目录 目录（7 节）
deepidea

deepidea

 · 

Compliance Was Expensive. Then the Rivals Started Dying First

2013–2017 Compliance, the collapse of Mt. Gox, and the fight with the IRS

February 24, 2014, evening on the US West Coast.

Coinbase posted a short statement on its official blog. Besides Coinbase, it was signed by Kraken, Bitstamp, BTC China, Blockchain.info and Circle, which together amounted to half of the bitcoin industry at the time. The statement was first titled “Joint Statement Regarding Mt. Gox Insolvency.” It was soon changed to the more restrained “Joint Statement Regarding Mt. Gox.”

A few hours later, the website of Mt. Gox, the world’s largest bitcoin exchange, went blank.

Four days after that, Mt. Gox filed for bankruptcy protection in Tokyo District Court. It said it had lost about 850,000 bitcoin, about 750,000 of them belonging to customers, worth roughly $470 million at the time.

The joint statement was more than a break with one company. It read like a manifesto: one part of the industry had decided to part ways with another.

Coinbase had gone further down that road than anyone. Less than two years old and much smaller than Mt. Gox, it had chosen from the start the path that looked slowest, clumsiest and least “bitcoin.”

This chapter is about that path: how much it cost, how much criticism it drew, and why, after its rivals fell one by one, Coinbase was the one still standing.

1. Two kinds of bitcoin company

In 2012, the bitcoin world roughly divided into two kinds of companies.

The first kind was Mt. Gox. Its name came from “Magic: The Gathering Online eXchange”; it began as a site for trading Magic cards, switched to bitcoin, and in 2011 was sold to Mark Karpelès, a French programmer living in Tokyo. It grew wildly, at one point in the first half of 2013 handling 80 to 90 percent of dollar-denominated bitcoin volume. Its technology and management, meanwhile, looked like a hobby project. It had been hacked once already in 2011, deposits and withdrawals were often delayed, and its relationships with banks were always strained.

The second kind had, at the time, almost only one example: Coinbase.

Brian Armstrong read Satoshi Nakamoto’s white paper at the end of 2010, and later, as an engineer at Airbnb, experienced first-hand how painful cross-border payments were. On March 29, 2012, Armstrong applied to Y Combinator, joined that summer’s batch, and teamed up with former Goldman Sachs trader Fred Ehrsam. In September the company raised a $600,000 seed round; in October Coinbase launched buying and selling bitcoin by bank transfer.

Those words, “by bank transfer,” were where the whole divergence began.

To let ordinary Americans buy bitcoin with a bank account, Coinbase had to plug into the US banking system. And the banks had only one demand: prove you are not a money-laundering channel. That meant identity verification (KYC), anti-money-laundering monitoring (AML) and suspicious activity reporting. It meant being regulated like a financial company.

In March 2013, the Financial Crimes Enforcement Network (FinCEN), part of the US Treasury, issued guidance that explicitly brought exchanging and issuing virtual currency under its rules for “money services businesses.” For the first time, rules had landed. For a company like Mt. Gox, this was a wall to get around. For Coinbase, it was a wall it had always planned to climb.

The first cost of this path came from the community.

To early bitcoin believers, the whole point of bitcoin was to get around banks and governments. A company that embraced banks, collected users’ identities and froze accounts for compliance reasons was close to a traitor. In its early years Coinbase was often mocked as “the bank of bitcoin.” Around 2014, some users had their accounts closed for sending money to gambling sites, and the community accused Coinbase of “tracking how users spend their bitcoin.” Some even said that using Coinbase didn’t count as really owning bitcoin.

But those were never the users Armstrong wanted. The target was ordinary people who had heard of bitcoin but had no idea what a private key was. For them, a product that linked to a bank account, looked like online banking and had someone accountable when things went wrong mattered far more than the idea of “decentralization.”

The numbers soon proved the bet right. In May 2013 Coinbase raised a $5 million Series A led by Union Square Ventures, then the largest round for a bitcoin startup; it had about 130,000 wallets at the time. By December, when it raised a $25 million Series B led by Andreessen Horowitz, it had about 600,000 wallets and was adding about 10,000 users a day.

In an industry where everyone talked about “disrupting banks,” the fastest-growing company was the one that looked most like a bank.

2. The purge begins

In October 2013, the FBI arrested Ross Ulbricht, founder of the dark web market Silk Road, at a public library in San Francisco, and the site was seized. Silk Road was one of bitcoin’s earliest and most notorious use cases: people bought and sold drugs on it with bitcoin.

The seizure made everyone realize that regulators were no longer just issuing guidance. They would actually arrest people.

Three months later, they turned to the industry itself.

In late January 2014, Charlie Shrem, CEO of the bitcoin exchange service BitInstant, was arrested at JFK Airport in New York. Shrem was then vice chairman of the Bitcoin Foundation and one of the industry’s best-known young faces. Prosecutors charged Shrem with conspiring to launder about $1 million for Silk Road users. Shrem posted $1 million bail and resigned from the foundation, then in September pleaded guilty to a lesser charge of aiding and abetting the operation of an unlicensed money transmitting business, and in December was sentenced to two years in prison.

Note the charge: operating an unlicensed money transmitting business. That was exactly what Coinbase had spent so much time and money to avoid.

Less than two weeks later, it was Mt. Gox’s turn.

On February 7, 2014, Mt. Gox halted all bitcoin withdrawals, citing “unusual activity.” The official explanation was a technical flaw called “transaction malleability,” but suspicion grew that the problem went much deeper. On February 24, a “crisis strategy draft” said to come from inside Mt. Gox circulated online, claiming the company had lost a large amount of bitcoin. That day, Coinbase and five other companies issued the joint statement from the start of this chapter, and then the Mt. Gox site went down.

On February 28, the bankruptcy filing confirmed the worst: about 850,000 bitcoin had vanished. CEO Karpelès blamed weaknesses in system security. A month later, Mt. Gox found about 200,000 bitcoin in an old-format wallet used before June 2011, but about 650,000 remained missing.

In less than five months, three of the bitcoin industry’s best-known names, the biggest dark web market, the best-known exchange service and the largest exchange, had respectively been seized, had their CEO arrested, and gone bankrupt.

The market panicked. Bitcoin’s price slid from the previous year’s high, and “bitcoin is dead” headlines filled the media again.

But inside the panic was a more important change: users began voting with their feet for “who can be trusted.”

Before Mt. Gox fell, people chose exchanges based on liquidity and price. Afterward, the first question became: “Could my money be lost too?”

On that question, the “boring” assets Coinbase had built up over the previous year and a half suddenly became valuable: a US-registered company, proper banking relationships, backing from top venture firms, most assets in offline cold storage, and a management team that could be sued and was therefore accountable.

That is also why the joint statement mattered. For the first time, the “compliance camp” stood up together and told users: Mt. Gox does not represent bitcoin, and we are not like it.

Users’ choices soon showed up in the numbers. On February 27, 2014, the day before Mt. Gox filed for bankruptcy, Coinbase announced that it had passed 1 million consumer wallets; 25,000 merchants were using it to accept bitcoin, and 4,000 applications had been built on its API. In early 2013, a little over a year earlier, it had fewer than 13,000 wallets.

Co-founder Fred Ehrsam put it bluntly in an interview: if Coinbase had not made a few key decisions early on, it might have met the same fate as Mt. Gox.

There was an interesting coincidence. Around the same time, Ben Reeves’s Blockchain.info had passed 1 million wallets a month earlier, in January 2014. The two men who had split two years before over “who holds the keys” had each followed their own path and reached a million users almost at the same moment. The difference was that Blockchain.info’s users were mostly people who knew what they were doing. More and more of Coinbase’s users were ordinary people encountering bitcoin for the first time.

Figure 2-1　In under five months, three iconic names fell

3. The compliance bill

“Compliance” is one word to say and a very long bill to pay.

The United States has no single money transmitter license. Each state has its own laws, its own regulator and its own capital and bonding requirements. A company that wants to operate nationwide has to apply state by state, file documents, pass reviews, post bonds, and then be examined again year after year.

For a startup of a few dozen people, that meant large legal bills, the cost of a compliance team, and the most expensive thing of all: time. A rival could ship a new feature today and open it to the whole world tomorrow. Coinbase first had to ask in which states the feature was legal and what new permissions it needed.

By the time Coinbase launched its US exchange in January 2015, it held licenses in 14 states, and 8 more states (including Massachusetts) had confirmed that no license was required. That was the result of more than two years of grinding.

The hardest nut was New York.

In June 2015, the New York State Department of Financial Services (NYDFS) formally introduced the BitLicense, a regime built specifically for virtual currency businesses and known for its strictness. Many crypto companies simply announced they were leaving the New York market. Coinbase chose to stay, served New York customers under a “safe harbor” provision while its application was reviewed, and finally received a BitLicense and a New York money transmitter license in January 2017. Regulators reviewed its anti-money-laundering, capital adequacy, consumer protection and cybersecurity policies.

The BitLicense itself had a bumpy birth. On July 17, 2014, NYDFS Superintendent Benjamin Lawsky published a first draft and opened a 45-day comment period. It drew more than 3,700 comments, many of them protests from the bitcoin community arguing that the bar was too high and would drive startups out of New York. In February 2015 the regulator issued a heavily revised second draft, and on June 3 the final rule took effect. It covered only intermediaries that held customer funds, not developers who simply wrote software.

In other words, the BitLicense was aimed precisely at companies like Coinbase that held other people’s money. The choice of “who holds the keys” made in summer 2012 had, three years later, turned into a license that required its own application and its own review.

It took a year and a half from the BitLicense’s introduction for Coinbase to receive one.

Figure 2-2　The compliance bill: from federal guidance to a New York license, 2013–2017

Was the bill worth paying? In the short run, maybe not. It slowed product development, left Coinbase always a step behind offshore exchanges in coins and features, and for a long time led some users to see it as “expensive and conservative.”

But in the long run, a license is a very particular kind of asset: hard to buy, hard to copy, and harder to get the later you try. Every license Coinbase added raised the bar for whoever came next. When banks, institutional investors and eventually Wall Street began looking for partners in the crypto world, the first name on the list was often Coinbase.

4. Taking on the IRS

If getting licensed was Coinbase walking toward regulators, the lawsuit that began in 2016 showed the other side of the path: being on the same side as regulators does not mean doing whatever they say.

The seeds of this conflict were planted on March 25, 2014. That day, the Internal Revenue Service issued Notice 2014-21, which for the first time defined bitcoin’s tax status: it is not currency, it is property.

That sounds abstract, but the consequences were concrete. If bitcoin is property, every sale, and every purchase made with bitcoin, could produce a capital gain or loss that had to be reported. Someone who bought a coffee with bitcoin would, in theory, have to work out the cost basis and gain on that cup. Nor did the IRS give a pass for the past: transactions before March 25, 2014 that had not been handled under these rules would not be blanket-exempted from penalties.

The rules were now clear, but almost nobody followed them. And the most direct way to find out who was trading and how much they had made was to go to the company holding the largest number of American users’ transaction records.

In late 2016, the IRS asked a court for a “John Doe summons” requiring Coinbase to hand over information on all its US users from 2013 to 2015. The IRS argued that bitcoin trades were widely going unreported. According to figures the IRS submitted in the case, the number of people who reported bitcoin-related transactions on their tax returns in 2013, 2014 and 2015 was just 807, 893 and 802 respectively.

For Coinbase, this was a dilemma.

On one hand, its whole business model rested on being “the one that follows the rules,” and openly fighting the IRS carried real risk. On the other hand, if it handed over the full transaction records of hundreds of thousands of users, “keeping your money at a compliant company” would turn into “handing everything about yourself to the government,” exactly what its critics feared most.

Coinbase chose to go to court, but in a restrained way. It did not deny that the IRS had the right to investigate tax evasion. It argued only that this summons was far too broad, amounting to an indiscriminate search of all its users.

In November 2017, a federal court ruled. Coinbase won in part and lost in part. It had to hand over information, but the scope was sharply narrowed to accounts with at least $20,000 in transactions in any one year from 2013 to 2015. In the end that covered about 14,355 accounts and about 8.9 million transactions, and only limited identity information had to be provided.

From “all users” to “about 14,000 large accounts”: that was the most room Coinbase could win within the rules.

Figure 2-3　The IRS summons: from "all users" to about 14,000 accounts

This case set the tone for Coinbase’s relationship with regulators from then on, and its later head-on fight with the SEC followed the same logic: acknowledge that the rules exist, but demand that the rules make sense; cooperate with regulators, but don’t give up fighting for users’ boundaries.

It is a hard posture to hold. Cooperate too much and users feel betrayed; fight too hard and you lose your identity as part of the compliance camp. Coinbase has walked that tightrope for more than a decade, sometimes gracefully, sometimes wobbling.

5. Looking back: judgment or luck?

Looking back from today, it is easy to tell this chapter as a simple story: Coinbase stuck to compliance, its rivals didn’t, the rivals died, Coinbase won.

But that story needs to be taken apart in at least three places.

First, Mt. Gox’s fall had nothing to do with Coinbase. Coinbase didn’t short it or beat it. Mt. Gox was crushed by its own poor security and management. Coinbase’s achievement was not “winning,” but being ready to catch the users fleeing at the moment its rival collapsed. That was partly judgment and partly luck: had Mt. Gox held on another three years, or fixed its systems, Coinbase would have had a much harder time.

Second, compliance was not a straight-line victory. The choice won Coinbase the United States but ceded vast ground in global markets. Binance, founded in 2017, took almost the opposite route: fast listings, low barriers and global expansion. Within six months it was the world’s largest exchange by volume. For many years after, Coinbase trailed far behind in volume. The cost of compliance was not just legal fees but the markets lost for being “too slow.” We tell that story in Chapter 4.

Third, Armstrong chose compliance first for product reasons, not moral ones. Armstrong wanted to build “ordinary people’s front door to bitcoin.” Ordinary people use bank accounts, and connecting to banks requires compliance. Compliance was the inevitable consequence of that positioning, not a separate noble choice. This matters. What is actually worth learning is not the slogan “follow the rules,” but this: first figure out who your users are, then accept the full cost of serving them.

What if Coinbase had taken the other road?

Suppose the Coinbase of 2012 had become an offshore exchange with no identity checks and no banks. It probably would have grown faster and made more money in the 2013 bull market. But it would have been on the same list as Mt. Gox and BitInstant, facing the same purge. And it would never have gained the things that later proved most valuable: access to US banks, eligibility to go public, Wall Street’s custody business, and its status as a “safe haven” in one industry crisis after another.

The most counterintuitive point of this chapter is that the payoff from compliance never comes in the current period. In a bull market it looks like a burden; only in a crisis does its value show. And the crypto industry is one with an unusual number of crises.

Mt. Gox in 2014 was only the first. Eight years later the same plot would play out again on a far larger scale, and that time the rival that fell would be called FTX.

Decision Card

  • Situation: 2012–2013: the bitcoin industry had almost no rules, and the largest exchange grew by running wild
  • Options: A: register offshore, skip identity checks, expand fast　B: connect to the US banking system and seek licenses state by state
  • Choice: B, and in the conflict with the IRS, both “cooperate and resist”
  • Outcome: Short term: slow growth, high costs, community criticism. Long term: after Mt. Gox and others fell, it became “the trustworthy choice,” and its licenses became a moat that is hard to copy
  • Lesson: First figure out who your users are, then accept the full cost of serving them

Key line: The payoff from compliance never comes in the current period. In a bull market it is a burden; in a crisis it is a moat.

Sources

From my new book Coinbase: On the Side of the Rules: https://pickful.ai/books/tqn4

书籍 Coinbase: On the Side of the Rules

Download Pickful App

Better experience on mobile

Device-phone-mobile iOS Play Android Arrow-down-tray APK

iOS

Android

APK