Not cool: Salvadorans scammed millions via ‘Chivo’ BTC wallet

Getting your Trinity Audio player ready...

A civil lawsuit claims that El Salvador’s government lost up to $24 million in taxpayer funds during last year’s botched rollout of its BTC digital wallet Chivo (‘cool’ in Spanish).

This week, Guatemala-based investigative journalism outlet No Ficción reported on a deposition given in August by Shaun Overton in a civil lawsuit filed in U.S. District Court for the Northern District of Texas. Overton heads up Texas-based software development firm ROI Developers/Accruvia, which is suing Athena Bitcoin Global, the company behind El Salvador’s BTC-based automated teller machines (ATM) and Chivo digital wallet.

ROI launched its legal action earlier this year based on its claim that Athena had failed to pay nearly $84,000 for work ROI did trying to salvage the Chivo wallet from September to November 2021. Athena countersued, accusing ROI of breaching confidentiality agreements by revealing software flaws in Athena’s ATMs, a breach that Athena claims convinced El Salvador to scale down its ATM purchases.

Backing up a bit, El Salvador became the first country to make BTC legal tender last year, a step that was widely viewed as a bid by its President Nayib Bukele to curry favor with foreign ‘crypto bros’ from Blockstream and Tether and burnish his ‘millennial cool’ dictator image.

Despite Bukele’s relentless cheerleading—aided by a sophisticated echo chamber of government-funded media and online trolls—local adoption of BTC has basically been nonexistent by both businesses and consumers. Even BTC-based remittances from abroad—the alleged engine behind Bukele’s Chivo push—have never topped 2% of the total.

To spur local adoption of BTC, Salvadorans were encouraged to download the Chivo wallet and collect a one-time payment of US$30 in BTC. But Chivo proved a nightmare following its September 7, 2021 launch, and Overton claims Chivo’s software consisted of “spaghetti code” that was “functionally unusable.” Sadly, the decisions made by government officials made a bad situation even worse.

Know your potted plant

Overton claims that “within the first 150 sign-ups on the platform, the vendor for KYC [know your customer] crashed.” Overton believed Bukele “had staked pretty much his entire career on [Chivo’s] successful rollout,” so the government decided to “eliminate” the KYC vendor from the process so they could “hit their 50,000-user initial launch point.”

From that point, Overton said “there was literally no supervision whatsoever” of who was opening Chivo wallets. If someone had a person’s name and their Documento Unico de Identidad (DUI) number, “they could sign up for Chivo Wallet, get $30 completely for free as a gift for registering, and then withdraw that money immediately.”

Users were required to submit photos of themselves to claim their $30 prize, but Overton claims to have been told by Miguel Sabal—a Venezuelan adviser to Bukele who allegedly makes up part of a ‘shadow cabinet’ in Bukele’s administration – that users were instead submitting “pictures of the wall, of potted plants.”

Cristosal, a local non-governmental organization, reported that over 1,100 individuals who tried to register with Chivo discovered that their DUI had already been entered into the system and their $30 claimed. DUI information is publicly available, so Overton said “all you got to do is find the list … sign up, get the 30 bucks, withdraw it in [BTC] and now it’s not traceable.”

Overton didn’t specify how he arrived at these figures but claims his group “estimated that 10-20% of all of the users registered were fraudulent. And the vast majority of that money had left the Chivo Wallet system.”

Overton claims that around four million users—out of a total population of 6.5 million—registered for Chivo. If 10% of those registrations were fraudulent, the government had been taken for $12 million, twice that sum if the 20% estimate applies. Neither is an insignificant sum for a country the size of El Salvador, particularly one that’s struggling to pay off its foreign debts.

Day trading for dummies

In addition to fraudulent registrations, Overton claims that the Salvadoran government was “hemorrhaging money in a completely separate way, through arbitrage.” The Chivo wallet only updated the fiat value of BTC once per minute, meaning that users could identify discrepancies between the listed Chivo price and the actual price.

The result, according to Overton, was that “we had pretty much the entire country turn into day traders” who waited for the real BTC price to sufficiently distance itself from the Chivo price, then “buy and sell risk-free and sell within five seconds later and make half-a-percent or a percent on their money.” Overton cited one specific case in which “we saw a guy start with $2,000 and he had like $400,000,” all of which was the government’s/taxpayers’ money.

The government’s official Chivo Twitter feed addressed this issue last October, warning that this was a type of “fraud” that the government was taking steps to eliminate.

Overton said he was again approached by shadow minister Sabal, who said “this needs to be fixed right now, tonight.” Overton said he warned Sabal of the dangers of rolling out software changes live without performing any quality assurance tests but was overruled.

True to form, a botched rollout of the ‘fix’ resulted in an official Chivo exchange rate of 1 USD = 1 BTC. At the time, one BTC was actually worth around US$60,000. Some 3,600 transactions that should have totaled around $180,000 were instead made at a value of over $10 billion, “which made the government insolvent immediately.”

Overton was granted the authority to temporarily pull the plug on the whole Chivo network, but not before users were able to withdraw around $250,000. Because the system had been designed to prohibit BTC withdrawals between 10 p.m. and 6-7 the following morning, “nobody could actually take the on-chain [BTC] out of the system, they could only transfer it within Chivo. The only money that was able to leak was using Lightning.”

That’s a reference to the Lightning Network, the so-called ‘Layer 2’ solution that attempts to circumvent the main BTC layer’s pitiful seven transactions-per-second limitations. Lightning, the most prominent version of which is operated by Blockstream, allows users to commit a certain quantity of BTC on the primary blockchain, then transact off-chain using proprietary Lightning play-money.

Like Chivo, Lightning has been something of a kludge from the start, but it’s telling that – based on the Chivo cockup – one of the only real use cases it’s been able to demonstrate to date is enabling fraud.

Athena was eventually turfed from its Chivo connection in December 2021, with many of its roles being assumed by entities controlled by iFinex, the parent company of both the controversial Tether stablecoin and the equally sketchy digital asset exchange Bitfinex. iFinex co-founder Giancarlo Devasini posed for a photo with Bukele last month, part of a celebration of the legislative triumph described below.

Dormant scam erupts

The No Ficcion article included a photo of Overton at a November 2021 blockchain conference at which Bukele announced his plans to build a ‘Bitcoin City’ in the municipality of La Unión. The cockamamie project was to be financed by the issuance of $1 billion worth of ‘Volcano Bonds,’ so dubbed because Bitcoin City planned to use geothermal energy supplied by local lava-spitters.

Bitcoin City doesn’t get much play nowadays, but last month, Bukele introduced legislation to create a National Commission of Digital Assets that will oversee not only BTC but also offer legal protection for other tokens, including Tether.

The legislation also allegedly clears a path for those Volcano Bonds, which were originally supposed to be issued this spring but were delayed. At the time, the government blamed the delay on Russia’s invasion of Ukraine, although the more popular view was that everybody thought Bukele’s idea was batshit crazy.

It’s even less conceivable to think of these bonds being welcomed by institutional investors now, given all the crypto carnage that’s transpired over the past month. But the need to sell these new bonds is acute, given the €667 million in existing Salvadoran bonds coming due in January and the International Monetary Fund nixing the country’s bailout requests.

The volcano bonds were to be issued on Blockstream’s Liquid Network, yet another Layer 2, this one targeting high-volume transactions between exchanges. To no one’s surprise, Bitfinex has been selected to handle the bond issuance via a locally incorporated subsidiary.

Some hidden iFinex offshoot will almost certainly be a major buyer of the rechristened ‘Bitcoin Bonds’—likely with Tether rather than dollars—to ensure no embarrassment for Bukele once the sale commences. But since half of the $1 billion raised will reportedly be used by Bukele to buy more BTC, the token will get a nice price pump, paving the way for an iFinex dump on retail users down the road.

While the bonds promise a yield of 6.5%, the main draw appears to be fast-tracked citizenship for those who ante up. With the regulatory spotlight intensifying on crypto crooks, the appeal for the Tether/Bitfinex crowd is obvious. El Salvador has an extradition treaty with the U.S., but it’s rarely been used, even for members of the notorious MS-13 gang.

Local media have suggested Bukele has made a pact with MS-13 to protect its members from extradition in exchange for keeping the peace. It’s not that much of a stretch to imagine Bukele working out similar deals with deep-pocketed blockchain bandits.

Follow CoinGeek’s Crypto Crime Cartel series, which delves into the stream of groups—from BitMEX to Binance, Bitcoin.com, Blockstream, ShapeShift, Coinbase, Ripple,
Ethereum, FTX and Tether—who have co-opted the digital asset revolution and turned the industry into a minefield for naïve (and even experienced) players in the market.