Erik Voorhees rejects allegations that ShapeShift handled stolen Coinrail tokens

Erik Voorhees has rejected allegations that his Shapeshift digital asset exchange had any improper connection with tokens stolen in the 2018 hack of the Coinrail exchange.

Earlier this new year, the X (formerly Twitter) personality known as Boring Sleuth issued a series of tweets detailing research he’d conducted on the flow of funds following the hack of South Korea’s Coinrail exchange in the summer of 2018. That breach resulted in the loss of KRW45 billion (worth around US$40 million at the time) in various Ethereum-based digital assets, including over 1,900 ETH.

Following the hack, Coinrail flagged an Ethereum address designated as Fake_Phishing1432 that was observed trying to move some of the stolen tokens. Etherscan data indicated that this address received assets from an address tagged as Fake_Phishing1431, which was the recipient of many of the types of tokens stolen from Coinrail before the exchange revealed the hack.

Sleuth’s research connected the 1431 address with several other reportedly scammy wallets, eventually leading to an address that Sleuth claims is associated with a ShapeShift developer. This developer address later interacts with a wallet Sleuth claims is associated with the developer who set up ShapeShift’s in-house’ loyalty token’ FOX.

Sleuth’s research led him/her/them to conclude that some of the stolen ETH—worth around $650,000 at the time and around $12 million today—ultimately flowed through ShapeShift itself. Sleuth further alleges that some of these tokens flowed straight to ShapeShift without first passing through an intermediary wallet belonging to some intermediary decentralized exchange (DEX).

The research behind these allegations ended up trending on the Breadcrumbs blockchain analytics platform, which was formed after its founder fell prey to an initial coin offering (ICO) scam in 2018.

Meanwhile, back on Twitter/X, some accounts suggested that all Sleuth’s research showed was that the scammer used ShapeShift to make good their getaway. Sleuth admitted this was “half true” but noted that the wallets receiving the ETH weren’t centralized exchange wallets but those used by ShapeShift team members “for things like setting up contracts.”

When Voorhees responded to these allegations, he dismissed the suggestion that they were proof of anything. Voorhees demanded that Sleuth post specific addresses so that they could be publicly verified.

When Sleuth complied with Voorhees’ demands, Voorhees mapped out some alternate, less salacious scenarios. Voorhees suggested some wallets that received hacked Coinrail tokens could have been an “innocent recipient from another trade.” Also, ShapeShift could have moved some of “its own ETH to an internal wallet, which later transacted with FOX wallet,” thereby explaining the connections.

Voorhees then rationalized that “ShapeShift maybe made $1500 pre-tax on trade fees” from the stolen ETH being converted on the exchange. Voorhees added that, “If those funds were known stolen at the time, we would’ve reported.”

Sleuth responded with an even more detailed breakdown of his findings, to which Voorhees failed to respond, either incapable of generating further snark or simply not wishing to draw further attention to the discussion.

ShapeShift’s history of looking the other way

Whatever the truth in this public he-said/Hees-said dustup, it wouldn’t be the biggest stretch to think Voorhees might not be overly concerned if his exchange was utilized for activities upon which the law frowns. As he said in 2018 regarding Shapeshift’s lack of ‘know your customer’ (KYC) and anti-money laundering (AML) practices: “I don’t think people should have their identity recorded to catch an occasional criminal.”

Voorhees plays a prominent role in Bitcoin’s post-launch history, mainly due to Satoshi Dice, a Bitcoin-based online gambling site that at one point generated as much as half of all Bitcoin transactions. In 2012, the site made an annual profit of over 33,000 Bitcoins.

Voorhees sold Satoshi Dice in 2013, but the following year, he was fined $50,000 by the U.S. Securities and Exchange Commission (SEC) for promoting the sale of shares in his companies to the public without first registering with the SEC. One month after this settlement, Voorhees launched ShapeShift.

Voorhees was already one of Bitcoin’s more anarchic aficionados, viewing any regulatory oversight as an unacceptable imposition on his rights and those of his customers. Shapeshift was purpose-built as the Mr. Magoo of exchanges, not requiring any identifying information from those who used ShapeShift to convert one asset to another.

Predictably, criminals found this disinterest in regulatory compliance inviting. In 2018, blockchain analysis conducted by the Wall Street Journal flagged the Colorado-based Shapeshift as the top U.S. exchange through which digital assets suspected of being the proceeds of crime were flowing.

In the Journal’s words, “a parade of suspected criminals has taken advantage of ShapeShift’s services since the exchange began in 2014.” These criminals even extended to a spoofing crew who set up a copycat exchange that stole money from ShapeShift customers—and then laundered the proceeds through ShapeShift.

Despite Voorhees himself claiming to have spent “millions of dollars” researching ways to avoid imposing AML/KYC requirements on ShapeShift customers, a ShapeShift lawyer insisted to the Journal that Voorhees was “not pro-money laundering.” Still, as one unnamed official close to Europol investigations of ShapeShift-linked criminality put it, “You can only run a red light so many times before you get pulled over.”

Shortly after the Journal’s report, ShapeShift made new KYC/AML demands of its customers, a “morally and ethically wrong” decision that Voorhees claimed led to company-wide suffering “on a philosophical and emotional level.” It also led to 95% of ShapeShift’s customers taking their business elsewhere, presumably due to their unwillingness to connect actual names to their criminal activities.

In 2022, ShapeShift ‘evolved’ into a Uniswap-like decentralized autonomous organization (DAO) in what was openly described as a way to ditch those pesky AML/KYC requirements, at least for now.

Just like Ayn Rand

While Voorhees remains staunchly opposed to government involvement in finance, he’s not above availing himself of government-dispensed corporate welfare. ProPublica research shows ShapeShift US Inc. received $1.7 million from the U.S. federal government’s COVID-inspired Paycheck Protection Program (PPP) in April 2020 and received an additional $1.3 million in April 2021. Both of these loans are listed as ‘forgiven.’

The initial loan identified ShapeShift as based in Wilmington, Delaware, with an industry category of ‘software publisher’ and the business listed as employing 65 individuals. The 2021 loan cited a Denver location, its industry category as’ other computer related services’, and employed 62 individuals.

Challenged on X/Twitter regarding the $3 million in handouts, Voorhees was unrepentant, arguing that the government “has stolen many millions of dollars from me and ShapeShift. If I get a chance to claw a small fraction back I’m taking it.”

Companies applying for PPP loans were required to attest that the loans were necessary for their continuing operation. While ShapeShift had physical offices, its operations were purely digital, and thus, for the vast majority of its employees, remote work was a viable option. Furthermore, digital asset trading increased during the pandemic, so it’s not like ShapeShift was facing any existential fiscal threats.

Asked how he could take a government bailout when his company didn’t need it, Voorhees framed his actions in the most self-flattering manner possible: “Taking the funds because company ‘needs it’ is not noble. Taking the funds because it’s our money in the first place, is.”

Voorhees once claimed to be “very sympathetic to full anarchy where there’s no central state.” Like most anti-state anarchists, Voorhees takes for granted the benefits that a strong central state can provide, including the ability to conduct research on concepts for which there’s no immediate commercial payoff. You know, like the technology on which he’s built his fortune, which was developed by the U.S. government using tax dollars paid by American citizens.

Recess is over

ShapeShift was the first exchange to follow Binance’s lead in the anti-competitive delisting campaign targeting the BSV token in April 2019. At the time, Voorhees tweeted that ShapeShift stood with Binance boss Changpeng ‘CZ’ Zhao, who, like Voorhees, views laws against money laundering as, just like, your opinion, man.

Voorhees may not be personally committing crimes, but he does build platforms that ensure those who do commit crimes have a better chance of making a clean getaway. There would be a lot more unfortunate victims of these crimes should Voorhees’ warped vision of a ‘basic safeguards are tyranny’ paradise ever materialize.

Given Voorhees’ ideological disinterest in knowing anything about his customers, it’s hard to take seriously his claim that the only reason ShapeShift didn’t do anything about the stolen Coinrail tokens was because they weren’t “known stolen.” For victims of crime, the line separating ‘not knowing’ and ‘not caring’ can often appear invisible.

Many BTC maximalists were positively giddy last week over the SEC’s approval of BTC spot-based exchange-traded funds. The suggestion was that this was a sign that blockchain technology had ‘matured’ to the point where the mainstream was accepting it. (‘Captured by Wall Street’ might be a more accurate diagnosis, but tomato, tomahto.)

Voorhees is a relic of a bygone age in which ‘crypto bros’ trumpeted the ability to buy firearms and fentanyl online without fear of arrest. He’s a sterling example of why many view anarchic libertarians as the epitome of arrested development.

A few years after the initial delisting wave, Voorhees was still pushing more exchanges to ditch BSV, tweeting that ostracism was an important tool “to set and enforce standards of behavior, without the State.” Until Voorhees learns that he has obligations beyond his selfish desires, this sector would do well to give him the cold shoulder—and his platforms a wide berth.

Follow CoinGeek’s Crypto Crime Cartel series, which delves into the stream of groups—from BitMEX to Binance, Bitcoin.com, Blockstream, ShapeShift, Coinbase, Ripple, Ethereum,
FTX and Tether—who have co-opted the digital asset revolution and turned the industry into a minefield for naïve (and even experienced) players in the market.

New to blockchain? Check out CoinGeek’s Blockchain for Beginners section, the ultimate resource guide to learn more about blockchain technology.