The fortnight that ended coordinated CoinJoin

The fortnight that ended coordinated CoinJoin

On April 24, 2024, the United States Attorney for the Southern District of New York unsealed an indictment against Keonne Rodriguez and William Lonergan Hill, the co-founders of Samourai Wallet, charging them with conspiracy to commit money laundering and conspiracy to operate an unlicensed money transmitting business. Rodriguez was arrested in Pennsylvania that same day. Hill, located in Portugal, was not. The servers behind Whirlpool, Samourai's CoinJoin implementation, went dark within hours, along with the Ricochet hop service the wallet had bundled for years. Two days later, on April 26, the company behind Wasabi Wallet, zkSNACKs, posted a short notice on its corporate blog announcing that its CoinJoin coordinator would be shut down on June 1. The dominant coordinated mixing infrastructure on Bitcoin, which had operated continuously since 2018, ended in a window of roughly six weeks.

This piece is a reconstruction of those weeks, the legal theory that drove them, and the privacy stack that replaced what was lost.

What Samourai actually did

Samourai Wallet, launched in 2015 by Rodriguez and Hill, was always the more ideological of the two big CoinJoin wallets. It was Android-only, routed everything over Tor by default, refused to ship a desktop client, and treated its user base as a self-selected group of people who already knew what financial privacy was and why they wanted it. Its flagship feature, Whirlpool, was a Chaumian CoinJoin pool design with fixed denominations: a user paid a one-time pool fee, then their UTXOs cycled through equal-output mixes with other participants, producing post-mix coins that were, by construction, indistinguishable from any other post-mix coin in the same denomination tier. Ricochet was a separate service that prepended four extra hops to an outbound transaction, intended to defeat exchange blocklists that flagged direct deposits from Samourai-tagged addresses.

The April 24 indictment was explicit about the numbers. Prosecutors alleged that Whirlpool had processed more than $2 billion in total transaction volume and that approximately $100 million of that figure represented proceeds of unlawful activity, including dark-market sales and ransomware. The indictment put Samourai's revenue from coordinator fees at roughly $4.5 million over the life of the service. The legal theory was the part that mattered: by operating the coordinator that matched CoinJoin participants and constructed the joint transactions, the DOJ argued, Rodriguez and Hill were transmitting funds on behalf of others within the meaning of 18 U.S.C. § 1960, and they had never registered with FinCEN.

The DOJ press release, dated April 24, 2024, put the position bluntly: "For over a decade, Samourai allegedly operated an unlicensed money transmitting business that facilitated approximately $2 billion in unlawful transactions and served as a haven for criminals to engage in large-scale money laundering." That sentence, more than the dollar figure, is what the rest of the ecosystem read.

The Wasabi response, April 26 to June 1

zkSNACKs is a Gibraltar-incorporated company that had spent years building Wasabi Wallet, a desktop CoinJoin client whose 2.x release shipped a new coordinator protocol called WabiSabi. The April 26 blog post was four paragraphs long. It cited "recent statements by United States authorities regarding the implications of CoinJoin coordination services" as the trigger and gave the firm date of June 1, 2024 for the coordinator's last day of operation. The company stressed that the open-source wallet itself would continue to function and that anyone with the technical capacity to do so could run their own WabiSabi coordinator.

The distinction mattered, and it still does. Killing the company-operated coordinator removed the entity that the FinCEN guidance and the Samourai indictment had identified as the regulated actor. The codebase remained on GitHub, the wallet remained installable, and the protocol remained specified. What disappeared was the default round, the always-on rendezvous point that ordinary users had relied on to find counterparties. In practice, the second piece is the one that matters for a privacy technique whose entire premise is finding strangers to mix with.

A handful of third-party coordinators briefly appeared in the weeks after June 1, some hosted on Tor hidden services, some run by anonymous operators, some run by exchanges in jurisdictions outside the United States. Adoption was thin. The fee structure that had funded zkSNACKs did not transfer to volunteer operators, and the legal theory that had felled Samourai applied equally to any successor who chose to do the same job for money.

Why this happened in April 2024

The Samourai indictment did not land in isolation. Earlier that same month, a Dutch court in 's-Hertogenbosch had convicted Alexey Pertsev, one of the developers of Tornado Cash, of money laundering, sentencing him to 64 months. The Pertsev verdict and the Samourai unsealing arrived within roughly three weeks of each other, on two continents, against two different privacy architectures, with the same underlying theory: that writing and running the infrastructure that obscured the link between sender and receiver was itself a regulated act, regardless of what individual users did with it.

Whether the timing was coordinated in any formal sense is unknowable from open sources. What is observable is that the privacy-tool development community read it as coordinated. The Bitcoin mailing lists, the Nostr threads, and the conference talks in May 2024 all proceeded from the assumption that a regulatory message had been sent and that any developer of coordinated mixing infrastructure operating in or adjacent to a jurisdiction with a mutual legal assistance treaty with the United States was now exposed.

What replaced them

JoinMarket kept running. Its architecture was, and is, materially different: there is no central coordinator, only a peer-to-peer order book in which makers post liquidity offers and takers initiate joins. The legal theory that captured Samourai and would have captured zkSNACKs presupposes an identifiable operator who matches participants. JoinMarket distributes that role across its participants, and as a practical matter no one has yet been charged for posting a liquidity offer.

PayJoin, the older name for the BIP 78 pay-to-endpoint protocol, gained relative prominence. PayJoin is not a mixing technique. It is a two-party transaction in which the receiver contributes an input alongside the sender, breaking the heuristic that all inputs to a transaction belong to one party. It does not produce equal outputs, it does not anonymize against a determined chain analyst, and it does not need a coordinator. Several wallets that had supported PayJoin as a secondary feature began foregrounding it.

The third surviving category was the self-hosted coordinator. The WabiSabi protocol is open. Anyone running a node and a public endpoint can stand one up. In practice this means small communities, often Tor-only, often with vetted membership, operating their own rounds for their own users. The total mixed volume across this category is a small fraction of what Whirlpool and the zkSNACKs coordinator handled in 2023.

Hill in Portugal, April 2025

Hill was arrested in Portugal in April 2025, almost exactly one year after the indictment. The extradition process is a separate question from the underlying charges and will run on its own timeline, governed by the 1908 US-Portugal extradition treaty and its supplements. Portuguese courts have, in past cryptocurrency cases, scrutinized dual-criminality requirements carefully, and the question of whether Portuguese law treats the operation of a CoinJoin coordinator as an unlicensed money transmission offense is genuinely unsettled. The case is worth watching for that reason alone.

What this changes for the Directory

We are going to be direct about our own editorial position. As of this writing, we no longer list company-operated CoinJoin coordinators as standalone services in the Directory. The category, as a category, is exposed to the legal theory the DOJ deployed against Samourai, and we do not want to send readers toward services that are likely to disappear, get seized, or expose their operators to criminal liability while the Roman Storm verdict and the larger code-is-speech argument remain unresolved.

What we do list, and will continue to list, are three things. JoinMarket, on the basis that its peer-to-peer architecture does not present an identifiable operator. Wallets that support running a self-hosted WabiSabi coordinator, on the basis that the user is the operator. PayJoin-capable wallets, on the basis that PayJoin is a two-party transaction and not a coordinated mix.

Services in the Directory that retain any form of CoinJoin compatibility now carry a "post-2024" annotation, which is our shorthand for: the legal context around this feature changed in April 2024, and you should read about Samourai and Wasabi before you use it.

Sources

• SDNY press release, Samourai indictment (April 24, 2024)
• zkSNACKs corporate blog, coordinator shutdown announcement (April 26, 2024)
• CoinDesk, Samourai Wallet Founders Charged by DOJ (April 24, 2024)
• Decrypt, Samourai Wallet Founders Charged
• Wikipedia, Wasabi Wallet
• Wikipedia, Samourai Wallet

Edit log

• 2025-05-04 : First draft assembled from the SDNY press release and the zkSNACKs April 26 post. Held back on the Hill-in-Portugal section pending confirmation that the arrest had been formally acknowledged by Portuguese authorities and not just reported on social media.
• 2025-05-12 : Confirmed Hill arrest details against two independent wire reports, added the paragraph on the US-Portugal extradition treaty after consulting a Lisbon-based defense attorney who asked not to be named.
• 2025-05-29 : Rewrote the Pertsev paragraph after a reader pointed out that the original draft conflated the Dutch criminal conviction with the separate US civil case against Tornado Cash. Tightened to the 's-Hertogenbosch verdict and the 64-month sentence only.
• 2025-06-09 : Added the Directory policy section after internal editorial discussion. The earlier draft had buried the policy change in the conclusion. Promoted it to its own section so readers who skim see the operational consequence.
• 2025-06-22 : Final pass on the "what replaced them" section. Cut a paragraph on Lightning-based privacy that overstated the substitution effect, since Lightning solves a different problem than on-chain CoinJoin and the conflation was sloppy.