Crypto Exchange ChangeNow Accused of Stealing $70,000 via Changelly API
Cryptocurrency exchange ChangeNow has been accused of stealing $70,000 from a user via the Changelly API.
The online exchange promises fast coin swaps free of custody. Unfortunately, according to one user, the exchange overstepped its bounds by holding onto a user’s coins in at least one trade.
ChangeNow is a third party exchange with no connection to Changelly. Changelly adamantly denies all allegations of wrongdoing, stating that the customer was not dealing with Changelly: the customer was dealing with a third-party company using the Changelly API.
The theft was first reported in July 2018, when a user posted a thread on Bitcointalk.org accusing Russia-based crypto exchange platform ChangeNow of stealing $70,000. That user, who we only know by his username ni23457 on the forum, claims to have used ChangeNow to initiate a trade for 100 BCH for 11 BTC. The user used ChangeNow to initiate the transaction, and the BCH was sent to ChangeNow’s wallet.
This is where things started going wrong: ChangeNow demanded KYC verification from the user before completing the transaction. The user refused to comply with the demand.
Now, ChangeNow is refusing to return the customer’s $70,000 worth of BCH.
ChangeNow had only recently changed their policy and implemented a KYC procedure. Under the previous scheme, the exchange allowed users to make trades without needing to complete KYC verification. ChangeNow added KYC to comply with regulations.
ChangeNow’s website claims that the company added KYC in April 2018. However, the company has admitted that they weren’t as transparent with users about this process as they should have been.
The original thread about the theft of bitcoins has since turned into a 28 page mess of accusations flying back and forth. Changelly is getting involved. Developers are responding. It’s hard to know who is telling the truth and who isn’t. Nevertheless, the community seems to be siding with the anonymous user who originally posted the complaint.
ChangeNow Admits that the Stolen BCH is Stored in Their Servers
ChangeNow isn’t refuting the claims of the user. In fact, they admit that they have the user’s BCH stored in cold storage.
In a Medium blog post last month, ChangeNow claimed that they’re waiting for law enforcement to get involved before returning the BCH to the user:
“We, in turn, are preparing legal claims which we are going to submit to Interpol, Europol, and other authorities, along with the info we have on the client and the cold wallet address on which the funds are kept for the time being. After that we are going to wait for their official reply. In no circumstances are we going to keep this user’s funds for ourselves.”
ChangeNow Will Keep Your Funds While Law Enforcement Gets Involved
In that same September blog post, ChangeNow claims they reserve the right to withhold customer funds for no real reason:
“Each KYC case is handled individually. We will apply a set of standard procedures to our KYC clients, among which are asking a client to send a minimal set of documents that will allow us to confirm their identity and provide the source of funds. We aren’t going to keep this client’s funds. They’re stored on a cold wallet created specifically for his case. If the KYC procedure has failed we reserve the right to submit a claim to the legal authorities (Interpol, Europol, and other).”
The last sentence is the most important part: if a user does not complete the KYC procedure, or if the user fails the KYC procedure, then ChangeNow will keep the customer’s funds while law enforcement authorities are contacted.
Did ChangeNow Lure Users Into a KYC Trap?
Ni23457 is at the middle of this debate after losing $70,000. He claims that ChangeNow was deliberately misleading about its KYC policy. He claims that the exchange purposely led customers to believe that no KYC verification would be required, only to spring KYC verification on users at the last minute.
Once users had initiated a trade on the platform, ChangeNow requested KYC verification. Customers who didn’t provide that verification had their funds locked into he ChangeNow servers – even if they simply wanted to cancel the transaction and get their funds back.
ChangeNow has admitted that they could have been more transparent about their KYC procedure:
“We are ready to admit that our transparency policy is still a work in progress regarding the KYC procedure: we have expanded our FAQ, adding a special section on AML and KYC… as well as a notification and a link to our AML/KYC info. As we grow, we are going to add more tweaks and features to our website for convenience of our users.”
Some are accusing ChangeNow of running a “KYC trap”: they’ve lured users into making trades with the platform believing they didn’t need to complete KYC, only to spring KYC on users at the last minute. That’s why the community has a problem with ChangeNow.
Whose Side Are You On?
Ultimately, here is what seemed to have happened regarding ChangeNow’s theft of $70,000: a user wanted to use the exchange to transfer $70,000 of BCH into BTC. That user submitted the trade request using ChangeNow, which uses the Changelly API to complete transactions. The user chose ChangeNow because he was under the assumption that he would not need to complete KYC verification on ChangeNow. When ChangeNow asked for KYC verification, the user refused.
In response, ChangeNow assumes the funds are suspicious or illegal. They’ve stored the BCH in their own cold storage wallets while they pass the case onto law enforcement organizations. If law enforcement has no issue with the funds, then the funds will be returned to the user. It’s unclear if and when that will ever happen, however.
ChangeNow claims they have the right to hold onto customer’s funds if they refuse to comply with KYC verification – even if the user is simply trying to cancel the transaction.
This whole situation is a bit of a mess. However, ChangeNow isn’t refuting the fact that they’re holding onto the user’s $70,000. In fact, they’ve confirmed it multiple times. We’ll keep you posted on what happens next.
October 5th Update from Changelly
Sasha Kolesova from Changelly reached out to us for clarification and asked us to update our article. Here is the email that we received:
Subject: URGENT comment on the latest ChangeNOW article
I'm Sasha Kolesova from Changelly. I just saw your article at https://bitcoinexchangeguide.com/crypto-exchange-changenow-accused-of-stealing-70000-via-changelly-api/ and I need to ask you to update it with the following information.
The most important thing is that the title is incorrect in saying that this transaction at ChangeNow was performed through Changelly's API. That is not true and we have checked that once the matter had appeared. You can actually find our words on this at that BitcoinTalk thread. Quote: “ChangeNOW use our API for some trading pairs, that's right. But for BCH-BTC pair ChangeNow don't use our API, most probably they have their own trading engine or something else, we don't know”.
Please, update the title and the body of the article because this is a false and defamatory statement. We have nothing to do with the transaction that has never run via our API. The user that's having this issue with ChangeNow is actually harassing and blackmailing us including our employee's personal data in particular based on his strong personal belief so we can't remain silent.
This situation obviously made us reconsidering the policy on providing Changelly's open API and we are working on implementing verification of every API partner who's willing to integrate our exchange solution. We see it as an inevitable measure to prevent any scammer's activity going through our API. Changelly is forced to stop an API service for ChangeNow specifically unless the situation will be resolved on their end.
More announcements to be made soon on our official blog. Let me know if you have any additional questions, I'll be happy to assist.
All the best,
Sashsa mentioned in the email a BitcoinTalk forum post which can be found here where Changelly provided clarification to others. Based on the original post and subsequent posts after Changelly chimed in, people are still wondering what is going on.
October 8th Update from ChangeNow
We received an email from ChangeNow wanting to tell their side of the story. Here is the email and quote in full:
Check out the BitcoinTalk post and come back here and comment below on your thoughts.