Coinbase sells blockchain analytics software to the U.S. Immigration and Customs Enforcement, sparking concerns about the potential disclosure of user location data.

A small non-profit organization, Tech Inquiry, which investigates government and corporate relationships, recently obtained a contract between the cryptocurrency exchange Coinbase and the U.S. Immigration and Customs Enforcement (ICE). According to the contract, Coinbase's analytics software, Coinbase Tracer, will provide the immigration agency with geographical tracking information of cryptocurrency users, sparking discussions on the potential exposure of exchange user data.

The contract was signed in September 2021 for a total of $1.37 million. In fact, the collaboration between Coinbase Tracer and the government began as early as 2020.

Coinbase Tracking Software?

In 2020, reports of Coinbase collaborating with law enforcement agencies and the IRS for the first time using their tracking software sparked discussions on user privacy. CEO Brian Armstrong explained that blockchain analysis tools have been around for a while, and since blockchain data is public, it is just organizing data to make it more useful. Coinbase stated that compliance exchanges linking fiat currencies need to adhere to anti-money laundering regulations, hence the use of blockchain analysis software for transaction monitoring. This is a necessary step for compliant operations within an incomplete regulatory framework.

Coinbase Tracer allows governments to track blockchain transactions more effectively, linking on-chain addresses to real-world money laundering and terrorist activities. According to the US Freedom of Information Act, ICE can track transactions involving nearly ten different cryptocurrencies, including Bitcoin, Ethereum, and USDT.

Foreign media outlet The Intercept questioned the contract with ICE mentioning "Historical geo tracking data," without detailing its data sources or restrictions. This issue has sparked discussions within the community.

In addition, Coinbase Tracer's predecessor originated from a company called Neutrino. It was acquired in the first half of 2019 and was originally known as a spyware company selling products to various countries, infamous for human rights violations. When the collaboration first took place in 2020, its negative image was brought up for discussion.

Coinbase Response

On July 1, Coinbase responded to these reports, stating that Coinbase does not sell user data. Coinbase's tools are used to support and assist in investigating financial crimes. Coinbase Tracer obtains data from public sources and never utilizes user data from the Coinbase exchange.

2/ Our Coinbase Tracer tools are designed to support compliance and help investigate financial crimes like money laundering and terrorist financing. Coinbase Tracer sources its information from public sources, and does not make use of Coinbase user data. Ever.

— Coinbase (@coinbase) June 30, 2022

Exchange Operators' Dilemma: Balancing Compliance and Privacy

Under the current anti-money laundering and anti-terrorist financing regulatory framework, VASPs (Virtual Asset Service Providers) typically bear significant responsibilities. Operators are obligated to monitor and report suspicious on-chain and off-chain financial activities, comply with KYC, and incur substantial compliance expenses for centralized exchanges, as seen in the case of Coinbase. CEO Brian Armstrong has previously protested against the regulatory burden brought by infrastructure projects. Additionally, the cooperative relationship between operators and the government often faces public scrutiny regarding user privacy.

XREX exchange co-founder Wayne Huang Yaowen stated: "We cannot deny that illicit financial flows such as human trafficking, arms and drug trafficking, fraud, etc., will continue to attempt to use cryptocurrencies to evade law enforcement investigations. Exchanges have the responsibility and obligation to cooperate with regulatory and law enforcement agencies. However, exchanges must also vigorously safeguard user privacy. For example, any regulatory agency seeking user transaction data must obtain a search warrant or subpoena from the prosecutor or court through legal and compliant channels."