Hacker News new | past | comments | ask | show | jobs | submit login
How a Bitcoin Evangelist Made Himself Vanish, in 15 Not So Easy Steps (nytimes.com)
176 points by anothermouse 10 days ago | hide | past | web | favorite | 92 comments





It just all seems like cosplay. Time, expense and inconvience in order to gain anonimity from casual twitter followers?

Will this protect him against a slightly funded and half motivated actor? Probably not.

“Announcing Jameson Lopp as a speaker at Baltic Honeybadger 2019 Bitcoin conference #bh2019, (link: https://bh2019.hodlhodl.com) bh2019.hodlhodl.com”

https://twitter.com/hodlhodl/status/1099286199783481350

Unless he is making a virtual appearance, just follow him or grab him there.

EDIT: I should make it clear I’m not just referencing the article but also the twitter conversations I’ve seen from th author (swatting is a good reason to take some of these steps obviously). For example, https://twitter.com/lopp/status/920669889064570880. He even comments himself in that thread “Local PD isn't going to send out the SWAT team again without calling me first”


The article started out with him being swatted. If your threat model includes anyone that can obtain your address and the lack of morals to swat someone then the steps listed above should work fine.

Going to a physical location and kidnapping is something far above the event that motivated the change.


> Will this protect him against a slightly funded and half motivated actor? Probably not.

He hired a PI to test the work. Presumably that defeats this viewpoint? Not saying it protects him from the FBI, but I'd say if a PI can't find you then anyone who does want to is going to need to be more than slightly motivated to do so.


Will this protect him against a slightly funded and half motivated actor? Probably not.

There is a large contingent of online craptivists who won't be bright enough or motivated enough to get to him, and the ones who are bright enough and motivated enough will probably be more interested in other people.

just follow him or grab him there

At least he's crossed the threshold of people having to do that.

"I don't need to outrun the bear. I just need to outrun you."


Maybe as a bitcoin shill, he should not have crossed the threshold of people WANTING to do that to him in the first place.

Then at least he could still stay in touch with his friends and family, and so many people wouldn't be so motivated to extract their revenge on him.

But no, running his illegal get-rich-quick pyramid scheme and fooling and exploiting other people was more important to him than his own and his dog's safety.

If he wasn't just doing this for cosplay and attention, and was actually concerned about his privacy, then maybe he shouldn't have contacted the New York Times and had them write an article about him, huh?


So your theory is that Lopp is taking these steps to protect himself from people who want to hurt him because he talks about Bitcoin publicly and the Bitcoin price has come down? That is wacky.

And you also claim he is a criminal who profited from an “illegal pyramid scheme”? Does this apply to anyone who has sold Bitcoin for more than they bought it for?


> To register his car, the D.M.V. insisted on a real name — not an L.L.C. — and a street address.

I don't understand: whose name appears on all the corporate vehicles driving around? A security van for Google, and Amazon delivery truck, a Brinks van: I'm supposed to think there's some employee's name on the title? What if that employee leaves?


I feel like another unstated risk here is that if someone can get his plate number through the DMV registration, they could buy tracking on it from one of the large ALPR firms and deduce his home location.

This is a real risk, though it does require bribing a DMV person and someone at one of the ALPR firms.

Corporations can and do register cars in their names. I assume LLCs are not afforded the same privilege because they do not undergo the same level of regulation that a C corp does. When you're involved in a car accident, your insurance doesn't want to go through webs of shell LLCs to find out who they need to sue / file a claim with.

A quick search suggests that a title can be transferred to an LLC. (e.g. https://smallbusiness.chron.com/transfer-private-vehicle-llc...). IANAL.

A vehicle title and a vehicle registration are separate things, though. It's entirely imaginable that an LLC may be able to own a vehicle title while still not being able to register that vehicle.

Vehicle registration is a common service offered by registered agent companies in the states mentioned in the article.

An out-of-state license plate could attract unwanted attention though, which may be why Lopp chose not to employ this technique.


> To make sure his phone wasn’t keeping a record of everywhere he’d been — and potentially transmitting it to apps he was using — he turned off all its geolocation services.

... Of course, IMEI tracking (from tower registration) can get you pretty much all of this data anyway. This article is more about how to partially obfuscate your identity to private actors.

It would be interesting to know how fast a professional could unravel all of this. Minutes? Hours?


It looks like $300 is enough to buy the IMEI data.

https://www.bloomberg.com/news/articles/2019-01-29/seems-you...


If you could determine the name of the LLC or the IMEI, a possible attack vectoris to social engineer/flat out bribe Cellco reps into giving you more data.

This is not that hard and there are private web forums where cellco reps surreptitiously offer their services for money/bitcoin/


But private actors can't easily map IMEI to user. Law enforcement typically can but the article doesn't suggest he's trying to defend against them, just private actors.

Sure, individuals in law enforcement or the phone companies can be suborned (i.e. bribed) but all the procedures procedures described in the article are part of "defense in depth". And in fact some of the others make it harder to even know which IMEI to track. I don't know the IMEIs of the handsets of any of my friends -- or even my own, though I could look it up.


You'd need the IMEI from either knowing the LLC or knowing his location and successfully recording it, no?

So maybe, like parent said, track him at an in-person conference appearance?


Satellite phone + satellite GPS would be better, right? Since money is apparently no object…

Satellite phones can be tracked..

Bitcoin is the very opposite of anonymous. Permanently recorded for posterity would be a better description. The best you can get is pseudonymous, and that's if you never actually spend any of the coin.

He didn't get targeted for having BTC -- he got targeted for being very public and loud about promoting BTC.

Maybe this is actually a lesson about why not to be a bitcoin shill, instead of a lesson about how to vanish.

Literally from the Bitcoin white paper:

"The traditional banking model achieves a level of privacy by limiting access to information to the parties involved and the trusted third party. The necessity to announce all transactions publicly precludes this method, but privacy can still be maintained by breaking the flow of information in another place: by keeping public keys anonymous. The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone."

That Bitcoin wasn't private was clear since day 0.


Also quite a good checklist for money laundering. I think buying a house in the UK now requires ID for this reason, and there's an ongoing campaign to close the loopholes for companies.

I do remember when I was briefly the director of a tiny UK non-profit that the company identity information was mandatory .. except for a very small list of those who were exempt because of intimidation, after a nasty terrorist campaign against Huntingdon Life Sciences. https://www.gov.uk/government/publications/restricting-the-d...


These days, American big banks want to know who is controlling LLCs when accounts are opened. This is due to new KYC rules.

This article has so little to do with Bitcoin that I think a more descriptive title would have been:

"How a Very Wealthy Person Conceals His Name and Address From The Public"


Wealthy maybe but not very wealthy. A very wealthy person would have many more options. This is more of a guide for someone that has money to burn on this as a (serious) hobby but isn't ludicrously out of reach for most readers.

I'd politely disagree, for most of the points yes, it's achievable for folks with disposable income, however I don't think the average reader (NYT or HN) can afford to buy 2 new homes and 1 new vehicle all in cash.

> When he found a property to buy, he used the L.L.C. and a cashier’s check from the L.L.C.’s bank account to pay for the house in full. A mortgage was not going to be possible.

> 9. Buy a boring car.

> 10. Buy a decoy house to fool the D.M.V.


yes, it's achievable for folks with disposable income

People living in NC and TX generally have a lot more disposable income than people in CA at the same gross income level. (In that sense, those other places are more free.)

pay for the house in full. A mortgage was not going to be possible.

It's entirely possible for an LLC to lease property. I also know for a fact that there are people in Chinatown who, for a variety of reasons, can't get a mortgage, but they can get alternative financing to the tune of several hundreds of thousands of dollars.

> 9. Buy a boring car.

Very affordable. I just did this.

> 10. Buy a decoy house to fool the D.M.V.

In the Blues Brothers movie, I think one of the characters had Wrigley Field as their address. If you have friends at an organization like a church, you could use that address.

The subject of the article did it with money. There are other people who do some things like this through their connections.


As someone who was a target of harassment just to reveal the identity of a friend, I can assure you that using friends is not a good way to secure information in the digital age.

The friend or the friendly organization needs to be prepared for the heat, and should have volunteered to face it. Volunteering a friend without their knowing what they're in for is pretty bad, of course.

> People living in NC and TX generally have a lot more disposable income than people in CA at the same gross income level. (In that sense, those other places are more free.)

Sure, it's just more difficult to get to the same gross income level in those places.


Except that he works his bitcoin shilling scam remotely.

Read the article: section 13.


>>> I'd politely disagree, for most of the points yes, it's achievable for folks with disposable income, however I don't think the average reader (NYT or HN) can afford to buy 2 new homes and 1 new vehicle all in cash.

>> People living in NC and TX generally have a lot more disposable income than people in CA at the same gross income level. (In that sense, those other places are more free.)

> Sure, it's just more difficult to get to the same gross income level in those places.

I'm not sure how you would manage to read this comment thread and think my comment is about the person in the article specifically.


I think the only take-away from this article is "Don't Shill Bitcoin".

And of course, step 16 of your not-so-easy plan to vanish to avoid the consequences of your actions should not be contacting the New York Times and having them write an article about you.


> I think the only take-away from this article is "Don't Shill Bitcoin".

That's a pretty limited reading of the article. Another lesson might be about the difficulty ordinary people have in staying private in modern society. I can think of many reasons why a person might desire (or need) the sort of privacy outlined in the article that don't have anything to do with "shilling bitcoin."

> And of course, step 16 of your not-so-easy plan to vanish to avoid the consequences of your actions should not be contacting the New York Times and having them write an article about you.

Sure. This whole thing appears to be little more than a publicity stunt.

I still think it is harder to earn $100k per year in a place like North Carolina than, say, California.


You're absolutely right in spirit, CA incomes are way higher in all senses as compared to NC. That said, for professionals working in the research triangle park (IBM, SAS, GE etc) or bankers in Charlotte 6 figs is not weird at all. NC is one of the better-off southern states (we gave up relatively quickly in the civil war and its still paying off).

I think the premise presupposes some level of funds. I mean if you don't have any excess cash what are you worried about in the first place?

But with that said you can buy houses for $20k in lots of places in this country, which I suspect the average HN reader could probably swing.


"Why a Very Dishonest Bitcoin Shill Conceals His Name and Address From The Public"

I am surprised it is possible to get a corporate credit card without a human’s name or identity tied to it.

Isn't it tied to someone via the corporation's ownership, still?

A revocable trust can own an LLC. In that situation your name only exists on a piece of paper at your house. It's extremely common to get a Nevada or Delaware LLC with a revocable trust to protect identity. There are tons of libertarian companies that will sell you kits to set it all up.

That's fascinating. How and why?

I'm an attorney and used to work for a bank. One of the hats I wore there was Anti-Money Laundering Officer. We had a potential client with this type of arrangement that went through several countries so I insisted on getting more and more information because it seemed suspicious that someone would go through all of that trouble unless they were doing something illegal. It turned out the gentleman traveled internationally quite a lot for business... and had accumulated three different families on three different continents. His revocable trust owned several LLCs as part of a complex plan to facilitate payments to all of his wives and children upon his death without them finding out about one another.

I regret that I wasn't privy to his plans for keeping them apart at his funeral.


What an odd moral thought experiment. I would guess this isn't exactly uncommon for a certain class of people and even though some people might feel revolted by it... If all goes to plan, I'm not sure that it's wrong?

My guess is that after his death it'll all just come undone with a discovery of his master digital calendar. So many birthdays!

A probable solution to the funeral thing is that the trust is set up to execute three funerals. Who care's what's in the urn, but it could deliver parts of him to all the places.


I am not a lawyer, but I know people who have done it in the past. The states where you can do it value corporate privacy. When you create your LLC with a revocable trust, as far as I am aware, all you have to present is the first page of the trust document and the declarations of ownership are on later pages, the trust owns the LLC, you own the trust and your ownership is never recorded in public. It's complicated and is a great tool for people trying to do good (protecting identity for safety) and bad (patent trolls).

https://www.thebalance.com/pros-and-cons-of-revocable-living...


The article said it was possible to register an LLC in those states without a name, and the CC is (apparently) tied to the LLC, not the owner or employee.

But they still record the name of the person who registers it, right?

It's not like they'll find a homicide tied to a CC and then be like, "oh, the CC is in the name of an ownerless corporation, I guess we're out of luck".


The article is slightly vague on this point. It says NV/WY/NM "don’t require corporations to record their owner", but that is not really accurate.

The owners are recorded when the LLCs are filed with the secretary of state, however these states are simply willing to keep the identities of the owners private, without publishing them as most other states do. As in most other states, you do need a Registered Agent, but you can delegate this to an attorney or company who serves to receive legal notices, correspondence, etc.

If there is any type of law enforcement investigation of the company, police would simply go to the secretary of state to determine the owners.


The owners are recorded when the LLCs are filed with the secretary of state, however these states are simply willing to keep the identities of the owners private

How hackable/social engineering proof are these state agencies? How likely is it that they are already compromised by people acting as resources for federal and non-governmental organizations?


They're just regular departments of their respective states. That is to say, probably about average susceptibility to hacking and social engineering. I don't know any specifics about what might be sent to the feds, but you can be damn sure if the IRS or any other federal agency calls the state they will fully cooperate. None of this would actually work to hide from the government, just from random non-expert members of the public.

None of this would actually work to hide from the government, just from random non-expert members of the public.

In 2019, one should be most worried about throngs of people who have less income and delusions of grandeur who can organize their groupthink online.


Not all Corp credit cards record the name of the person registering them. The ones my company uses are all tied to the company and we internally manage keeping up with who has what.

I meant registering the corporation, not the CC.

Perhaps I'm missing something, but the DMV links him to his LLC which is linked to everything else. A quick records search on myself pulled up the requisite registration information, so I'm left to question how anonymous he actually is.

> That would make him easy to track down if someone learned the name of the L.L.C. Nevada, Wyoming and New Mexico, however, don’t require corporations to record their owner. Mr. Lopp took advantage of that.

His real identity is tied to the DMV, which ties him to the car, which is tied to the LLC; does this not deanonymize the LLC? From the LLC you get the rest of his large assets, namely his second house.

How is the car tied to the LLC?

> When he purchased a new car, he picked a much less flashy model, and he used the L.L.C. to sign the papers.

> To register his car, the D.M.V. insisted on a real name — not an L.L.C. — and a street address.

As far as I can tell, the car belongs to the LLC, it's not in his name, but his real identity is a registered driver or some such to said car.


And the address his DMV records are tied to is a crap box his LLC owns somewhere he doesn't live.

It's *not the address that matters, it's linking him to a specific LLC. If he bought his car under the same LLC that bought the house where he lives, then you can find him through the LLC.

If he used one LLC for car, another for the house, the point is moot... but the article leads me to believe they are under the same LLC, hence the initial comment.

I suppose a better question to have asked would be if there was/is any benefit for the DMV associated car+house to be purchased with an LLC rather than outright?

EDIT: a word


That's a fair point, thanks for pointing it out.

It's weird to see someone publishing info about how he's concealing. I'm hiding, here's how I did it. Perhaps, he sees an opportunity in concealing identity business.

Maybe the article is a decoy and what he said is not how he did it.

He may be testing his privacy framework. If publishing it doesn't make it weaker, it's a good framework. I guess he does not believe in security by obscurity.

That, and it's also possible he's taken more steps than described in this article.

A lot of the comments here are about how this wouldn't hold up to state actors. I don't see anywhere that indicates that this is the goal (except for maybe the title?)

I think it's clear that Lopp was seeking privacy from swatters and is well aware that privacy from the government is a moot discussion.

Sounds good, but I suspect many of those steps won't actually work. That is, he hasn't truly vanished, maybe to online trolls who are into SWATTING.

It’s a continuum. There’s a lot of difference between hiding from stalkers and online trolls and effectively hiding within a nation state that is devoting considerable resources to find you. It’s also somewhat a function of what you’re willing to give up to hide.

Sounds good, but I suspect many of those steps won't actually work. That is, he hasn't truly vanished, maybe to online trolls who are into SWATTING.

If this sort of thing could be structured so that it could be delivered economically, there are a lot of YouTubers who would be a potential market for this sort of service. That level of security would be entirely appropriate for them and very valuable.

This certainly fits into the category of things that don't scale.


I might be missing something here, but he's buying a bunch of stuff in the name of the LLC but they aren't actually LLC expenses. Isn't that a violation of tax law at minimum? Possibly something more serious like fraud, no? I have a side business and it's an LLC. I know I can't just start buying cars, houses, cell phones, etc. and claim them as business expenses.

How is he doing that legitimately?


All you have to do is properly label any such spending as an owners draw or disbursement. As long as you properly report any income received and don't call personal spending a business expense you're not doing anything wrong.

Interesting. Thanks. I guess since I keep everything perfectly separated I didn't even know that was a possibility.

Buying them in the name of the LLC doesn't mean they are being claimed as business expenses.

Really? I didn't know that. I figured that was kind of a must, but apparently not.

Final step, post it all on NYTimes!

Seriously though, the toughest part about seeking anonymity is working against human nature and one's need for social validation.


It doesn't sound like he's shed his identity, but instead he wants to make it so his identity can't be tracked to his physical location anymore.

That's actually a feature if you want to know whether you've done it well!

One of my fav Wired articles was about this... https://www.wired.com/2009/08/gone-forever-what-does-it-take...

Wonderful article... but incredibly selfish. I'm pretty sure if I'd faked my death and then later on reached out to my wife, she would murder me and nobody would know.

So, does he just never visit family and friends to maintain privacy? Sounds lonely.

The New York Times somewhat ironically won't let me read this article in private mode. "You're in private mode. Log in or create a free account to continue reading."

I would be interested to know how he arranged his DNS service.

"Bitcoin evangelist": The most anonymous way to buy things, of course, is to simply use cash....

Buys a house, in cash. Buys another "throwaway" house for his car, in cash. Buys car, in cash. And then claims: "Mr. Lopp estimates that his efforts to disappear have cost him about $30,000."

Yeah, right.


I interpreted this as referring to the privacy stuff on its own: paperwork, legal advice, etc. - and, yes, the place for his car to live. (Which sounds like it probably wasn't very expensive.)

Maybe $30k net. He could have sold the old house and car for a market price and then purchased a new house and car for a little less. It is entirely believable that he found a run-down shack in North Carolina to buy for less than twenty grand.

Auto insurance is a legal requirement. My insurance company asks me to state where my car is habitually parked, and would consider a misleading answer fraudulent.

> Auto insurance is a legal requirement.

Not in all states. In Texas, you do not need auto insurance if you can prove you have the financial ability to pay what an insurance company would otherwise pay.


If you're serious about hiding your physical location, this honestly doesn't seem like much of a showstopper. It happens routinely anyway and, barring obvious red flags, it's going to be hard for an insurance company to discover the fraud.

as typical the clickbait title implies much more than reality



Applications are open for YC Summer 2019

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact

Search: