{"id":12367,"date":"2019-03-24T00:18:22","date_gmt":"2019-03-24T00:18:22","guid":{"rendered":"https:\/\/davidgerard.co.uk\/blockchain\/?p=12367"},"modified":"2019-03-25T18:23:21","modified_gmt":"2019-03-25T18:23:21","slug":"shapeshift-and-cipherblade-bad-pr-and-shells-within-shells","status":"publish","type":"post","link":"https:\/\/davidgerard.co.uk\/blockchain\/2019\/03\/24\/shapeshift-and-cipherblade-bad-pr-and-shells-within-shells\/","title":{"rendered":"ShapeShift and CipherBlade: money laundering accusations, and shells within shells"},"content":{"rendered":"

In Decrypt, Friday morning: “The case of CipherBlade, ShapeShift\u2019s PR saviour”<\/a> \u2014 with “additional reporting by David Gerard.”<\/p>\n

Cas Piancey on Twitter noticed<\/a> that CipherBlade seemed a little odd … and we proceeded to look into just what was going on here. Ben Munster put together his own, Cas’s and my research into the article on Decrypt.<\/p>\n

I worked my backside off on this story Thursday afternoon, and then on Decrypt editor and cofounder Josh Quittner’s fair-but-harsh edit Thursday evening. Editing on a serious piece is a bit like blood sports in a Google doc, and Josh’s love is appropriately tough \u2014 so I’m grasping that “additional reporting” credit with both hands.<\/p>\n

Amy Castor posted “Blockchain analytics firm CipherBlade steps in to launder ShapeShift\u2019s image”<\/a> on Friday morning, just before the Decrypt piece went up, and I supplied stuff for her piece too. Amy wins the prize for getting the word “launder” into the headline.<\/p>\n

There’s a lot of stuff you can’t say, or wouldn’t bother saying, in a proper magazine with offices and so on. So here’s a few outtakes \u2014 extra background material and DVD extras on the story.<\/p>\n

Update:<\/strong>\u00a0 Also read Richard Sanders’ response<\/a> to this post.<\/p>\n

ShapeShift versus the Wall Street Journal<\/h3>\n

On 28 September 2018, the Wall Street Journal ran “How Dirty Money Disappears Into the Black Hole of Cryptocurrency”<\/a> by Justin Scheck and Shane Shifflett (archive<\/a>), fingering the ShapeShift<\/a> crypto exchange \u2014 incorporated in Switzerland, but run out of Denver, Colorado \u2014 as a channel for money laundering. According to the Journal:<\/p>\n

To examine the scope of crypto money laundering, the Journal built computer programs that tracked funds from more than 2,500 suspected investment frauds, hacks, blackmail schemes and other alleged crimes that used bitcoin and Ethereum by analyzing the currencies\u2019 underlying software.<\/p>\n

… The Journal found that ShapeShift processed nearly $9 million of the suspect funds, more than any other exchange with U.S. offices.<\/p><\/blockquote>\n

ShapeShift was very<\/i> upset about this report. Not least because, as ShapeShift\u2019s PR told Ben at Decrypt, ShapeShift had been very <\/i>generous to the WSJ with its time, and the two had worked \u201cclosely.\u201d So ShapeShift felt betrayed when the journalists produced \u00a0… journalism. ShapeShift\u2019s founder and CEO Erik Voorhees posted a response<\/a> to the report a few days later, saying “We have worked with the journalists for 5 months under false pretenses.”<\/p>\n

On Wednesday evening, ShapeShift put out a press release report \u2014 taken up by CoinDesk<\/a> (who also spoke to ShapeShift), CoinTelegraph<\/a> and The Block<\/a> \u2014 from a “blockchain investigation agency” called CipherBlade,<\/a> to exonerate ShapeShift<\/a> (archive<\/a>). CipherBlade said:<\/p>\n

… the WSJ\u2019s $9 million \u201claundering\u201d claim was overstated by a factor of 4x.<\/p>\n

… The WSJ singled out ShapeShift for activity that is routine across any cryptocurrency exchange.<\/p><\/blockquote>\n

That is \u2014 money laundering did happen, okay, but it was less than the Wall Street Journal said, and anyway this is all “activity that is routine across any cryptocurrency exchange”, because apparently that makes it all okay? It’s fine. Nothing to see here.<\/p>\n

CipherBlade to the rescue<\/h3>\n

But what of CipherBlade, who wrote the report? Apparently at their own expense \u2014 they state that ShapeShift didn’t pay them for the months-long investigation.<\/p>\n

CipherBlade was founded only eight months ago. It says on its homepage that “We have recovered millions of dollars of stolen funds, prevented dozens of ICO scams, and professionally handled PR disasters and other emergency situations.”<\/p>\n

Kyle S. Gibson noted CipherBlade’s previous success \u2014 they posted<\/a> about investigating the Oyster ICO’s PRL token hack, and tracked down the founder, “Bruno Block,” who exit-scammed the ICO in November 2018 through a deliberately-maintained back door.<\/a> CipherBlade also claim credit for recovering funds from when ICO pundit Ian Balina<\/a> got hacked in April 2018.<\/p>\n

To lodge an incident report,<\/a> CipherBlade charges users 0.746 ETH, around $100. They’ll also lodge a police report for you for $350 total.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Matthew Greene, a company analyst and spokesman, told Decrypt that this fee for filing a free police report was for the benefit of customers who were feeling “disoriented”. The full quote he gave Ben (which didn’t make it to the final version of the Decrypt article):<\/p>\n

Victims of crimes often are disoriented and don’t know where and how to report their situation most efficiently. We have a lot of experience with that and can advise them on which agency to report to depending on the nature of the crime and the jurisdictions involved, and we analyse the incident and draft a report for them that has all the features that law enforcement agencies need to process it easily and become active immediately.<\/p><\/blockquote>\n

And, from Richard Sanders to Ben:<\/p>\n

The only payments on our site direct are for the report function, which isn\u2019t super frequently used. We\u2019re typically taking payment via crypto and providing addresses to our clients directly<\/p><\/blockquote>\n

Cipherblade’s Medium blog<\/a> contains two articles, and the other article<\/a> (archive<\/a>) also just talks about how awful the Wall Street Journal is.<\/p>\n

The corporate shell game<\/h3>\n

Cipherblade’s LinkedIn<\/a> says it’s based in Pittsburgh, using what appears to be a shared working space<\/a> in the Bakery Square<\/a> shopping centre. The website<\/a> says “\u00a9 CipherBlade Ltd., UK”.<\/p>\n

The UK company Cipherblade Ltd.<\/a> was incorporated on 28 August 2018. It has two directors:<\/a> Genevieve Magnan, of North East Point, Mahe, Seychelles; and, as company secretary, a company called Northwestern Management Services Limited. This company is, or has been, secretary for several hundred companies,<\/a> and gives them a mailing address at 31 Southampton Row, Office 3.11, 3rd Floor, London, England, WC1B 5HJ \u2014 a no doubt extremely crowded room in serviced offices that also offer virtual offices.<\/a><\/p>\n

(I went and looked on Thursday evening \u2014 the building does, in fact, have a third floor. This bit isn’t anything crypto-related, it’s just how you do corporate shells when UK Companies House<\/a> is being too informative for your liking.)<\/p>\n

Cipherblade UK is owned by Cipherblade of the Marshall Islands, whose address is listed in their UK subsidiary’s incorporation papers as Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro MH96960 Marshall Islands \u2014 an address also hosting a tremendous number of companies.<\/p>\n

Cipherblade UK started<\/a> with several other companies as directors \u2014 all resident<\/a> at 8 Global Gateway, Rue de la Perle, Providence, Mahe, Seychelles, another very popular address.<\/a> All quit within a month.<\/p>\n

Genevieve Magnan has, of course, nothing to do with the daily running of CipherBlade. She works at AAA International Services,<\/a> a company that incorporates shell companies for other companies. (I’ve linked an archive of their home page there \u2014 because the site itself kept trying to randomly send me malware. They might want to take a look at that.) Her job is being a “nominee director” \u2014 a stand-in name and face, so that the beneficial owners<\/a> can hide themselves.<\/p>\n

Corporate shells within shells were really brought home to the public when a pile of information was leaked from Mossack Fonseca<\/a> for the Panama Papers<\/a> \u2014 about the legions of tax dodgers and money launderers who were hiding their malfeasance behind networks of shell companies.<\/p>\n

The Panama Papers site<\/a> stresses that “there are legitimate uses for offshore companies and trusts, and we do not intend to suggest or imply that any people, companies or other entities have broken the law or otherwise acted improperly” \u2014 but if you’re complaining of money-laundering accusations, it may not be the best look to use a company that uses an obscurantist maze of shells, even if they’re doing it for actual privacy reasons and not to hide money from the tax man.<\/p>\n

(It turns out that journalism is work, particularly when you spend hours on a rabbit hole that just leads to “LOL you have reached the department of corporate shell games.”)<\/p>\n

Don’t mess with Richard Sanders<\/h3>\n

Richard Sanders, CipherBlade\u2019s Chief Security Officer, describes in the footnotes of the Medium post how he “served in US army Special Operations Forces, rose to security lead at Google and” \u2014 get this \u2014 “assisted Binance and FBI in development of GDPR protocol.” I asked<\/a> if he had over 300 confirmed kills,<\/a> but apparently<\/a> he doesn’t. I’m not 100% confident about the claim of helping the FBI cope with the GDPR, either. But let’s assume he’s on the level.<\/p>\n

Sanders used to run a small business called SHPlates, to engrave and decorate ruck plates \u2014 steel plates that add weight to a backpack for training purposes. This did well enough<\/a> that Sanders could “donate six figures a year to charities and that\u2019s what the business is for. I\u2019m always thinking, what can I do to raise more money for charities?” \u2014 but also needed to raise $1,000 in a Kickstarter to “relaunch.”<\/a><\/p>\n

In the blockchain world, he’s an advisor<\/a> to Dusk,<\/a> a securities blockchain startup, and “director of defense”<\/a> for Energi,<\/a> an extremely minor proof-of-stake altcoin whose ambition is to become a “Cryptocurrency for World Adoption”. NRG volume<\/a> is around $160,000 a day — 95% on Digifinex, 5% on KuCoin and a little bit on CryptoBridge, and only against BTC — so it may have some way to go.<\/p>\n

It all comes back to ShapeShift<\/h3>\n

If Sanders can make a go of this and do a good job, then fine, y’know. The weird corporate shell games are a bit LARPy, and Energi is nonsense. But if Sanders is honest and technically competent, that immediately puts him ahead of 95% of the crypto world.<\/p>\n

The real story here is ShapeShift trying to protect its image. It’s odd that they didn’t hire a better-known blockchain analytics firm \u2014 or, at the very least, pay CipherBlade for their work. (As all freelancers know, “exposure” is a word that means “dying of dehydration in a desert.”)<\/p>\n

It’s important to note that ShapeShift is the exchange that left New York state<\/a> in 2015 to avoid regulation under the BitLicense,<\/a> and didn’t even have Know-Your-Customer identity checks until late 2018.<\/a> It would be surprising if criminals hadn’t<\/i> availed themselves of such facilities.<\/p>\n

ShapeShift doesn’t knowingly facilitate criminals, and kicks them off and calls the authorities if they catch them \u2014 as they did when the WannaCry hackers<\/a> tried cashing out through ShapeShift. But trying to imply that money-laundering doesn’t happen there, or is meaningless to the extent it does happen, is nonsensical.<\/p>\n

Erik Voorhees, the exchange\u2019s founder, is an archetypal Bitcoin libertarian. He sincerely thinks the sector doesn’t need regulation, and sees current regulations as damnable impositions. And that’s fine \u2014 there’s always a dialectic between the regulators and the institutions on how much to regulate.<\/p>\n

Correcting a paper on a report you believe they got wrong is fine too \u2014 papers are often mediocre, and get things wrong. We can suck. But painting such investigations as inherently unfair is not how anything works, and just makes you look bad. It’s better to own the bad things that happened, and document what you’ll be doing about them going forward.<\/p>\n

Your public isn’t just your fellow bitcoiners any more. If you’re dealing in real money, society expects you not just to be on the level \u2014 but to be able to show<\/i> that you’re on the level. And that’s not just the regulators \u2014 it’s the news outlets, and especially the financial press. And the press’s readers. The expectation is social, not just some outside imposition by the state.<\/p>\n

Additional reporting from Ben Munster, Amy Castor, Cas Piancey and Kyle S. Gibson. You do know that journalists all know each other and talk, right.<\/i><\/p>\n

\"Become<\/a>

Your subscriptions keep this site going. Sign up today!<\/a><\/i><\/p><\/div>","protected":false},"excerpt":{"rendered":"

There’s stuff you can’t say in a proper magazine with offices and so on. So here’s a few DVD extras from the Decrypt article on ShapeShift and CipherBlade.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[460,1110,661,1185,1109,570,1187,1161,546,1186,875],"class_list":["post-12367","post","type-post","status-publish","format-standard","hentry","category-uncategorised","tag-amy-castor","tag-ben-munster","tag-cas-piancey","tag-cipherblade","tag-decrypt-media","tag-erik-voorhees","tag-josh-quittner","tag-kyle-s-gibson","tag-oyster-pearl","tag-richard-sanders","tag-shapeshift"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/posts\/12367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/comments?post=12367"}],"version-history":[{"count":33,"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/posts\/12367\/revisions"}],"predecessor-version":[{"id":12409,"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/posts\/12367\/revisions\/12409"}],"wp:attachment":[{"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/media?parent=12367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/categories?post=12367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/davidgerard.co.uk\/blockchain\/wp-json\/wp\/v2\/tags?post=12367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}