SHUM — Should Have Used Monero

Binance data handover puts Russian man away for 13 years over Ukraine donations

A man in Russia was sentenced to 13 years in prison because Binance decided it would be a good idea to share his donations to Ukraine with the Russian Government.

Yuri Belenkiy, a Russian IT specialist living in Bulgaria, was sentenced on 26 October to 13 years on 'terrorism financing' charges over cryptocurrency donations to Ukraine — after Binance handed his account data to the Russian government. KYC/AML surveillance data collected by an exchange was repurposed by an authoritarian state to prosecute the account holder. Monero has no counterparty that can be squeezed for your history. Used instead of Monero: KYC'd crypto on Binance. More: @L0laL33tz (x.com)

Feds track down random Ethereum node operator via Etherscan and Verizon to force court testimony

Feds hunt random crypto node user and force court testimony. Tracked via Etherscan and Verizon to prove New York jurisdiction under subpoena threat.

Federal prosecutors hunting venue for a $50M+ crypto theft case in the Southern District of New York needed to prove the stolen funds had passed through New York. They found Dylan Brodeur, who had simply run an Ethereum node from his home 2021-2023 and checked his rewards on Etherscan — and tracked him down by correlating the IP behind his Etherscan account with Verizon network records. Contacted in September 2026 under subpoena threat, he testified in court for about ten minutes, confirming his node's New York location so the trial could stay in SDNY. Merely operating Ethereum infrastructure and looking up rewards on a public block explorer was enough to deanonymize a bystander and drag him into someone else's criminal case. Used instead of Monero: Ethereum (as infrastructure victim — transparent chain node with an identifiable operator). More: @BitcoinArchive (x.com)

HEX / PulseChain founder Richard Heart detained in Istanbul on Interpol notice

Should've used Monero (quoting Watcher.Guru on the arrest)

Turkish intelligence and police detained Richard Heart (Richard James Schueler) in Istanbul's Beşiktaş district on an Interpol Red Notice requested by Finland over alleged aggravated tax fraud; reports cited ~$4M cash, dozens of luxury watches, electronics and firearms seized. Extended SHUM meme rather than a classic transparent-ledger failure — the notice was for tax fraud, not coin choice. Used instead of Monero: (nothing — meme applied loosely). More: CoinDesk: Heart arrested in Istanbul (coindesk.com); @MoneroChanSOL (x.com)

UK trader robbed at knifepoint for $800k in home invasion

just got my house invaded, taped up held at knife point & robbed for $800k

A UK-based crypto trader posted that armed robbers invaded his home, taped him up and held him at knifepoint until he transferred roughly $800k, then moved the loot to a traceable Solana wallet he linked publicly. A transparent chain made his holdings visible and his address a target — criminals can watch balances and plan physical attacks, a risk that grows with every public ledger balance. Used instead of Monero: traceable crypto on a transparent chain. More: solscan wallet (solscan.io)

Ledger supply-chain theft proceeds traced through Tornado Cash and Zcash

hackers just used ZEC and got caught, best time ever for the phrase Should Have Used Monero

Funds from a Ledger hardware-wallet supply-chain attack (~$86–103M across hundreds of addresses) were moved through Tornado Cash then into Zcash shielded pools and on to USDC. Investigators including @YFarmX claimed to match 108 Zcash exits by exact value and gas-payment patterns. Tether froze ~$10M USDT. fluffypony posted 'SHUM'; researchers stressed Zcash cryptography itself was not broken — the trail came from metadata and exact-value matching on an optional-privacy coin. Used instead of Monero: Zcash, ETH, USDT, Tornado Cash. More: @fluffypony (x.com); @n1neshards (x.com)

Viral thread on Tether's destroyBlackFunds burn function

TETHER CAN DELETE YOUR BALANCE.

A widely shared post explained that the USDT contract has had a destroyBlackFunds function since the 2017 Ethereum deployment: after an address is blacklisted, Tether's owner multisig can zero the balance, reduce supply, and later remint the same amount elsewhere. The post cited a March 2025 Massachusetts DOJ forfeiture of ~$9M USDT that used burn-then-reissue. The issuer can not only freeze but permanently delete a stablecoin balance — Monero has no equivalent off switch. Used instead of Monero: USDT. More: @XBToshi (x.com)

Conduit sues Tether over a $2.76M USDT freeze

Conduit Technology (cross-border payments firm)

Conduit filed in SDNY alleging Tether froze $2.76M of working-capital USDT on 24 Sep 2025 and has refused to release it. The company says Brazilian police and a Brazilian court confirmed its treasury wallet was never on the seizure list, and that the freeze forced layoffs. Issuer freeze of a stablecoin treasury, even when the holder says it was never the target. Used instead of Monero: USDT. More: Conduit sues Tether over $2.76 million f (theblock.co)

Empire Market co-creator sentenced to 40 years; 2,814 BTC forfeited with partner

A dark web drug market operator was sentenced to 40 years in prison and agreed to forfeit 1,230 bitcoin. His partner also forfeited 1,584 bitcoin, totalling 2,814 bitcoin worth $231 million.

Raheim Hamilton, co-creator of Empire Market (2018–2020, 4M+ transactions, $430M+ volume, ~$375M in net drug sales), was sentenced to 40 years and fined $5M by Judge Seeger in Chicago. He agreed to forfeit ~1,230 BTC plus 24.4 ETH and three properties; co-creator Thomas Pavey pleaded guilty separately and agreed to forfeit ~1,584 BTC, gold bars and more properties. The market relied on Bitcoin and even encouraged mixers — and the proceeds still sat on the transparent chain to be seized. Used instead of Monero: Bitcoin.

Arkham says it identified 97% of Strategy's Bitcoin despite Saylor

Michael Saylor / Strategy (MicroStrategy)

Arkham posted that Saylor said he would never reveal Strategy's Bitcoin addresses, and that in May 2025 Arkham had already identified 97% of them. Labelled wallets held about $40.3B on-chain plus $15.5B tagged at Fidelity, ~78% of Strategy's BTC. A public chain makes even a corporate treasury clusterable; SHUM replies treated it as the same transparency problem. Used instead of Monero: Bitcoin. More: @kyc_rip (x.com)

Senate/WSJ: 84% of Iran-sanctioned wallets used USDT

Wallets sanctioned over Iran ties; Tether as the rail

Cointelegraph reported a US Senate investigation, citing the WSJ, found 84% of wallets sanctioned over Iran ties transacted exclusively or nearly exclusively in USDT. Related reporting the same month described a DOJ seizure warrant for about $61M in USDT tied to Iranian oil revenues, and Tether saying it had frozen more than $5B across law-enforcement cases. Sanctions enforcement on a public stablecoin ledger; same punchline as the May 2026 Iran seizure. Used instead of Monero: USDT. More: @Cointelegraph (x.com)

Andrew Tate prison remark about Railgun

Unnamed crypto prisoners referenced by Andrew Tate; replies from Monero users

Tate posted that he overheard crypto guys in federal prison saying they should have used Railgun. Monero users replied that they should have used Monero. Transparent or account-based privacy tools vs protocol-level private cash. Used instead of Monero: Railgun, Bitcoin/Ethereum privacy tools. More: @hazae41 (x.com)

Coinsbuy wallets drained of $7.9M; proceeds swapped toward Monero

Coinsbuy-linked wallets and the attacker

On-chain investigator Specter flagged ~$7.9M leaving Coinsbuy-linked Ethereum and TRON wallets on 9 Aug 2026. Funds moved through exchanges including ChangeNOW, FixedFloat and BingX; part was converted to XMR. ChangeNOW froze a six-figure slice. Coinsbuy paused deposits and withdrawals, then restored them. Inverse SHUM: theft on transparent chains, then a jump to Monero. The part that had not yet converted was still freezable at the exchange. Used instead of Monero: ETH, TRON tokens. More: Coinsbuy wallets lose $7.9M as funds mov (cryptofolds.org)

Strike / Wallet of Satoshi demanded Lightning sender identity

Strike user who received sats via Lightning (Wallet of Satoshi)

Custodial Lightning platform demanded the sender’s full legal name or it would return the funds. Custodial Bitcoin/Lightning is not private; platform can demand identity. Used instead of Monero: Bitcoin Lightning via custodial wallet.

Santa Catarina Civil Police seize self-custodied crypto via Chainalysis

Brazilian couple accused of diverting company funds

Police seized ~$72k in self-custodied crypto. Tools cited: Chainalysis Reactor + Wallet Scan. Self-custody of BTC/ETH/SOL is not anonymity; public addresses are traceable. Used instead of Monero: Bitcoin, Ethereum, other transparent coins.

Tether freezes wallets

Holders of frozen USDT addresses (TRON example cited)

USDT freeze of ~$54,714 on a TRON address as part of a larger freeze cycle. Centralized stablecoins can be frozen; Monero cannot be issuer-blacklisted the same way. Used instead of Monero: USDT.

ZachXBT traces $120M USDT; Tether freezes $72M; part swapped to Monero

Unnamed entity moving 120.2M USDT on Tron

A Tron address received $120.2M USDT and routed funds across exchanges, instant swaps, bridges, and Monero buy orders that spiked XMR. Tether froze a related address holding ~$72M USDT. The leftover USDT was freezable; the part that reached Monero was the part investigators could no longer follow the same way. Used instead of Monero: USDT. More: Monero Jumps 30% After ZachXBT Traces $1 (thedefiant.io)

Circle blacklists a privacy-protocol contract

Users of a privacy protocol whose contract address Circle blacklisted

Issuer blacklisted a privacy-tool contract; users described as rugged. Account-based / contract privacy on a transparent chain can still be frozen at the issuer or contract layer. Used instead of Monero: Circle/USDC-related privacy protocol.

FBI Operation Blackout seizes ~127,000 BTC

Targets of a crackdown on scam compounds / organized crime

Reported record forfeiture of ~127,000 BTC (~$8B at then-prices). Large BTC holdings on a public chain can be identified and seized. Used instead of Monero: Bitcoin.

US boasts ~$1B in seized Iranian-state crypto

Wallets attributed to Iranian state actors

Bessent quoted as saying wallets were grabbed; ~$1B seized to date in that campaign. State-linked transparent-crypto wallets can be identified and seized. Used instead of Monero: Bitcoin and other transparent crypto.

Pope failed a bank security check joke-SHUM

Pope Leo XIV (news story about a US bank not believing him on the phone)

Viral story that a bank hung up when he said he was the Pope. Used as a joke SHUM, not a crypto tracing case. Humorous extension of the meme to traditional banking identity checks. Used instead of Monero: bank account.

$282M hardware-wallet social-engineering theft swapped into Monero

Unnamed victim and attacker tracked by ZachXBT

Attacker stole ~2.05M LTC and 1,459 BTC via hardware-wallet social engineering, then rapidly swapped most of it to XMR through instant exchanges. XMR spiked ~70% and printed an ATH. Inverse SHUM: the attacker used transparent coins to steal, then used Monero to disappear. Community used it as ‘this is why people convert’. Used instead of Monero: Bitcoin, Litecoin. More: Hacker steals $282 million crypto from a (coindesk.com)

Cryptomixer seized (Operation Olympia)

Cryptomixer operators and users; ransomware gangs including DPRK-linked actors

Swiss and German police seized Cryptomixer servers/domain. Europol said it helped launder >€1.3B since 2016; >€25M in BTC confiscated plus 12TB of data. Another centralized Bitcoin mixer taken down; same punchline as Samourai/ChipMixer/Helix. Used instead of Monero: Bitcoin mixer (Cryptomixer). More: European police dismantle cryptocurrency (cybersecuritydive.com)

IntelBroker / Kai West arrested after one Bitcoin payment

Kai West, alias IntelBroker

Hacker who sold stolen corporate data insisted on Monero. In January 2023 an undercover FBI agent got him to accept one $250 BTC payment. That BTC path through KYC (Ramp/Coinbase etc.) identified him. Classic downgrade attack: should have stuck to Monero only. Used instead of Monero: Bitcoin (one undercover payment). More: Monero-only hacker IntelBroker caught af (dlnews.com)

~3,520 BTC (~$330M) swapped toward Monero after a theft

Suspected hacker(s) flagged by ZachXBT

More than 3,520 BTC moved into XMR, pumping the coin ~45%. Derivatives open interest jumped in parallel. Inverse SHUM: stolen BTC was converted to Monero to break the trail. Used instead of Monero: Bitcoin. More: Did the $330M BTC hacker double down on (coindesk.com)

Bybit hack / Lazarus laundering — community asked why not Monero

Lazarus Group / DPRK-linked hackers

Huge Bybit theft. A large share was washed through ETH, THORChain, and no-KYC venues such as eXch rather than going straight to Monero. Essays and threads asked why they did not just use XMR. Nation-state thieves still often stay on transparent rails for liquidity, then get followed. Used instead of Monero: ETH, BTC, THORChain, centralized mixers/exchanges. More: Why criminals often skip Monero even aft (medium.com)

Victim robbed of ~$4M in visible crypto

Unnamed holder targeted because holdings were visible

Person robbed of about $4 million in crypto. Community framed it as a consequence of public balances. Transparent chain reveals wealth; privacy argued as physical-safety issue. Used instead of Monero: transparent cryptocurrency.

Wasabi Wallet / zkSNACKs withdraws from the US after Samourai arrests

Wasabi/zkSNACKs users in the United States

Days after Samourai founders were charged, Wasabi’s coordinator stopped serving US users. Bitcoin CoinJoin options collapsed in the US in one week. Same week as Samourai: Bitcoin privacy software being shut or geo-blocked, SHUM as the remaining spend option. Used instead of Monero: Bitcoin CoinJoin / Wasabi.

Samourai Wallet founders arrested; mixer infrastructure seized

Keonne Rodriguez and William Lonergan Hill (Samourai Wallet)

DOJ charged Samourai founders; domains/servers seized. Bitcoin CoinJoin/Whirlpool users told the remaining practical private-spend option was Monero. Bitcoin privacy tool shut down; SHUM as ‘use a private base layer instead of a mixer’. Used instead of Monero: Bitcoin CoinJoin / Samourai Whirlpool. More: @BoyScou84038220 (x.com); SDNY announcement of Samourai charges (justice.gov)

Binance $3.9B USDT move visible before DOJ settlement news

Binance (on-chain observers)

A large USDT transfer was publicly visible days before the settlement payment was announced. r/Monero framed it as SHUM. USDT is a public ledger; large treasury moves are observable. Used instead of Monero: USDT. More: Binance 3.9B USDT move (cointelegraph.com)

OFAC sanctions Sinbad.io Bitcoin mixer

Sinbad.io and users including Lazarus

US Treasury sanctioned Sinbad, a mixer that replaced Blender for DPRK-linked washing after Blender was listed in 2022. Another transparent-chain mixer gets listed; same meme as Blender/Tornado/ChipMixer. Used instead of Monero: Bitcoin mixer (Sinbad.io).

ChipMixer seized; ~$46M BTC taken; operator charged

Minh Quoc Nguyen (alleged operator) and ChipMixer users including ransomware gangs and Hydra customers

US/German/Europol takedown of one of the largest BTC mixers. DOJ said it processed >$3B, including ransomware, Lazarus heists, Hydra, and the FTX hacker’s coins. Centralized Bitcoin mixer keys and servers can be seized; mixing BTC ≠ Monero. Used instead of Monero: Bitcoin mixer (ChipMixer). More: DOJ ChipMixer takedown announcement (justice.gov)

LocalBitcoins shuts down

P2P BTC traders; historically also how OxyMonster was identified

The original BTC P2P platform closed under regulatory pressure. OxyMonster, the case that coined SHUM, had been tied to LocalBitcoins accounts in his real name. KYC’d P2P BTC is how several 2017 busts happened; the platform itself then died. Used instead of Monero: Bitcoin on LocalBitcoins.

FTX collapse

FTX filed for bankruptcy after a run on customer deposits revealed an $8 billion hole.

"Not your keys, not your coins" became a headline again. Users who trusted a centralized custodian with a transparent, traceable ledger had no privacy and no recourse once the house of cards fell.

Tornado Cash sanctioned; developer arrested

Tornado Cash users and developer Alexey Pertsev (Dutch arrest)

OFAC sanctioned Tornado Cash; a developer was arrested. Ethereum mixer users got the same SHUM line Bitcoin mixer users later got. Smart-contract mixer on a transparent chain can be sanctioned and its developers targeted. Used instead of Monero: Tornado Cash on Ethereum. More: @lethal_jeff (x.com)

OFAC sanctions Blender.io Bitcoin mixer

Blender.io and users including Lazarus

US Treasury sanctioned the BTC mixer used to wash DPRK-stolen coins. Same category as Tornado/ChipMixer: a Bitcoin privacy service got listed. Sanctioning a mixer on a transparent chain; community contrast with protocol-level privacy. Used instead of Monero: Bitcoin mixer (Blender.io).

Hydra Market seized; 543 BTC confiscated

Hydra Market operators (Dmitry Olegovich Pavlov charged) and users

World’s largest darknet market taken down by German BKA with US help. Servers seized plus 543 BTC (~$25M). Hydra ran a built-in BTC mixer. Same week SHUM replies appeared on Twitter. Market hotspot wallet was Bitcoin; that BTC was sitting there to be seized. Used instead of Monero: Bitcoin. More: DOJ: shutdown of Hydra Market (justice.gov)

Ronin / Axie Infinity $625M hack; thief sent funds to CEXes

Lazarus Group (later attributed)

One of the largest DeFi thefts. The attacker funded from and deposited to centralized exchanges. On-chain trolls told them to use Tornado and Stealthex. Community also applied SHUM. Stolen ETH/USDC on a public chain, then rushed to KYC venues. Used instead of Monero: ETH, USDC, centralized exchanges. More: So You’ve Stolen $600M. Now What? (coindesk.com)

Canadian Freedom Convoy crypto donations flagged/frozen

Freedom Convoy donation campaigns (HonkHonkHodl, Adopt a Trucker, etc.)

RCMP flagged crypto addresses holding close to $1M in BTC and other coins. Some funds later seized or made hard to cash out. Community said truckers should have used Monero. Transparent donation addresses can be listed and frozen by the state. Used instead of Monero: Bitcoin, Ether, other transparent coins. More: @VigilanteCrypto (x.com); Canada issues order against Freedom Conv (elliptic.co)

Bitfinex hack couple arrested; $3.6B Bitcoin seized

Ilya Lichtenstein and Heather Morgan

Arrested in connection with the 2016 Bitfinex hack. They chain-hopped including some Monero, but BTC traces plus KYC still led to seizure of a record BTC stash. Community argued that incomplete/late Monero use plus BTC leftovers is how you get caught. Used instead of Monero: Bitcoin, partial Monero chain-hop. More: @protienking (x.com); $3.6 billion bitcoin seizure / Monero ch (wired.com)

Hacker News top reply on the Bitfinex seizure: “should have used monero”

HN commenters on the Lichtenstein/Morgan arrest story

The federal seizure story hit HN; a terse parent comment was just the meme. Same Bitfinex event already listed; this is the extra high-visibility non-Twitter instance. Used instead of Monero: Bitcoin.

OFAC sanctions Suex OTC / swap service

Suex and customers cashing out darknet/ransomware BTC

First major OFAC action against a crypto exchange/OTC used as a cash-out for ransomware and darknet BTC. Addresses frozen. Transparent coins at a nested exchange can be listed and frozen. Used instead of Monero: Bitcoin via Suex.

PayPal Flags Transaction With the Word "Persian" In The Description

Reddit user u/OsrsNeedsF2P posted a screenshot of a notice someone received from PayPal because a transaction’s description containted the word “Persian.” PayPal made the following demand for KYC/AML information in order to “resolve the compliance inquiry”: On June 01, 2021, you sent a payment […] for “Dinner at the Persian.” Please provide the following information: An explanation of the reference “Persian.” The purpose of this payment, including a complete and detailed explanation of what is intended to be paid for.   Source: reddit.com/r/Monero/comments/nraezt/paypal_blocked_this_mans_... Original report: reddit.com

PayPal Bans Tor Supporter Larry Brandt

In March of 2021, PayPal banned Larry Brandt who, according to the Electronic Frontier Foundation, primarily used his account to fund Tor nodes. The EFF, whose report was published on June 2, communicated with PayPal and tried (fruitlessly) to get a more detailed explanation of why Brandt’s account was terminated: We reached out to PayPal for clarification, to urge them to reinstate Brandt’s account, and to educate them about Tor and its value in promoting freedom and privacy globally.

CipherTrace Links 72,000 Iranian IP Addresses to Over 4.5 Million Bitcoin Addresses

Surveillance corporation CipherTrace was able to link 72,000 Iranian IP addresses to over 4.5 million Bitcoin addresses. The post, which is actually an excerpt from a larger report, explains how CipherTrace had a seen recent spike in Iranian IP addresses associated with Bitcoin activity, particularly (as their surveillance was able to identify) mining. These Iranian IP addresses were either involved in direct cryptocurrency transactions or were used to query the blockchain to verify funds in cryptocurrency addresses that they control. One likely explanation for this uptick in Iranian IPs ...

Colonial Pipeline ransom paid in Bitcoin, later largely recovered

Colonial Pipeline / DarkSide ransomware

Ransom paid in BTC (~$5M). DOJ later recovered most of it because Bitcoin is public. DarkSide had charged extra for BTC vs Monero. Paying / receiving ransom in BTC left a recoverable trail. Used instead of Monero: Bitcoin. More: Colonial Pipeline ransom reporting; Dark (decrypt.co)

Marathon Mining Pool Mines Its First Compliant Block

U.S. Bitcoin mining corporation Marathon mined its first “compliant block” about a week after diverting all of its hashing power to its new “compliant mining pool” (which was announced about a month prior). The following is an excerpt from Marathon’s press release: On March 30, Marathon announced that it was launching the first Bitcoin mining pool based in North America that is fully compliant with U.S. regulations, including AML and OFAC’s standards. The mining pool refrains from processing transactions from those listed on the U.S. Original report: twitter.com

Roman Sterlingov arrested at LAX over Bitcoin Fog

Roman Sterlingov, alleged Bitcoin Fog operator

Arrested boarding a plane. DOJ said Bitcoin Fog mixed ~1.2M BTC over a decade including Silk Road/AlphaBay proceeds. Conviction later became a flashpoint over Chainalysis reliability. Running or even heavily using a BTC mixer still left a graph the government used in court. Used instead of Monero: Bitcoin mixer (Bitcoin Fog). More: Bitcoin Fog / Sterlingov case (cointelegraph.com)

CBI Allows Iranian Financial Institutions to Use Bitcoin Mined Within Iran

The Central Bank of Iran (CBI) started allowing other financial institutions (besides just itself) to use cryptocurrency internationally, but only cryptocurrency that was mined by a licensed crypto miner within Iran. CoinTelegraph reported: According to a report from the English-language Iranian economic news source Financial Tribune, the Central Bank of Iran, or CBI, is authorizing banks and licensed forex shops to use cryptocurrency as payments for imports. Under its regulatory framework, the cryptocurrency must derive from licensed crypto miners only. Original report: twitter.com

LocalBitcoins Bans Xanthusqueegly for Sending Funds Directly to a Darknet Market

In a post titled “Local bitcoin website terminated my account after ~8yrs”, a user on Reddit showed a screenshot of the notice LocalBitcoins sent to them when they terminated the account for sending funds directly to a DarkNet Market. The message opened with the following: We have noticed that you have been sending/receiving bitcoins to/from prohibited wallets/platforms/websites. As per our terms of service your LocalBitcoins account has been terminated on 2021-04-15. Original report: reddit.com

U.S. Government Sanctions 28 Crypto Addresses by Executive Order

The U.S. Department of the Treasury announced that President Biden had issued executive order 14024 titled “Blocking Property With Respect To Specified Harmful Foreign Activities of the Government of the Russian Federation.” In part, it sanctioned a total of 28 cryptocurrency addresses belonging to the individuals on the list. While the addresses were mostly Bitcoin, Litecoin, and Ethereum, there was a Dash address and Zcash t-address in there as well.   Source: home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20210415

Marathon Announces Plans for an OFAC-Compliant Mining Pool

Marathon, a Bitcoin mining corporation based in the U.S., announced that it would be creating a mining pool which would be totally compliant with U.S. financial regulations. The press release opened with the following: Marathon Digital Holdings, Inc. […], today announced that the Company will be launching the first Bitcoin mining pool based in North America that is fully compliant with U.S.

Capitol Protestors Blocked From Crowdfunding Legal Defense Fees

Even as the U.S. capitol riot narrative was in the process of completely falling apart, the government was still using it to push an authoritarian agenda. Simultaneously, the corporate media and financial corporations were weilding their power to engage in financial censorship. As the defendants from January 6th were slowly moving through the legal system, they were attempting to crowdfund their defense fees online.

Bitwala Freezes @RiccardoMasutti's Account Due to Six-Month-Old CoinJoin Deposit

Twitter user @RiccardoMasutti had their Bitwala account frozen due to a six-month-old coinjoin deposit. Bitwala also demanded additional KYC/AML data in order to have the account restored. @RiccardoMasutti posted a thread on Twitter which opened with the following: @bitwala sent me an email 3 days ago about a couple of post-CoinJoin transactions that happened almost 6 MONTHS AGO. “We await your response with the requested information within the next 5 days in order to be able to continue our banking journey together.” – Riccardo Masutti (@RiccardoMasutti) 26 Mar 2021   Source: twitter.c... Original report: twitter.com

BitMEX Flags @kristapsk's Account for CoinJoin Deposit Over 6 Months Old

BitMEX flagged @kristapsk’s account and demanded KYC/AML data due to a coinjoin deposit made over six months prior. Got an e-mail from @BitMEX about old #Bitcoin deposit transaction (last summer) that “may be connected with activity that is against 1.1(a) of the HDR Terms of Service.”, it was @joinmarket coinjoin. Original report: twitter.com

Kevin O'Leary on Why Institutions Will Pay Premium for Bitcoin Mined a Certain Way

Shark tank investor Kevin O’Leary appeared on CoinDesk TV to talk about regulatory environments changing, crypto market volatility, and (primarily) provenance requirements for institutional investors. He predicts that over the next year, he’ll be partnered with “five to ten different miners” which will allow him to acquire “virgin coin” that he can sell at a premium. The following is a transcript of an excerpt from the interview where O’Leary elaborates on this issue: I don’t think the community, if you want to call it that, realizes how big a deal this is going to become.

Bottlepay Returns @Marty_P_B's CoinJoin Deposit

Bottlepay flagged and returned an incoming transaction from Twitter user @Marty_P_B because the Bitcoin had a recent coinjoin history, specifically via Samourai’s mixing service Whirlpool: @bottlepay have rejected my incoming btc transactions due to the coins having been in samourai wallet and/or mixed with @SamouraiWallet #Whirlpool If you have been sent mixed coins you will get stung. @matt_odell @PeterMcCormack @proofofsteph #bitcoin – MartyB (@Marty_P_B) 2 Mar 2021 In their defence, they did return the btc as quickly as they could, but this will impact a lot of customers. Original report: twitter.com

Financial Crackdowns After U.S. Capitol Riot

Shortly after the U.S. capitol riot on January 6, 2021, and about a month before the narrative started to completely collapse, payment platforms and surveillance firms worked to expose and disrupt the funding mechanisms of people present at the capitol that day. GoFundMe actually kicked things off during the months prior by removing “fundraiser attempts that appeared to challenge the legitimacy of 2020 election results.” Several days after the riot, they removed “numerous fundraisers intended to raise money for travel expenses.” GoFundMe said the following in a statement to Fox News: “Due...

REvil drops Bitcoin and demands Monero only

REvil / Sodinokibi ransomware

After years of charging extra for BTC, REvil removed Bitcoin as a payment option and demanded XMR. Insurers still often refused XMR, so many victims kept paying BTC and those payments kept getting traced. The gang itself made the SHUM argument; victims who still paid BTC later had funds recovered. Used instead of Monero: Bitcoin. More: Wikipedia ransomware section citing REvi (en.wikipedia.org)

White House Market drops Bitcoin and goes Monero-only

White House Market admins and vendors

A major darknet market abandoned BTC and accepted only XMR, citing tracing and exchanger issues. Explicit ‘we should use Monero’ policy from the operators themselves. The market applied the meme as policy after years of BTC vendor busts. Used instead of Monero: Bitcoin. More: White House Market abandons Bitcoin to o (ihodl.com)

Ex-Microsoft engineer sentenced for first-of-its-kind Bitcoin tax fraud

Unnamed ex-Microsoft engineer in Forbes coverage

Prison sentence for Bitcoin tax fraud. Prosecutor quote: you cannot steal money via the Internet and think Bitcoin will hide it. SHUM reply on the Forbes tweet. BTC tax/tracing case used as another SHUM headline. Used instead of Monero: Bitcoin.

Blockseer Launches Compliant Bitcoin Mining Pool

Blockseer, a Bitcoin mining company acquired by by Canadian corporation DMG Blockchain Solutions in February of 2018, launched a North America-based mining pool which, according to the press release, would “not only meet, but exceed the US Government’s Office of Foreign Assets Control (OFAC) compliance for BTC addresses.” More from their press release: All users of Blockseer’s pool are required to pass KYC (Know Your Customer) protocols, and blocks posted to the Bitcoin blockchain by Blockseer’s pool will only contain filtered transactions using Blockseer and Walletscore’s labeling data, a...

BitVavo Bans u/Bujuu for CoinJoin Withdrawal(s)

Reddit user u/Bujuu posted that their BitVavo account was shutdown shortly after making a withdrawal to a Wasabi coinjoin: I did indeed sent my BTC to my Wasabi wallet and used the coinjoin in there. The message they received from BitVavo contained the following: […] Your account has been closed. […] Bitvavo is required by European law to have sufficient knowledge of its users, their accounts and the transactions associated with those accounts. Bitvavo must estimate the risks that a user can pose for Bitvavo. Original report: reddit.com

Zcash Shill Loses Zcash Privacy Bet

Shortly after the Electronic Frontier Foundation announced that they are accepting Zcash donations, some people voiced concerns about Zcash’s weak privacy. In response, a Zcash shill going by the handle @MoneyKnowledge0 made a z-address donation to the EFF’s z-address, a transaction that is supposed to be “completely anonymous,” and then challenged anyone to find the original t-address: Above is the tx-id to my donation. Please, if you are all sure of yourselves trace my T-address. Reward is $100 of a currency of your choice. Original report: twitter.com

Twitter celebrity-account hack / BTC giveaway scam

Twitter hackers who collected ~12 BTC

Compromised high-profile accounts ran a Bitcoin giveaway. Someone encoded vanity-address messages: Bitcoin is traceable, why not Monero. Community piled on with SHUM. Scam proceeds on a public chain; even the on-chain trolls said use Monero. Used instead of Monero: Bitcoin. More: @coinbureau (x.com); Why the Twitter hacker used Bitcoin inst (decrypt.co)

Elliptic Adds "Blockchain Monitoring" Support for Zcash & Horizen

Surveillance corporation Elliptic announced that it added “blockchain monitoring” support for “privacy coins” Zcash and Horizen. Elliptic’s blog post on this matter describes how there are two “classes” of privacy coins: privacy-by-default ones like Monero (which are essentially impossible to develop monitoring tools for) and opt-in privacy ones like Zcash: The first class of privacy coins are private by default. This includes the likes of monero, which seeks to conceal the details of all transactions.

Chainalysis Adds "Investigation and Compliance" Support for Dash & Zcash

Chainalysis, a blockchain surveillance corporation, announced in a blog post that they now support Dash and Zcash in their “investigation and compliance” product(s). How can blockchain surveillance products support “privacy” coins? Further into the article, under a section titled “Real world use of Dash and Zcash privacy features,” Chainalysis goes into the “privacy” features each coin offers and how they are actually being used “in the wild.” For Dash, PrivateSend is essentially a basic coinjoin implementation, and no one uses it: Mixing transactions related to PrivateSend make up roughl...

Carnegie Mellon Study on XMR vs ZEC Shows That Optional Privacy Is a Fundamental Flaw

A group of researchers from Carnegie Mellon University published a study that analyzed the traceability of Monero vs Zcash. In sum: Monero is untraceable; Zcash is at least as traceable as Bitcoin. The following is an excerpt from the abstract: We run some traceability experiments based on previously published papers for each coin. Results show that, introducing strict security and anonymity requirements into the cryptocurrency ecosystem makes the coin effectively untraceable, as shown by Monero. On the other hand, Zcash still hesitates to introduce changes that alter user behavior.

BlockFi CEO Confirms Flagging CoinJoin Deposits

Reports started cirulating that BlockFi users were having their accounts flagged if their deposits had recent coinjoin history: Have received multiple reports that @TheRealBlockFi is flagging deposits with coinjoin history. Majority of flags have been for utxos that interacted with Wasabi’s fixed fee address which has since been removed. Either way expect this to continue. Original report: twitter.com

Bitcoin mixer operators prosecuted (Helix, Bitcoin Fog, later ChipMixer etc.)

Larry Harmon (Helix), Roman Sterlingov (Bitcoin Fog), other mixer operators

Operators of BTC tumblers were arrested and funds forfeited. Community line: mixing a transparent coin is not the same as using Monero. Should have used a private base-layer coin instead of a Bitcoin mixer. Used instead of Monero: Bitcoin mixers (Helix, Bitcoin Fog, ChipMixer). More: US claims $400 million from Helix (coindesk.com)

Larry Harmon arrested for operating Helix mixer

Larry Dean Harmon, Helix / Coin Ninja

First US criminal case that explicitly treated Bitcoin mixing as the crime. Helix was wired into AlphaBay, Hansa, Hydra, Wall Street Market. Later $60M FinCEN penalty and $400M forfeiture. The mixer operator himself became the cautionary tale. Used instead of Monero: Bitcoin mixer (Helix). More: FinCEN fines Helix CEO $60M (coindesk.com)

Paxos Flags @McHodled's Account After CoinJoin Withdrawal

Shortly after successfully withdrawing to a Wasabi mixing address, Paxos flagged the acccount of @McHodled and sent them the following message: We noticed that a BTC withdrawal from your account has potentially been sent to a known Bitcoin mixing service. This type of transaction is not permitted on the platform. Please confirm whether the funds have been sent to a mixing service. @McHodled later tweeted that it was the fixed fee address for Wasabi that gave it away: The fixed fee address is the issue. Original report: twitter.com

GoFundMe Suspends Two Ukranian Plane Crash Fundraisers (Reinstated)

Shortly after taking off from Tehran, Iran on January 8, 2020, Ukraine International Airlines flight PS752 was struck down by missiles from the Iranian Revolutionary Guard, killing everyone on board. The Iranian Heritage Society of Edmonton launched a GoFundMe for the families and friends of the passengers, as did an individual named Shayesteh Majdnia (a board member of that organization). Original report: twitter.com

Christmas Bitcoin-wallet gift doxxes the giver

Joke scenario: boyfriend gifts a BTC wallet, ex looks up the public balance

Viral joke tweet about giving a loaded BTC wallet; the recipient’s ex checks the chain and sees what is left. John Foss: Should have used Monero #shum Everyday illustration that BTC balances are public. Used instead of Monero: Bitcoin.

Binance Freezes @bittlecat's Account & Requires KYC Data for Attempted CoinJoin Withdrawal

Binance Singapore froze the account of user @bittlecat for attempting a Bitcoin withdrawal to a Wasabi mixing address. @bittlecat posted about this on Twitter and provided screenshots of the communication they had with Binance support: Bitcoiners be warned: this is what happens if @BinanceSGD finds you withdrawing to @wasabiwallet Not surprised that my transactions are tracked, it’s KYC after all But I’m very concerned that Binance knew I was sending to wasabi, when all I input was a bc1 address, nothing more – Catxolotl (@bittlecat) 19 Dec 2019 @bittlecat was required to submit KYC/AM... Original report: twitter.com

PayPal cuts off Pornhub

Pornhub / adult-industry merchants and customers

PayPal froze Pornhub. Monero core contributor Howard Chu: Bitcoin kicked off the movement but fails to deliver. Should have used Monero. Payment-processor deplatforming; permissioned money vs private cash. Used instead of Monero: PayPal, Bitcoin (as insufficiently private/permissionless).

Chainalysis Able to Analyze Darknet Fentanyl Dealer's Bitcoin Transactions

In February of 2017, a woman suffered a fatal overdose on fentanyl which was purchased on the darknet by her fiancè (who also suffered an overdose but survived). The U.S. Drug Enforcement Agency (DEA) pursued an investigation which led to the arrest of the dealer “ETIKING” in late June of 2017. He was indicted less than a month later, convicted in January of 2018, and sentenced to life in prison in April of 2018. The agents were able to focus their investigation on ETIKING after a confidential source gave them a Bitcoin address that they linked to a Coinbase.com account, which obviously co...

Paxful Freezes & Then Bans u/Dtitanowner's Account for CoinJoin Deposit

After Reddit user u/Dtitanowner had deposited Bitcoin from three Wasabi coinjoin transactions, Paxful froze their account and sent them the following message: Please note that your account is undergoing compliance review. As per compliance review, please provide answers to the following enhanced due diligence questions: What’s the source of the your funds? Please explain the source of funds that your account is receiving, especially 3 last received transactions u/Dtitanowner didn’t hear back from Paxful for over four months when they finally decided to ban the account because it was “hig... Original report: reddit.com

Bisq User u/Izzytdi's Exchange Accounts Frozen Due to Tainted Bitcoin

User u/Izzytdi sold Monero for Bitcoin on Bisq, and then deposited that Bitcoin on Poloniex and Bitfinex. Poloniex quickly froze the account but did not communicate further for at least two months. Bitfinex also froze u/Izzytdi’s account and demanded an absurd amount of KYC/AML data: The first exchange was poloniex, which out of the blue just stopped my withdrawals. When I opened tickets all they will tell me is that my trading “looks suspicious” and needs a person to approve it.

BestMixer.io seized — first major LE takedown of a crypto mixer

BestMixer operators and users

Dutch FIOD + Europol + Luxembourg seized six servers. ~$200M / 27k BTC mixed in a year. Banner: YOU ARE NOT ANONYMOUS. Police said they logged a year of interactions. First public mixer seizure; mixing BTC on someone else’s servers is not privacy. Used instead of Monero: Bitcoin/BCH/LTC mixer (BestMixer). More: Europol: Bestmixer.io taken down (europol.europa.eu)

Wall Street Market takedown

Wall Street Market admins (including ‘TheOne’ / Tibo Lousee and others)

German/US/Dutch operation shut one of the then-largest DNMs. Payments were heavily Bitcoin. Fits the late-2010s ‘another vendor/market bust → SHUM’ pattern documented as the default DNM reply. Same 2017–2019 vendor-bust meme applied to a major market. Used instead of Monero: Bitcoin.

Bitfinex Freezes & Bans GhostPi1's Account for Months-Old CoinJoin Deposit

Reddit user u/GhostPi1 had his Bitfinex account frozen when they went to withdraw some Bitcoin that was deposited months prior from a coinjoin transaction: Account locked after i tried to send bitcoins from bitfinex almost two months from deposit. They ask about February transactions. Bitfinex didn’t reply back for nearly a month, at which time they informed u/GhostPi1 that they would be permanently suspending the account and allowing the remaining funds to be withdrawn within 5 business days: […] Unfortunately, I must inform you that Bitfinex is no longer in a position to do business w... Original report: reddit.com

SHUM becomes the default reply on every darknet vendor bust

Multiple unnamed darknet vendors arrested in 2017 after BTC tracing

A string of dealers were tied to real-world identities via Bitcoin. Bitcoin.com and r/DarkNetMarkets noted SHUM as the stock reply. Industrial era of the meme; many small cases rather than one headline. Used instead of Monero: Bitcoin.

AlphaBay aftermath — meme consolidates; fluffypony tweets SHUM

AlphaBay / Alexandre Cazes; Monero community

After the July 2017 AlphaBay takedown, investigators quantified BTC but an ‘unknown amount of Monero.’ By November the acronym was in circulation on Twitter. Origin story: feds could follow BTC, not XMR balances on the seized market. Used instead of Monero: Bitcoin. More: Bitcoin.com Deep Web Roundup explicitly (news.bitcoin.com)

OxyMonster / Gal Vallerius arrest — SHUM acronym coined

Gal Vallerius, Dream Market admin/mod ‘OxyMonster’

Arrested entering the US. Agents followed a BTC tip-jar to LocalBitcoins accounts in his real name and matched writing style to Instagram/Twitter. This is the thread that proposed the acronym SHUM. Used instead of Monero: Bitcoin. More: u/drawner22 (reddit.com); Miami Herald reporting on the arrest (li (miamiherald.com)

WannaCry BTC wallets swapped into Monero

WannaCry operators

Researchers said WannaCry bitcoin was exchanged for XMR. Inverse SHUM: they used BTC first, then jumped to Monero. Cited as evidence that even the operators decided Bitcoin was the problem. Used instead of Monero: Bitcoin (initially). More: Researchers say WannaCry operator moved (arstechnica.com)

Hansa Market honeypot / Operation Bayonet (with AlphaBay)

Hansa Market users; Dutch police ran the site as a honeypot after AlphaBay fell

After AlphaBay, users fled to Hansa. Dutch police were already inside Hansa logging BTC transactions and shipping data. Classic ‘you ran to another BTC market’ moment that fed the newborn SHUM meme. Transparent BTC plus a seized/honeypot market is how a lot of 2017 arrests happened. Used instead of Monero: Bitcoin.

Mt. Gox collapse

Around 850,000 bitcoins belonging to customers and the company were missing and likely stolen.

The largest Bitcoin exchange of its era lost or stole hundreds of thousands of customer coins. Custody, not cryptography, was the failure — the exact problem Monero's self-custody ethos exists to avoid.