Binance Singapore upset privacy advocates yesterday after a user tweeted that the exchange was blocking withdrawals to the privacy-focused bitcoin wallet, Wasabi. The tweet set off concerns about how much information Binance collects about its users, and how it can determine which wallets are used for bitcoin withdrawals.
The user, @Bittlecat, told Decrypt that Binance Singapore had observed how he had previously withdrawn funds to a Wasabi wallet and that the next transaction was CoinJoined, a way of mixing coins with strangers that obscures the origin of bitcoins. “They explicitly mentioned that they did not tolerate me sending bitcoins ‘especially to darknet/mixer sites,’ and thus suspended future withdrawals,” he said.
“They were watching what I did even AFTER I withdrew my funds. No bank ever questions what I do after I draw cash out of the ATM, why should this be any different?” he said.
Coinjoins technology seems to be the culprit, as initially posited by a Medium post by another anonymous user, 6102bitcoin. Wasabi wallet, the author writes, is “particularly easy to identify” because it relies on Coinjoins. (You can read more about Chaumian Coinjoins here, in a link that Wasabi helpfully provides on its website.)
A Binance spokesperson told Decrypt that Bittlecat’s speculations were correct. “The user actually explained it in the comment thread,” the spokesperson told Decrypt, and provided a screenshot of Bittlecat's post.
A number of users vented their unhappiness with how Binance Singapore dealt with Bittlecat. The exchange had asked him to explain the purpose of the withdrawal, and wanted to know his job description and salary, in exchange for having his account reinstated, Bittlecat said.
“I use wasabi wallet precisely because I dislike the thought of my transactions being watched. It is the same reason we close the toilet door when we do our business—not because we are doing anything illegal, but because we want privacy,” Bittlecat explained later.
“Given the number of data leaks and hacks in the cryptocurrency space, I am not comfortable sharing more documents. The recent Binance hack in May followed by a customer data leak in August inspires even lesser confidence,” he added.
Binance eventually gave Bittlecat his Bitcoin back, but the fallout caused Binance CEO Changpeng Zhao to respond to it via a blog post today.
Zhao explained that Binance Singapore was simply following anti-money laundering regulations that exchanges are required to implement. “It’s not a choice for the exchange to make. Many people don’t realize this and blame the exchange,” he wrote. “Well, technically they have 2 choices: 1. run the AML checks, or 2. don’t do business here. Option 2 doesn’t help anyone.”
Singapore scrupulously observes requirements set out by the Financial Action Task Force, or FATF, an international body that sets the world’s standards for anti-money-laundering procedures. (Other countries such as the Cayman Islands and Panama, do not play by FATF’s rules.)
Likewise, it’s no surprise that Binance is concerned about withdrawals to Wasabi: analysis by the data analytics firm Chainalysis this week claimed that it could track Wasabi wallet transactions, and linked the alleged PlusToken scammers—a reportedly Chinese ponzi scheme suspected of bilking $2 billion from its victims—to its use.
In his blog post, Zhao pointed out that users could use “non-regulated exchanges”—which carry their own risks—or decentralized exchanges; exchanges that live on blockchains and away from the grasp of regulators. But these usually have lower liquidity and no fiat access, he said. “If you are really serious about privacy, you should consider using a privacy coin, as the name suggests,” he noted.
Bittlecat’s not entirely convinced: “While I appreciate CZ taking the time to address this, his answer was that of a bureaucrat,” he told Decrypt. Bittlecat called on developers to start looking into improving CoinJoin implementations. “I can blame Binance all I want, but that won't change the fact that they can now spot that I'm sending to wasabi. It's time to get developers to look into fixing those holes,” he said.
[This story was updated at 2:45PM PST with additional comment from Bittlecat.]