Changenow “scam” or review how ni23457 blackmails the exchange

Nathan Aren
7 min readSep 11, 2018

The following article is dedicated to an unprecedented event in the world of cryptocurrency.

On the 7th July 2018, user nicknamed ni23457 posted a message on the “Scam Accusations” section of bitcointalk. This message accused ChangeNOW exchange in holding the user’s 100 BCH/11 BTC/ $70 000.

User ni23457 is stating that he came to ChangeNOW by mistake, confusing it with Changelly (which is, to be fair, quite hard to do). Further in the message the user is describing that his transaction of 100 BCH was stopped by the exchange’s technical support team. The transaction was thought to be suspicious by the support, so they requested the KYS (passport identification) from the user. This is exactly where the most interesting part of the story starts. ni23457 is stating that he was thrown off by the fact that the employee of the technical support had a Russian name — Sergey. We are not quite sure why this name triggered ni23457 so much, but the following step of the user can be called truly crazy. The quote from the user: “I took an image with someone’s passport from google-images and sent them.” Is this really what people tend to do having $70 000 at stake? Of course, the lie did not work and user’s 100 BHC were temporarily frozen by ChangeNOW for further investigation (identifying ni23457 with his actual passport and a picture). However, ni23457 is refusing to partake in this procedure, justifying the denial with the fact that he is being afraid for his own life. In my perspective, this statement is absurd.

ChangeNOW commented on the event using the BCT forum:

«Hello, everyone. We’re here to clear everything up. Our automated verification system deemed this user’s transaction suspicious, so we asked this user to provide some ID and the source of funds according to KYC guidelines, which, as you might know, every service on the market follows. In response to that, he sent us a fake ID picture which he self-admittedly got off of Google, because he, quote, “didn’t take the service seriously”. He also failed to provide any coherent information about the source of his funds. He did send us a different ID picture after some more talking to our support, but only after an investigation had been launched.

We mention the fact that we might ask the user to provide identification in case of a suspicious transaction in our Terms of Use and Privacy Policy, which this user also failed to familiarize himself with before using ChangeNOW.

As for the coins that we supposedly “stole”: they have been moved to a cold storage where they will remain untouched until the investigation is complete. It’s been a number of times that we actually prevented theft of stolen funds this way. We hope that you understand our tactics and realize that we aren’t interested in ripping our customers off just like that. Besides, our support team has repeatedly stated to this user that he will get his funds back after the situation clears up. Good day.»

Everything seems logical here, so I decided to continue watching the story unfold.

Several days have passed and a new message from ni23457 appeared on BCT. The user was offering money for publishing his information in blogs and other crypto-related sources. This is where i became obvious that the confrontation os far from being over.

However, I did not pay much attention to the problem at the time and decided that the user just wants the public to know about his problem, but, apparently, that was not the case.

After some time I began to notice that Google is referring to the pages with absolutely identical data. The number of such pages was growing and, most importantly, none of these pages were mentioning the fact that ni23457 tried to fool ChangeNOW by sending fake documents. The informations on the pages was stating that ChangeNOW is holding the users money illegally and does not justify their “criminal actions” in any way.
Reddit started to do the same thing in a while, too. At first, ni23457 was accusing ChangeNOW with being scammers, and afterwards posted: “I want to BUY MANY VOTES! I will pay a lot. I have a lot of money!” Who is this person, who is not afraid to buy other people’s opinions? I made a screenshot of the page. This was a great decision, as in day’s time ni23457 deleted his message, trying to leave no trace.

Archive: http://archive.fo/iXMQm

Some of Reddit users were ready to share the information that had no validation and they had no idea about.

Here is the list:

andyrgreig
asherx
dbroncoboy
gabyshinn
iseoranker
kanetreble
nekomisa
primeaudio
radakito
rashonski
redshreds
reppit
spagrspagr
yusuef

UPD 21.09.2018

Here are some more shills on Reddit, which I managed to find:

potgu

hichi-kun

Bronnylee

KZdrenka

lukas32164

UPD 27.09.2018

After andyrgreig was banned after several warnings about spam on Reddit, this person, apparently, independently began to use a new shill. Here he is:

qilmblee

Quite a bit of trolls on this list! The messages are all copy pasted and accusing ChangeNOW of scam, even though it is completely not true.

There was also a number of people wanting to earn some on BCT:

https://bitcointalk.org/index.php?action=profile;u=2374957
https://bitcointalk.org/index.php?action=profile;u=2346989
https://bitcointalk.org/index.php?action=profile;u=1246188
https://bitcointalk.org/index.php?action=profile;u=1246196
https://bitcointalk.org/index.php?action=profile;u=2352582

All the profiles are dedicated to accusing ChangeNOW.

Medium:
https://medium.com/@petitefemmeforte petite nana
https://medium.com/@HallerManjbrianstephen haller
https://medium.com/@paulmcglynn25Paul McGlynn
https://medium.com/@mananaduboiManon Dubois
https://medium.com/@fredlouvier/responsesFred Louvier
https://medium.com/@jamescross601/responsesJames Cross

There are only six users accusing ChangeNOW on Medium so far, but their messages are all identical and do not state that fact that ni23457 had faked the documents. At this point it is quite obvious that ni23457 started the campaign of framing ChangeNOW and undermining the authority of a secure exchange trusted by thousands of users.

Now it is time to tell about the position of ChangeNOW on this happening. The exchange is following the European AML rules and the rules of KYC. When the situation requires identification of the user, the exchange asks for the passport (ID) that is valid in the resident’s country as well as additional information about the fund.

The information on the procedure can be found here.

ChangeNOW was following the set of rules and asked the user to confirm their identity, as the sum of the transaction was quite significant. The exchange states, that the funds are temporarily frozen until the time ni23457 agrees to the legal confirmation. Also, as ni23457 provoked mistrust with his actions, the user will have to explain where the fund is coming from.

Despite the simplicity of the procedure, ni23457 absolutely does not want to confirm the identity, spreading fake information and buying trolls instead. Most probably, this user has something to hide and is, possibly, a scammer who tried to launder money. However, there is another justification — probably, ni23457 is following someone’s directions to undermine the authority of ChangeNOW.

I will be continuing to follow this story and adding the newest information to this article.

UPD 5.10.2018

ni23457 began sending spam messages to the Telegram chat (ChangeNow) and put pressure on the Trustpilot rating. I watched long enough to understand the nature of this person’s actions. I came to the conclusion that he uses all available opportunities to undermine the authority of the exchange.

As you can see, the messages are absolutely identical, which is a sign of the actions of one person or a limited group. These are just a few screenshots, in fact, the number of messages on average reaches 50 per day.

Trustpilot. I do not have much time to point every message, but the overall picture is obvious to me. He creates completely meaningless reviews with a negative assessment, which critically affects the rating of the company. I will note the professionalism of the service team: they promptly react to spam, not allowing to mislead users.

So, such actions are regarded as defamation. If we turn to wikipedia, we will see the following signs:

«Defamation, calumny, vilification, or traducement is the communication of a false statement that, depending on the law of the country, harms the reputation of an individual, business, product, group, government, religion, or nation.»

«In some civil law jurisdictions, defamation is treated as a crime rather than a civil wrong. In Saudi Arabia, defamation of the state, or a past or present ruler, is punishable under terrorism legislation.»

I will continue to follow this story by providing updates.

--

--