know SMTP fairly well, used to run my own server, and looked fairly deeply at DKIM / SPF / DMARC. However I also know blockchain protocols intimately, and I can say with certainty that the Bitcoin protocol and SMTP are completely different (as well as Ethereum, Monero, Stellar, Ripple, EOS, Tron, and on and on). It is just a completely different thing.

If you are worried about other wallets not accepting "my" wallet, as is the typical problem with hosting your own email, you don't need to worry. Money is money, if I receive it I receive it. It's just completely different from receiving a text-based message like the wide-open and free SMTP is.


It's not that easy to setup your own wallet. Most require you to download the entire blockchain if you want to be completely independent of a third-party.


What's not easy about downloading the blockchain? All you need is to have enough free space, press the button, and wait a while.


Bitcoin is around 270GB. Monero is around 64GB. These aren't trivial downloads, and then you'll need to leave the wallet running to stay in sync or you'll have lengthy waits while it catches up the next time you run.

Most people can open a credit card or bank account in 30 minutes or less. Waiting a week for a blockchain to download is a non-starter for most.


Actually, it's over 300GB for Bitcoin and almost 85GB for Monero today.

Regardless of that, I recently synced Monero from scratch in 3 hours, over a 802.11n network that never seems to do better than ~75Mbps. We can extrapolate that Bitcoin would be done in something like 9.5 hours. So I don't know where you got a week from.

If you still don't like that, you can always use a remote node, in which case you can begin using a new account literally immediately, even better than your 30 minutes at a bank.

IMHO that is a perfectly fine tradeoff for a new user who doesn't want to commit to syncing the blockchain. Nevertheless, when I deal with new, non-technical users in the Monero community, I find that they almost always prefer to run their own fully synced node, even though they understand the tradeoff (i.e., that using a remote node is probably fine). I even had a guy that has no computer, phone only, looking for help on setting up a full node on his phone.

Anecdotal perhaps, but it certainly makes me skeptical of the claim that blockchain size is a big hurdle for many people at all.

Oh yeah, and just for completeness: you can prune the blockchain with both Bitcoin and Monero if storage space is a concern, reducing it by something like 70%.


Using any third-party removes the benefit of not using a third-party.

Also I'd test your speed report, but ultimately I don't want waste 300GB or 85GB of my monthly download cap on that experiment. In the past download was slow and CPU usage was high while syncing. I don't see people running to devote a large portion of their internal storage or download cap for crypto, unless they are crypto enthusiasts.


> Using any third-party removes the benefit of not using a third-party.

No, it doesn't. Why would you make such an absurd statement? Using a remote node is nothing like using a centralized payment processor. For one thing, they can't gain access to your funds. For another, there are thousands that you can use interchangeably.


It's as simple as it sounds. Relying on a third-party means you're relying on a third-party.

If you're relying on a completely hosted webwallet, then you really don't know that they don't have access to your funds. If you use something like Electrum then there is less risk, but you're still relying on a third-party to relay accurate information to you about the blockchain, which could possibly open yourself up for attacks(albeit complex and likely limited in scope). Every new tool/service adds more layers, and means more trust of third parties is required.


> which could possibly open yourself up for attacks(albeit complex and likely limited in scope)

It's laughable to compare this to using a third party which can hold your funds indefinitely and censor your transactions with no recourse for you. That's very simple, and unlimited in scope.

Sure, running a local node is even better, but using a remote one doesn't "remove the benefit." That's nonsense. It removes maybe the bottom 1% of the benefit while leaving the other 99% intact.


There are conveniences associated with the banking system, such as someone compromising your account, there is a large chance you'll get your money back. Unless you're friends of the crypto devs to force a fork, then you're likely screwed with crypto if your wallet is compromised.

I didn't say it removed all benefit, but removed the benefit of "not relying on a third party", because you are. It sounds like you're saying "you can most likely trust those third parties", which is not the point of being independent.


No, that isn't what I'm saying at all. What I'm saying that the level of trust required in a remote node is so minimal as to be almost negligible. Realistically, the worst they could do is deny you service, at which point you can just switch to any other of the thousands of nodes out there.

It's simply not comparable to trusting a third party that can block your transaction without recourse and/or hold your funds indefinitely.


Sure, but even with E-Mail there are a lot of smaller service providers. It's not _ideal_, yes, but the situation is at least a tad better and one failing company will not destroy the whole ecosystem.


Kinda similar to like under a gold standard you don't actually pay with gold. You can, but most people just use centralised "wrappers" around gold in the form of bank notes.


I don't know of any countries that are still on a gold standard.


Neither do I


There is no gold anymore, mate.


Well, it's not there's no physical gold, but there's still a shortage. So it's pretty easy to get spot price, even from a local shop. And if you have substantial amounts to sell, you may get spot price plus several percent.

Also, I've read that silver is hot now, given the likely surge in the silver/gold ratio.


Any gold dealer begs to differ.


It means dont keep your money at exchanges if you want to control them


Also protects the stupid. You can still send this address BTC. You just need to withdraw it to your own wallet first. Which buys the user time in which to discover it's a scam


It means that to block these funds every single recipients must block the address.


In this case you could just create a separate wallet and send BTC through it. Sounds like Poloniex does its job better than your own wallet here.


Just because you can stuff dollars under your bedsheets doesn't mean you can't also use a bank.


How many users tried to send to this address?


Did you mean to say "denylist"? :upside_down_smiley:


why would they convert btc into usd? they are not stupid.


like trying to stop a steam roller with a mattress

obv the hackers will likely use multiple addresses


The weak link here is: to run a successful scam, you need to publicize the incoming address widely. That allows exchanges to block it. If you keep the address in secret, you can't get the gullible masses to fall for it.


One per Twitter account would have worked better in this case.


More database rows of blocked addresses?


Well, having to trawl for all of them, versus needing to find only one. I assume that leaves the window open longer.


It would be reasonable for exchanges to parse Twitter feeds and other social channels for anti money laundering and fraud signal, similar to Github shipping AWS secrets accidentally exposed in commits to AWS for triage/suspension.

Once you’ve got the infra in place, you can have AML and other compliance staff triage and action from a dashboard (blocking suspect transfers until further review has been performed, and releasing transfers of a review shows nothing suspect).

(Have done some AML/KYC work in the fiat finance space)


One thing I've learned in life is that nothing is as polished or automated as you'd think. I would be surprised if anybody was doing this except maybe high tier law enforcement.

Only because I've seen first-hand how advanced their taint analysis is, so I'm already over that surprise.


There are companies that do that and make AML/KYC databases for the exchanges to use.


multiple addresses, mixing, small batches, etc. there are tons of ways to evade exchange restrictions.


You can, but typical spam target won't, because they don't think they need to - they think it's a legit thing so they don't need to make any effort to hide it.


The most recent Elon Musk tweet (2:38 pm PDT; I cannot believe Twitter hasn't locked this down yet) used the same address.


i saw another one 2 minuses ago. remarkable twitter has not fixed it yet.


I read somewhere that they hacked it multiple times. The first tweet got taken down and then it got posted again.


That doesn't sound very decentralized and trustless. If I want to get scammed in this brave new world, shouldn't I be allowed to? Maybe I want to fund the Nigerian Prince's get-out-of-jail efforts.


You're allowed to, but if you intentionally get yourself scammed knowing full well, you don't get to demand your money back.

In the traditional banking and commerce system, if you get scammed on, say, ebay, they will refund you. If someone hacks into your online banking, the warranties set by your bank will refund you (to a point). If your bank goes tits up, the national bank will compensate you.

Yes you pay a fee, but it's insurance.

Anyway, your statement + the actual scam in question just reminds me of eve online, where the money doubling scam is old as balls. The funny thing is that the operators of the game allow it - nobody stole money from you, you gave it away. Some scams there are long hauls, people slowly working their way up in the ranks of a corporation before liquidating the assets and taking the money. Again, the company behind the game will do nothing because their systems have not been compromised - YOU gave the person access to the company wallet. It's funny.

Bitcoin is the same, you're responsible for your own actions, you don't pay an insurance fee, you bear all the risk yourself. If you give your BTC to an exchange and they get hacked, that's on you because you moved your money out of your own wallet. They may compensate you (or print their own money to do so), but they may not have to.


I am glad I am not the only one who saw this and immediately thought of Eve. I was always surprised at how many people got suckered into this scam on eve even after it was well known.

CCP's policy on allowing this type of grift is fair, if greed overtakes rational thinking then the 'victim' has no one to blame. Granted in this case they used trusted twitter users to trojan their scam, not sure that has happened on eve.


The block only affects people moving coins from an exchange account. Those coins are, in the final analysis, still controlled by the exchange. It doesn't affect anyone who is moving coins from an account they directly control (i.e. have the keys to).


That sounds like centralized with extra steps


How can you justify a statement like that? Anyone can control their transactions if they want as was just explained to you. If anything it is decentralization with extra steps.


Is cash, which functions in effectively the same way, not usually recognized as centralized?


In this context not at all. No one controls who you give physical cash to. If someone promises you magic beans in a bar and you give them $1000, no one stops you, just as when you control a balance, nothing stops you from sending it to any address you want. I'm not actually sure what part of this is not clear.


Thats what Bitcoin exchanges in Russia are for.


So much for "Bitcoin is anonymous, decentralized and nobody controls it".


It is - all the exchanges in the world can't stop you from making the transaction if you want to.


Bitcoin has never been anonymous, only pseudonymous.


- You still don't know who (which individual) is behind the BTC address, because bitcoin is anonymous.

- It is decentralized, but some exchanges process big percentages of conversions. Transferring the coins to other BTC wallets is decentralized. Moving it out of the BTC blockchain is often done through exchanges though, but there's a lot of them, and you can avoid the exchanges as well.

- No, everybody controls it; it's a consensus-based system, so if enough people agree on taking things in one or another direction it will. Look up "hard fork" in the context of BTC.


Hah not only that but guess which BTC just became less fungible


if you are having trouble getting liquid because a has-been exchange flagged your address, I wrote a guide


Link?


My comments history




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: