Конец лёгкой приватности биткойна: как аресты Samourai убили CoinJoin
On April 24, 2024, federal agents arrested the two founders of Samourai Wallet, the most widely used Bitcoin mixing service of its era. Within hours, Icelandic police had seized its servers and domains.
Six weeks later, zkSNACKs quietly switched off Wasabi's CoinJoin coordinator, ending mainstream no-friction coin privacy almost overnight. What happened in between is a case study in how modern crypto investigations actually work.The arrests
Keonne Rodriguez, Samourai's CEO, was taken into custody in Pennsylvania. William Lonergan Hill, the CTO, was picked up the same morning in Portugal pending extradition to the United States. Prosecutors in the Southern District of New York charged both men with conspiracy to commit money laundering and conspiracy to operate an unlicensed money transmitting business, counts carrying up to 20 and five years respectively. According to the superseding indictment, more than 80,000 BTC, worth over $2 billion at the time of each transaction, flowed through Samourai's Whirlpool and Ricochet features, including at least $100 million in proven criminal proceeds from markets like Silk Road and Hydra (DOJ indictment).How the bust actually worked
The mechanics of the case matter for anyone who assumed mixers were untouchable. Samourai marketed itself as decentralized and trustless, but its architecture depended on a centralized coordinator server operated by the founders, which matched participants and generated fresh addresses for every mix. That single point of control proved fatal. Court filings show the founders required mobile users to hand over extended public key data, or XPUBs, to the coordinator, information they did not strictly need. After the seizure, forensic review confirmed those records were sufficient to link many Whirlpool inputs to outputs. Investigators also assembled a paper trail the defendants wrote themselves. The indictment cites public tweets taunting Europol, Telegram messages urging hackers to run stolen funds through Whirlpool, a DEA briefing document saved on Rodriguez's laptop, and an October 2022 transaction from an undercover agent processed by the service itself. Both men ultimately pleaded guilty. The broader pattern echoes earlier mixer prosecutions, from Bitcoin Fog operator Roman Sterlingov to the pending Tornado Cash developer case (CoinDesk).The domino falls on Wasabi
Samourai never got the chance to surrender. zkSNACKS, the company behind rival wallet Wasabi, read the writing on the wall within days. On April 27 it blocked US users entirely, then announced on May 1 that its CoinJoin coordination service would shut down on June 1, 2024. "We have always made efforts to operate under legal clarity," the team wrote. "At this point, we need to regain more certainty before moving forward." The shutdown rippled beyond Wasabi itself, since Trezor Suite and BTCPay Server both relied on the same coordinator. The wallet lived on as a capable non-custodial client, just without the feature that made it famous (The Defiant).Why coordinators were the weak point
A CoinJoin is just a collaborative transaction; nothing about the math is illegal. The vulnerability was operational. Someone has to match participants, collect fees and keep the lights on, and that someone is findable, arrestable and suable. Regulators had telegraphed the move for years. FinCEN proposed rules treating mixers as money laundering concerns, exchanges began flagging mixed coins, and every prior takedown narrowed the field. When prosecutors charged Samourai, no coordinator operator could claim surprise (BleepingComputer). The lesson generalizes across the privacy ecosystem, well beyond Bitcoin mixers. Services promising anonymity while operating identifiable infrastructure are structurally exposed, a theme we return to often in our security notes.What replaced easy coin privacy
Nothing filled the gap cleanly. What emerged instead is messier, more technical and harder to shut down:- Ashigaru: a September 2024 community fork of Samourai's code that relaunched Whirlpool-style coordination, Tor-only, in mid-2025 (Ashigaru announcement).
- Ginger Wallet: a Wasabi fork keeping the desktop client alive against third-party coordinators.
- JoinMarket: a peer-to-peer CoinJoin marketplace with no central operator, where makers earn fees for providing liquidity.
- Payjoin and Lightning: cooperative payment techniques and off-chain routing that add privacy without any mixer at all.