Samourai Wallet Shutdown: Ripple Effect on Privacy & Self-Custody Tools

The shutdown of Samourai Wallet and the subsequent arrest of its co-founders have significant ramifications for the cryptocurrency industry. Research delves into the specifics of how Samourai Wallet functioned, the reasons behind its closure by the U.S. authorities, and the potential consequences for privacy and self-custodial cryptocurrency tools.

**The Indictment of the Samourai Wallet Founders**

On April 24, 2024, Keonne Rodriguez and William Lonergan Hill, co-founders of Samourai Wallet, were apprehended and charged with money laundering and operating an unlicensed money-transmitting business. Rodriguez, the company’s CEO, pleaded not guilty and was released on a $1 million bond. Hill, the CTO, is currently facing extradition from Portugal to the U.S., where he was detained. Following these arrests, the FBI issued a cautionary statement, warning American citizens against using unregistered cryptocurrency money-transmitting services. This move suggests that U.S. regulators might consider making money transmitter licenses mandatory for non-custodial cryptocurrency tools in the near future.

**How Samourai Wallet Operated**

Samourai Wallet differentiated itself from ordinary wallet applications by offering privacy-enhancing features such as Ricochet and Whirlpool. Ricochet added intermediary transactions between sender and recipient, while Whirlpool utilized a technique known as CoinJoin. This process pools inputs and outputs from multiple users, making it difficult for blockchain analysts to trace the ownership of funds. Users of Whirlpool provided an input address along with a blinded output address to a coordinator server, which facilitated the transaction without knowing who contributed which input. Samourai had plans to transition to a decentralized coordinator to further enhance privacy.

**Accused of Operating an Unlicensed Money Transmitting Business**

Under 18 U.S. Code § 1960, it is illegal to operate an unlicensed money transmitting business. While this statute doesn’t precisely define what constitutes a money transmitter, it highlights the importance of control over money transmission. Despite being a self-custodial wallet that didn’t control user funds or transactions, Samourai could have theoretically pre-screened transaction inputs for its CoinJoin service, similar to the approach taken by Wasabi Wallet. A court ruling in New York on an unrelated case, involving Tornado Cash, suggested that a business can be considered a money transmitter even if it doesn’t control the transferred funds, as long as it facilitates fund transfers.

**Privacy Tool and Legal Definitions**

Interestingly, Samourai also had a privacy tool named Stowaway, which allowed two users to mix their coins and mask the payment amount. This PayJoin implementation was offered free of charge and had few users, potentially explaining why it wasn’t included in the indictment. The court’s argument that Tornado Cash’s founders controlled their service and profited from it implies that earning revenue from facilitating crypto transactions can make a service qualify as a money transmitter. FinCEN guidance also suggests that while software providers enabling untraceable transactions are considered anonymization service providers, they can be deemed money transmitters if they engage in value transmission for financial gain.

**Charges of Money Laundering**

Rodriguez and Hill are also facing money laundering charges, which carry the possibility of up to twenty years in prison. According to 18 U.S. Code § 1956(a)(1), a defendant must conduct a financial transaction knowing the proceeds come from unlawful activities to be charged with money laundering. The indictment claims that Samourai’s founders promoted their platform to participants in dark or grey markets. Despite not exercising control over user funds, the centralized server used for transactions was cited in the indictment, albeit inaccurately, as the server did not manage funds, but merely verified addresses.

**Extending Legal Responsibility**

The allegations against Samourai Wallet suggest that prosecutors are attempting to extend legal responsibility for money laundering activities to non-custodial tools when server infrastructure is employed. This notion is supported by the Tornado Cash case, where ongoing payments to host the website and the facilitation of transaction processing were cited as evidence of complicity in money laundering. The implication is that non-custodial Bitcoin wallet providers running nodes and hosting front ends could be held accountable if aware of illegal activities facilitated through their services.

**First Amendment Protections**

Conversely, projects consisting solely of code hosted on repositories could be protected under the First Amendment, according to a legal precedent from the 1996 Bernstein v. U.S. Dept. of State case. In this case, Daniel J. Bernstein successfully challenged the requirement to obtain a government license to publish and distribute encryption software. The court ruled that computer code constitutes a form of expressive speech protected by the First Amendment, suggesting a potential defense for similar privacy tools.

**Implications for the Industry**

The Samourai Wallet case underscores the tension between privacy-focused cryptocurrency tools and regulatory authorities. While privacy and decentralization remain core principles for many in the crypto community, the legal landscape is continuously evolving. The outcome of this case could set important precedents regarding the legality of privacy-enhancing tools and the responsibilities of their developers. As the industry awaits further developments, the balance between privacy, regulatory compliance, and innovation remains a critical ongoing debate.