how to avoid buying blacklisted/dirty bitcoins

[apogio]

Hi apogio

but i guess there is a misunderstanding let me go explain some potential privacy risks, lets say you are using cex and if you withdraw from it repeatedly to the same wallet, or if you combine multiple known outputs in a single transaction. This could make it easier for someone (like an internal records) to link your activity and see who you are. This is a potential privacy risks for me and i wanted warn others. Thats why spending in parts could avoid this. (attention from the exchange or link to your activity)

Hi,

the thing with CEXs is that they track (and they are supposed to track) every transaction their users make. So, if you deposit $500 three times and immediately buy and withdraw the XMR to your self-custody, the CEX will know the following:

(a) Trêvoid deposited $1500
(b) Trêvoid bought 2 XMR, then 2.1 XMR and then 1.9 XMR with this money, leaving them with a total of 6 XMR and $0.
(c) Trêvoid withdrew 1.5 XMR to address XYZ, then 2.5 XMR to address OPK and then 2 XMR to address UJM.

They have this knowledge and they can share it with any authority that can legally ask for it.

(fake) example story : a h*cker demands a ransom of $250,000 in Bitcoin, which is (lets say) 3.62 BTC and he is paid 3.62 BTC. He knows that Bitcoin is tracked and goes to an exchange that does not require KYC, any documents and exchanges his BTC for XMR in several transactions. Since he doesn't trust this exchange, he transfers XMR several times to cold wallets, and after that, he exchanges XMR for Bitcoin somewhere and sends it to Binance to withdraw these funds to his bank account. It seems like a complex chain: Bitcoin > XMR > XMR > Bitcoin and this can be tracked, all due to the volume and time interval (because it can link to your activity). The volume of $250,000 is quite large, and even if it occurs over a week, there may be only 1 or 2 similar operations for that amount, which greatly simplifies tracking, as such operations stand out among the mass of others.

What if you remove the red part that I highlighted in your text? If the criminal decides not to cash out on their crypto, then it's essentially a very difficult thing to track. It's almost impossible. The trigger point for the authorities comes from the fact that some user X, who can't justify their crypto income, suddenly send (even in small parts) $250,000 to a CEX to cash out. This should make the CEX suspicious.

[LoyceV]

the thing with CEXs is that they track (and they are supposed to track) every transaction their users make. So, if you deposit $500 three times and immediately buy and withdraw the XMR to your self-custody, the CEX will know the following:

(a) Trêvoid deposited $1500
(b) Trêvoid bought 2 XMR, then 2.1 XMR and then 1.9 XMR with this money, leaving them with a total of 6 XMR and $0.
(c) Trêvoid withdrew 1.5 XMR to address XYZ, then 2.5 XMR to address OPK and then 2 XMR to address UJM.

Centralized exchanges are basically like banks, but (at least for the moment) less strictly regulated, and I assume they'd actually share more data with more different governments than banks do.
For both, it's safe to assume they keep all records of all transactions forever.

If I go to an ATM 3 times, and take out €500 3 times, all the bank knows is that Marcel now has €1500 in his pocket. If I were to deposit that again, they can assume it's the same pile of bills or different bills. But if someone else deposits €1500, they have no idea if there's a link between the transactions. XMR is more or less the same.

[bias]

Spend your XMR (withdraw) in parts; don't send everything at once to one wallet in a large volume. In the blockchain, most transactions range from 1 XMR to 100 XMR; other volumes will stand out significantly.

Generally, if you follow a strategy, you must calculate and measure all variables. One of them is never moving amounts that can trigger alarms by themselves. So, even if XMR is private, sending 2k XMRs is an alarm of its own.

And lastly, if you need Secure No KYC-AML Crypto Swaps let me know, good luck!

Probably I will. Thank you!

~snip~

The problem starts from the moment you use a CEX for cashing out the f... Fiat, and not only with XMR, but with all coins. The conclusion is that the best way is to use P2P and privacy-based coins (I don't know any other besides Monero). However, even in this case, you will never know if your coins are 100% "clean".

[apogio]

The problem starts from the moment you use a CEX for cashing out the f... Fiat, and not only with XMR, but with all coins. The conclusion is that the best way is to use P2P and privacy-based coins (I don't know any other besides Monero). However, even in this case, you will never know if your coins are 100% "clean".

I am not entirely against CEXs, I want to emphasise that!

Like LoyceV said above, let's say that I (apogio) withdraw 0.1BTC from Binance and 1 month later you (bias) deposits 0.1BTC on Kraken and request to sell it and withdraw the FIAT to your account.

Now, in the meantime, we may have transacted P2P and I may have given you that 0.1BTC.
With BTC, the UTXOs are totally and provably different each time, which means that the 0.1BTC can be traced back and the authorities can see where it originated from. There are ways to obfuscate the history, like we discussed above.
With XMR, you can think of it as a BTC UTXO, which, by protocol rules, is mixed everytime it's transacted. It's like having the mixing feature plugged-in on the base layer of the blockchain. Which means, that there is no way for Binance and Kraken to know that you have transacted with me, but they can guess it is.

That's why the invented the KYC/AML algorithms. Because the want to be able to catch the scenario where I, being a criminal, may send someone my coins and this someone may use them elsewhere. So, the KYC/AML algorithms provide a "score". In our example, if you were to deposit 0.1BTC that you, somehow, received from an unknown source, they will request all this data, because they are sure, or they guess that the 0.1BTC derives from illicit activities. Which is totally annoying, because if you think about it, this guessing game will almost always be completely arbitrary.

[Trêvoid]

Hi apogio

but i guess there is a misunderstanding let me go explain some potential privacy risks, lets say you are using cex and if you withdraw from it repeatedly to the same wallet, or if you combine multiple known outputs in a single transaction. This could make it easier for someone (like an internal records) to link your activity and see who you are. This is a potential privacy risks for me and i wanted warn others. Thats why spending in parts could avoid this. (attention from the exchange or link to your activity)

Hi,

the thing with CEXs is that they track (and they are supposed to track) every transaction their users make. So, if you deposit $500 three times and immediately buy and withdraw the XMR to your self-custody, the CEX will know the following:

(a) Trêvoid deposited $1500
(b) Trêvoid bought 2 XMR, then 2.1 XMR and then 1.9 XMR with this money, leaving them with a total of 6 XMR and $0.
(c) Trêvoid withdrew 1.5 XMR to address XYZ, then 2.5 XMR to address OPK and then 2 XMR to address UJM.

They have this knowledge and they can share it with any authority that can legally ask for it.

(fake) example story : a h*cker demands a ransom of $250,000 in Bitcoin, which is (lets say) 3.62 BTC and he is paid 3.62 BTC. He knows that Bitcoin is tracked and goes to an exchange that does not require KYC, any documents and exchanges his BTC for XMR in several transactions. Since he doesn't trust this exchange, he transfers XMR several times to cold wallets, and after that, he exchanges XMR for Bitcoin somewhere and sends it to Binance to withdraw these funds to his bank account. It seems like a complex chain: Bitcoin > XMR > XMR > Bitcoin and this can be tracked, all due to the volume and time interval (because it can link to your activity). The volume of $250,000 is quite large, and even if it occurs over a week, there may be only 1 or 2 similar operations for that amount, which greatly simplifies tracking, as such operations stand out among the mass of others.

What if you remove the red part that I highlighted in your text? If the criminal decides not to cash out on their crypto, then it's essentially a very difficult thing to track. It's almost impossible. The trigger point for the authorities comes from the fact that some user X, who can't justify their crypto income, suddenly send (even in small parts) $250,000 to a CEX to cash out. This should make the CEX suspicious.

Yes that correct, if we remove that part it will be difficult thing to track. But also if you have done KYC on your CEX, it can also be linked to you. CEX will know only record of your deposit, trading, and withdrawal activities. Also once you withdraw xmr to your own wallet, the privacy features of xmr make it nearly impossible for anyone to trace further movements.

[bias]

~snip~

I'm not "against" them either. I'm against the KYC/ AML policies that they have to follow and comply with. But in the times that we live in, I don't expect better treatment from authorities.
I wanted to ask (in an imaginary scenario) if BTC changes its code and protocols and inserts the same mechanism as XMR. It will be a tremendous change, and since BTC is the King, nobody will delist it or isolate it. So, what will happen to all of the CEXs and the general anti-money laundering methods?  What will they do?

[apogio]

I'm not "against" them either. I'm against the KYC/ AML policies that they have to follow and comply with. But in the times that we live in, I don't expect better treatment from authorities.
I wanted to ask (in an imaginary scenario) if BTC changes its code and protocols and inserts the same mechanism as XMR. It will be a tremendous change, and since BTC is the King, nobody will delist it or isolate it. So, what will happen to all of the CEXs and the general anti-money laundering methods?  What will they do?

Good question. I prefer not to answer, because I am not very technically capable, but I 've posted a new thread, where I hope that bitcoin contributors, or in general, more technically savvy users will answer.

[duke_otc]

With the amount of BTC that passed through silk road and the likes, I think only newly mined coins can be called clean.
I remember people paying a premium for such newly mined coins.

yes to be honest i dont give a **** about if its dirty or not i still buy because if this keeps on going eventually every bitcoin will be dirty. i just want to know if a btc is dirty or not so i dont send it on an exchange

[examplens]

yes to be honest i dont give a **** about if its dirty or not i still buy because if this keeps on going eventually every bitcoin will be dirty. i just want to know if a btc is dirty or not so i dont send it on an exchange

You messed up the quote, but ok.

You can't get a concrete answer to this because it all depends on which AML check method a service uses.
Here are some examples. Two different exchanges recognized the same funds differently. One found an 80%+ risk score, while the other had no problem because the risk score was below 30%. (checked one of my addresses)
Next, many instant exchangers use an AML check by Whitebit, which necessarily marks all coins and transactions related to eXch as high risk. For example, Binance did not cause a problem with coins related to eXch.

So, AML crap has become quite individual; you just have to pay attention to which service you use and where you send your coins.

Here is an example of a response I received from an exchange after they stopped my order.

The digital asset for which you submitted an order to sell was acquired by a hacker attack on the Bybit stock exchange in February 2025. You are not a direct acquirer, two intermediate transactions passed from the theft of the digital asset to your acquisition (so we are sure that you are not familiar with the origin), but we are unable to accept your transaction for the reasons stated.

[bias]

You can't get a concrete answer to this because it all depends on which AML check method a service uses.
Here are some examples. Two different exchanges recognized the same funds differently. One found an 80%+ risk score, while the other had no problem because the risk score was below 30%. (checked one of my addresses)
Next, many instant exchangers use an AML check by Whitebit, which necessarily marks all coins and transactions related to eXch as high risk. For example, Binance did not cause a problem with coins related to eXch.

So, AML crap has become quite individual; you just have to pay attention to which service you use and where you send your coins.

Here is an example of a response I received from an exchange after they stopped my order.

The digital asset for which you submitted an order to sell was acquired by a hacker attack on the Bybit stock exchange in February 2025. You are not a direct acquirer, two intermediate transactions passed from the theft of the digital asset to your acquisition (so we are sure that you are not familiar with the origin), but we are unable to accept your transaction for the reasons stated.

Well, I faced the same issue with the WhiteBit exchange. I send an Alt coin that I wanted to cash out and they requested to verify (?) both the sender's address and the recipient's address (the one I used to withdraw after the sale). I sent them an instant message to find out the reason for this, and they told me that they need to know for our protection...🙄🥱
By the way, is it possible to tell us what happened after you got this reply from them? I mean, do you get your coins back? Did they blacklisted you? Did they let you continue without a problem?

[examplens]

Well, I faced the same issue with the WhiteBit exchange. I send an Alt coin that I wanted to cash out and they requested to verify (?) both the sender's address and the recipient's address (the one I used to withdraw after the sale). I sent them an instant message to find out the reason for this, and they told me that they need to know for our protection...🙄🥱

Whitebit is probably the worst example of (mis)use of AML checks. There are numerous cases of complaints against them, and they were risky even before the AML euphoria, and it seems that this only gave them additional justification to manipulate transactions.
It is recommended to avoid them.

By the way, is it possible to tell us what happened after you got this reply from them? I mean, do you get your coins back? Did they blacklisted you? Did they let you continue without a problem?

It is a local exchange (certainly not Whitebit) mentioned above. I received a refund, the process took about a week.

[bias]

Whitebit is probably the worst example of (mis)use of AML checks. There are numerous cases of complaints against them, and they were risky even before the AML euphoria, and it seems that this only gave them additional justification to manipulate transactions.
It is recommended to avoid them.

I didn't want to even sign up there, not to make a trade and pass all their stupid KYC/AML procedures. However, it's the only exchanger which have listed the alt that I have. So, I didn't have any other choice but to get there and sell it. Thankfully, it will take a lot of time to revisit it and make something there.

It is a local exchange (certainly not Whitebit) mentioned above. I received a refund, the process took about a week.

Good to hear it. It's been cases where the exchanger holds the coins and doesn't return them to their owner, or they blacklisted them for future transactions.

[examplens]

Good to hear it. It's been cases where the exchanger holds the coins and doesn't return them to their owner, or they blacklisted them for future transactions.

Even more amusing is that the coins that the exchange returned to me had a 1% risk score. In a way, they 'cleaned' my coins even though they refused to process the swap order. 

[Trêvoid]

Good to hear it. It's been cases where the exchanger holds the coins and doesn't return them to their owner, or they blacklisted them for future transactions.

Even more amusing is that the coins that the exchange returned to me had a 1% risk score. In a way, they 'cleaned' my coins even though they refused to process the swap order. 

That is pretty ironic 

they wouldn't process your swap but ended up returning your coins with a lower risk score, so the refusal kind of acted as an unexpected “cleaning” of your assets.

[LoyceV]

Even more amusing is that the coins that the exchange returned to me had a 1% risk score. In a way, they 'cleaned' my coins even though they refused to process the swap order. 

Did they consolidate your coins to their own address, or did they return it directly from the address you deposited to?

Who determines this "risk score"? I'd say this just confirms the "risk score" is mostly arbitrary.

[examplens]

Did they consolidate your coins to their own address, or did they return it directly from the address you deposited to?

Who determines this "risk score"? I'd say this just confirms the "risk score" is mostly arbitrary.

First, they asked me for a new Bitcoin address, because their system does not allow them to send to the original one from which I sent coins, because it is "compromised". In a short analysis, I did not find a connection between the 'dirty' coins that I sent and those that I received in return.

They use Elliptic to check the 'risk score'. As far as I understood them, it is a tool used by service partners, where they forward/sell coins.

[bias]

Even more amusing is that the coins that the exchange returned to me had a 1% risk score. In a way, they 'cleaned' my coins even though they refused to process the swap order. 

Well, that's the best case scenario that I have heard of. Where did you make the "risk score" check to see that 1%? Or do they tell it to you? From what I heard, they guide you to check it through the checker provider that they use.

Who determines this "risk score"? I'd say this just confirms the "risk score" is mostly arbitrary.

The whole situation is arbitrary from the start. We know that they want to know and control everything. Since every exchanger uses another AML "risk checker" service, we can say that any of them can black listed whatever address it "sees" fit. However, if they cooperate between them and share their info regarding "black address", then we will face the same issue in any exchanger. It seems that we are not far away from this becoming a regularity.😟

[apogio]

First, they asked me for a new Bitcoin address, because their system does not allow them to send to the original one from which I sent coins, because it is "compromised".

I am happy for you, I am still not getting my coins back from Godex.

Who determines this "risk score"?

They use some algorithms for this purpose There is a service called Chainalysis and I know it's widely used by exchanges.

[examplens]

I am happy for you, I am still not getting my coins back from Godex.

In my case, it was a fully regulated and licensed exchange service. Whom he could very easily take to court and most likely win the case with additional big costs for them. In doing so, they might risk the license issued by the central bank.

Unfortunately, we have reached a point where some 'wild' services block users' funds without any accountability and decide for themselves what to do with that money.

[apogio]

In my case, it was a fully regulated and licensed exchange service. Whom he could very easily take to court and most likely win the case with additional big costs for them. In doing so, they might risk the license issued by the central bank.

Oh yeah the difference is obvious, of course.

Once more, I will quote Loyce, who explains it perfectly here:

I'm (up to some point) okay with centralized but well-known and regulated services (be it casinos or exchanges) that require KYC. I'm also okay with completely anonymous but trusted services that don't ask for any personal data.
Problems start when unregulated exchangers demand personal data after depositing, which many exchangers seem to do. We need more trusted exchangers, not less.