Quick Summary
- Keonne Rodriguez, CEO of Samourai Wallet, is serving 5 years in federal prison. His CTO William Lonergan Hill got 4. Their crime: writing privacy software that the DOJ says transmitted $237 million in criminal proceeds.
- On September 26, Bitcoin Magazine published Rodriguez’s seventh letter from inside. It is a 30-day account of federal transit — shackles, a Cold War-era plane with German and Russian emergency stickers bolted to the walls, and a cellmate doing 20 years for murder.
- Two days before that letter went live, somebody drained $387.5 million out of Bitget’s hot and warm wallets. That attacker is still swapping the stolen coins through THORChain in the open. No handcuffs. No half mattress. No 23-hour lockdown.
- The point is not that the system is broken. The point is that it was never built to protect you. It was built to protect the people who never needed your permission in the first place.
What Happened: A 4-Hour Drive That Took 30 Days
Keonne Rodriguez self-surrendered. He spent close to two years on pre-trial release. He was classified minimum security. He had no incident reports.
Then he wrote software.
Samourai Wallet was a Bitcoin wallet with built-in privacy tooling — Whirlpool coinjoins and a "Ricochet" feature. The Department of Justice charged its founders with operating an unlicensed money transmitting business, alleging the service moved more than $237 million in criminal proceeds and facilitated over $2 billion in Bitcoin transactions overall. Both pleaded guilty. In November 2025, Rodriguez was sentenced to five years and Hill to four.
In his latest letter, published September 26 by Bitcoin Magazine, Rodriguez describes being told on June 10 he was being transferred for a drug and alcohol treatment program — a program that shaves a year off your sentence if you complete it. He had asked to drive himself there. The request was denied without explanation.
What followed: six men shackled at wrist and ankle, chains run around their waists so they could only take "painful short shuffling steps," a bus where the armed officers stopped twice for biscuits and cigarettes while the prisoners sat in full restraints.
Then the plane. Rodriguez writes that the safety stickers were "all in German and Russian" — an aircraft so old that the emergency instructions were in languages nobody on board could read, while every passenger was chained to a seat. Then a concrete holding room in Oklahoma City where inmates "somehow fashioned a lighter and proceeded to get extremely high on K2 — known also as Deuce. In prisons Deuce is commonly just roach spray or rat poison drenched on a small piece of paper."
Then the range. His cellmate introduced himself as Shadow. A man doing 20 years for murder. He got half a foam mattress and a light that never turns off.
His line about why he was there:
"I was on my way to a camp for the fake crime of not having a license I didn’t even need in the first place."
And the line that should land harder than any of it:
"I laid there, ass on bare metal, harsh light shining through the threadbare sheet and asked myself if all this was worth the year off."
A four-hour drive took thirty days. The government spends roughly $10,000 moving a single prisoner through that Oklahoma hub, by Rodriguez’s own account, and it locked 120 men to a range with enough drugs inside to supply a small city. That is the machine that was built to punish a man for writing code.
The Hypocrisy Nobody Wants To Say Out Loud
Now put that letter next to the news from two days earlier.
On September 24, Bitget — one of the largest crypto exchanges on earth — had its hot and warm wallet infrastructure compromised. The exchange first reported $351.6 million stolen. It later revised the number up to $387.5 million after finding additional transfers on Zcash and Tron.
By Monday, September 28, Bitget was resuming Bitcoin withdrawals on a phased schedule, and its CEO Gracy Chen was publicly begging THORChain — a permissionless protocol — to freeze the attacker’s funds. THORChain’s response was, essentially, we don’t have a blacklist and we can’t make one. Which is the entire point of a permissionless protocol, and also the entire reason you should not be keeping your savings on someone else’s exchange.
Meanwhile, the attacker kept swapping stolen Ether for Bitcoin through THORChain vaults. Out in the open. With block explorers publicly tagging the addresses in real time. Bitcoin Magazine reported that Bitget’s CEO blamed North Korea-linked hackers for the breach.
So here is the ledger, printed side by side:
- Wrote privacy software → five years, shackles, half a mattress, a murderer for a roommate.
- Stole $387.5 million → a press release, a phased withdrawal schedule, and a polite request to a decentralized protocol that cannot say no fast enough.
Nobody has been arrested in the Bitget case. Nobody will be extradited from Pyongyang. The exchange will eat the loss, pass the cost to users through fees, and issue a blog post about "strengthening security." The only person who touched a prison cell in this comparison is the guy who wrote the good version of the software.
And here is the part that should terrify anyone who builds on Bitcoin: the charge Rodriguez pleaded to — operating an unlicensed money transmitting business — has nothing to do with whether the software worked, whether users were harmed, or whether Rodriguez personally handled a single satoshi. It is a licensing charge. It is the same legal theory that could be pointed at any non-custodial tool where a third party uses it badly. The BIP-110 fight already showed you how fast the "guardians of neutrality" turn into gatekeepers when enough leverage is applied.
If writing code that other people can misuse is a crime, then Tor is a crime. Cash is a crime. The postal service is a crime.
The Bitcoin Lesson: Stop Asking Permission To Be Secure
Every exchange hack story on this site ends the same way, and people keep not listening.
When Coinbase’s systems buckled and AWS wobbled, custodial risk stopped being theoretical — your balance is an IOU, and an IOU is only as strong as the company holding it and the regulator not freezing it. Bitget just proved it a second time in three days, at a cost of $387.5 million, and Bitget is one of the good ones.
Rodriguez is a different flavor of the same lesson. He built a tool whose only job was to let people move their own money without asking anyone’s permission. The state’s answer was not "that tool has a flaw." The state’s answer was "that tool is a business and you did not file paperwork." And when the paperwork is the crime, the software is irrelevant.
Which means the only defensible position is the boring one:
- Hold your own keys. Not on an exchange, not in a lending platform, not in a wrapped product. If you do not know where to start, start here.
- Assume nobody is coming to protect you — not an exchange, not a regulator, not a court, not a protocol’s emergency council. Bitget’s own CEO found that out live when she asked a decentralized protocol to freeze funds and it said it structurally cannot.
- Treat privacy as infrastructure, not as a vibe. Whirlpool exists because the alternative is a permanent, public, searchable record of everything you ever bought.
- Don’t let the news cycle decide your setup. The people who lost $387.5 million this week were the ones who assumed the exchange would handle it.
And when you do need to move between fiat and sats — without handing your ID to a company that has to file paperwork to exist — use an exchange that respects the point. Use coupon code LOVEISBITCOIN at Bull Bitcoin and keep the custody where it belongs.
FAQ
Is Samourai Wallet still available?
No. Samourai Wallet’s apps were shut down following the DOJ action and the founders’ guilty pleas. The code and the ideas live on in other privacy tooling, but the original service is gone.
What exactly did Keonne Rodriguez plead guilty to?
Operating an unlicensed money transmitting business. Not theft. Not fraud against users. The DOJ alleged the service transmitted over $237 million in criminal proceeds; Rodriguez and co-founder William Lonergan Hill pleaded guilty and were sentenced to 5 and 4 years respectively in November 2025.
How much was stolen from Bitget?
$387.5 million, revised upward from an initial figure of $351.6 million after additional transfers on Zcash and Tron were identified. Bitget said cold wallets were not compromised — the breach hit hot and warm wallet infrastructure.
Why can’t THORChain freeze the stolen funds?
THORChain has said it has no built-in address blacklist and no mechanism for selectively freezing specific funds. Its network halt is an emergency security mechanism that affects the protocol broadly, not a targeted freeze. That is the tradeoff of a permissionless protocol.
Does this mean I should not use exchanges at all?
It means you should not store value on one. Buying, selling, and moving between fiat and Bitcoin is fine. Leaving your stack there because it is convenient is how you end up in a support ticket queue while your coins go through a mixing protocol you cannot stop.
Final Thoughts
A man is sitting in a federal cell right now, on half a mattress, under a light that never turns off, because he wrote privacy software. His cellmate murdered someone and got twenty years. The man who stole $387.5 million is asleep in his own bed, and the coins he stole are still moving across a public blockchain while the exchange that lost them announces a withdrawal timetable.
Two different legal systems. Same week. Same asset.
So I’ll ask you the only question that matters here: if writing code that someone else abuses gets you five years, and stealing $387.5 million gets you a phased withdrawal schedule — which one do you think the people who lost their money will be sleeping next to tonight?
Tell me in the comments. And if you are still keeping your Bitcoin on somebody else’s balance sheet, do yourself a favour and go buy a hardware wallet before the next press release.
Source: Samourai Letter #7: Notes From The Inside, Bitcoin Magazine, September 26, 2026. Additional reporting: Cointelegraph, The Block, DOJ SDNY.
