Nopara exposes Samourai's X-Pub data betrayal
- Nopara’s post-mortem reveals Samourai stored user X-Pubs while weaponizing social media to hide technical failures.
- The FBI’s server seizure exposed a centralized database that unraveled Bitcoin privacy for thousands.
- The scandal forces a reckoning in the Bitcoin community on trust versus code.
Nopara’s detailed post-mortem lands like a bombshell: Samourai, long marketed as a privacy fortress, operated a centralized database of user X-Pubs - the very data that compromises financial anonymity.
According to Nopara on Stacker News Live, Samourai failed to implement foundational privacy protections like Tor-by-default, while leadership allegedly used social media harassment and sock puppets to silence technical criticism. The façade held until the FBI seized Samourai’s servers - and found exactly what Nopara warned about: a trove of X-Pubs enabling transaction tracing at scale.
"The government didn't need to break cryptography - they just queried the database."
Nopara, Stacker News Live
Internal communications reviewed by Keyon reveal founders feared this outcome, aware their infrastructure contradicted Bitcoin’s trustless ethos. Yet publicly, Samourai amplified aggressive marketing, positioning itself as a shield against state surveillance while running a trust-heavy backend.
The fallout is immediate. With both Wasabi and Samourai’s CoinJoin implementations compromised, Bitcoin’s privacy tooling faces a crisis of legitimacy. Developers now question whether privacy can survive when code is secondary to brand.
"We were selling freedom money - but the books were centralized."
Keyon, Stacker News Live
This isn’t just a technical failure. It’s a betrayal of the social contract underpinning Bitcoin: that users don’t have to trust the provider. Samourai did not just cut corners - it built its business on the data it promised to erase.