Nopara exposes Samourai's X-Pub data betrayal
- Nopara’s post-mortem reveals Samourai stored user X-Pubs while weaponizing social media to hide technical failures.
- The FBI’s server seizure exposed a centralized database that unraveled Bitcoin privacy for thousands.
- The scandal forces a reckoning in the Bitcoin community on trust versus code.
Nopara’s detailed post-mortem lands like a bombshell: Samourai, long marketed as a privacy fortress, operated a centralized database of user X-Pubs - the very data that compromises financial anonymity.
According to Nopara on Stacker News Live, Samourai failed to implement foundational privacy protections like Tor-by-default, while leadership allegedly used social media harassment and sock puppets to silence technical criticism. The façade held until the FBI seized Samourai’s servers - and found exactly what Nopara warned about: a trove of X-Pubs enabling transaction tracing at scale.
"The government didn't need to break cryptography - they just queried the database."
- Nopara, Stacker News Live
Internal communications reviewed by Keyon reveal founders feared this outcome, aware their infrastructure contradicted Bitcoin’s trustless ethos. Yet publicly, Samourai amplified aggressive marketing, positioning itself as a shield against state surveillance while running a trust-heavy backend.
The fallout is immediate. With both Wasabi and Samourai’s CoinJoin implementations compromised, Bitcoin’s privacy tooling faces a crisis of legitimacy. Developers now question whether privacy can survive when code is secondary to brand.
"We were selling freedom money - but the books were centralized."
- Keyon, Stacker News Live
This isn’t just a technical failure. It’s a betrayal of the social contract underpinning Bitcoin: that users don’t have to trust the provider. Samourai did not just cut corners - it built its business on the data it promised to erase.