On the Hunt for Remnants of the Samourai Wallet Crypto Mixing Services in the DNS

The founders of the cryptocurrency mixing services company Samourai Wallet, Keonne Rodriguez and William Lonergan Hill, were sentenced in April 2024. They are currently serving time for executing more than US$2 billion in unlawful transactions and laundering more than US$100 million in criminal proceeds.¹

The Samourai Wallet website was taken down and its mobile offerings taken off Google Play Store. Despite these efforts, though, do remnants of the crypto mixing services remain in the DNS?

The WhoisXML API research team sought to find out by expanding a list of three domains identified as indicators of compromise (IoCs). Our investigation uncovered:

• Four IP addresses, three of which are malicious
• Two IP-connected domains
• 66 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.justice.gov/usao-sdny/pr/founders-and-ceo-cryptocurrency-mixing-service-arrested-and-charged-money-laundering