# Altilly Files: full text of all pages > Every content page of https://altillyfiles.com, concatenated in reading order. Numbers like [#1234] link to that message in the published chat (https://altillyfiles.com/chat#1234); a plain-text copy of the chat is at https://altillyfiles.com/chat.txt. Chat times are UTC-8. Nothing on this site is a finding by any court or authority. Generated 2026-09-30 from the markdown sources at https://altillyfiles.com/content/. Index: https://altillyfiles.com/llms.txt --- # Introduction Source: https://altillyfiles.com/ Markdown: https://altillyfiles.com/content/intro.md ## Why I'm publishing this now I have been struggling for years since the Altilly hack. It was hard to get a job, to start something new in the industry, or to carry on with other projects. Even when I got a mortgage for a house, the bank asked where the money for the small deposit came from, and they dug deep into my bad history with Altilly. My business relationship with Mike ended in late 2022. After that, my only contact with him was about getting money back: first the Solar funds, which he repaid in full by 19 March 2024, and later a promise he made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck, which he never followed up on. Then, in February 2025, Xeggex collapsed after what it called a hack. People tried to link it to me and started threatening me. I have been receiving threatening messages for years now, and I want to be done with it. I am working on something new, and I cannot go on without closing this chapter. When I first said publicly who I believe Mike is, in February 2025, many people did not believe me (see the examples below). It was hard to argue against that. Then I realised I had the data: the management team's Telegram group. I went through all the messages and saw the hints and the evidence. That is why I built this website and am publishing the chat, read-only. I could have done this earlier, but it was a chapter I found hard to close. I knew I would have to go through every chat, remove all customer data, and live through the whole experience again. I was also ashamed of how stupid I was then: how I ran a business, posting memes and stupid things. Reading my own messages now feels like reading messages from a child pretending to run an exchange. I was very naive. Some of those messages are worse than embarrassing, and I have left them in (see [What I got wrong](https://altillyfiles.com/story#what-i-got-wrong)). When I was given ownership of the group [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578), I decided to go all in. A lot of emotions went through me: fear, anger, sadness. I have PTSD from this. I am reliving the threats [#2155](https://altillyfiles.com/chat#2155)–[#2160](https://altillyfiles.com/chat#2160), [#2385](https://altillyfiles.com/chat#2385) and the sleepless nights [#2471](https://altillyfiles.com/chat#2471). My health got worse during that time. I lost everything: my money [#2805](https://altillyfiles.com/chat#2805), [#5602](https://altillyfiles.com/chat#5602), my employees, my friends, my team. I was broke. Meanwhile, the man I knew as Mike was moving into a new house with a large indoor pool, which we saw on video [#5094](https://altillyfiles.com/chat#5094), [#5106](https://altillyfiles.com/chat#5106), [#5114](https://altillyfiles.com/chat#5114), [#5123](https://altillyfiles.com/chat#5123), [#5125](https://altillyfiles.com/chat#5125). At the same time he was selling another house, which he said had been bought about nine years earlier [#5471](https://altillyfiles.com/chat#5471), [#6163](https://altillyfiles.com/chat#6163)–[#6166](https://altillyfiles.com/chat#6166). The chat does not show how the new house or its renovation was paid for, and I do not know. I was soaking in a second-hand, broken bathtub, without even a shower. (In the chat I only joked that I had "no super fancy bath tub" [#5154](https://altillyfiles.com/chat#5154).) Chuck told us in January 2021 that he had to go to the food bank [#3430](https://altillyfiles.com/chat#3430); as I remember it, he relied on it until December 2021. We were both struggling while doing refunds. We collected bottles and returned them at the bottle depot, just to get a few extra pennies to put back into refunds or to pay some bills. My wife was pregnant during that time [#5156](https://altillyfiles.com/chat#5156). I never expected that he could do what I now believe he did to me. I saw him as family. I was too naive to even consider that he might have been behind it all. We talked in other team channels, we built things together, we did things together. He felt like family. That is my belief, not a finding: no court or authority has confirmed that Mike took the funds or that he is Paul Vernon. I just want this to be over. It has been more than five years now. ## What has been said about me Here are representative public claims. Some are wrong, some partly true, some simply true. Each links to its source and to where you can check it here. 1. **"User stolen at altilly.com by Mr Nayiem Willems"** ([Reddit, January 2021](https://old.reddit.com/r/u_AltillyComScam/comments/ktezjo/)) and, from the same account, "Only 14 days to claim your founds" ([r/banano, January 2021](https://old.reddit.com/r/banano/comments/kr9tm9/)). **The claim window part is true.** Mike had suggested giving people 60 days [#1973](https://altillyfiles.com/chat#1973), and the form first ran to 26 February 2021 ([r/garlicoin](https://old.reddit.com/r/garlicoin/comments/kmban0/)). On 3 January 2021 I cut that, against Chuck's advice, and the new notice set a final date of 9 January, six days later [#2438](https://altillyfiles.com/chat#2438), [#2443](https://altillyfiles.com/chat#2443)–[#2447](https://altillyfiles.com/chat#2447). On 27 January Chuck asked for the form link to be removed and replaced by a new link that "only us 3" would know about, for "special circumstances" [#3355](https://altillyfiles.com/chat#3355)–[#3358](https://altillyfiles.com/chat#3358). Thousands of people were too late [#5052](https://altillyfiles.com/chat#5052). See [Refunds](https://altillyfiles.com/refunds) and [Timeline](https://altillyfiles.com/timeline). 2. **"Altilly Exchange FAKE Refunds, Possible Exit Scam"** ([Bitcointalk, February 2022](https://bitcointalk.org/index.php?topic=5385112.0)). **Partly true.** The database was lost [#1285](https://altillyfiles.com/chat#1285), [#1524](https://altillyfiles.com/chat#1524), so we required deposit-confirmation emails [#2146](https://altillyfiles.com/chat#2146), [#4665](https://altillyfiles.com/chat#4665), which shut out people with other proof. Our checks were also weaker than I later claimed [#3563](https://altillyfiles.com/chat#3563)–[#3566](https://altillyfiles.com/chat#3566). See [The refund years](https://altillyfiles.com/story#the-refund-years). 3. **"They refunded me only a small part"** ([r/MoonCoin, April 2021](https://old.reddit.com/r/MoonCoin/comments/mtxr3d/)), and a Banano holder wrote that Altilly "still have not refunded Banano despite refund confirmations over a year ago" ([r/banano, January 2023](https://old.reddit.com/r/banano/comments/10j6wjo/)). **True for those people.** Refunds were partial, some saved assets fell short [#4580](https://altillyfiles.com/chat#4580), [#4849](https://altillyfiles.com/chat#4849), and work was unfinished when the chat ends [#6876](https://altillyfiles.com/chat#6876), [#7421](https://altillyfiles.com/chat#7421). Other users did report being refunded. See [Refunds](https://altillyfiles.com/refunds). 4. **"Admins delete my questions in the telegram"** ([Bitcointalk ANN thread, 2021](https://bitcointalk.org/index.php?topic=5166945.0)). **Partly true.** We removed messages about a class action [#3929](https://altillyfiles.com/chat#3929)–[#3934](https://altillyfiles.com/chat#3934). See [Transparency](https://altillyfiles.com/transparency) and [What I got wrong](https://altillyfiles.com/story#what-i-got-wrong). 5. **"Nayiem is the perpetrator. He is Karl, and he is Mike… show us proof that Mike existed during Altilly"** ([r/pepecoin, February 2025](https://old.reddit.com/r/pepecoin/comments/1il8ei9/)). **I dispute this.** Mike is a separate member of this chat throughout [#1000](https://altillyfiles.com/chat#1000)–[#1002](https://altillyfiles.com/chat#1002), [#1876](https://altillyfiles.com/chat#1876)–[#1878](https://altillyfiles.com/chat#1878), and his name was already circulating publicly in January 2021 [#2679](https://altillyfiles.com/chat#2679). See [Who was Mike?](https://altillyfiles.com/mike) and [the chat](https://altillyfiles.com/chat). 6. **"The CEO with the name of 'Karl' has been found to be… Nayiem Willems. He has previously rugged a different exchange"** ([r/pepecoin, February 2025](https://old.reddit.com/r/pepecoin/comments/1iisdmd/)). **I am not Karl, but part of this has a real basis.** In June 2022 Xeggex announced it was being acquired by my company, Dokdo UAB, and its site said it was "a service of Dokdo Global" ([archived notice](https://web.archive.org/web/2022/https://xeggex.com/post/xeggex_user_notice_aquisition)). I announced it and did not complete it. My February 2025 line that I had "no connection" with Mike, and Xeggex's that I was "never involved", were both inaccurate. See [After Altilly](https://altillyfiles.com/story#after-altilly). 7. **"You knew Mike… and did and said nothing until after it happened again?"** ([r/pepecoin, February 2025](https://old.reddit.com/r/pepecoin/comments/1ikt45d/)). **True.** I did not warn Xeggex users. I was afraid, I had no proof, I expected not to be believed, and I put getting money back from the 2022 Solar incident ([Solar's statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png)) first. On Discord on 30 November 2022 I wrote to Mike: "We are not going to say anything if you can return the funds in 24hrs." See [After Altilly](https://altillyfiles.com/story#after-altilly). 8. **"Nayiem doesn't pass the sniff test"** ([r/pepecoin, February 2025](https://old.reddit.com/r/pepecoin/comments/1ip0qha/)), asking why the CEO had no server access and why users waited 13 days. **Partly fair.** I had no access to the Cherry servers [#1492](https://altillyfiles.com/chat#1492), [#1493](https://altillyfiles.com/chat#1493), and that was my failure as CEO. The 13-day gap came from a wrong date in my 2025 write-up. I put the incident on 12 December 2020, mixing up two dates: the day I formed Qredit Ltd (incorporated on 11 December 2020) and the date of the incident. The chat puts the incident at 23-25 December [#1031](https://altillyfiles.com/chat#1031), [#1103](https://altillyfiles.com/chat#1103), and the notice went out within days [#1232](https://altillyfiles.com/chat#1232). See [What I got wrong in 2025](https://altillyfiles.com/story#what-i-got-wrong-in-2025). ## How to read this site - **[The chat](https://altillyfiles.com/chat)** is the primary record. Numbers like [#1232](https://altillyfiles.com/chat#1232) open a message. Times are UTC-8. - **[My story](https://altillyfiles.com/story)** is my account, with links. Where I write "I believe" or "as I remember it", the chat does not prove it. - **[Assessment](https://altillyfiles.com/assessment)** is a neutral reading, including the parts that hurt me. - **[Who was Mike?](https://altillyfiles.com/mike)** weighs the evidence both ways, without a verdict. - **[Transparency](https://altillyfiles.com/transparency)** lists every removal and gap. The notes I added in 2026 are my beliefs, not records from the time. - **[Ask a question](https://altillyfiles.com/ask)** if something does not add up. I will answer in public. > **Note:** > > Please do not contact, confront or visit anyone named or discussed here. I am convinced "Michael O'Sullivan" was an alias Mike used, possibly with a false passport. That needs investigation by law enforcement; until then, as a precaution, I am not accusing any real person who shares that name. --- # My story Source: https://altillyfiles.com/story Markdown: https://altillyfiles.com/content/story.md ## The Altilly story, in my own words *Written by Nayiem Willems, September 2026. This page sits next to the published Altilly management chat. Numbers like [#1056](https://altillyfiles.com/chat#1056) link to messages in that chat. Times in the chat export are UTC-8. In Sweden, where I lived, it was about 9 hours later.* In February 2025 I wrote a write-up called "Follow-Up on the Xeggex Story", which I shared with investigators and initially posted on Reddit. Everything that was in it is now on this site, except the details about a private person that I should not have published (see below); where its assumptions and statements were wrong, they have been corrected against the Telegram chat export. I wrote it fast, while Xeggex was collapsing and people were accusing me. I wrote it from memory, years after the events. English is not my first language. Several things in it were wrong, and people have used those mistakes against me. So I am writing it again more carefully, with the chat next to it so you can check what I say. ### What I got wrong in 2025 - **Dates.** I wrote "12 December 2020" for the incident, then "13 December" for the $10k/$15k conversation. Both were wrong. The incident was 23-25 December 2020, and the $10k/$15k exchange happened on 24 December [#1056](https://altillyfiles.com/chat#1056)–[#1060](https://altillyfiles.com/chat#1060). I also wrote that the collapse came "twelve days after forming the company", and that part was right. UK Companies House shows that Qredit Ltd (no. 13077371) was incorporated on 11 December 2020, with me as sole director and the only person with significant control. The incident began on 23 December, 12 days later. Mike does not appear anywhere in the company's register entry. "12 December" was my mistake: I mixed up the two dates, the day I formed the company and the date of the incident. - **The company.** I wrote that I registered "Altilly" in the UK and planned a UK licence. The UK company was Qredit Ltd (no. 13077371), incorporated on 11 December 2020, with me as sole director. The chat never mentions it. It never traded, never filed accounts and was struck off on 17 May 2022 (see [December 2020](https://altillyfiles.com/story#december-2020) below for why). The licence we were preparing was Estonian [#5023](https://altillyfiles.com/chat#5023), [#5745](https://altillyfiles.com/chat#5745). - **Revenue.** I gave exact volume and profit figures. The volume can be checked in archived tracker pages: Altilly's reported 24-hour volume was mostly $10k–$130k in 2019 and $250k–$550k in autumn 2020, and peaked at about $880k on 15 December 2020 ([CoinMarketCap, archived](https://web.archive.org/web/20201215004125/https://coinmarketcap.com/exchanges/altilly/)). [Nomics](https://web.archive.org/web/20201129231937/https://nomics.com/exchanges/altilly) counted about $68M for 2020 up to late November, and weekly totals in late 2020 were $2M–$5M. Trackers rated Altilly's volume quality low, and much of it came from a few small tokens. I have no records of profit. As I remember it, the fees went to Mike; he said about 0.8 of the 31 lost bitcoin was his, "exchange fees" [#1662](https://altillyfiles.com/chat#1662), [#1663](https://altillyfiles.com/chat#1663). - **The "postcard".** I meant the Revolut card. In 2025 I placed it after the house videos and made it sound like something I sent out of sympathy. In fact Mike ordered a company Revolut card in February 2021. Revolut showed that its service was not offered in his country [#3646](https://altillyfiles.com/chat#3646), so the card came to my address and I forwarded it [#3639](https://altillyfiles.com/chat#3639), [#3647](https://altillyfiles.com/chat#3647), [#3960](https://altillyfiles.com/chat#3960). That was months before the house videos. - **The "PAUL Vernon" envelope.** My 2025 write-up made the name Paul Vernon sound like something I found only later. In that write-up, written from memory, I described finding the name through a "paulv" code signature during the Xeggex period (2022) and then by searching the name on Mike's postal address, and I dated the moment "it became painfully clear" to December 2022. That was wrong. The card arrived in an envelope addressed to "PAUL Vernon", and I posted a photo of it in this chat on 4 February 2021 [#3833](https://altillyfiles.com/chat#3833), almost two years earlier. Mike himself had also named the old hosting email "paul@satotechlt.com" on 26 December 2020 [#1326](https://altillyfiles.com/chat#1326), [#1328](https://altillyfiles.com/chat#1328). At the time I searched the name, found only a British blues musician, and let it go [#7585](https://altillyfiles.com/chat#7585). I did not connect the name to Cryptsy until 2022. - **Hetzner.** I wrote "Hetzner servers (which I controlled)". The account was in my name, but Mike was the one moving wallets onto it [#1119](https://altillyfiles.com/chat#1119), [#1121](https://altillyfiles.com/chat#1121). - **The email.** I wrote that Mike "dismissed" my question about which email was compromised. The chat shows that he wrote the address in the group himself [#1326](https://altillyfiles.com/chat#1326). What I remember him dismissing was a different question: whether "Paul" was his real name. The messages around that moment are missing from the export [#1323](https://altillyfiles.com/chat#1323), [#1325](https://altillyfiles.com/chat#1325), [#1327](https://altillyfiles.com/chat#1327), so I cannot show it, and I mixed the two up in 2025. - **The public notice.** The notice text I quoted in 2025 named the wrong exchange and was not the real text. The real text is [#1232](https://altillyfiles.com/chat#1232). - **"Users were reassured their funds were safe."** Every notice said "We are not sure yet if funds are lost" [#1167](https://altillyfiles.com/chat#1167), [#1232](https://altillyfiles.com/chat#1232). The only "safe" line came from me: I wanted to add that hackers could not access funds [#1180](https://altillyfiles.com/chat#1180). Mike replied "we don't know this", Chuck agreed, and it was dropped [#1183](https://altillyfiles.com/chat#1183), [#1190](https://altillyfiles.com/chat#1190)–[#1193](https://altillyfiles.com/chat#1193). It was an assumption. The day before, Mike had put the loss at 10k, "might be 15" [#1056](https://altillyfiles.com/chat#1056)–[#1060](https://altillyfiles.com/chat#1060), and he said the servers had been deleted, not robbed [#1103](https://altillyfiles.com/chat#1103), [#1132](https://altillyfiles.com/chat#1132). I also hoped the Backblaze backups still held the wallet keys. Mike said the backups were gone too, first "not sure if the hacker did that or maybe a billing issue at backblaze" [#1108](https://altillyfiles.com/chat#1108), then that they had been deleted [#1342](https://altillyfiles.com/chat#1342) and could not be recovered "once deleted by user" [#1498](https://altillyfiles.com/chat#1498). I remembered this as Mike saying Backblaze itself was compromised; the chat shows he said the backups were deleted, not that Backblaze was hacked. - **Refund checks.** I wrote about "10,000+ transactions, 500+ assets", all checked one by one on blockchain explorers. About 137 assets were saved [#1757](https://altillyfiles.com/chat#1757), and our checks were not that thorough (see below). - **"Paul Vernon was never charged."** I meant that he never faced justice, but the words were false. He was indicted in the US in 2019. - **Figures.** In 2025 I wrote that Mike left us with "$900K in refunds to process and $2.4 million in 'saved' assets to return", and my personal website speaks of a "$2.4 million loss". Both descriptions of the $2.4 million are wrong. It was not the saved assets alone, and it was not the loss. It was the total of all claims, saved and non-saved assets together, from our final claims sheet. That sheet is not in the chat. The chat shows the valuation being set up [#2534](https://altillyfiles.com/chat#2534), [#2553](https://altillyfiles.com/chat#2553) and Chuck building the non-saved-asset and conversion sheets [#7426](https://altillyfiles.com/chat#7426). The chat's own estimate of what was lost is about $1 million [#1677](https://altillyfiles.com/chat#1677). Roughly 31 BTC [#1600](https://altillyfiles.com/chat#1600), at the roughly $27K per bitcoin implied in the chat at the time [#1672](https://altillyfiles.com/chat#1672), [#1673](https://altillyfiles.com/chat#1673), comes to about $0.8 million. The claims total can be higher than the loss for two reasons. The claims include the saved assets, which still existed. And the claims were valued at a later date. Until I publish the sheet, $2.4 million is my figure and cannot be checked here. The $900K is a separate claim: it is what I say I later paid in refunds from my own income. The chat does not show that either. - **The house.** I wrote that Mike "used stolen funds to live in a luxury villa" and called his house a mansion. I cannot prove that. The chat shows him moving into a new house in 2021 while selling another one [#5094](https://altillyfiles.com/chat#5094), [#6163](https://altillyfiles.com/chat#6163)–[#6166](https://altillyfiles.com/chat#6166), [#7544](https://altillyfiles.com/chat#7544). It does not show how either was paid for. What it does show is the contrast in that same year: Chuck going to the food bank [#3430](https://altillyfiles.com/chat#3430) and me with "no money at all" and "zero cash" [#2805](https://altillyfiles.com/chat#2805), [#5602](https://altillyfiles.com/chat#5602), scraping money together while we worked on refunds, while the developer who controlled the wallets [#1299](https://altillyfiles.com/chat#1299), [#1621](https://altillyfiles.com/chat#1621) was renovating his new house with an indoor pool [#5106](https://altillyfiles.com/chat#5106), [#7430](https://altillyfiles.com/chat#7430)–[#7431](https://altillyfiles.com/chat#7431). Read the chat and its context, and draw your own conclusions. - **Private people.** In 2025 I published the name of a private person linked to the postal address Mike gave, and a property listing. I wrote that "if there was a 100% guarantee that people would visit his location, I would share his personal details", and I shared what I had with an online group trying to find him. That was wrong. That person may have nothing to do with any of this, and a group of strangers is not the police. This site does not repeat those details. The evidence about Mike himself (the envelope, the hosting email, the code and registry links) is on the [Who was Mike?](https://altillyfiles.com/mike) page and in the chat; read it and draw your own conclusions about him. - **The authorities.** I wrote that "a two-way dialogue was officially opened with the U.S. Marshals". A two-way dialogue was opened, so that I could send them information, but they never responded in it, other than giving me a tip reference number (see below). My 2025 wording made it sound like more than that. - **Things I stated as facts that I cannot prove.** These were: that Altilly funds were traced to the EXMO and Livecoin hackers, that Mike "orchestrated everything", that I refunded $900K, and that a phone call was "final confirmation". Below I give each one as a belief or as an unproven figure. ### How I got involved I started Qredit (XQR) in January 2018. In August 2018 a person named Mike offered Qredit a free listing on the Altilly exchange, and I accepted. I later helped Altilly with front-end design and marketing [#699](https://altillyfiles.com/chat#699), [#752](https://altillyfiles.com/chat#752). As I remember it, in late 2018 Mike suggested that I become the CEO and public face of Altilly, with Qredit as the exchange's own currency. He would stay in the background and run development. That was a private conversation before this chat starts, so these are not his exact words. Other public descriptions of my role do not match this one. In 2019 Altilly's Bitcointalk announcement said it was "now owned and operated by Hodler Enterprises". Altilly's notice after the hack said the exchange "was acquired in 2019", and also that it had no "official ownership by either of the 2 parties". My personal website says "I acquired Altilly in 2018 and invested $175,000 personally." I have not published documents that settle who owned Altilly or what I paid, so please read this section as my memory. The later chat shows the working setup. Fees were charged in XQR [#183](https://altillyfiles.com/chat#183), [#583](https://altillyfiles.com/chat#583), I spoke for Altilly in public, and Mike ran development and the servers [#1492](https://altillyfiles.com/chat#1492), [#1493](https://altillyfiles.com/chat#1493). The chat also mentions a company called Hodler Enterprises in connection with Altilly [#702](https://altillyfiles.com/chat#702). As I remember it, the arrangement was this. I had the title of CEO, and I would get ownership of the whole project once I had set up a proper company for it. There is no message in the chat that transfers ownership, so this is my memory, not a documented fact. Two messages fit with it. In September 2019, when Chuck pointed out that our site text looked tied to Hong Kong, I wrote that Altilly "operates out of Sweden", "But it's still incorporated in Hongkong, until I have the things sorted here" [#757](https://altillyfiles.com/chat#757)–[#759](https://altillyfiles.com/chat#759). In December 2020, when Chuck asked about a Hong Kong address, Mike said it was for a company registration service he had meant to use to form a company in Hong Kong, and "never did do that tho" [#1776](https://altillyfiles.com/chat#1776)–[#1778](https://altillyfiles.com/chat#1778). So the Hong Kong company I mentioned in 2019 was never formed. I repeated something I had not checked. As far as I know, Altilly was never registered as a company anywhere. On 11 December 2020 I registered Qredit Ltd in the UK, as a step towards running Altilly as a regulated business. As I remember it, Mike had privately promised that once I had set up that company, I would formally acquire Altilly. We were already moving servers and wallets to my hosting provider, Hetzner, with Mike doing the moving (see below). The incident began twelve days later, before any acquisition, so I never formally owned the exchange I was the public face of. This is my memory; no message in the chat records the promise. Our private promises were made in a one-to-one Telegram chat between Mike and me, and I cannot show it: Mike deleted the entire history of that chat for both of us, so it cannot be recovered. Only fragments survive. In May 2021 I posted screenshots of part of that private chat in this group [#5025](https://altillyfiles.com/chat#5025), [#5028](https://altillyfiles.com/chat#5028); they are about the Estonian licence and a new exchange, not about ownership of Altilly. I also have Discord screenshots from November and December 2022. I also asked Mike to go through KYC as an owner of the business. He did not want to, and told me I could have full ownership instead. I do not know his reasons. I did not see it as a warning sign then. The chat never mentions Qredit Ltd; the company details come from Companies House. I never drew a salary from Altilly and never earned any money from it. The plan was that pay would start once I had formally acquired it, and that never happened. That is my own account; the group chat does not discuss it. What the chat does show is where I stood at the time. Right after the hack I wrote that even with the database back "I will be in massive debt" [#1533](https://altillyfiles.com/chat#1533), and that I was "1mln usd in debt" [#1882](https://altillyfiles.com/chat#1882). A few days later I wrote "I have no money at all" [#2805](https://altillyfiles.com/chat#2805). I paid for services such as the support desk myself until I had "zero cash" [#5602](https://altillyfiles.com/chat#5602) and was "done paying for all those 3rd parties" [#6772](https://altillyfiles.com/chat#6772). In August 2021 I wrote that "we already have the funding for the crypto license" [#7230](https://altillyfiles.com/chat#7230). That money came from Mike: in May 2021 he had offered to put up about 10k for the licence, "i think i can probably get that 10k by the end of the week… should get that started as soon as you can", and to "send a little extra if i can" [#5728](https://altillyfiles.com/chat#5728), [#5729](https://altillyfiles.com/chat#5729), [#5737](https://altillyfiles.com/chat#5737), while I was applying for the Estonian licence [#5735](https://altillyfiles.com/chat#5735), [#5745](https://altillyfiles.com/chat#5745). The chat shows the offer; that he then sent it is my account. No message in the chat shows me receiving a payout, a salary or fee revenue from Altilly. Some messages were removed before publication [#7598](https://altillyfiles.com/chat#7598), though, so that absence is not proof on its own. Mike said at the time that he had only just been saying at home that "we might start having an incoming from this exchange soon finally" [#1901](https://altillyfiles.com/chat#1901). The only mention of a salary is a joke, in which I called myself his "favorite employer" [#4198](https://altillyfiles.com/chat#4198), [#4201](https://altillyfiles.com/chat#4201). My impression was that Mike was not chasing quick cash, and after the hack he offered to put in his own money [#2806](https://altillyfiles.com/chat#2806), [#5728](https://altillyfiles.com/chat#5728). That is only my impression, and some messages point the other way. He said some of the exchange-fee and PYRK balances were his [#1663](https://altillyfiles.com/chat#1663), [#1748](https://altillyfiles.com/chat#1748), he wondered "what we could have sold altilly for before the hack" [#1889](https://altillyfiles.com/chat#1889), and he said he was "happy with a few mil to live on" [#5493](https://altillyfiles.com/chat#5493). ### December 2020 Around 23 December users started telling me that withdrawals were failing and that some balances showed zero. As I remember it, I called Mike and he said he had just woken up and did not know what was happening. That call is not in the chat. My own first message about it in the group, on 24 December, already called it "the hack" [#1031](https://altillyfiles.com/chat#1031). What the chat shows is how Mike's account changed: - **24 December (morning in Sweden).** Mike's first report was that an attack came in through "an insecure recue port" and that 3 machines were affected [#1033](https://altillyfiles.com/chat#1033), [#1034](https://altillyfiles.com/chat#1034). These appear under Chuck's name because he forwarded them later that day. The export marks the first one as forwarded from Mike's (now deleted) account and dates the original late on 23 December in chat time, early on 24 December in Sweden. - **24 December.** I asked, "Is it really under 10k Mike?" [#1056](https://altillyfiles.com/chat#1056). The message just before my question is missing from the export. He answered "might be 15" and "wont know for sure until i get everything moved" [#1059](https://altillyfiles.com/chat#1059), [#1060](https://altillyfiles.com/chat#1060). In the same minute he suggested telling people "we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057). He also drafted a line saying data had been removed "due to the suspicious outage" [#1065](https://altillyfiles.com/chat#1065). I worked on that wording with him and agreed to it [#1072](https://altillyfiles.com/chat#1072), [#1075](https://altillyfiles.com/chat#1075). I went along with calling it an outage. As I remember it, he also said a failsafe had shut the platform down over a balance mismatch. That is not in the chat. - **25 December.** He wrote that "somebody hacked into their systems. deleted all the servers" [#1103](https://altillyfiles.com/chat#1103) and that the backups were gone [#1108](https://altillyfiles.com/chat#1108). When Cherry Servers first blamed non-payment, in an email from their support staff that Mike forwarded to the group [#1110](https://altillyfiles.com/chat#1110), he said "there were no overdue invoices, so thats a lie" [#1111](https://altillyfiles.com/chat#1111). Later he suggested that a change he had made kept the attackers out, "so i guess they got pissed off and just deleted everything" [#1132](https://altillyfiles.com/chat#1132). - **26 December.** Early that day he said the attacker came in through an old email still attached to the account [#1289](https://altillyfiles.com/chat#1289). Then paul@satotechlt.com appears, with "history on that domain probably has my name", meaning Mike's own name [#1326](https://altillyfiles.com/chat#1326), [#1328](https://altillyfiles.com/chat#1328). The messages in between are missing [#1323](https://altillyfiles.com/chat#1323), [#1325](https://altillyfiles.com/chat#1325), [#1327](https://altillyfiles.com/chat#1327), so I cannot show whether someone asked him for it. Later he said that old email had no 2FA, unlike his current one [#1504](https://altillyfiles.com/chat#1504), and that Cherry told him the deletion request came from it over a Tor IP [#1508](https://altillyfiles.com/chat#1508). He said he would ask Cherry for the full login history [#1509](https://altillyfiles.com/chat#1509). Later he said the history "only went back 5 days" [#1749](https://altillyfiles.com/chat#1749). No Cherry login records were ever posted. According to the research I rely on, the Cherry client relationship was in Qredit's name. Cherry's liability notice came to me [#4349](https://altillyfiles.com/chat#4349). Only Mike had logins to those servers, and I never had access [#1492](https://altillyfiles.com/chat#1492), [#1493](https://altillyfiles.com/chat#1493). In March 2021 I noted that Cherry's notice did not match an earlier email in which they "clearly stated it was their fault" [#4350](https://altillyfiles.com/chat#4350). Neither Mike nor I ever obtained full login records. As the account holder, I should have pushed for them. There are also two accounts of why wallets were moving to Hetzner. Mike alone was moving Altilly's servers and wallets to my Hetzner account [#1119](https://altillyfiles.com/chat#1119), [#1121](https://altillyfiles.com/chat#1121), [#1483](https://altillyfiles.com/chat#1483), [#2602](https://altillyfiles.com/chat#2602). I had no access to the Cherry servers they were coming from [#1492](https://altillyfiles.com/chat#1492), [#1493](https://altillyfiles.com/chat#1493). On 24 December Mike drafted a line saying the move "wasn't planned" and was a reaction to the "suspicious outage" [#1065](https://altillyfiles.com/chat#1065), and my public notice said the same: we decided to move after noticing the suspicious activity [#1232](https://altillyfiles.com/chat#1232). But in the following days Mike wrote that the saved wallets had "been at the new host for awhile" [#1371](https://altillyfiles.com/chat#1371), that one coin was one he "was moving awhile back" [#1447](https://altillyfiles.com/chat#1447), and that he had been writing a guide on setting up the new servers "for moving over" [#2586](https://altillyfiles.com/chat#2586). Those later messages do not fit with "It wasn't planned". What made it across were mostly bitcoin clones added in the previous 30 days [#1297](https://altillyfiles.com/chat#1297), much of it low in value; I called part of it "worthless shitcoins" worth about $490 in total [#2518](https://altillyfiles.com/chat#2518), [#2519](https://altillyfiles.com/chat#2519). BTC, ETH, DASH, DOGE, XQR and the "safe" wallets stayed on Mike's Cherry servers and were lost [#1299](https://altillyfiles.com/chat#1299), [#1600](https://altillyfiles.com/chat#1600), [#1733](https://altillyfiles.com/chat#1733), [#4094](https://altillyfiles.com/chat#4094), [#4095](https://altillyfiles.com/chat#4095). According to Mike, those servers were deleted through an old login on his hosting account, from a Tor IP [#1504](https://altillyfiles.com/chat#1504), [#1508](https://altillyfiles.com/chat#1508). I believe the "hack" came just as the high-value assets were due to move. That is my own reading. No message in the chat gives a date for moving them, and Mike only called the move "a big task" [#1298](https://altillyfiles.com/chat#1298). Some messages point the other way. Not only the big coins were left behind: Mike said another server holding "1.2m" was still at the old host [#1392](https://altillyfiles.com/chat#1392), and that a wallet with 1.2m PYRK of his own was gone [#1745](https://altillyfiles.com/chat#1745). And on 8 January 2021 I could still see 24 ETH in the Altilly wallet that had not been stolen [#2861](https://altillyfiles.com/chat#2861). My own Qredit (XQR) was lost too. XQR was Altilly's fee coin, and I had moved all my own XQR onto Altilly because I trusted its setup. On 27 December Chuck asked "is XQR safe?" and I answered "Nope" and "All lost" [#1731](https://altillyfiles.com/chat#1731)–[#1733](https://altillyfiles.com/chat#1733). It was, as I wrote, "right before a swap" [#1734](https://altillyfiles.com/chat#1734). That XQR was what I had to start Qredit Ltd with, so the company never traded. It filed no accounts and was struck off in 2022. I believe Mike took the XQR along with the rest, but that is a belief. The chat shows only that it was lost. Mike put the bitcoin loss at "around 31 bitcoins, the rest i have no idea" [#1600](https://altillyfiles.com/chat#1600). I estimated the total at about $1 million, knowing it could be more [#1677](https://altillyfiles.com/chat#1677). I wrote and posted the public notice. It said the system "was hacked above OS level" and that we were "not sure yet if funds are lost" [#1232](https://altillyfiles.com/chat#1232). I based it on Mike's reports and trusted them. The notice also said we had lost the domain, while Mike was repointing that same domain's DNS [#1206](https://altillyfiles.com/chat#1206), [#1227](https://altillyfiles.com/chat#1227). That was inaccurate. EXMO and Livecoin were hacked in the same days, and we discussed both [#1053](https://altillyfiles.com/chat#1053), [#1088](https://altillyfiles.com/chat#1088). Mike called it "state sponsored for sure" [#1054](https://altillyfiles.com/chat#1054). As I remember it, I was later told that some Altilly funds went to wallets linked to those attackers. I have no addresses and no tracing report, so please treat this as hearsay. At the time it made me believe we were part of a wider attack, and I told Mike "It's not your fault" [#1256](https://altillyfiles.com/chat#1256). My home address was already public through my company registrations [#1579](https://altillyfiles.com/chat#1579). Threats reached Chuck and me [#2155](https://altillyfiles.com/chat#2155)–[#2160](https://altillyfiles.com/chat#2160), [#2385](https://altillyfiles.com/chat#2385). On 3 January 2021 I found that someone had been in one of our guest igloos [#2372](https://altillyfiles.com/chat#2372). That night two people were running through the garden with flashlights, and I called the police [#2471](https://altillyfiles.com/chat#2471). ### The refund years The user database was lost [#1352](https://altillyfiles.com/chat#1352), [#1353](https://altillyfiles.com/chat#1353), so we rebuilt balances by hand. Users filled in claim forms and later forwarded their original deposit-confirmation emails. Those emails were our main check [#2146](https://altillyfiles.com/chat#2146), [#4665](https://altillyfiles.com/chat#4665). We looked up transaction IDs only sometimes, and less often than my 2025 text suggested (see [#3564](https://altillyfiles.com/chat#3564) below). Mike sent a balances spreadsheet [#1719](https://altillyfiles.com/chat#1719) and a list of 137 saved assets [#1757](https://altillyfiles.com/chat#1757). Many saved-asset refunds were sent in kind by Mike from the recovered wallets, about 60 coins in early April 2021 alone [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). Some went through the projects' own developers [#2145](https://altillyfiles.com/chat#2145), [#2149](https://altillyfiles.com/chat#2149), [#2518](https://altillyfiles.com/chat#2518). In 2021 I had almost no cash [#2805](https://altillyfiles.com/chat#2805), [#5602](https://altillyfiles.com/chat#5602). Some assets fell short. The MRX wallets showed zero while users were still asking about MRX [#4580](https://altillyfiles.com/chat#4580), [#4849](https://altillyfiles.com/chat#4849). I do not know why, and I cannot explain it. Not every approved user got their saved assets back, and I won't pretend otherwise. In January 2021 I did some refunds myself [#3215](https://altillyfiles.com/chat#3215), [#3514](https://altillyfiles.com/chat#3514), but most of the saved-asset keys stayed with Mike, who kept them on his own machines [#1621](https://altillyfiles.com/chat#1621), [#3917](https://altillyfiles.com/chat#3917). He did the bulk sends in one push from 1 to 3 April 2021 [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903), and by May Chuck said most approved users had been paid [#4966](https://altillyfiles.com/chat#4966). The rest stalled. Mike promised a program for the leftovers "tomorrow" [#4875](https://altillyfiles.com/chat#4875), TUSC had "not yet" gone out [#4906](https://altillyfiles.com/chat#4906), and Chuck kept asking him about RDD, HONK and unpaid first rounds [#5951](https://altillyfiles.com/chat#5951), [#6432](https://altillyfiles.com/chat#6432)–[#6433](https://altillyfiles.com/chat#6433), [#6876](https://altillyfiles.com/chat#6876). In the end I got HONK moving and handed its keys to the dev myself [#6731](https://altillyfiles.com/chat#6731), [#6739](https://altillyfiles.com/chat#6739). Part of the blame is mine: when Chuck pushed, I put refunds behind QSLP and other work [#7052](https://altillyfiles.com/chat#7052), [#7144](https://altillyfiles.com/chat#7144), [#7181](https://altillyfiles.com/chat#7181). Chuck's last request to Mike to clear everything pending got no answer in the export [#7421](https://altillyfiles.com/chat#7421). Our Freshdesk help desk, where claims came in as support tickets, was set up and run by Mike, who called the admin login "my login" [#83](https://altillyfiles.com/chat#83), [#4421](https://altillyfiles.com/chat#4421). At first he paid for it and our Fastmail himself [#3229](https://altillyfiles.com/chat#3229), [#3288](https://altillyfiles.com/chat#3288). In March 2021 a card payment failed, so I gave him my own card and he used it for both services [#4417](https://altillyfiles.com/chat#4417), [#4419](https://altillyfiles.com/chat#4419), [#4420](https://altillyfiles.com/chat#4420). I remembered this only vaguely, but the chat confirms it. After that, keeping the service running depended on me putting money on that card. When I had none, Freshdesk was disabled [#5602](https://altillyfiles.com/chat#5602), [#5971](https://altillyfiles.com/chat#5971), [#6029](https://altillyfiles.com/chat#6029), and it came back once I paid [#6901](https://altillyfiles.com/chat#6901). Even then, my card had been charged, but the account once still showed as "inactive", with all invoices paid [#6903](https://altillyfiles.com/chat#6903). Chuck could use it anyway [#6904](https://altillyfiles.com/chat#6904), and I never found out why it showed that. It was suspended again in August 2021, and Freshworks told us it had emailed "Michael", meaning Mike, and got no reply [#7345](https://altillyfiles.com/chat#7345). I paid again [#7319](https://altillyfiles.com/chat#7319), [#7357](https://altillyfiles.com/chat#7357). I do not know exactly when we lost the ticket history for good; the chat stops before that happened. When the refund work in the chat stops in September 2021, it was not finished. First-round saved assets were still pending [#6876](https://altillyfiles.com/chat#6876), [#7421](https://altillyfiles.com/chat#7421). For non-saved assets, Chuck was still building the sheets and a BTC claim page [#7426](https://altillyfiles.com/chat#7426), [#7517](https://altillyfiles.com/chat#7517). From late 2021 I paid refunds from my own income. In 2022 I sold my mining businesses; I used the proceeds first to pay back the investors, and then used my own share of the sale to pay Altilly refund users. All of it went to refunds except about $25,000 that covered my personal debt; by my records this comes to about $900,000. I know a reader cannot verify that from this site, and that even published amounts and transaction IDs could be called random payments to random wallets. People who were not paid tend to say so publicly; most people who were paid do not. The people who can really check it are the projects that were listed on Altilly and their communities, by asking their own members whether they received refunds, including for non-saved assets ([Check the refunds yourself](https://altillyfiles.com/refunds#check-the-refunds-yourself)). Not everyone was paid, and the people still complaining had real grievances. I stopped paying refunds around 2022/2023. I made only a handful after that. Part of the reason is that by then I had come to believe who Mike really was, and I watched Xeggex carry on, and I lost the energy to keep going. That is a reason, not an excuse. My own estimate is that the claims still unpaid come to around $50,000–60,000 in total, but I cannot prove that figure. Most of those claims are close to impossible to check now: the user database was lost [#1352](https://altillyfiles.com/chat#1352), [#1353](https://altillyfiles.com/chat#1353), and many of the coins' blockchains, including the old Qredit chain, no longer exist, so neither the deposits nor my payments can be looked up. Many of the claims that came in near the end were fake. I am not promising further payments here. See the Refunds page for where this stands. ### What I got wrong **Governance.** As CEO I let one person hold all technical control: servers, keys, backups and the database config. In 2019 Mike wrote "we are too small to worry about audits yet" and "too small to even start moving to safe storage" [#215](https://altillyfiles.com/chat#215), [#216](https://altillyfiles.com/chat#216). I accepted that. We had no audit and no real cold storage, and I never insisted on server access. Our public About page still told users the opposite, that our safe storage was off network in a secured facility [#721](https://altillyfiles.com/chat#721). Users trusted that, and it was not true. **Trusting Mike.** I knew "Mike" was not his real name [#7595](https://altillyfiles.com/chat#7595). He told me he did not want to use his real name because he also ran adult websites, and that it would hurt his and Altilly's reputation if people knew an adult-website owner was behind an exchange. That is what he told me; I cannot verify it. Pseudonyms were not unusual in crypto at the time, and I accepted it. I never verified who he was. I trusted him completely: in May 2021 I told him "I trust you with the hosting panel. It's not like something bad ever happened before" [#5658](https://altillyfiles.com/chat#5658). I was the admin of our Revolut Business account. I invited him, set up his accounts and helped him order his card [#3638](https://altillyfiles.com/chat#3638), [#3644](https://altillyfiles.com/chat#3644), [#3693](https://altillyfiles.com/chat#3693). Revolut asks for identity checks, but in March 2021 Mike put his off ("my passport is at the china visa office" [#4415](https://altillyfiles.com/chat#4415)), and I do not know whether he completed it. On 4 February 2021 his card arrived in an envelope addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833), and I forwarded it [#3960](https://altillyfiles.com/chat#3960). As I remember it, I searched the name, found only a British blues musician, and let it go (my 2026 note [#7585](https://altillyfiles.com/chat#7585)). I kept working with him until at least September 2021 in this chat [#5658](https://altillyfiles.com/chat#5658), [#7427](https://altillyfiles.com/chat#7427)–[#7430](https://altillyfiles.com/chat#7430), and in other channels until the Solar incident in late 2022. In May 2021 he offered me "that 10k" towards licence costs for our next venture, and I accepted [#5728](https://altillyfiles.com/chat#5728)–[#5740](https://altillyfiles.com/chat#5740). That was wilful blindness, and I own it. **How refunds were handled.** Some of my messages look bad because they were bad. They stay in the published chat: - **[#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020), May 2021.** After I complained that people were only now finding their balances [#5011](https://altillyfiles.com/chat#5011), Chuck wrote "I can drag it out forever if you want. Im pretty good with word play", "they will feel good about it" and "Hang the carrot out front and they will follow". I replied "Go for it." [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020), knowing that I intended to repay them through the new exchange, Altfenix. There was a plan behind the waiting: since January I had talked about repaying non-saved assets with a token [#2442](https://altillyfiles.com/chat#2442), [#2853](https://altillyfiles.com/chat#2853), and the next day I set it out as an "Altilly refund token", pegged to a value, listed on the new exchange (later Altfenix) and bought back "at 1usd for example", including from users willing to take less [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203). 25% of the new exchange's fees was set aside partly for hack claims [#5535](https://altillyfiles.com/chat#5535), [#5882](https://altillyfiles.com/chat#5882). There were no funds to pay otherwise [#5184](https://altillyfiles.com/chat#5184), [#5602](https://altillyfiles.com/chat#5602). In June the plan became tokens per coin with bid markets on Altfenix [#6657](https://altillyfiles.com/chat#6657)–[#6665](https://altillyfiles.com/chat#6665). Chuck also described stretching out the saved-asset rounds to buy time [#5962](https://altillyfiles.com/chat#5962), [#6027](https://altillyfiles.com/chat#6027), [#6811](https://altillyfiles.com/chat#6811), and I called that "a good thing, because the next solution will be better and easier for all of us" [#6813](https://altillyfiles.com/chat#6813). Altfenix never launched. For the people told to wait, it was still stalling. - **[#6842](https://altillyfiles.com/chat#6842), June 2021.** To value claims, we used CoinGecko's price history for the days of the hack [#6838](https://altillyfiles.com/chat#6838)–[#6841](https://altillyfiles.com/chat#6841). I told Chuck to take the lower of the day's open and close prices — "the most beneficial for us. So the lowest one" — and, "if there is a massive difference with the day before, then again, the lowest value" [#6842](https://altillyfiles.com/chat#6842). Chuck suggested 25 or 26 December, "whichever is better for us", and I agreed [#6844](https://altillyfiles.com/chat#6844)–[#6847](https://altillyfiles.com/chat#6847). The hack fell in a period when altcoin prices were spiking, and we did not want a one-day spike to set the value. Valuing at the date of the loss is normal, but choosing the lowest of the available prices "for us" favoured the exchange over the people owed money, and I should have picked one neutral rule instead. That was my idea, and it was wrong. - **[#3564](https://altillyfiles.com/chat#3564), January 2021.** We had thousands of claims, many sent as screenshots, so I did not check every transaction: "We will be here for another 10 years if we start checking all txid's" [#3566](https://altillyfiles.com/chat#3566). Instead I checked each coin as a whole: after collecting all claims for a coin, the total had to match what was left in that coin's wallet — "I make sure that the end balance matches with what Im going to refund" [#3558](https://altillyfiles.com/chat#3558) — and if it did not, "then its fucked up", which had not happened yet [#3570](https://altillyfiles.com/chat#3570). Claims without an amount were held back until we found the deposit email [#3555](https://altillyfiles.com/chat#3555). Within that check, I did not look at individual small claims: "anything between 50-200 usd I don't check at all" [#3563](https://altillyfiles.com/chat#3563), [#3564](https://altillyfiles.com/chat#3564). I kept no separate payout ledger beyond marking addresses with users [#3574](https://altillyfiles.com/chat#3574), [#3575](https://altillyfiles.com/chat#3575), and team members who had bought on Altilly did not have to send deposit emails [#3951](https://altillyfiles.com/chat#3951)–[#3953](https://altillyfiles.com/chat#3953). Checking the totals stopped anyone from claiming more than a wallet held, but it could not stop one person's inflated claim from being paid out of other people's share, and the missing payout ledger is why I cannot show today who was paid what. - **[#4029](https://altillyfiles.com/chat#4029)–[#4032](https://altillyfiles.com/chat#4032), February 2021.** Our banking partner gave us a list of 139 high-risk countries, including Nigeria [#4020](https://altillyfiles.com/chat#4020)–[#4028](https://altillyfiles.com/chat#4028). Most of our users were from Nigeria, and we decided not to refuse them refunds [#4021](https://altillyfiles.com/chat#4021), [#4034](https://altillyfiles.com/chat#4034)–[#4036](https://altillyfiles.com/chat#4036). My worry was that small payments into listed countries could get our accounts closed [#4028](https://altillyfiles.com/chat#4028) while we were setting up a regulated business with a new banking partner [#4083](https://altillyfiles.com/chat#4083). For "a really pushy person", I told Chuck to "do the refund, but not by email and remove all traces" [#4029](https://altillyfiles.com/chat#4029); Chuck replied "Wait" / "what?" [#4030](https://altillyfiles.com/chat#4030), [#4031](https://altillyfiles.com/chat#4031). I had already done this once for a long-time user who had become very offensive: I put him on a separate list to be paid at the end and deleted the messages [#4032](https://altillyfiles.com/chat#4032), [#4033](https://altillyfiles.com/chat#4033); he was paid later. The people were owed that money and they got it. But paying the loudest people quietly and erasing the record was unfair to those who waited, and hiding payments is not how a business that wants a licence should operate. - **[#2158](https://altillyfiles.com/chat#2158), [#2159](https://altillyfiles.com/chat#2159), December 2020.** When Chuck showed me a threat, I wrote "What an idiot. Let him do his thing." People had lost money. That remark, and others like it [#5059](https://altillyfiles.com/chat#5059), [#6386](https://altillyfiles.com/chat#6386), show a dismissive attitude I am not proud of. There are other messages you should see too: - Critics were removed. I once said not to delete their messages [#2682](https://altillyfiles.com/chat#2682), but I also accepted deleting messages that mentioned a class action [#3929](https://altillyfiles.com/chat#3929)–[#3934](https://altillyfiles.com/chat#3934). - I removed a dated repayment promise from our site [#3418](https://altillyfiles.com/chat#3418)–[#3421](https://altillyfiles.com/chat#3421) and took other text down [#1918](https://altillyfiles.com/chat#1918), [#7179](https://altillyfiles.com/chat#7179). - While we were trying to buy back a copy of the database from someone who offered it, I wrote "we can't say that we just bought it from someone", and I agreed to say we "recovered an sql dump" [#2967](https://altillyfiles.com/chat#2967)–[#2973](https://altillyfiles.com/chat#2973). The seller then disappeared with the deposit [#3037](https://altillyfiles.com/chat#3037). - I wrote "don't worry about the users… I will come up with a clever solution" [#5051](https://altillyfiles.com/chat#5051) at the same moment Chuck said thousands had missed the deadline [#5052](https://altillyfiles.com/chat#5052). - I planned a refund token partly to "create some trading activity on it" [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), [#6807](https://altillyfiles.com/chat#6807). On 25 December I also wanted to tell users that hackers could not reach the funds [#1180](https://altillyfiles.com/chat#1180). Mike replied "we don't know this" [#1183](https://altillyfiles.com/chat#1183), and he was right. The day before, when Chuck pointed out that the public status page showed missing assets, Mike said "ill fix that soon", and nobody objected [#1077](https://altillyfiles.com/chat#1077)–[#1079](https://altillyfiles.com/chat#1079). On 27 December, when Cherry confirmed that all the server data had been wiped, I wrote "Don't share this with anyone yet until I have my stuff ready" [#1564](https://altillyfiles.com/chat#1564), [#1566](https://altillyfiles.com/chat#1566). Some private remarks read badly and stay in the chat. In May 2021, while planning a new exchange with Mike, I wrote "We managed so far with the damage control of Altilly. I can't pull this twice. Next time will be one way ticket to Russia or China" [#5354](https://altillyfiles.com/chat#5354). I meant that I could not survive another collapse; a minute later I wrote "I don't know what i will do to myself if it ever happens again" [#5361](https://altillyfiles.com/chat#5361). Readers can judge that for themselves. I also said an internal refund list was something "no one needs to know a fuck about" [#3147](https://altillyfiles.com/chat#3147), and I agreed that we should not tell people Altilly was not incorporated in Sweden [#2164](https://altillyfiles.com/chat#2164)–[#2167](https://altillyfiles.com/chat#2167). ### After Altilly In May 2021 Mike and I planned Altfenix. I pushed for cold wallets and manual withdrawals [#5666](https://altillyfiles.com/chat#5666), and he agreed [#5668](https://altillyfiles.com/chat#5668). A demo page went up [#5771](https://altillyfiles.com/chat#5771), but the exchange had not launched by September 2021 [#7428](https://altillyfiles.com/chat#7428). In December 2021 I took a job with another project and left Altfenix to Mike. In early 2022 Mike told me an exchange wanted to list Qredit for free and that he had checked it. It was Xeggex. About a month later he said "Karl from Xeggex" wanted him to join and might sell the exchange, which would help pay refunds faster. Mike proposed that we work on Xeggex together and approach "Karl", and he introduced me to him. I proposed that my company, Dokdo, acquire Xeggex on the condition of full KYC/AML compliance, and I announced the plan publicly in 2022. For a while the Xeggex website itself described Xeggex as "a service of Dokdo Global"; archived copies from 6 June 2022 and from September to December 2022 show this. When I asked for the backend and wallet code for an audit, Mike shared only the frontend. As I remember it, he said it was "not ready yet for an audit". I disclose all of this because it is why some people later accused me of being behind Xeggex. None of it is in the chat, which ends in 2021. As I remember it, code for another project first appeared on a GitHub account I understood to be Karl's, was deleted, and then appeared on Mike's account. He said he had "fat fingers". Once, when he code-signed the Qredit wallet for me on a Mac, the user name shown was, as I remember, "paulv". He said the Mac was secondhand. I let that go too. I have no screenshots of the GitHub episode, so this paragraph rests on my memory alone. In late November 2022 we found that funds had been taken from Solar (SXP), a project I led. On 30 November 2022 Solar posted a statement in the Solar validator group on Discord, titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS". It was not posted on Solar's public Telegram channel, blog or Twitter, which is why earlier searches could not find a public copy: ![Solar statement, 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png) It says that on 29 November 2022 "a series of unauthorised swap transactions were detected which took place between 12th August 2022 and 29th November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins", and that "In total, 1,878,477 SXP was fraudulently swapped during this time resulting from a vulnerability detected in the BSC nodes used to provide API data to the swap service." It says this "was not due to a hack or breach of security of the Solar mainnet or Solar Core", that "user funds were never at risk", and that it did "not" result "in the creation of new SXP coins". It also says: "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." The statement does not name anyone. That the perpetrator was Mike comes from my own evidence, the Discord screenshots below, not from the statement. The screenshots are in my February 2025 write-up; they are my own evidence, not an official record. On 29 November 2022 at 22:45 I wrote to him on Discord: "Why did you do it Mike?" At 00:17 on 30 November I wrote: "We are not going to say anything if you can return the funds in 24hrs." At 05:43 that morning MikeO answered: "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." On 3 December 2022 he wrote: "I had nothing to do with the altilly hack." My goal was to get that money back. It did not come back in 24 hours. By my account, Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. The final payments can be checked on the Solar blockchain. That money was for the Solar incident, not Altilly. **Solar repayment ledger (author's records)** | Date | SXP | Transaction ID | |---|---|---| | 1 Dec 2022 | 79,326 | — | | 15 Aug 2023 | 20,000 | — | | 6 Nov 2023 | 30,000 | — | | 19 Nov 2023 | 50,000 | — | | 24 Dec 2023 | 99,151 | — | | 22 Jan 2024 | 100,000 | — | | 24 Feb 2024 | 200,000 | — | | 18 Mar 2024 | 300,000 | `f3669e37529613b3404e05aa392957f85f3399d69a07681545fc81afbc2f5125` | | 19 Mar 2024 | 250,000 | `db2d920119b1cfdb0cfc18ead64d2c2e53b45268da68b3409f8c354750adf6f5` | | 19 Mar 2024 | 250,000 | `7db5a21493e3eb942de5d506d9932b197ecaf8b0063fb5e3ada8a9c076bf9153` | | 19 Mar 2024 | 250,000 | `a22584020653038e3871bb6a0c8b45dc96ecfc86d0ed3b57baddf5dea455a0b0` | | 19 Mar 2024 | 250,000 | `8fa26f4671daf7fa0b3f7e04f8e119544c23b5b6f81dd71d79988410d0cc07c7` | | **Total** | **1,878,477** | | Receiving address (the Solar swap wallet involved in the theft): `SdiefkN6SmFiRLUNDjuGMKUu89Tvtx4NwX` At about the same time, around November 2022, I came to believe that Mike was running Xeggex himself, that "Karl" did not exist, and that Mike was Paul Vernon. These are my beliefs. No authority has confirmed any of them. I cancelled the Dokdo acquisition. On 3 December 2022 Mike asked me on Discord, "should I start removing references to Dokdo on Xeggex?", and I answered "Yes, please". A screenshot of that exchange is in my February 2025 write-up; it is not part of this chat. The business relationship ended in late 2022, and I no longer trusted him. After that, I stayed in contact with him for one reason: getting money back. First the Solar funds, which he repaid in full by 19 March 2024, and later a promise he made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck. He never followed up on it. In 2025 I wrote that after he repaid "we never spoke again"; this paragraph is the more complete account. While we worked together, Mike had his own project inside my Hetzner account, with its own API key. He could create and manage servers in that project [#5937](https://altillyfiles.com/chat#5937), [#5941](https://altillyfiles.com/chat#5941), [#6040](https://altillyfiles.com/chat#6040)–[#6042](https://altillyfiles.com/chat#6042), but he had no access to the rest of my account. That is how Altilly's new servers were set up in 2020 [#1119](https://altillyfiles.com/chat#1119), [#1121](https://altillyfiles.com/chat#1121), [#2586](https://altillyfiles.com/chat#2586). After we split up in late 2022, I found out that he was also using that project for Xeggex, including a Solar node for Xeggex. I told him to move everything out of it. He finished in January 2023, and I deleted the servers. I did not go public in 2022. Solar was a legitimate project in the top 200 on CoinMarketCap, and I did not want it linked to someone I believed was Paul Vernon. I also had no proof that Mike ran Xeggex, and I was afraid of him. I had a young child and a family to protect, and Solar to run. I believed Mike was Paul Vernon, whom a US court had placed in fugitive status, and I feared that he might have access to large funds. In March 2022 bitcoin from the 2014 Cryptsy theft started moving, as the blockchain analysis firm Elliptic reported ([Elliptic](https://www.elliptic.co/blog/bitfinex-2.0-elliptic-traces-bitcoin-worth-512-million-from-2014-cryptsy-exchange-theft)). Nobody has shown who moved those coins; my fear that Mike might have access to them was only a fear. I also remember Mike once saying, in a private conversation, that he could make someone disappear. It is not in the chat, I cannot prove he said it, and I do not know what he meant. I mention it only because my memory of that remark frightened me, and it still does. I did not want to confront someone I believed was a wanted fugitive. Above all, I expected that nobody would believe me. The business relationship had ended, and the only contact I kept with him was about getting money back. My expectation turned out to be right. When I did go public in February 2025 and said that I believed Mike, "Karl" and Paul Vernon were the same person, many people did not believe me. On Reddit they wrote that I was "the perpetrator" and "Karl" myself ([r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1il8ei9/), [r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iisdmd/)), and that I did not "pass the sniff test" ([r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/)). More of these reactions are on the [home page](https://altillyfiles.com/). That disbelief is exactly what I expected in 2022. I also expected that going public would hurt me more than it would help anyone, and in 2025 that happened too: after my statement, people came to my properties, and I moved house because my address was public. These are my reasons, not an excuse. I have to be honest about the cost. From late 2022 I believed Mike ran Xeggex, and Xeggex kept taking deposits for more than two years while I said nothing. I did not warn its users. I put getting the Solar money back, and keeping Solar away from this, ahead of speaking out. I also doubt that a warning from me would have stopped many people. When I went public in February 2025, Xeggex had already frozen withdrawals. Even so, when its website came back in March, people kept using it. Users asked on Reddit about buying there again ([r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1jceats/)), and in May 2025 a coin project still listed Xeggex as one of the places to trade its coin ([r/BonkcoinPoW](https://old.reddit.com/r/BonkcoinPoW/comments/1kq3wgx/)). In 2026 the Xeggex domain came back with a "refund" offer, and an old user wrote that he paid it a deposit, despite warnings all over Reddit ([r/Crypto_Scam_Exchange](https://old.reddit.com/r/Crypto_Scam_Exchange/comments/1qwi92l/comment/oohcpxo/)). I cannot prove that an earlier warning would have changed nothing. People who lost money on Xeggex may still blame my silence, and I understand that. In February 2025 Xeggex halted withdrawals, blaming a hacked CEO Telegram account and then a corrupted database. People started messaging me to ask who was behind Xeggex, and that is when I went public, with the write-up I correct at the top of this page. On 27 June 2025 Xeggex announced it was shutting down. ### What I know and what I believe **What is documented:** - The incident was 23-25 December 2020. We estimated the loss at the time at about $1 million [#1033](https://altillyfiles.com/chat#1033), [#1103](https://altillyfiles.com/chat#1103), [#1677](https://altillyfiles.com/chat#1677). - Mike ran the Cherry servers, and I had no access [#1492](https://altillyfiles.com/chat#1492), [#1493](https://altillyfiles.com/chat#1493), [#1504](https://altillyfiles.com/chat#1504), [#1508](https://altillyfiles.com/chat#1508). - His explanations changed over those days [#1056](https://altillyfiles.com/chat#1056)–[#1060](https://altillyfiles.com/chat#1060), [#1103](https://altillyfiles.com/chat#1103)–[#1132](https://altillyfiles.com/chat#1132), [#1289](https://altillyfiles.com/chat#1289), [#1504](https://altillyfiles.com/chat#1504). - Mike wrote paul@satotechlt.com and said the domain history "probably has my name" [#1326](https://altillyfiles.com/chat#1326), [#1328](https://altillyfiles.com/chat#1328). That domain is one letter off satotechltd.com, whose WHOIS record lists Paul Vernon / Project Investors Inc [#7577](https://altillyfiles.com/chat#7577). I believe it was a typo, but that is my reading. - Mike's Revolut card came to my address in an envelope addressed to "PAUL Vernon" [#3647](https://altillyfiles.com/chat#3647), [#3833](https://altillyfiles.com/chat#3833), [#3960](https://altillyfiles.com/chat#3960). - The GitHub account "mrmikeo" (MikeO) is the account used for Altilly development, with the email mike@altilly.com. On 1 April 2024 it made a commit to Xeggex's official GitHub organisation (xeggex/hummingbot, commit d1479b80fe). - The Xeggex domain (August 2021) and its GitHub organisation (September 2021) existed before Mike told me about "Karl". - UK Companies House lists a director registered as Michael O'Sullivan for XEGGEX SOFTWARE SERVICES LTD (dissolved 31 December 2024) and XGX SOFTWARE LTD (dissolved 26 August 2025) ([Companies House](https://find-and-update.company-information.service.gov.uk/company/14910559/officers)). The register does not verify identities. I am convinced "Michael O'Sullivan" is an alias Mike used, possibly with a false passport. I cannot prove that myself; it needs to be investigated by law enforcement. Until it is, and only as a precaution, I am not accusing any real person who happens to share that name. - Paul Vernon founded Cryptsy. In 2017 a US court entered an $8.2 million default judgment against him in the Cryptsy customer class action, after he did not defend it. A 17-count federal indictment was filed in Florida in 2019 and made public in January 2022. The court placed him in fugitive status in 2019. He has not been convicted, the charges are allegations, and no filing in that case mentions Altilly or Xeggex. **What I believe but cannot prove:** - That Mike is Paul Vernon. - That "Karl" was Mike, and that Mike was behind Xeggex. - That the Altilly hack may not have been an outside attack. I have no evidence of what happened on Cherry's side, and Mike denied any part in it on 3 December 2022. At the time, Altilly's own public statement, which went out while I was its public face, said that "suggestions of the attack being an inside job are totally untrue and unfounded". I held that view then, and I changed it later. These beliefs formed from late 2022 onward, about two years after the Altilly incident. In the notes I added to the chat [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575), [#7577](https://altillyfiles.com/chat#7577), [#7579](https://altillyfiles.com/chat#7579)–[#7598](https://altillyfiles.com/chat#7598), some of them are written as facts: "Paul Vernon 👌" [#7585](https://altillyfiles.com/chat#7585), "orchestrate" [#7587](https://altillyfiles.com/chat#7587), "10k out of nowhere" [#7592](https://altillyfiles.com/chat#7592) and "Mike/Paul" [#7595](https://altillyfiles.com/chat#7595). Please read those notes as my beliefs. My notes about the house "months after the hack" [#7589](https://altillyfiles.com/chat#7589)–[#7592](https://altillyfiles.com/chat#7592) also leave out what the chat shows: Mike was selling another house at the time [#5471](https://altillyfiles.com/chat#5471), [#6163](https://altillyfiles.com/chat#6163)–[#6166](https://altillyfiles.com/chat#6166), and the furniture for the new one had been in a warehouse "for a year" by September 2021 [#7431](https://altillyfiles.com/chat#7431). The chat does not show how the new house was paid for. No court or authority has confirmed that Mike is Paul Vernon, that "Karl" is Mike, or that Mike took the Altilly or Xeggex funds. A community member once told me about a phone call that I took as confirmation. Silence on a phone line proves nothing, and I no longer rely on it. I will not publish anyone's address, phone number or photos, and I ask nobody to contact, confront or visit anyone. In 2025 I did not keep to this, as I said above, and I am sorry for it. ### About the missing messages 663 message numbers are missing from the published export. Here is what I can and cannot tell you: - **Messages I removed.** I removed some myself because they contained customer data, data about unrelated third parties, or data about early team members [#7598](https://altillyfiles.com/chat#7598). At least one gap, [#7582](https://altillyfiles.com/chat#7582), comes after I became owner, so that deletion was mine. - **Messages others may have removed.** Mike could delete his own messages at any time before his account was deleted. Chuck created the group and was its owner until 28 September 2026 [#7578](https://altillyfiles.com/chat#7578), so he could delete messages too, as could any admin. - **What I cannot see.** I only became owner of this group on 28 September 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578). Before that I had no admin rights in this group; like every member, I could delete only my own messages. I cannot see what was deleted, by whom, or when. Some gaps fall at sensitive points, around 24 December [#1055](https://altillyfiles.com/chat#1055), [#1058](https://altillyfiles.com/chat#1058), [#1061](https://altillyfiles.com/chat#1061)–[#1064](https://altillyfiles.com/chat#1064) and around the paul@satotechlt.com email [#1323](https://altillyfiles.com/chat#1323), [#1325](https://altillyfiles.com/chat#1325), [#1327](https://altillyfiles.com/chat#1327). Customer data does not obviously explain those gaps, and I understand why they raise questions. I did not remove messages because they make me look bad. Those messages are still there [#2968](https://altillyfiles.com/chat#2968), [#4029](https://altillyfiles.com/chat#4029), [#5020](https://altillyfiles.com/chat#5020), [#6847](https://altillyfiles.com/chat#6847). I would welcome a comparison with a full export from any other former member. The unredacted chat, including customer data, is available to authorities. ### What I have given to authorities In early 2025 I reported what I knew to the FBI and to the U.S. Marshals Service. The Marshals opened a two-way dialogue and gave me a tip reference number, 777-W77728. They never responded in it beyond that number. That number is a reference for my report. It does not confirm any investigation or any of my beliefs. The FBI has not given me a case number. As far as I know, no authority has made a public statement about Altilly, Xeggex or Mike. I can give any authority that asks (contact me on Telegram at [@nayiem](https://t.me/nayiem)): - the unredacted management chat; - the "PAUL Vernon" envelope photo; - the Discord screenshots from November and December 2022, and Solar's [30 November 2022 statement](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png); - the other material I have mentioned on this page. That is where this belongs. I made real mistakes as CEO and in how refunds were handled, and I have tried to own them here. I did not take the users' money. --- # Chronicle Source: https://altillyfiles.com/chronicle Markdown: https://altillyfiles.com/content/chronicle.md ## The chronicle: Altilly from the inside, 2019-2021 This chronicle tells the story of Altilly's management chat from beginning to end: how the exchange was run before the incident, what happened in December 2020, and how the team handled the aftermath. To write it, every message in the export was re-read. The drafting was AI-assisted, and every quote and message number was then checked against the chat. Numbers in brackets, such as [#1232](https://altillyfiles.com/chat#1232), link to the message in the [chat reader](https://altillyfiles.com/chat), so you can check each point yourself. Some ground rules: - All dates and times are the export's timestamps, which are in UTC-8. In Sweden, where Nayiem lived, it was about nine hours later. - In the export, Mike's messages appear under "Deleted Account". - The only people named are Nayiem, Chuck and Mike. Other private people, customers and staff are described by role. Customer data and the attacker's IP address are left out. - The text tries to stay neutral and includes unflattering facts about everyone, Nayiem included. > **Note:** > > **About missing messages** > > 663 message numbers are missing from the export. About 130 of them fall before the incident (Jul 2019 – Jul 2020, mostly Jul–Aug 2019). According to Nayiem, these are mainly a graphic designer who deleted all of his own messages before leaving the group. About 530 fall after the incident (Dec 2020 – Oct 2021; the largest numbers in Dec 2020 – Feb 2021 and May–Jul 2021), plus 1 in Sep 2026. Telegram does not show who deleted a message or when. Nayiem only became owner of the group on 28 Sep 2026. He says he removed some messages to protect customer and third-party data; other members, including Mike, could delete their own messages. The unredacted chat is available to law enforcement. ### Building Altilly (Jul-Dec 2019) #### A small team with a long list The management chat began on 8 July 2019. Chuck created a group called "Holder Core" with Mike and Nayiem [#1](https://altillyfiles.com/chat#1), and Nayiem corrected the name to "Hodler Core" [#4](https://altillyfiles.com/chat#4). Chuck asked for a short meeting every two weeks [#3](https://altillyfiles.com/chat#3). He also posted a list of principles: communication, organisation, efficiency, automation and a marketing plan, which he followed with the question "Do we have a plan?" [#15](https://altillyfiles.com/chat#15). The roles were clear from the start. Mike was the only developer. Chuck handled support, listings and business development. Nayiem worked on partnerships, marketing and strategy. Most of the backlog waited on Mike, and his own list was long: KYC and AltillyPass, listing and delisting tools, a new admin area and website updates [#51](https://altillyfiles.com/chat#51). The KYC work alone meant finishing the AltillyPass purchase flow, integrating the KYC provider and adding an "is user verified" API call [#55](https://altillyfiles.com/chat#55). Listings were the first dispute. Chuck proposed a pass/fail review before any listing fee was charged, so that rejected projects would not need refunds, and Mike agreed [#28](https://altillyfiles.com/chat#28), [#47](https://altillyfiles.com/chat#47). Mike wanted KYC from every project that applied [#60](https://altillyfiles.com/chat#60). Chuck warned that developers disliked it and that "we may end up losing many more assets" [#62](https://altillyfiles.com/chat#62), [#63](https://altillyfiles.com/chat#63). He also admitted that "90% of the devs i have to speak to, fail the reviews and many for refusing to add team members on website" [#70](https://altillyfiles.com/chat#70). They agreed to try KYC and to log applicants who dropped out [#73](https://altillyfiles.com/chat#73). New submissions reopened on 12 July [#125](https://altillyfiles.com/chat#125). Complaints came the same day. The fee had moved from a flat XQR amount to $300 in XQR, and this was "not published until we went live with new listings" [#175](https://altillyfiles.com/chat#175). Nayiem's reply was "Dude is right. But on the other hand.. What the fuck. 100 dollars?" [#177](https://altillyfiles.com/chat#177). Chuck called the complainers "whining devs" and suggested going back to a fixed XQR amount [#183](https://altillyfiles.com/chat#183). When Chuck asked Nayiem whether a listing he was working on cost a lot, Nayiem answered "A lot of time" [#146](https://altillyfiles.com/chat#146), [#148](https://altillyfiles.com/chat#148). He said he still needed a white paper and a KYC disclaimer for it [#143](https://altillyfiles.com/chat#143). #### What the exchange looked like The figures that appear in the chat point to a small exchange with little trading. Chuck said the BCH base market was "doing absolutely nothing" [#191](https://altillyfiles.com/chat#191). In August the sponsored banner showed Qredit (XQR) at 8 satoshis with 0.093 BTC of 24-hour volume [#365](https://altillyfiles.com/chat#365). Chuck asked for a September volume target of $400k [#626](https://altillyfiles.com/chat#626). On 11 September he reported a "sudden volume drop" and asked whether a market-making competition had to run all the time "to keep over 100k" [#786](https://altillyfiles.com/chat#786). Nobody answered that in the chat. Security planning was minimal from the start. When someone asked about a third-party audit, Mike said "we are too small to worry about audits yet" [#215](https://altillyfiles.com/chat#215), "heck we are too small to even start moving to safe storage" [#216](https://altillyfiles.com/chat#216), and put audits at "probably 2020" [#220](https://altillyfiles.com/chat#220). When Chuck raised privacy coins, whose team holdings reviewers could not verify, Nayiem said: "We can decide later when we get in to trouble" [#242](https://altillyfiles.com/chat#242). KYC went through the provider Token of Trust (TOT). On 24 July Nayiem reported that live keys would be activated the next day. He said TOT "was really impressed about the integration. But especially that Mike did find the live keys, none of their customers ever did that" [#302](https://altillyfiles.com/chat#302). Adoption was slow. Chuck said he was "having to walk almost everyone thru the altillypass" because users with too little balance were sent back to an empty form, and Mike added an error message that same day [#360](https://altillyfiles.com/chat#360), [#363](https://altillyfiles.com/chat#363). By the end of August, Chuck's email to TOT gave the numbers: "54 have applied 32 approved". Some users said they had waited weeks with no notice [#661](https://altillyfiles.com/chat#661). #### Improvised revenue Money came from several small, improvised sources. Chuck warned that 20 approved listings were waiting, "a couple since before we shut down listings long ago" [#338](https://altillyfiles.com/chat#338). He gave Mochimo, a community-run coin, a discounted listing fee of 0.1 BTC [#378](https://altillyfiles.com/chat#378). He proposed selling the sponsored banner slot [#365](https://altillyfiles.com/chat#365), [#368](https://altillyfiles.com/chat#368). He also traded free market-maker accounts for promotional articles [#355](https://altillyfiles.com/chat#355). Competitions cost only "$150 in XQR" [#583](https://altillyfiles.com/chat#583). Chuck wanted to use free competitions to pull in communities he wanted "to steal thier volume from other exchanges" [#608](https://altillyfiles.com/chat#608). Some housekeeping was loose. When Chuck asked how to set up one listing, Nayiem told him to list it "without any announcement" [#225](https://altillyfiles.com/chat#225), [#227](https://altillyfiles.com/chat#227). For the airdrop, Mike matched 10,383 users and arrived at 5,871,800 XQR after removing invalid referrals [#416](https://altillyfiles.com/chat#416), [#431](https://altillyfiles.com/chat#431), [#432](https://altillyfiles.com/chat#432). When Mike asked about deducting unfound referrals, Nayiem said "You can take it from my account" [#417](https://altillyfiles.com/chat#417)–[#420](https://altillyfiles.com/chat#420). On 12 August Nayiem asked "Anyone knows what happened with 10k merits?" [#450](https://altillyfiles.com/chat#450), and no one answered in the chat. His plan for an email campaign to more than 4,000 project developers relied on guessed addresses: "I asked all the websites from the assets listed on coingecko. and replaced www. with info@" [#548](https://altillyfiles.com/chat#548), [#559](https://altillyfiles.com/chat#559). Under that plan coins would pay "1500 usd I believe" [#563](https://altillyfiles.com/chat#563). The mood in August was good. Mike wrote "This is why you need a team to build something good. one person can't think of everything" [#476](https://altillyfiles.com/chat#476), and Chuck answered "We have a good core team i think.." [#477](https://altillyfiles.com/chat#477). On fiat, Mike wanted to "make sure the banking relationship is good before we start taking in millions of dollars in deposits" [#524](https://altillyfiles.com/chat#524). Nayiem estimated "probably 2 months? But at least this year" [#516](https://altillyfiles.com/chat#516). #### September: few new listings, lower fees On 4 September Nayiem asked how many new coin applications had arrived in two weeks. Chuck answered "1 maybe 2", then "Maaaaybe 3" [#681](https://altillyfiles.com/chat#681), [#683](https://altillyfiles.com/chat#683), and Nayiem replied "oh boy" [#684](https://altillyfiles.com/chat#684). Nayiem said "We really need to do something about the volume" [#692](https://altillyfiles.com/chat#692). He moved to free ERC-20 and QAE listings and asked that reviews be kept brief, which lowered the vetting standard [#753](https://altillyfiles.com/chat#753). When Chuck asked whether 10% was still the listing-agent commission, Nayiem offered to raise it to 25% [#782](https://altillyfiles.com/chat#782), [#783](https://altillyfiles.com/chat#783). Chuck also noted that he would soon be working long shifts with much less time for Altilly [#631](https://altillyfiles.com/chat#631). In the same period Nayiem redesigned the front end. He told Chuck: "Just don't throw it in the group. not waiting for endless discussions again" [#704](https://altillyfiles.com/chat#704). When legal text on the site raised the question of jurisdiction, he explained that "Altilly operates out of Sweden" but was "still incorporated in Hongkong, until I have the things sorted here" [#759](https://altillyfiles.com/chat#759). The one clear growth signal was web traffic. Chuck shared an Alexa chart showing the site's rank improving from about #196k to about #94k over 90 days [#779](https://altillyfiles.com/chat#779), [#780](https://altillyfiles.com/chat#780). "So it may not seem or feel like it but we are slowly growing and altilly is becoming known to the world," he wrote [#781](https://altillyfiles.com/chat#781). The platform also showed operational strain. On 15 September 38 withdrawals were pending [#790](https://altillyfiles.com/chat#790). Mike traced the cause to a stuck withdrawal "that actually went out and caused the balance percent to drop below the shutdown threshold", and he restored service [#792](https://altillyfiles.com/chat#792), [#793](https://altillyfiles.com/chat#793). When the free-listing special ended, Chuck asked what the new prices would be and got no reply [#799](https://altillyfiles.com/chat#799). On 3 October Nayiem wrote off a new team member who was "working as lone wolf" and "rude against other team members", and Chuck agreed: "Not a good fit" [#801](https://altillyfiles.com/chat#801), [#806](https://altillyfiles.com/chat#806). #### Late 2019: deferring KYC On 15 October, with asset reviews "finally completed", Chuck asked whether projects that refused KYC should be delisted [#831](https://altillyfiles.com/chat#831). Nayiem said to "leave it for now". His reasoning was "Once Altilly becomes more mature, we can ask the devs to apply for KYC" [#833](https://altillyfiles.com/chat#833), [#834](https://altillyfiles.com/chat#834). In December Chuck told the others that support tickets were almost all about pending deposits and withdrawals, so FAQ pages would not help [#861](https://altillyfiles.com/chat#861). He also mentioned "some tech issues early on today" [#860](https://altillyfiles.com/chat#860). The year ended with planning. On 29 December the team agreed on a prize table for a March market-maker competition [#862](https://altillyfiles.com/chat#862), [#867](https://altillyfiles.com/chat#867), and Chuck listed the pipeline: "3 for Jan, 2 for feb and the MM for March" [#869](https://altillyfiles.com/chat#869). In summary, Altilly at the end of 2019 was a small exchange with thin volume. It was run informally by three people and depended on one developer. It had no audit and no cold storage. It earned money from listing fees and competitions, and it kept relaxing its own rules to win listings. The team was still on friendly terms, still joking, and still expected the exchange to grow. ### Running the exchange (2020, before the incident) The management chat for 2020 is thin. The group had been busy almost every day in mid-2019. In 2020 it went quiet for weeks or months at a time, with no messages between mid-May and 20 July or between 29 July and 15 November. The day-to-day running of Altilly probably happened elsewhere: in support tickets, in the wider "Hodler Headquarters" staff group, and in private messages. What this group does record are the decisions the three principals took to each other, and those show what the exchange was like in its last year before the incident. Some messages from this period are missing from the export. For example, Chuck replies on 25 February to a message #886 that is not there [#892](https://altillyfiles.com/chat#892). #### A small exchange with thin trading The year began with the schedule Chuck had set out on 29 December 2019: listing events in January and February, then a market-maker competition in March. Its prize table shared out a percentage of the prize pool plus a 100k XQR fund for all participants, and Nayiem approved it with "All good" [#862](https://altillyfiles.com/chat#862)–[#869](https://altillyfiles.com/chat#869). On 9 January 2020 Chuck asked whether team members in the Hodler Headquarters group should get fee-free trading, and proposed "much nicer" filled-in price charts as the default view [#872](https://altillyfiles.com/chat#872)–[#879](https://altillyfiles.com/chat#879). His reason for the charts was frank: "These charts remove the low trading look by filling it in." [#880](https://altillyfiles.com/chat#880). Nayiem agreed to both: "both yes, and yes." [#882](https://altillyfiles.com/chat#882). So the team knew trading was thin, and chose to change how it looked rather than what it was. Nothing in this stretch gives volume, revenue or user figures. What there is points the same way. Late in the year Chuck complained that referral sign-ups did nothing for the business: "All it does is inflate the total user number which in my mind is pointless if those users are not trading" [#984](https://altillyfiles.com/chat#984). #### Listings, reviews and the paid vote New assets were still coming in, partly through a community listing vote. On 26 July Chuck reported that "2 out of the 3 submitted for voting are ok. One is a no way" [#939](https://altillyfiles.com/chat#939)–[#940](https://altillyfiles.com/chat#940). Mike answered that they "Need to find two more" [#941](https://altillyfiles.com/chat#941). Chuck then offered to steer a developer with two coins into the vote at ".15 each coin" [#942](https://altillyfiles.com/chat#942)–[#944](https://altillyfiles.com/chat#944). Mike joked "Guaranteed discount if he does", as long as the developer could wait two weeks [#945](https://altillyfiles.com/chat#945)–[#947](https://altillyfiles.com/chat#947). Earlier, on 25 February, Chuck had warned that "All assets need to be properly reviewed especially any being pushed by" a referral promoter "or anyone on BTCT crews". He added that he had been "extrememly nervous" about that person being given admin access [#893](https://altillyfiles.com/chat#893). The messages do not say who gave that access or what it covered. Nayiem replied the next day: "Yea, now I understand." [#896](https://altillyfiles.com/chat#896). The same person came up again on 15 November. Chuck forwarded complaints from others, "Just letting you guys know how others are feeling about his sketchy stuff". They said the promoter kept pushing listings of tokens he had invested in and wanted a cut every time someone claimed from a faucet. "Its almost like he wants to use altilly as his personal income stream," one of them wrote [#968](https://altillyfiles.com/chat#968)–[#972](https://altillyfiles.com/chat#972). Nayiem said he did not know what to say and asked how Mike felt [#973](https://altillyfiles.com/chat#973), [#981](https://altillyfiles.com/chat#981). Mike settled it: "im not doing referral fees on faucets", "not doing any more airdrops either", and Chuck would review any assets the promoter suggested [#985](https://altillyfiles.com/chat#985)–[#989](https://altillyfiles.com/chat#989). Checks on listed projects stayed light, following the October 2019 decision to leave KYC until "Altilly becomes more mature" [#833](https://altillyfiles.com/chat#833)–[#834](https://altillyfiles.com/chat#834). Nothing in 2020 shows that changing. #### Fiat plans without a verification process In the spring, fiat and banking services came up for the first time. On 14 April Chuck wrote: "It sounds like FIAT is coming to Altilly. What route are we taking for verifying users?" [#910](https://altillyfiles.com/chat#910). Nayiem did not know. He would "have to ask Mike" and was "not sure if we are going to use the kyc features that the other guy made" [#911](https://altillyfiles.com/chat#911). On 13 May he said banking would be limited to assets that paid listing fees and were fully verified, because "If we list an asset that scams later, we will be fucked." [#916](https://altillyfiles.com/chat#916)–[#918](https://altillyfiles.com/chat#918). Chuck suggested starting with only the base pairs [#921](https://altillyfiles.com/chat#921). In July Chuck asked twice whether card-based address verification could be reviewed by a person before cards went out [#922](https://altillyfiles.com/chat#922)–[#923](https://altillyfiles.com/chat#923), [#949](https://altillyfiles.com/chat#949)–[#950](https://altillyfiles.com/chat#950). He warned that people "who may have intentions of money laundering will use a 'front' address", and wanted utility bills or mortgage papers as proof [#954](https://altillyfiles.com/chat#954)–[#955](https://altillyfiles.com/chat#955). Nayiem agreed that forms could be reviewed. He said they needed "either something automated or need to hire someone", and that he would come back to it "once we get to that part" [#951](https://altillyfiles.com/chat#951), [#956](https://altillyfiles.com/chat#956)–[#959](https://altillyfiles.com/chat#959). The chat does not show that happening before December. #### Security and custody The team knew other exchanges were being attacked. On 14 February Chuck passed on, in confidence, that another exchange, Crex, had been hacked [#884](https://altillyfiles.com/chat#884). On 28 July Nayiem suggested looking into BitGo's custody service for exchanges, and into Chainalysis "For Altilly and especially Qredit Motion" [#961](https://altillyfiles.com/chat#961)–[#965](https://altillyfiles.com/chat#965). Mike rejected BitGo: "we aren't even close to being at that level yet. Also, this is an American company. We need to be very cautious of working with any american companies for anything." [#966](https://altillyfiles.com/chat#966). Nayiem answered "Alright" [#967](https://altillyfiles.com/chat#967). This matches Mike's position from July 2019, when he said the exchange was "too small to even start moving to safe storage" [#216](https://altillyfiles.com/chat#216). It is also a point Nayiem returns to in his 2026 notes. The same month Mike mentioned that he had owned the domain of an exchange project he "almost launched" with others, and had let it go "Along with any domain I had on that account" [#931](https://altillyfiles.com/chat#931)–[#937](https://altillyfiles.com/chat#937). #### The team Operations still rested on three people. Chuck ran support, listings and compliance ideas while also taking outside jobs. Mike held the technical side and made the final calls, and often took hours to answer. Nayiem asked questions, approved plans and mostly deferred to Mike on technical and verification matters [#911](https://altillyfiles.com/chat#911), [#973](https://altillyfiles.com/chat#973). The chat stayed informal and often crude. On 25 February Mike posted a long, violent movie quote and marked it "😂 fun movie line" [#889](https://altillyfiles.com/chat#889)–[#891](https://altillyfiles.com/chat#891). Staffing was handled loosely. On 21 November Nayiem told the others: "I officially fired [a team member] today", and asked them to "Keep an eye on things". By that evening he had reversed it: "Seems he's not fired yet. We had a long talk yesterday. He's going to give his best." [#992](https://altillyfiles.com/chat#992)–[#995](https://altillyfiles.com/chat#995). #### December 2020: optimism, then the incident In the last weeks before the incident the mood was forward-looking. On 18 December Chuck brought Mike and Nayiem into a Discord discussion with an outside project that was interested in Altilly, and wondered whether "maybe Motion could handle this?" [#999](https://altillyfiles.com/chat#999)–[#1014](https://altillyfiles.com/chat#1014). The next day he predicted: "Once we are able to host IEOs i think altilly will explode provided we market that correctly", with "Many more options" once Motion was available [#1021](https://altillyfiles.com/chat#1021)–[#1022](https://altillyfiles.com/chat#1022). ### The incident (23–31 Dec 2020) #### An "outage" (23–24 December) The chat does not record the moment Altilly went down. On 23 December Chuck shared an SEC press release, and the next morning Mike dismissed it [#1027](https://altillyfiles.com/chat#1027), [#1029](https://altillyfiles.com/chat#1029). That was the last ordinary exchange in the chat. A few hours later Nayiem asked Mike for "more details about the hack that happened" and asked whether keeping each asset on its own server would have prevented it [#1031](https://altillyfiles.com/chat#1031), [#1032](https://altillyfiles.com/chat#1032). This is the first time the incident appears in the group. Chuck answered by forwarding two messages Mike had written at 22:11 the evening before. They said the attack may have come "from maybe an insecure recue port at the host level" and that "3 machines" with similar configurations were affected [#1033](https://altillyfiles.com/chat#1033), [#1034](https://altillyfiles.com/chat#1034). Six minutes later Nayiem said he had a "brilliant idea for Altilly" [#1035](https://altillyfiles.com/chat#1035). That evening Mike called the wave of exchange attacks "state sponsored for sure" [#1054](https://altillyfiles.com/chat#1054). Nayiem asked whether the loss was "really under 10k", and Mike replied "might be 15" [#1056](https://altillyfiles.com/chat#1056), [#1059](https://altillyfiles.com/chat#1059). The public message was agreed in the same few minutes. Mike wrote: "Just tell them that we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057). He described wiping the machines as a precaution taken because of a "suspicious outage" [#1065](https://altillyfiles.com/chat#1065). Chuck asked what they should say if users asked about missing assets, since the status page showed them. Mike said he would "fix that soon" [#1077](https://altillyfiles.com/chat#1077)–[#1079](https://altillyfiles.com/chat#1079). Chuck's draft post thanked users for their patience "the past 24 hours since the outage occurred" and said services were moving "to a more reliable source" [#1084](https://altillyfiles.com/chat#1084). By early 25 December most assets looked active again on the status page [#1093](https://altillyfiles.com/chat#1093)–[#1096](https://altillyfiles.com/chat#1096). #### The servers disappear (25 December) At 14:12 on 25 December Mike reported that someone had "hacked into their systems" and "deleted all the servers". He added: "if not then it's game over" [#1103](https://altillyfiles.com/chat#1103), [#1104](https://altillyfiles.com/chat#1104). The host was Cherry Servers [#1106](https://altillyfiles.com/chat#1106). The backups at Backblaze were gone as well [#1108](https://altillyfiles.com/chat#1108). Cherry's first explanation was that the servers had been "cancelled by the system due to non-payment". Mike answered: "there were no overdue invoices, so thats a lie" [#1110](https://altillyfiles.com/chat#1110), [#1111](https://altillyfiles.com/chat#1111). The team heard that Livecoin, hacked in the same week, used the same host [#1113](https://altillyfiles.com/chat#1113). Several of the weaknesses came from the team itself. Mike was "still in the process of moving stuff" to a new host, Hetzner, when the servers were deleted [#1119](https://altillyfiles.com/chat#1119), [#1121](https://altillyfiles.com/chat#1121). He thought a change he had made had locked the intruder out, "so i guess they got pissed off and just deleted everything" [#1132](https://altillyfiles.com/chat#1132). Later he admitted that the Backblaze API keys "should have" been upload-only [#1271](https://altillyfiles.com/chat#1271). At one point Nayiem sounded an alarm over more than $500k of XQR volume on CoinMarketCap. The figures turned out to be 572 hours old [#1154](https://altillyfiles.com/chat#1154), [#1159](https://altillyfiles.com/chat#1159). #### What to tell users Nayiem argued for disclosure: "it will backfire if we don't tell the truth" [#1163](https://altillyfiles.com/chat#1163). His draft said a new system user had appeared after reinstalls, meaning the system "was hacked above OS level" [#1167](https://altillyfiles.com/chat#1167). He also wanted to add that "hackers were unable to access funds" [#1180](https://altillyfiles.com/chat#1180). Chuck objected that nobody knew this and that users would expect to be paid. He warned that every word "will be copied repeated and anylized for years" [#1190](https://altillyfiles.com/chat#1190), [#1195](https://altillyfiles.com/chat#1195). Chuck also asked for a plan for handling users before anything was posted, and predicted "100 tickets an hour" [#1176](https://altillyfiles.com/chat#1176), [#1178](https://altillyfiles.com/chat#1178). The chat does not record any such plan being agreed. The notice, headed "26th of December 2020 – 01:25 CET", said Altilly had lost access to its servers, "including the domain, several wallets and the whole codebase", and that it was not yet known whether funds were lost [#1232](https://altillyfiles.com/chat#1232). It went live at about 17:23 [#1233](https://altillyfiles.com/chat#1233). The claim about the domain does not match the chat, because the team was pointing altilly.com's Cloudflare DNS at a new server at that same time [#1206](https://altillyfiles.com/chat#1206), [#1227](https://altillyfiles.com/chat#1227). Chuck then told HQ staff not to reply to anyone and removed their admin rights [#1243](https://altillyfiles.com/chat#1243), [#1263](https://altillyfiles.com/chat#1263). Nayiem asked the others, "Don't leave me here" [#1253](https://altillyfiles.com/chat#1253), and told Mike, "It's not your fault" [#1256](https://altillyfiles.com/chat#1256). Chuck wrote "so close" [#1262](https://altillyfiles.com/chat#1262). #### How it happened and what was lost (26–27 December) Overnight Mike reported that the attacker had got in "thru an old email still attached to the account" [#1289](https://altillyfiles.com/chat#1289). He wrote the address, paul@satotechlt.com [#1326](https://altillyfiles.com/chat#1326), and explained that it dated from the account's setup three years earlier and still had login access without 2FA [#1504](https://altillyfiles.com/chat#1504). Cherry said the deletion request came from that email over a Tor IP [#1508](https://altillyfiles.com/chat#1508). Mike had already identified the attacker's IP as a Tor exit node earlier that day [#1450](https://altillyfiles.com/chat#1450). Mike said that access to the portal would have let an attacker boot machines into rescue mode and add users [#1510](https://altillyfiles.com/chat#1510). He had more than 10 servers there, "maybe 15" [#1518](https://altillyfiles.com/chat#1518). Backblaze said that deleted data could not be recovered. Mike could have used "object lock" but had not known about it [#1498](https://altillyfiles.com/chat#1498), [#1501](https://altillyfiles.com/chat#1501). At 23:45 Cherry confirmed that all server data "was cleaned when they were deleted" [#1564](https://altillyfiles.com/chat#1564). The losses included: - **User records.** The private GitHub repository held "just the code". Without the database and config files nothing could run or be decrypted, and Mike found no backup of the config [#1351](https://altillyfiles.com/chat#1351)–[#1353](https://altillyfiles.com/chat#1353). - **Cold wallets.** The "safe" wallets sat on a VPS at Cherry, and their backups were gone [#1299](https://altillyfiles.com/chat#1299). - **Ownership records.** Mike's worst case was holding wallets on the new host "but we will have no idea what belongs to who" [#1308](https://altillyfiles.com/chat#1308). - **Bitcoin.** Mike estimated the loss at "around 31 bitcoins, the rest i have no idea" [#1600](https://altillyfiles.com/chat#1600). He had not written down where the BTC had been sent during the migration [#1516](https://altillyfiles.com/chat#1516). Chuck said: "Sounds like were fucked all the way around" [#1312](https://altillyfiles.com/chat#1312). Mike shared goodwallets.txt, a list of wallets on the new host that were believed to be safe [#1370](https://altillyfiles.com/chat#1370). Chuck put the public group into slow mode [#1364](https://altillyfiles.com/chat#1364), [#1366](https://altillyfiles.com/chat#1366). Nayiem, who said he "never had access to those servers. Mike didn't allow me, because I break things" [#1492](https://altillyfiles.com/chat#1492), [#1493](https://altillyfiles.com/chat#1493), helped turn the list into about 87 surviving assets [#1408](https://altillyfiles.com/chat#1408)–[#1420](https://altillyfiles.com/chat#1420), [#1452](https://altillyfiles.com/chat#1452)–[#1458](https://altillyfiles.com/chat#1458). The strain showed. Mike said "you spend 3 years trying to build somethign and somebody comes along and it's gone in a day" [#1341](https://altillyfiles.com/chat#1341) and talked about retiring from crypto. Nayiem answered "Not yet" [#1332](https://altillyfiles.com/chat#1332), [#1335](https://altillyfiles.com/chat#1335). Nayiem also wrote "All your fault Mike" [#1379](https://altillyfiles.com/chat#1379) and later "Thank you for ruining my Saturday" [#1468](https://altillyfiles.com/chat#1468), both in the joking tone of the chat. Chuck posted an "Exit Scam?" forum thread [#1320](https://altillyfiles.com/chat#1320) and a support ticket that read "i know where you live" [#1563](https://altillyfiles.com/chat#1563). Nayiem said he was starting a "plan B" to protect his family and his other businesses [#1525](https://altillyfiles.com/chat#1525), [#1527](https://altillyfiles.com/chat#1527). He also said he feared someone could "book an igloo. Sleep one night and then kill me" [#1584](https://altillyfiles.com/chat#1584). He asked Mike to keep Cherry's final answer private "until I have my stuff ready" [#1566](https://altillyfiles.com/chat#1566). #### Deciding to repay (27–29 December) On 27 December Nayiem asked the other two to commit to months of work: "1 million usd can be done. It's not impossible" [#1626](https://altillyfiles.com/chat#1626). Chuck agreed but said he needed to be able to pay his bills [#1627](https://altillyfiles.com/chat#1627). Mike said he was in "if you got an idea thats gonna make a million bucks quickly" and added "i have nowhere to go and nothing else to do" [#1630](https://altillyfiles.com/chat#1630), [#1632](https://altillyfiles.com/chat#1632). Chuck admitted he was "not sure where to money gonna come from" [#1657](https://altillyfiles.com/chat#1657). Mike also said "we weren't really holding alot, compared to other places" [#1621](https://altillyfiles.com/chat#1621). The one withdraw wallet whose address he could remember still held about $13,239 in USDT [#1624](https://altillyfiles.com/chat#1624). XQR was "All lost" [#1731](https://altillyfiles.com/chat#1731)–[#1733](https://altillyfiles.com/chat#1733). Mike shared a spreadsheet of the balances that were saved [#1719](https://altillyfiles.com/chat#1719). Nayiem said nothing should be sent to users until returns could be documented [#1725](https://altillyfiles.com/chat#1725). The next day Mike said he was going to send the XNC developer his coins [#1814](https://altillyfiles.com/chat#1814). Nayiem published a status page at altilly.com/assets.html [#1825](https://altillyfiles.com/chat#1825). The claims process was designed quickly: - **Evidence.** Mike proposed collecting contact details and the balances users believed they had held [#1972](https://altillyfiles.com/chat#1972). Chuck suggested limiting claims to deposits made up to 60 days before the breach [#1643](https://altillyfiles.com/chat#1643). - **Minimum claim.** Nayiem wanted a $25 minimum so "airdrop users" could not claim [#1964](https://altillyfiles.com/chat#1964), [#1966](https://altillyfiles.com/chat#1966). - **The form.** A Google Form went live on 28 December [#2029](https://altillyfiles.com/chat#2029). The Portuguese notice gave the deadline year as 2020 instead of 2021 [#2032](https://altillyfiles.com/chat#2032). The form required a Google login to limit spam [#2068](https://altillyfiles.com/chat#2068). - **Security.** Chuck criticised Nayiem for publicly asking users to send zip files [#2075](https://altillyfiles.com/chat#2075). Chuck was also guarded with the public. He advised Nayiem against publicly promising repayment, saying the plan was best kept "close to chest" [#1911](https://altillyfiles.com/chat#1911)–[#1917](https://altillyfiles.com/chat#1917). When users asked where the refund money would come from, he answered "Why does it matter as long as users are refunded" [#1923](https://altillyfiles.com/chat#1923). He warned that "If we tell them too much they will find a way to scam us" [#1985](https://altillyfiles.com/chat#1985). Nayiem relayed a user's demand that the hot wallet and the location of "the stolen 30 BTC" be made public [#2112](https://altillyfiles.com/chat#2112). Chuck said the BTC had been held in "safe storage", with only about 0.3 BTC in the withdrawal wallet at a time [#2118](https://altillyfiles.com/chat#2118), [#2119](https://altillyfiles.com/chat#2119). Mike advised telling users only that the matter was being investigated [#2124](https://altillyfiles.com/chat#2124). Nayiem said it felt "like someone died 2 days ago" [#1899](https://altillyfiles.com/chat#1899). He recounted a history of repeated debt, which in his own account included a period of "work on darknet", and ended by saying he was now "1mln usd in debt" [#1882](https://altillyfiles.com/chat#1882). Mike said that at most the structure of the users table had been copied into Qredit Motion, with no data [#1895](https://altillyfiles.com/chat#1895). #### The last days of the year (30–31 December) Chuck proposed asking claimants to forward their original deposit emails so faked screenshots could be ruled out [#2146](https://altillyfiles.com/chat#2146). Developers began taking back saved coins so they could pay their own holders. The Beyondcoin team, for example, said it could handle its distribution [#2149](https://altillyfiles.com/chat#2149). Developers were told to allow "at least a week" [#2218](https://altillyfiles.com/chat#2218). A claimant threatened to report Altilly to "all possible authorities in Sweden". Nayiem replied "What an idiot", said the claimant could go to the Swedish embassy, and noted that Altilly was "not incorporated in Sweden" [#2156](https://altillyfiles.com/chat#2156), [#2158](https://altillyfiles.com/chat#2158), [#2164](https://altillyfiles.com/chat#2164). Nayiem also admitted "We didn't have an active list of assets we held on Altilly. I took the most recent list from coingecko" [#2210](https://altillyfiles.com/chat#2210). He noted that "Lawyers are all on holiday" [#2183](https://altillyfiles.com/chat#2183). He asked whether to remove Altilly from Trello because "Its painful to watch" [#2243](https://altillyfiles.com/chat#2243), [#2247](https://altillyfiles.com/chat#2247). On 31 December Mike found 15,132 contact records in the support system, which was the nearest thing left to a user list [#2281](https://altillyfiles.com/chat#2281). Chuck suggested checking large claims against old support tickets, saying it "could end up saving alot of $" [#2284](https://altillyfiles.com/chat#2284), [#2286](https://altillyfiles.com/chat#2286). ### Aftermath and claims (Jan-Mar 2021) #### A refund process with no database By the start of January 2021 Altilly had stopped trading and the team's only job was paying people back. Claims came in through a Google Form and by email to a repay@ address. The records behind the process were thin: there was no list of the assets held [#2210](https://altillyfiles.com/chat#2210), and the best user list was the 15,132 support-desk contacts [#2281](https://altillyfiles.com/chat#2281). Claimants' document emails were being bounced by the spam filter [#2335](https://altillyfiles.com/chat#2335). On 3 January Nayiem changed the refund window. Saved coins would start being repaid in seven days [#2439](https://altillyfiles.com/chat#2439), and the final claim date was set for 9 January [#2443](https://altillyfiles.com/chat#2443). He also planned an ERC-20 "voucher" token for claims that could not be paid [#2442](https://altillyfiles.com/chat#2442). Chuck thought changing the date was "a mistake" and warned that "People will see this as a desperation act" [#2444](https://altillyfiles.com/chat#2444), [#2445](https://altillyfiles.com/chat#2445). He was also managing how things looked. He told users the process "may take months" because there were 80,000 users [#2451](https://altillyfiles.com/chat#2451). When Nayiem posted an image showing only about 1,800 form submissions, Chuck deleted it [#2453](https://altillyfiles.com/chat#2453), [#2457](https://altillyfiles.com/chat#2457), [#2460](https://altillyfiles.com/chat#2460). That same morning the pressure became personal. Nayiem received anonymous messages with a photo of his property. He then reported that someone had been inside a building there: "fridge is empty... i can see footsteps in the snow" [#2366](https://altillyfiles.com/chat#2366), [#2372](https://altillyfiles.com/chat#2372). Chuck's advice included weapons [#2402](https://altillyfiles.com/chat#2402). A few facts from the first week showed how weak the setup had been. Mike admitted that of the seven countries on the sanctions list in the policy, "the only one i was actively blocking at cloudflare was iran" [#2515](https://altillyfiles.com/chat#2515). He also raised a hope that the master database had sat on a separate PCIe SSD that "was not wiped" [#2491](https://altillyfiles.com/chat#2491), [#2500](https://altillyfiles.com/chat#2500). The chat never records an answer from the host. On 4 January Nayiem reset the root password on one of the servers. He told Mike it was not because he did not trust him, but because a transaction had not arrived [#2569](https://altillyfiles.com/chat#2569). Mike was already saying that any future exchange would have to be "a completely walletless system" [#2612](https://altillyfiles.com/chat#2612). #### Buying back the database On 6 January a user in the public group called the team "sloppy and amateur" for running servers without backups, and claimed, without evidence, to know who was selling the stolen bitcoin. Chuck removed the user and deleted the messages [#2679](https://altillyfiles.com/chat#2679), [#2680](https://altillyfiles.com/chat#2680), [#2683](https://altillyfiles.com/chat#2683). The next day a new member mentioned Cherry Servers by name, even though the host had never been made public. Nayiem asked, "Who knew about cherry?" [#2715](https://altillyfiles.com/chat#2715). The contact said a friend of his ran an offshore host that held a mirror of Altilly's data [#2746](https://altillyfiles.com/chat#2746). Mike was keen: "i'll pay 10k for the db dump if it matches" and "i dont care if it's destroyed or not, i just wnat a copy" [#2749](https://altillyfiles.com/chat#2749), [#2755](https://altillyfiles.com/chat#2755). On 8 January Nayiem negotiated with the host operator [#2790](https://altillyfiles.com/chat#2790). He offered $5,000 for the database. The seller showed a 13 GB archive, Altilly.7z, and offered 72 hours of SSH access [#2793](https://altillyfiles.com/chat#2793), [#2800](https://altillyfiles.com/chat#2800). A file listing showed a large altilly.sql [#2882](https://altillyfiles.com/chat#2882), [#2883](https://altillyfiles.com/chat#2883). The team also accepted that the dump could not undo the theft: "btc is already gone, transferred" [#2858](https://altillyfiles.com/chat#2858). Nayiem was open about the strain ("Dealing with these type of people every day is killing me.. mentally" [#2845](https://altillyfiles.com/chat#2845)). He also said he would only consider relaunching "If we have a license + insurance" [#2873](https://altillyfiles.com/chat#2873). Mike sent 0.02457 BTC as a first payment, calling it "a gamble" [#2925](https://altillyfiles.com/chat#2925), [#2933](https://altillyfiles.com/chat#2933). Chuck said, "This feels real and he feels cooperative" [#2939](https://altillyfiles.com/chat#2939). While they waited, the team discussed what to tell the public. Nayiem said, "we can't say that we just bought it from someone" [#2968](https://altillyfiles.com/chat#2968). Mike suggested saying only that they had "recovered an sql dump from the 23rd" [#2972](https://altillyfiles.com/chat#2972). Within hours both of the seller's accounts had been deleted: "Both accounts gone" [#3037](https://altillyfiles.com/chat#3037). Nayiem wrote, "we get kicked again while we are already on our knees" [#3047](https://altillyfiles.com/chat#3047). Mike then saw what he had missed. The file name, format and timestamp did not match his own dumps, and "this story was a little flaky tbh" [#3051](https://altillyfiles.com/chat#3051), [#3053](https://altillyfiles.com/chat#3053). Nayiem said he was getting two or three such offers a day [#3075](https://altillyfiles.com/chat#3075). On 11 January he concluded that no money would come from the hosting provider [#3092](https://altillyfiles.com/chat#3092). #### Developers, disputes and an unverified process For the rest of January, refunds went through project developers or were paid coin by coin. Some of these handovers went wrong. The Goldcoin developer confirmed he had received the coins [#3244](https://altillyfiles.com/chat#3244). Chuck then found that he had "deleted all our chat history", and he had left the Altilly group [#3248](https://altillyfiles.com/chat#3248), [#3255](https://altillyfiles.com/chat#3255). Beyondcoin's refund channel disappeared as well [#3213](https://altillyfiles.com/chat#3213). Nayiem said he had doubts "after that beyondcoin thing. And after goldcoin wanted to put everything in their own dev fund" [#3305](https://altillyfiles.com/chat#3305). Chuck's verdict was: "Some of these devs talk a good talk but are devious as hell" [#3310](https://altillyfiles.com/chat#3310). On 18 January Mike said he would "pull out my 2.8m pyrk from the wallet and leave the remaining user funds" [#3175](https://altillyfiles.com/chat#3175). So Mike himself held a large PYRK balance on the exchange, in the same wallet as users' PYRK. Chuck repeatedly complained about how the work was coordinated: "It hard for me to help when i have limited info" [#3298](https://altillyfiles.com/chat#3298). On 27 January he wrote, "It appears we have temporarily lost Nayiem" [#3355](https://altillyfiles.com/chat#3355). The next day Nayiem launched a spreadsheet-backed status page, and Chuck planned to release updates slowly: "the key here is to continually show progress. I will stretch it out some" [#3412](https://altillyfiles.com/chat#3412). That same morning Chuck mentioned that he was in serious financial difficulty [#3430](https://altillyfiles.com/chat#3430). He called the process so far "a clusterfuck" [#3508](https://altillyfiles.com/chat#3508). The same day Nayiem explained how claims were checked. "anything between 50-200 usd I don't check at all," he said, because "We will be here for another 10 years if we start checking all txid's" [#3564](https://altillyfiles.com/chat#3564), [#3566](https://altillyfiles.com/chat#3566). His only control was whether the total claimed for each coin matched what was left in that coin's wallet [#3558](https://altillyfiles.com/chat#3558), [#3570](https://altillyfiles.com/chat#3570). Payouts were not recorded in a ledger ("I just mark the addresses with the users") [#3575](https://altillyfiles.com/chat#3575). Chuck pointed to Livecoin, which was documenting its payouts to protect itself against lawsuits [#3576](https://altillyfiles.com/chat#3576). #### February: cards, country screening and exceptions In early February Nayiem gave Chuck and Mike cards on his Revolut Business account [#3638](https://altillyfiles.com/chat#3638), [#3644](https://altillyfiles.com/chat#3644), [#3723](https://altillyfiles.com/chat#3723). He also told Chuck not to use the balance "for BS", because the account was one he used for his own bills [#3732](https://altillyfiles.com/chat#3732). Two days later Nayiem posted a photo of a DHL envelope from Revolut, delivered to his address, with the comment "That was really quick." It was addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). Mike had ordered his card by then, to be sent to Nayiem's address because Revolut did not ship to his country, while Chuck had not yet ordered his and still had no card on 11 February [#3638](https://altillyfiles.com/chat#3638)–[#3693](https://altillyfiles.com/chat#3693), [#3712](https://altillyfiles.com/chat#3712), [#3836](https://altillyfiles.com/chat#3836). On 19 February Mike wrote "i got my revolut card today" [#3960](https://altillyfiles.com/chat#3960). Read together, these messages show that the envelope held the card Mike ordered. Nobody in the group commented on the name at the time. The rules were applied unevenly. On 15 February Nayiem warned Chuck that instantly deleting messages about a class action "might trigger some other suspicious things." Chuck replied that "99% of users are content right now but if they see opportunity to jump on a class action they will" [#3929](https://altillyfiles.com/chat#3929), [#3932](https://altillyfiles.com/chat#3932). On 19 February they agreed that team members did not need to send deposit emails ("i think we can trust the team") [#3953](https://altillyfiles.com/chat#3953), [#3956](https://altillyfiles.com/chat#3956). Ordinary claimants still had to provide them. Chuck reported that PYRK had 15 refunds declined "due to sanctioned countries" [#4005](https://altillyfiles.com/chat#4005). Nayiem then told Chuck that for "a really pushy person," he should "Do the refund, but not by email and remove all traces" [#4029](https://altillyfiles.com/chat#4029). The countries in question were on the banking partner's 139-country high-risk list, not a sanctions list, though Chuck had the "sense this list covers all sanctions of any type" [#4023](https://altillyfiles.com/chat#4023), [#4027](https://altillyfiles.com/chat#4027), [#4028](https://altillyfiles.com/chat#4028). Nayiem described one case of this kind involving a long-time supporter, who, by the author's account, was paid [#4032](https://altillyfiles.com/chat#4032), [#4033](https://altillyfiles.com/chat#4033). The same day he said "The majority of our users is from Nigeria" [#4036](https://altillyfiles.com/chat#4036), and he confirmed that the BTC and ETH wallets were gone [#4094](https://altillyfiles.com/chat#4094). His attention was already moving to Qredit Motion. He laid out a roadmap before its subscription marketing began [#4136](https://altillyfiles.com/chat#4136), and a Qredit swapper went live on 21 February [#4236](https://altillyfiles.com/chat#4236). #### March: holdouts and the host's denial For the MOON refunds, Nayiem ruled that "bold claims with no tx id or screenshots is just a no go" [#4310](https://altillyfiles.com/chat#4310). Then two claimants who were threatening a class action turned out to have no deposit emails. Chuck noted that paying them "may avoid the suit" but would show the rule was not enforced [#4326](https://altillyfiles.com/chat#4326). He suggested telling one of them that Mike was "vouching for his account personally" [#4339](https://altillyfiles.com/chat#4339). Nayiem held off on those refunds for the moment [#4324](https://altillyfiles.com/chat#4324), [#4325](https://altillyfiles.com/chat#4325), [#4328](https://altillyfiles.com/chat#4328). On 9 March Cherry Servers sent a formal notice denying liability [#4349](https://altillyfiles.com/chat#4349). Nayiem said it contradicted an earlier email in which the host had taken the blame [#4350](https://altillyfiles.com/chat#4350), [#4355](https://altillyfiles.com/chat#4355). Mike approved publishing both [#4356](https://altillyfiles.com/chat#4356). Later in the month Nayiem posted his own full card details in the chat so the helpdesk and email bills could be paid [#4417](https://altillyfiles.com/chat#4417). He also admitted he had once uploaded purchased email leads to Mailchimp as "altilly users" [#4440](https://altillyfiles.com/chat#4440), [#4443](https://altillyfiles.com/chat#4443). Morale fell. When Nayiem said everyone was working hard, Chuck asked, "Who is everyone?" [#4405](https://altillyfiles.com/chat#4405), [#4406](https://altillyfiles.com/chat#4406). Mike wrote that programming "used to" be something he loved, "but ever since that hack it's been like a chore" [#4476](https://altillyfiles.com/chat#4476). Nayiem answered: "But first Altilly refunds. Once that is done, you are a free man... Until then, you need to help me make us rich" [#4481](https://altillyfiles.com/chat#4481), [#4482](https://altillyfiles.com/chat#4482). ### Refunds, Altfenix and new plans (Apr–Jun 2021) #### The refund weekend In early April the team finally started sending out the "saved" assets, the coins whose wallets had survived the hack. The job was split two ways. Chuck kept a Google Sheet with one tab per coin, holding the amount and the address. Mike sent the coins and put each transaction ID in the sheet, and Chuck then emailed each user [#4592](https://altillyfiles.com/chat#4592)–[#4607](https://altillyfiles.com/chat#4607). The first coin, 42coin, went out on the evening of 1 April [#4610](https://altillyfiles.com/chat#4610)–[#4613](https://altillyfiles.com/chat#4613). Mike worked through the night, reporting "done" coin by coin. Several wallets had to be upgraded or resynced first, one server could not be reached for hours, and the CryptoNote coins needed custom scripts [#4608](https://altillyfiles.com/chat#4608), [#4621](https://altillyfiles.com/chat#4621), [#4628](https://altillyfiles.com/chat#4628), [#4699](https://altillyfiles.com/chat#4699). By the evening of 2 April about fifty coins had been paid [#4613](https://altillyfiles.com/chat#4613)–[#4808](https://altillyfiles.com/chat#4808). Nayiem mostly set priorities: saved assets came first, and "rest of the shit storm will come later" [#4583](https://altillyfiles.com/chat#4583). He added that the leftovers "probably can't even buy a full tank of gasoline" [#4743](https://altillyfiles.com/chat#4743). The claim checks were weak, and the team knew it. Claims were accepted on deposit-confirmation emails alone. Chuck noted: "Thats the downside to only accepting deposit emails" [#4665](https://altillyfiles.com/chat#4665). Some wallets could not cover their claims, such as Bettler and Dimecoin [#4643](https://altillyfiles.com/chat#4643), [#4693](https://altillyfiles.com/chat#4693). Some claims asked for more than the user had put on the original form. Mike ruled that "we can't just give them credit for every deposit email if they only said they had 90k in their claim" [#4828](https://altillyfiles.com/chat#4828). One Mooncoin claimant was paid 1.5 billion MOON on Mike's word alone. Chuck: "if you are vouching for him we can do that" [#4778](https://altillyfiles.com/chat#4778), [#4781](https://altillyfiles.com/chat#4781), [#4800](https://altillyfiles.com/chat#4800). Mike also noted about PYRK that "I don't remember anybody other than me having that much on the exchange" [#4807](https://altillyfiles.com/chat#4807). By the end of 3 April, 28 assets were still open, and Mike put this down to sync problems and CryptoNote coins [#4874](https://altillyfiles.com/chat#4874), [#4875](https://altillyfiles.com/chat#4875). Chuck mentioned in passing that two users were recruiting for a class action [#4853](https://altillyfiles.com/chat#4853). In April Chuck went back to work [#4831](https://altillyfiles.com/chat#4831), and on 20 April, when he had to step back for personal reasons, Nayiem told him "We will handle it" [#4916](https://altillyfiles.com/chat#4916), [#4922](https://altillyfiles.com/chat#4922)–[#4924](https://altillyfiles.com/chat#4924). TUSC, whose wallet keys Mike still had, was still not distributed by then [#4876](https://altillyfiles.com/chat#4876)–[#4880](https://altillyfiles.com/chat#4880), [#4905](https://altillyfiles.com/chat#4905), [#4906](https://altillyfiles.com/chat#4906). On 1 May Chuck said closing the developers' group could be discussed now that most saved assets were refunded. He had first worried it "would appear to devs we were trying to simply disappear" [#4966](https://altillyfiles.com/chat#4966). He asked for an overall update on Motion and on the non-saved plan, and Nayiem promised one for the next day [#4971](https://altillyfiles.com/chat#4971)–[#4974](https://altillyfiles.com/chat#4974). The chat does not show that update. #### "Drag it out" In mid-May Nayiem complained that users were only now finding out they had funds on the exchange. Without the database they could not be emailed, and he predicted "this is going to take a few years" [#5011](https://altillyfiles.com/chat#5011)–[#5012](https://altillyfiles.com/chat#5012). Chuck replied: "I can drag it out forever if you want. Im pretty good with word play" and "Hang the carrot out front and they will follow". Nayiem answered "Go for it" [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020). The next day he set out a refund-token plan to be bought back on the new exchange [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched. The idea came back later. On 25 May Chuck set out a three-phase refund schedule, with a second round on 1 June and a final round on 1 January 2022. The purpose was partly to spare Mike and partly "to drag it out buying us time" [#5955](https://altillyfiles.com/chat#5955)–[#5962](https://altillyfiles.com/chat#5962). On 30 May Nayiem wanted to put refunds on "holiday mode" for two weeks so the team could work on Qredit Motion. Chuck advised against telling users about any pause [#6035](https://altillyfiles.com/chat#6035)–[#6037](https://altillyfiles.com/chat#6037). #### Altfenix On 16 May Nayiem floated a new idea in the developers' group, which Chuck copied into this chat. An Estonian crypto licence that was being pursued for Qredit Motion would also allow an exchange. How would people feel about a new one, built "with all the legal licenses and insurances" [#5023](https://altillyfiles.com/chat#5023)? Chuck objected: "If you promote this to users of altilly, it is doomed". He said unrefunded users would try to destroy it [#5044](https://altillyfiles.com/chat#5044)–[#5052](https://altillyfiles.com/chat#5052). Nayiem answered: "If I get 10% approval from users, that's more than enough" [#5059](https://altillyfiles.com/chat#5059). Within hours he had divided the roles. Mike would do the technical side. Nayiem would take "the business part and the emotional stress". Chuck would be the spokesperson who would "take all the bullets from users" [#5091](https://altillyfiles.com/chat#5091). Most of the design work came from Mike. There would be no wallet daemons, and coins would be listed only if they could be reached through an API, which he said would save "like 90%" [#5083](https://altillyfiles.com/chat#5083)–[#5090](https://altillyfiles.com/chat#5090). A separate "oracle" at a hidden location would hold the keys and check each withdrawal [#5158](https://altillyfiles.com/chat#5158)–[#5169](https://altillyfiles.com/chat#5169). Nayiem wanted deposits swept to cold wallets and withdrawals approved by hand a few times a day [#5180](https://altillyfiles.com/chat#5180), [#5340](https://altillyfiles.com/chat#5340)–[#5344](https://altillyfiles.com/chat#5344), [#5669](https://altillyfiles.com/chat#5669). He described the scale of the shortfall by saying "we can not mine for 200k usd in a short period of time" [#5184](https://altillyfiles.com/chat#5184). He also proposed an "Altilly refund token" that users with unsaved assets could sell at a discount or hold until the team bought it back [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203). On 17 May Nayiem registered Altfenix.com: "Alt= Altilly / Fenix= some bird that rises from ashes" [#5235](https://altillyfiles.com/chat#5235)–[#5236](https://altillyfiles.com/chat#5236). He gave the licence as 12,000 euro capital plus a 9,900 euro fee, then described it as "so basically 12.000 euro, from which 2100 euro will be returned", which treats the fee as part of the 12,000 euro rather than on top of it [#5239](https://altillyfiles.com/chat#5239)–[#5240](https://altillyfiles.com/chat#5240). Logos, a trademark filing and a demo page followed [#5252](https://altillyfiles.com/chat#5252)–[#5254](https://altillyfiles.com/chat#5254), [#5771](https://altillyfiles.com/chat#5771). Mike warned that "This will take many months to build first version" [#5276](https://altillyfiles.com/chat#5276), and that only the V2 source code survived, with "No database" [#5308](https://altillyfiles.com/chat#5308)–[#5310](https://altillyfiles.com/chat#5310). He also drafted a fee schedule: 50% for operations, 25% for a "Rainy Day Fund" that would also pay claims from the hack, 10% for referrals and 15% for developer pools [#5535](https://altillyfiles.com/chat#5535). Nayiem defended the 50% operations share "in case we get hacked another time" [#5883](https://altillyfiles.com/chat#5883). Nayiem said: "Originally, Altilly wasnt really that bad" [#5266](https://altillyfiles.com/chat#5266). He also admitted: "I can't pull this twice. Next time will be one way ticket to Russia or China" [#5354](https://altillyfiles.com/chat#5354). Mike mentioned in passing that an attacker had once tried an SQL injection, and that "the guy already had root access at that point" [#5821](https://altillyfiles.com/chat#5821)–[#5827](https://altillyfiles.com/chat#5827). Nayiem soon wanted more than an exchange. He wanted one platform with KYC, fiat, cards and insurance, because a plain exchange would mean "starting from the bottom again, working for pennies" [#5558](https://altillyfiles.com/chat#5558). Money was very short. When Mike said the help desk wanted to charge the card, Nayiem said "I have zero cash, I'm sure they can wait a few days" [#5600](https://altillyfiles.com/chat#5600)–[#5602](https://altillyfiles.com/chat#5602). Freshdesk was disabled by 29 May [#6029](https://altillyfiles.com/chat#6029). #### Tone toward users On 19 May Nayiem dismissed the critics: "binance has over 18mln users. We had over 80k users. Those negative users will be forgotten one day" [#5857](https://altillyfiles.com/chat#5857). On 10 June he said: "I like it when Altilly users are saying that they are going to sue me. Like it will give them their money back instantly" [#6386](https://altillyfiles.com/chat#6386)–[#6387](https://altillyfiles.com/chat#6387). On 9 June he put off an outside request with "Tell him that I will reply to him after dealing with my burnout" [#6325](https://altillyfiles.com/chat#6325). Chuck, meanwhile, asked Mike not to hand about 100m COLX to a developer who "wants all of it for his team" [#5912](https://altillyfiles.com/chat#5912)–[#5916](https://altillyfiles.com/chat#5916). He also warned that "natives are getting restless" over the HONK refunds, which were stuck because a BCH wallet had not worked [#6433](https://altillyfiles.com/chat#6433)–[#6436](https://altillyfiles.com/chat#6436). On 15 June Chuck forwarded a post from Nayiem's account mocking investors for backing "a depressed CEO with lousy updates and a big ego and big dreams. Missing deadlines like nothing", and asked "Do we have an imposter?" Nayiem replied "nope :P" [#6471](https://altillyfiles.com/chat#6471)–[#6473](https://altillyfiles.com/chat#6473). #### Satoexchange and the old code On 11 June Nayiem announced a "really close partnership" with Satoexchange, which he said did about $250k a day in volume [#6398](https://altillyfiles.com/chat#6398)–[#6402](https://altillyfiles.com/chat#6402). He wanted Sato's frontend changed to look like Altilly so Altilly users would move over. He also worried: "I'm definitely fucked if they go out of business under my name" [#6415](https://altillyfiles.com/chat#6415)–[#6416](https://altillyfiles.com/chat#6416). On 16 June he found old code and got into a v1 staging server from around September 2019. He called it "reverse engineering Mike's stuff" and added "Im glad Mike never gave me access to the database" [#6534](https://altillyfiles.com/chat#6534), [#6557](https://altillyfiles.com/chat#6557). None of it was real Altilly data: "I will never get back old user data" [#6536](https://altillyfiles.com/chat#6536). A prestaging copy showed "7 assets, 3 users and 15 markets" [#6594](https://altillyfiles.com/chat#6594). Chuck asked what it would do for them unless they reopened Altilly. Nayiem's answer was "reopen altilly… but make it Altfenix", and he ended with "Not everything is lost" [#6608](https://altillyfiles.com/chat#6608)–[#6610](https://altillyfiles.com/chat#6610), [#6629](https://altillyfiles.com/chat#6629). #### Late June: IOU tokens and cost cuts On 17 June Mike described the plan for unpaid claims. They would be issued as tokens and traded in markets such as QBTC→BTC, so that "if somebody is willing to settle for 50%", those bids would be paid first [#6657](https://altillyfiles.com/chat#6657). When Mike suggested redirecting the altilly domain, Chuck objected that this would remove the hack notice, and the idea was dropped [#6661](https://altillyfiles.com/chat#6661)–[#6666](https://altillyfiles.com/chat#6666). He also warned that the new exchange should not look like "just a way to get assets back". Nayiem replied: "Let me deal with the business side" [#6667](https://altillyfiles.com/chat#6667)–[#6668](https://altillyfiles.com/chat#6668). The team began cancelling bare-metal servers, each costing about $100 a month or more [#6672](https://altillyfiles.com/chat#6672), [#6681](https://altillyfiles.com/chat#6681), [#6697](https://altillyfiles.com/chat#6697). Nayiem got the SLP wallet working and gave all its private keys to a HONK project contact, who would pay seven claimants. Chuck questioned the move [#6731](https://altillyfiles.com/chat#6731), [#6739](https://altillyfiles.com/chat#6739), [#6745](https://altillyfiles.com/chat#6745). Only 5.25 billion HONK had been recovered, and "The rest was lost" [#6750](https://altillyfiles.com/chat#6750). Chuck wrote: "I look forward to a time when i can be happy again" [#6759](https://altillyfiles.com/chat#6759). The ticket system stayed offline because Nayiem did not "have the money yet to fix it" [#6770](https://altillyfiles.com/chat#6770). On 26 June Nayiem moved to token refunds for both saved and unsaved assets. Chuck said: "I purposely strung it out to buy you extra time" [#6806](https://altillyfiles.com/chat#6806)–[#6811](https://altillyfiles.com/chat#6811). For valuing lost assets, Nayiem pointed him to CoinGecko's historical prices and told him to use the price that was "the most beneficial for us. So the lowest one" [#6838](https://altillyfiles.com/chat#6838)–[#6842](https://altillyfiles.com/chat#6842). Nayiem says altcoin prices were spiking around the hack, and they did not want a one-day spike to set the value. The Altfenix pages went up on qredit.io on 30 June [#6864](https://altillyfiles.com/chat#6864). ### Winding down (Jul–Oct 2021) #### Refunds that kept slipping By the summer of 2021 Altilly had not traded for more than six months. What was left of it was a refund operation, and it was running behind its own promises. On 1 July Chuck reminded Mike and Nayiem that July had been "earmarked for the 2nd round of refunds for saved assets." He had been giving users that date "for several months." He added that "we still have assets that have not been paid first round" [#6872](https://altillyfiles.com/chat#6872), [#6876](https://altillyfiles.com/chat#6876). Nayiem told him to say "there are some delays, we will get back to them asap" [#6878](https://altillyfiles.com/chat#6878). On 12 July Chuck asked again. Nayiem said nothing would move "until we have qslp running properly with an interface," which he put at "about 2 weeks or something" [#7052](https://altillyfiles.com/chat#7052), [#7053](https://altillyfiles.com/chat#7053). On 29 July Chuck asked for a round of saved and partially saved refunds and said the final round would be at the end of the year [#7139](https://altillyfiles.com/chat#7139), [#7141](https://altillyfiles.com/chat#7141). Nayiem asked for "a few more days" [#7143](https://altillyfiles.com/chat#7143). On 9 August Chuck said approved users still had not received their saved assets and asked for "a couple days break from other work" to send them [#7180](https://altillyfiles.com/chat#7180). Nayiem said he "will put my focus on it really soon." He signed off at almost 7 a.m. his time, still without sleep [#7181](https://altillyfiles.com/chat#7181), [#7183](https://altillyfiles.com/chat#7183). On 19 August Chuck repeated that some users had not yet been sent their first round [#7344](https://altillyfiles.com/chat#7344). On 25 August Nayiem shared a Discord message from a user who had been approved in April and still had nothing. Chuck replied that the claim "is approved and ready to send" [#7377](https://altillyfiles.com/chat#7377), [#7379](https://altillyfiles.com/chat#7379). The team kept talking about new listings even with the platform offline. On 3 July Chuck suggested offering free market-maker accounts to developers hurt by the hack, because giving them one "helps get markets moving" [#6886](https://altillyfiles.com/chat#6886), [#6887](https://altillyfiles.com/chat#6887). On 5 July Nayiem told Chuck to say that the plan was "4-6 assets per month at this stage." He added that he was "a bit tired of folks that want to be on the first row but want to wait until we have the exchange running" [#6899](https://altillyfiles.com/chat#6899), [#6900](https://altillyfiles.com/chat#6900). The next day he raised the corporate tax the team would eventually owe on trading-fee income [#6906](https://altillyfiles.com/chat#6906). #### Handing the Wrkz wallet away On 9 July Nayiem asked whether he could "just send over the wrkz wallet files to the devs" [#6909](https://altillyfiles.com/chat#6909). Chuck said two WrkzCoin refunds had been paid, two were still pending, and every other claim was "invalid or no response" [#6910](https://altillyfiles.com/chat#6910), [#6912](https://altillyfiles.com/chat#6912). He questioned the approach: "Is there a reason were doing this?" and "is this a habit you want to get into?" [#6915](https://altillyfiles.com/chat#6915), [#6917](https://altillyfiles.com/chat#6917). Nayiem said assets that were "difficult to restore or difficult to send + without any valuable market" would "only cost us time and headache," and he named HonkHonk and Wrkz [#6921](https://altillyfiles.com/chat#6921), [#6922](https://altillyfiles.com/chat#6922). Mike agreed that Wrkz was "a pain to send anything other than small amounts." He had sent "a few million" before "giving up" [#6925](https://altillyfiles.com/chat#6925), [#6933](https://altillyfiles.com/chat#6933). One of the pending refunds was for 2B [#6927](https://altillyfiles.com/chat#6927). Chuck asked, "How did you confirm he is CEO of wrkz?" Nayiem answered, "I didn't actually" [#6998](https://altillyfiles.com/chat#6998), [#6999](https://altillyfiles.com/chat#6999). He then asked the project's community to confirm the recipient and posted a screenshot of that exchange [#7005](https://altillyfiles.com/chat#7005). Chuck objected that the post was "giving too much info" and that telling the community only two refunds were left was not the "best idea right now." He then withdrew the objection ("nm") [#7008](https://altillyfiles.com/chat#7008), [#7010](https://altillyfiles.com/chat#7010), [#7011](https://altillyfiles.com/chat#7011). Next he warned: "That guy is in cambodia which is on sanctioned list." Nayiem replied, "Will send over the wallet now" [#7030](https://altillyfiles.com/chat#7030), [#7033](https://altillyfiles.com/chat#7033). The chat contains no further discussion of the sanctions point. On 11 July Nayiem confirmed that the developer had received the wallet [#7037](https://altillyfiles.com/chat#7037), [#7038](https://altillyfiles.com/chat#7038). In October Mike confirmed that "the dev got the whole thing" [#7570](https://altillyfiles.com/chat#7570), [#7571](https://altillyfiles.com/chat#7571). #### Fragile tools and a self-inflicted outage The infrastructure kept failing. On 11 July Chuck posted an error screenshot from the new development site. Nayiem said Mike had "funked it up again," and Mike replied that "it's not really ready for clicking around yet" [#7040](https://altillyfiles.com/chat#7040), [#7041](https://altillyfiles.com/chat#7041), [#7046](https://altillyfiles.com/chat#7046). On 23 July altilly.com began redirecting to Google [#7114](https://altillyfiles.com/chat#7114). Nayiem first pointed out that only he and Mike had DNS access, and suggested Mike had changed it on purpose [#7119](https://altillyfiles.com/chat#7119). The Cloudflare audit log showed no changes [#7120](https://altillyfiles.com/chat#7120). He then found the cause himself: "I deleted qae.altilly.com" [#7123](https://altillyfiles.com/chat#7123). He reported it "fixed" [#7124](https://altillyfiles.com/chat#7124), but Chuck said they were "already getting called out on it in refund group" [#7126](https://altillyfiles.com/chat#7126). During the same weeks Nayiem described a stress dream about another of his websites and said a WordPress site of his kept "going offline with 500 errors" [#7098](https://altillyfiles.com/chat#7098), [#7107](https://altillyfiles.com/chat#7107). Both show how thinly his time was spread. On 1 August the Altilly information moved to a Qredit-hosted page. Nayiem announced it as "live now" [#7149](https://altillyfiles.com/chat#7149). Chuck asked for a wording change, noting that "the word 'since' implies a period 'after' the hack" [#7151](https://altillyfiles.com/chat#7151), [#7155](https://altillyfiles.com/chat#7155), and asked for the saved and non-saved asset lists to go back up. Nayiem agreed [#7163](https://altillyfiles.com/chat#7163). Chuck summed up the move: "Pretty much all we did was move the info from altilly to qredit" [#7164](https://altillyfiles.com/chat#7164). The next day Chuck said he had been "playing dumb" with a user because something on the site "needs to be removed," or else "were going to get bombarded by every non saved asset user" [#7175](https://altillyfiles.com/chat#7175), [#7176](https://altillyfiles.com/chat#7176). The support tools lapsed again and again for lack of payment. On 14 August the ticket account was "suspended again," and Chuck also needed Fastmail restored to get back into Discord [#7202](https://altillyfiles.com/chat#7202), [#7206](https://altillyfiles.com/chat#7206). On 15 August he reminded Nayiem that "freshdesk and fastmail" needed paying [#7215](https://altillyfiles.com/chat#7215). On 18 and 19 August he was still repeating "TIckets/Fastmail" [#7305](https://altillyfiles.com/chat#7305), [#7309](https://altillyfiles.com/chat#7309). He warned that user emails bounced while the help desk was down, "so its important we keep that live until at least the saved assets are completed" [#7339](https://altillyfiles.com/chat#7339), [#7340](https://altillyfiles.com/chat#7340). When the billing problem came back on 20 August, Nayiem confirmed the monthly ticket-system cost as "250 usd" [#7363](https://altillyfiles.com/chat#7363), [#7369](https://altillyfiles.com/chat#7369), [#7371](https://altillyfiles.com/chat#7371). Chuck also asked whether work had begun on the ALT2020 token on the Qredit blockchain [#7208](https://altillyfiles.com/chat#7208). He proposed handling non-saved-asset refunds in two steps [#7209](https://altillyfiles.com/chat#7209). He also asked that the next phase stay closed "until all other claims have been paid first... Or its going to get real messy" [#7221](https://altillyfiles.com/chat#7221), [#7222](https://altillyfiles.com/chat#7222). #### The HNC licensing proposal On 17 August Nayiem brought a proposal from the HNC team, which he said had gained "12k users in the last 2 weeks." It involved using that team's crypto licence and sharing licence costs [#7228](https://altillyfiles.com/chat#7228), [#7229](https://altillyfiles.com/chat#7229). He said "We already have the funding for the crypto license" [#7230](https://altillyfiles.com/chat#7230); by Nayiem's account this was the roughly 10k Mike had offered in May to fund the licence [#5728](https://altillyfiles.com/chat#5728), [#5729](https://altillyfiles.com/chat#5729). Chuck called it "Alot at risk for a little convenience" [#7233](https://altillyfiles.com/chat#7233). Nayiem answered: "If we fuck up, with their license. They lose their license. and we have another chance" [#7236](https://altillyfiles.com/chat#7236). He also objected to providing the development, paying half the cost of another company's licence and then splitting the profit as well [#7250](https://altillyfiles.com/chat#7250). Chuck said, "That is a CEO call but I think its a bad idea," and later, "I just work here :P" [#7246](https://altillyfiles.com/chat#7246), [#7274](https://altillyfiles.com/chat#7274). Nayiem said, "I need to think about it" [#7285](https://altillyfiles.com/chat#7285), and then pointed to HNC's market ranking [#7286](https://altillyfiles.com/chat#7286), and Chuck replied, without giving evidence in the chat, that "they had like 80% fake trading on altilly" [#7287](https://altillyfiles.com/chat#7287), [#7288](https://altillyfiles.com/chat#7288). Nayiem answered that rank 170 was "not easy to fake", "unless they hold 99% of the coins" [#7289](https://altillyfiles.com/chat#7289), [#7290](https://altillyfiles.com/chat#7290). Mike noted that the system was already "being setup so you can have multiple frontend exchanges" [#7293](https://altillyfiles.com/chat#7293). #### Threats and fatigue On 1 September Nayiem shared a screenshot from someone asking where to serve legal papers [#7380](https://altillyfiles.com/chat#7380), [#7381](https://altillyfiles.com/chat#7381). Chuck guessed it was over KYC and put the chance of legal action at "less than 5%" [#7383](https://altillyfiles.com/chat#7383). Nayiem wrote, "I'm starting to not enjoy this shit anymore," and said things were "starting to become serious" now that he had a family to consider [#7384](https://altillyfiles.com/chat#7384), [#7385](https://altillyfiles.com/chat#7385). He admitted he was behind on private messages at 2 a.m. [#7393](https://altillyfiles.com/chat#7393). The same evening a user threatened legal action over DOGE, although, as Chuck pointed out, "he didnt even claim doge" [#7402](https://altillyfiles.com/chat#7402). Nayiem's response was: "People don't understand that there are no funds. ... Don't waste your time" [#7407](https://altillyfiles.com/chat#7407), [#7409](https://altillyfiles.com/chat#7409). On 6 September Nayiem posted a long accusatory message from the person who had asked where to serve legal papers [#7417](https://altillyfiles.com/chat#7417), [#7418](https://altillyfiles.com/chat#7418), and Chuck replied with a crude remark about him [#7420](https://altillyfiles.com/chat#7420). That evening Chuck wrote to Mike that they had to "hit 'all' the saved assets and get out whatever is pending before pushing anything else. Weve made alot of promises we are not keeping and natives are starting to get very restless" [#7421](https://altillyfiles.com/chat#7421). #### September: last plans In early September Chuck mentioned personal difficulties [#7424](https://altillyfiles.com/chat#7424). He said he was "about 80% finished" with the non-saved asset sheets and the conversion tables, and would then value each asset "as of Dec 24 25 or 26" [#7426](https://altillyfiles.com/chat#7426). On 10 September Nayiem posted "the planning for now," with marketing, refunds and sales to follow in the same document [#7428](https://altillyfiles.com/chat#7428), [#7429](https://altillyfiles.com/chat#7429). The claims turned up gaps in the records. There were 95 claims for a "ROCK" token that no list included [#7435](https://altillyfiles.com/chat#7435), which Nayiem explained had been "basically airdropped" [#7438](https://altillyfiles.com/chat#7438). Chuck asked, "If somebody shows me a deposit slip can i kick you?" [#7446](https://altillyfiles.com/chat#7446). The Blocknet wallet did not hold enough to cover its refunds [#7450](https://altillyfiles.com/chat#7450). TUSD and a second stablecoin were added to the non-saved list from memory [#7530](https://altillyfiles.com/chat#7530), [#7532](https://altillyfiles.com/chat#7532), and Mike called both "minimal" [#7534](https://altillyfiles.com/chat#7534). On 16 September Chuck finished the BTC refund request page: "800+ users for now," out of "over 1600 entries" [#7517](https://altillyfiles.com/chat#7517)–[#7519](https://altillyfiles.com/chat#7519). On 13 September a news story about account takeovers started a discussion about security. Nayiem admitted that at Altilly "we did sometimes a password reset for the user on a different email," adding "Not sure how we checked things" [#7473](https://altillyfiles.com/chat#7473). Chuck pressed for forced 2FA at registration [#7474](https://altillyfiles.com/chat#7474), [#7490](https://altillyfiles.com/chat#7490). Mike replied: "im making 2fa a requirement to deposit, withdraw, or trade" [#7491](https://altillyfiles.com/chat#7491). Two days later a critic attacked Altilly publicly. Nayiem replied to every review [#7494](https://altillyfiles.com/chat#7494), [#7498](https://altillyfiles.com/chat#7498), wrote "This dude is really pissing me off" [#7500](https://altillyfiles.com/chat#7500), and the next day said the critic "has finally shut his mouth" [#7509](https://altillyfiles.com/chat#7509). The rest is mostly background talk. Mike reported a deal on his house [#7535](https://altillyfiles.com/chat#7535), [#7544](https://altillyfiles.com/chat#7544), [#7559](https://altillyfiles.com/chat#7559). Nayiem reported that Satoexchange, the exchange he had announced as a close partner in June, had "Lost user funds. Dev is missing" [#7560](https://altillyfiles.com/chat#7560), [#7561](https://altillyfiles.com/chat#7561), and Mike added that another exchange had also been hacked [#7562](https://altillyfiles.com/chat#7562). Chuck shared news of a regulatory settlement involving Tether and Bitfinex [#7567](https://altillyfiles.com/chat#7567). The last working exchange in the chat is Mike's 26 October confirmation about the Wrkz wallet [#7570](https://altillyfiles.com/chat#7570), [#7571](https://altillyfiles.com/chat#7571). After that the group goes silent. The schedule posted in September [#7428](https://altillyfiles.com/chat#7428) is never shown being delivered, and the saved-asset refunds are never marked complete. ### Looking back (2025–2026 notes) After 26 October 2021 the group goes quiet for more than three years. The messages after that were not written while events were happening. Almost all of them come from Nayiem, looking back at the old messages. They are summarised here as his later commentary. #### February 2025: thanks The first new messages appear on 8 and 9 February 2025. Nayiem replies to three old messages from Mike with "Thank you Mike 🙂", "Thanks" and "Thanks again" [#7572](https://altillyfiles.com/chat#7572), [#7574](https://altillyfiles.com/chat#7574), [#7575](https://altillyfiles.com/chat#7575). Two of those old messages are videos Mike had shared in May 2021. Chuck's only response is an eyes emoji [#7573](https://altillyfiles.com/chat#7573). The export does not say what prompted the thanks. By Nayiem's account, Mike had already left the group by then; Nayiem was browsing through the old messages and meant the thanks ironically, knowing he would use this material against him. The timing fits: it came around the same day as his first Reddit post about Mike and Xeggex (about 8 February 2025). #### September 2026: taking over the channel On 27 September 2026 Nayiem asks Chuck to give him ownership of the channel [#7576](https://altillyfiles.com/chat#7576). Chuck replies "Done" the next day [#7578](https://altillyfiles.com/chat#7578). On 29 September Nayiem tells the group he intends to make the channel "public and make it read-only". He says he first has to "go through all 7000 messages" because he sees "a lot of customer data, emails etc." [#7579](https://altillyfiles.com/chat#7579). In the end the group itself stays private; the redacted chat is published on this site instead. He also says he needs to check whether the Google Docs of Altilly assets are private, because "They contain customer data too" [#7580](https://altillyfiles.com/chat#7580). His last message is a notice that some messages were deleted "to protect customer data and data of unrelated 3rd parties and other management employees that have been in this group during the early days" [#7598](https://altillyfiles.com/chat#7598). So the published record is partly curated by Nayiem, and he is also the person making the accusations below. Readers should keep both facts in mind. #### The allegation against Mike Most of the 2026 notes are replies attached to messages from 2020 and 2021. Together they argue that the December 2020 hack was not what it looked like at the time. The main claim is attached to the email from Cherry Servers that Nayiem had posted in March 2021 [#4353](https://altillyfiles.com/chat#4353). In it, the hosting provider said the attacker had got into the account the year before. Nayiem's 2026 note calls it "the first response from Cherry Servers after I reached out to them on behalf of Altilly" and says Mike "used this situation to orchestrate the 'hack'" [#7587](https://altillyfiles.com/chat#7587). He also re-shares Cherry's formal notice denying liability [#7586](https://altillyfiles.com/chat#7586), [#4349](https://altillyfiles.com/chat#4349). He then adds captions to material Mike posted after the hack: - Three videos from May 2021, two posted by Mike and one forwarded by Chuck [#5106](https://altillyfiles.com/chat#5106), [#5114](https://altillyfiles.com/chat#5114), [#5125](https://altillyfiles.com/chat#5125), re-captioned as Mike's bathtub, garden and living room/office "5 months after the 'hack'" [#7589](https://altillyfiles.com/chat#7589), [#7590](https://altillyfiles.com/chat#7590), [#7591](https://altillyfiles.com/chat#7591). The chat does not show how the work was paid for. - Mike's May 2021 message "i think i can probably get that 10k by the end of the week" [#5728](https://altillyfiles.com/chat#5728), which at the time was about paying for the licence [#5735](https://altillyfiles.com/chat#5735), [#5745](https://altillyfiles.com/chat#5745). The 2026 caption says that months later, after renovating his house and building "a massive in-door pool", Mike suddenly "has 10k out of nowhere" [#7592](https://altillyfiles.com/chat#7592). - Mike's July 2020 remark that he had "almost launched" another exchange and owned its domain [#931](https://altillyfiles.com/chat#931), [#933](https://altillyfiles.com/chat#933). Nayiem's note says Mike was running "other exchange ventures without anyone from the team knowing… Already before Altilly" [#7593](https://altillyfiles.com/chat#7593). Mike had, however, mentioned that project to the group himself in 2020. - A July 2020 thread in which Mike turned down BitGo [#964](https://altillyfiles.com/chat#964), [#966](https://altillyfiles.com/chat#966). Nayiem's note says Mike was "disregarding any conversation that involves chainalysis or cold wallets" [#7594](https://altillyfiles.com/chat#7594). At the time Nayiem accepted the decision with "Alright" [#967](https://altillyfiles.com/chat#967). #### Identity and the old email Nayiem also returns to 26 December 2020. That day Mike posted the old email address that had been used to take over the hosting account, paul@satotechlt.com [#1326](https://altillyfiles.com/chat#1326), and said the domain's history "probably has my name" [#1324](https://altillyfiles.com/chat#1324), [#1326](https://altillyfiles.com/chat#1326), [#1328](https://altillyfiles.com/chat#1328). In September 2026 Nayiem replies with an image of a historical WHOIS lookup for the correctly spelled version of that domain [#7577](https://altillyfiles.com/chat#7577), plus a Bitcointalk link [#7583](https://altillyfiles.com/chat#7583). In a longer note he writes that he "always knew that Mike never used his real name". He repeats second-hand reasons he says he was given at the time for why Mike kept his real name away from the exchange; they are unverified and not repeated here. He also says his own WHOIS check at the time found nothing because the domain as Mike typed it contained a one-letter typo [#7595](https://altillyfiles.com/chat#7595). Separately, he replies to the 2021 photo of the card envelope [#3833](https://altillyfiles.com/chat#3833) with a short remark [#7585](https://altillyfiles.com/chat#7585). In another reply Nayiem posts a link to a court record and a link to a Cryptsy settlement website [#7581](https://altillyfiles.com/chat#7581). He does this without explaining it further in the group. That note mentions a private individual and is not repeated here. #### Cryptsy and Chuck On 1 April 2021 Mike had pointed out that the bitcoin stolen in the Cryptsy hack had never moved, adding "we had noticed they hadn't moved years ago" [#4525](https://altillyfiles.com/chat#4525), [#4529](https://altillyfiles.com/chat#4529). Nayiem's 2026 reply picks out the word: "'we' had noticed?" [#7596](https://altillyfiles.com/chat#7596). He then links Chuck's December 2020 remark about losing 9 BTC in 2014 [#1399](https://altillyfiles.com/chat#1399) and writes: "Chuck lost 9 BTC on Cryptsy… While the thief is literally in front of his face" [#7597](https://altillyfiles.com/chat#7597). The note implies that Mike was the Cryptsy thief. Nothing in the chat backs this up. #### Nayiem on himself Some of the notes are directed at Nayiem himself. In the same message about Chuck he writes: "Ironically I feel stupid too for being naive and missing all of the hints. I could have known if I paid more attention to the details." [#7597](https://altillyfiles.com/chat#7597). He also replies to his own March 2021 message in which he had posted his full payment-card details to the group [#4417](https://altillyfiles.com/chat#4417). He says the card "is no longer working" and that he is leaving the message up "because it might look suspicious in this context" [#7588](https://altillyfiles.com/chat#7588). In reply to Chuck's June 2021 stock tip, which predicted a rise from $1.20 to $50 a share [#6378](https://altillyfiles.com/chat#6378), he posts a September 2026 screenshot showing the stock at 0.00 USD [#7584](https://altillyfiles.com/chat#7584). #### How to read these notes The notes were written five years after the events. They come from one participant, and they are allegations. Nobody in the chat answers them. Mike, whose account shows only as "Deleted Account", does not reply. Chuck's only reply is the "Done" handing over ownership [#7578](https://altillyfiles.com/chat#7578). Several facts are worth setting next to the notes: - The messages from 2020 and 2021 contain no admission by Mike. - Mike was the person who first pointed to the old hosting email as the way in [#1504](https://altillyfiles.com/chat#1504). - Mike later said he would make 2FA mandatory on the successor platform [#7491](https://altillyfiles.com/chat#7491). - During those years Nayiem himself trusted Mike with the servers, and later said he had never had database access [#1493](https://altillyfiles.com/chat#1493), [#6557](https://altillyfiles.com/chat#6557). The 2026 notes show how Nayiem came to see those years. They do not settle what happened to Altilly's servers. ### What the chat does not show The chat is one group among several, and parts of it are missing. It does not show: - **Who deleted the missing messages, or when.** Telegram does not record this (see the note at the top). - **The day-to-day running of the exchange in 2020.** That happened in support tickets, the wider staff group and private messages, none of which are in this export. - **Reliable volume, revenue or user figures.** Apart from a few 2019 snapshots [#365](https://altillyfiles.com/chat#365), [#786](https://altillyfiles.com/chat#786), the chat gives no trading or revenue figures. - **The moment Altilly went down.** The incident first appears as a question about "the hack that happened" [#1031](https://altillyfiles.com/chat#1031). - **Where the stolen bitcoin went.** Mike's estimate of "around 31 bitcoins" [#1600](https://altillyfiles.com/chat#1600) is the only figure, and the chat contains no tracing of the funds. - **An answer about the separate SSD.** Mike's hope that the master database "was not wiped" [#2491](https://altillyfiles.com/chat#2491), [#2500](https://altillyfiles.com/chat#2500) is never answered in the chat. - **A user-handling plan before the public notice**, which Chuck asked for [#1176](https://altillyfiles.com/chat#1176), [#1178](https://altillyfiles.com/chat#1178). - **A ledger of refund payouts.** Nayiem said he only marked addresses against users [#3575](https://altillyfiles.com/chat#3575). - **The Motion and non-saved-asset update promised for 2 May 2021** [#4971](https://altillyfiles.com/chat#4971)–[#4974](https://altillyfiles.com/chat#4974). - **Completion of the saved-asset refunds or of the September 2021 schedule** [#7428](https://altillyfiles.com/chat#7428). - **Any reply from Mike or Chuck to the 2026 allegations**, or any admission by Mike [#7578](https://altillyfiles.com/chat#7578). - **Who Mike is.** The chat contains the Revolut card envelope addressed to "PAUL Vernon", posted while Mike's card was on order [#3833](https://altillyfiles.com/chat#3833), the old hosting email he named himself, paul@satotechlt.com [#1326](https://altillyfiles.com/chat#1326)-[#1328](https://altillyfiles.com/chat#1328), and Nayiem's later notes. That is evidence, but it does not legally establish Mike's identity; see [Who was Mike?](https://altillyfiles.com/mike). - **Whether the 2026 allegations are true.** They are one participant's reading, written five years later. --- # Who was Mike? Source: https://altillyfiles.com/mike Markdown: https://altillyfiles.com/content/mike.md ## Who was Mike? > **Caveat:** > > **Read this first.** No court or authority has confirmed that Mike is Paul Vernon, or that Mike took the Altilly funds. This page sets out the documents that bear on those questions, including the ones that point the other way. Where something is only Nayiem's belief, it is labelled as a belief. The developer who built and ran Altilly's exchange software appears in the chat as "Deleted Account". The team called him Mike and tagged him as @MrMike_O. He ran the servers, the wallets and the database [#1492](https://altillyfiles.com/chat#1492) [#1493](https://altillyfiles.com/chat#1493) [#1299](https://altillyfiles.com/chat#1299) [#2491](https://altillyfiles.com/chat#2491). He lived in north-east China [#3639](https://altillyfiles.com/chat#3639) [#2674](https://altillyfiles.com/chat#2674). After the chat ended, Nayiem came to believe that Mike was Paul Vernon, the founder of the Cryptsy exchange, who is under US indictment. This page asks how far the evidence supports that belief. **How the cards are graded.** Each card is graded by how much weight it can bear on the question "who was Mike?": - **Strong**: a document from the time that is hard to explain another way. - **Moderate**: a real document that needs one reasonable assumption. - **Weak**: a detail that fits but proves little. - **Points the other way**: facts that weaken the case or complicate it. - **Context**: public records the other cards rely on. ### In short - **Well documented:** Mike was a real person, separate from Nayiem. He used the name Michael Osullivan and the GitHub account mrmikeo. - **Well documented:** In February 2021 Mike ordered a company Revolut card. It arrived in an envelope addressed to "PAUL Vernon". When Revolut asked him to verify his ID in March 2021, he put it off [#4415](https://altillyfiles.com/chat#4415). - **Well documented:** Mike is on no company register we found. The UK company formed in December 2020, Qredit Ltd, lists only Nayiem. - **Likely, but not confirmed:** Mike used the name Paul Vernon. - **Possible, but unproven:** Mike is the Paul Vernon of Cryptsy. Several details fit, but each one has an innocent explanation, and no authority has said so. - **Not shown by anything on this page:** that Mike took the Altilly funds. ### The evidence #### Mike was a real person, separate from Nayiem > **Strong evidence:** > > Some people online have said that Mike never existed and that Nayiem was Mike. One example is a Reddit post of February 2025 (). The chat does not support that claim. > > - **He answered to "Mike".** When Nayiem or Chuck tagged @MrMike_O, "Deleted Account" answered [#790](https://altillyfiles.com/chat#790) [#792](https://altillyfiles.com/chat#792) [#794](https://altillyfiles.com/chat#794). > - **He used the name Michael Osullivan.** A support email to him opens "Hi Michael" [#3288](https://altillyfiles.com/chat#3288). In May 2021 he shared a whitepaper cover with the author line "Michael Osullivan, @MrMikeO" [#5529](https://altillyfiles.com/chat#5529). > - **He linked his own GitHub account**, github.com/mrmikeo [#4380](https://altillyfiles.com/chat#4380). > - **He lived in China.** He asked whether Revolut sends cards to China [#3639](https://altillyfiles.com/chat#3639), and described the weather in the north-east [#2674](https://altillyfiles.com/chat#2674). > - **Nayiem lived in Sweden.** At the same time, Nayiem was writing from Sweden and planning a trip to Stockholm [#5734](https://altillyfiles.com/chat#5734) [#5735](https://altillyfiles.com/chat#5735). > - **Mike was named publicly before any of this.** A 2018 Bitcointalk announcement names "Michael Osullivan" as the Altilly coin developer (). > > This shows that Mike was a real person with a working identity of his own. It does not show which of his names, if any, was his legal name. #### The Revolut card addressed to "PAUL Vernon" > **Strong evidence:** > > In February 2021 Nayiem set up a Revolut Business account for the team and invited Mike and Chuck. > > - Nayiem told Mike he could now order a card [#3638](https://altillyfiles.com/chat#3638). > - Mike asked, "they send physical cards to china?" [#3639](https://altillyfiles.com/chat#3639). He then got the message "Sorry, our service is not offered in your country" [#3646](https://altillyfiles.com/chat#3646). > - Nayiem replied, "Send it to my address, I will send it to you then" [#3647](https://altillyfiles.com/chat#3647). > - Mike wrote "ok, done" [#3653](https://altillyfiles.com/chat#3653), and Nayiem confirmed, "Mike is registered and ordered his card" [#3693](https://altillyfiles.com/chat#3693). > - Two days later Nayiem posted a photo of a Revolut DHL envelope, dated 3 February 2021, delivered to his address. It was addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). Chuck asked, "card already?" [#3834](https://altillyfiles.com/chat#3834). > - Chuck ordered his own card and received it separately [#3846](https://altillyfiles.com/chat#3846). > - Mike later wrote that parcels "can take a few days to clear customs" in China [#3837](https://altillyfiles.com/chat#3837), and on 19 February, "oh, i got my revolut card today" [#3960](https://altillyfiles.com/chat#3960). > > The name on the card is whatever the account holder registered. Here the account holder was the person the team knew as Mike, writing in 2021, years before anyone had a reason to invent the link. This is the most direct document on this page. > > **What it does not show:** that a bank had checked the name. In March 2021 Revolut asked Mike to verify his ID. He put it off: "my passport is at the china visa office" [#4414](https://altillyfiles.com/chat#4414) [#4415](https://altillyfiles.com/chat#4415) [#4416](https://altillyfiles.com/chat#4416). We do not know whether he completed that check later. Revolut's own records would show what name, if any, the account was verified under (see "What would settle this"). #### Mike's own words: "paul@satotechlt.com" > **Moderate evidence:** > > On 26 December 2020, while the team tried to work out how the servers had been wiped, Mike said the attacker got in "thru an old email still attached to the account" [#1289](https://altillyfiles.com/chat#1289). About 25 minutes later he wrote the address and added a comment: > > > paul@satotechlt.com [#1326](https://altillyfiles.com/chat#1326) > > history on that domain probably has my name [#1328](https://altillyfiles.com/chat#1328) > > Later that day he said it was an email he had used "when initially setting up the service 3 years ago", with no 2FA [#1504](https://altillyfiles.com/chat#1504). He said Cherry Servers told him the deletion request came from that email over Tor [#1508](https://altillyfiles.com/chat#1508). > > This was written before anyone in the group suspected Mike of anything. It shows that Mike had used the address paul@satotechlt.com, and that he expected the domain's history to show his name. > > **Caveats.** > > - Three messages around these are missing from the export: numbers 1323, 1325 and 1327. The message just before the address reads only "the old email address that was used does" [#1324](https://altillyfiles.com/chat#1324). We cannot see what the missing messages said or who removed them. > - The address points to "satotechlt.com", not "satotechltd.com". The next card explains why that matters. #### The satotechltd.com WHOIS record > **Moderate evidence:** > > A historical WHOIS record shows who registered satotechltd.com, one letter different from the address Mike wrote. Nayiem posted a screenshot of it in the chat in 2026 [#7577](https://altillyfiles.com/chat#7577). The record shows: > > - the domain was created 18 July 2015, with expiry 18 July 2016; > - the registrant is "PAUL VERNON", company "PROJECT INVESTORS INC", Delray Beach, Florida. > > Project Investors Inc. is the company that ran Cryptsy. A Bitcointalk post from January 2016 lists a Hong Kong "Satotech Limited" linked to Vernon, with the same phone number as the WHOIS record (). Nayiem posted that link too [#7583](https://altillyfiles.com/chat#7583). > > **Why this is only moderate.** > > - The link depends on reading "satotechlt.com" as a typo for "satotechltd.com". That is Nayiem's reading, made in 2026, when he posted the satotechltd.com record in reply to Mike's message [#7577](https://altillyfiles.com/chat#7577). It is reasonable, but it is not proven. > - Neither domain is registered today, so the records cannot be checked live. > - The one historical record we have covers only 2015 to 2016. Mike dated his use of the email to about 2017 [#1504](https://altillyfiles.com/chat#1504). The record does not show whether the domain was renewed. #### The Dalian mailing name matches a person in the Cryptsy court record > **Weak evidence:** > > While ordering the card, Mike gave a postal address in Dalian, China, and a name to mail things to [#3662](https://altillyfiles.com/chat#3662) [#3663](https://altillyfiles.com/chat#3663). He also gave a phone number [#3669](https://altillyfiles.com/chat#3669). > > The addressee's name is the same as a name that appears in court filings in the Cryptsy receivership, where it is connected to Vernon. > > **We do not publish the name, the address or the phone number, and we do not describe the court filings in more detail, so that the person cannot be identified.** They belong to a private person who may have nothing to do with any of this and is accused of nothing here. Please do not try to find out who it is. The details are redacted from the chat on this site, and the full details are available to authorities. Nayiem did include this name, with a property listing, in his February 2025 write-up, which he shared with investigators and initially posted on Reddit. He now says that was wrong (see [What I got wrong in 2025](https://altillyfiles.com/story#what-i-got-wrong-in-2025)). > > **Caveats.** > > - The name is common in China, and we have not confirmed that the two are the same person. > - A receiver's filing contains allegations, not findings. > - Nayiem's 2026 note on this message is a belief written with hindsight, not a record from the time [#7581](https://altillyfiles.com/chat#7581). > - Because the name is withheld, readers cannot check this match themselves. That is why it is graded weak here, and why the [Assessment](https://altillyfiles.com/assessment) does not rely on it. > > It fits with the envelope and the email above, but on its own it could easily be a coincidence. #### Mike and the stolen Cryptsy bitcoin > **Weak evidence:** > > On 1 April 2021 Mike brought up Cryptsy without being asked: "was looking at the old cryptsy hack stuff. The bitcoin that was stolen was never redeemed after it moved" [#4525](https://altillyfiles.com/chat#4525). He linked the exact transaction [#4526](https://altillyfiles.com/chat#4526) and said it was "now worth 664 million dollars" [#4527](https://altillyfiles.com/chat#4527). Then he added: > > > yea, we had noticed they hadn't moved years ago, thought it was strange back then that they didn't move after a year. my guess is they messed up something and lost access to the keys. [#4529](https://altillyfiles.com/chat#4529) > > Nayiem joked, "I would like to have those keys" [#4530](https://altillyfiles.com/chat#4530). Mike replied "me too" and "im sure people still watching those addresses tho" [#4531](https://altillyfiles.com/chat#4531) [#4532](https://altillyfiles.com/chat#4532). Chuck said he watched them too [#4534](https://altillyfiles.com/chat#4534). > > In 2026 Nayiem highlighted the word "we" [#7596](https://altillyfiles.com/chat#7596). That word could mean Cryptsy's own staff, but it could just as well mean people in the crypto community, who followed these coins closely. Chuck, for one, said he watched them too. On its own this proves nothing. It is here because it shows Mike knew the Cryptsy theft in detail. > > For context: about a year later, in March 2022, the Cryptsy theft coins moved for the first time in nearly eight years (Elliptic, ). Elliptic does not say who moved them. #### The mrmikeo GitHub account and the Xeggex commit > **Moderate evidence:** > > These are public records, which we checked on 29 September 2026. Git author names and emails are chosen by the user, so they show which account was used, not who was behind it. > > - **The Altilly repositories.** The official Altilly Node client (github.com/altilly/nodealtillyapi) lists its author as "Michael Osullivan". Its commits were made by the account mrmikeo, and a 2019 commit to another Altilly repository used mike@altilly.com. > - **The mrmikeo profile.** The account was created in 2017. It shows the name "MikeO" and the location "Northern China" (). Mike linked to it himself in the chat [#4380](https://altillyfiles.com/chat#4380). > - **The Xeggex commit.** The official Xeggex GitHub organisation has a fork of the hummingbot trading software. The latest commit on its main branch, d1479b80fe, dated 1 April 2024, was made by mrmikeo through GitHub's web interface (). It is a routine "sync with upstream" merge, not new code. But only an account with write access to that Xeggex repository could make it. > - **Coding style.** The Altilly client, a personal client on the mrmikeo account, and Xeggex's official Node client share an unusual way of writing the same setup code. This is our own comparison. A shared habit is suggestive, not conclusive. > - **Dates.** The xeggex.com domain was registered on 31 August 2021, and the Xeggex GitHub organisation was created on 20 September 2021. > > This is good evidence that the Altilly developer's account had a working role at Xeggex in 2024. On the question of Paul Vernon it says nothing either way. #### Companies House > **Context:** > > **Xeggex's UK companies.** The UK register lists officers under the name Michael Osullivan for two Xeggex-related companies: > > - **XEGGEX SOFTWARE SERVICES LTD** (no. 14910559), incorporated 2 June 2023 and dissolved 31 December 2024. > - The first director was listed as "JOHN, Michael Osullivan", born 1973, with a European nationality and a UK residence. He served from 2 June 2023 to 1 March 2024. > - He was followed by "OSULLIVAN, Michael John", born 1973 (a different birth month), listed as a citizen of Vanuatu living in China. > - Register: > - **XGX SOFTWARE LTD** (no. 15572800), incorporated 18 March 2024 and dissolved 26 August 2025. > - "OSULLIVAN, Michael John", born 1973, listed as Ecuadorean and living in China, was director and secretary. > - The correspondence address is in Dalian. We do not reproduce it. > - Register: > > The register records what the filer declares. When these companies were filed, Companies House did not verify identities. The different name orders, nationalities and birth months are themselves worth noting. Nayiem is convinced "Michael O'Sullivan" is an alias Mike used, possibly backed by a false passport; the different name orders, nationalities and birth months would fit that. The register cannot prove it; establishing who filed these entries is a job for law enforcement. **The name may also belong to a real person who has nothing to do with this. We do not accuse anyone of that name of anything.** > > **Altilly's company.** Mike does not appear on any company register we have found in connection with Altilly. The next card covers the company Nayiem formed. #### Qredit Ltd: the company Nayiem formed, with no Mike on the register > **Context:** > > We checked the UK register (Companies House) on 30 September 2026 (). > > - **QREDIT LTD** (no. 13077371) was incorporated on **11 December 2020**, at a London formation-agent address. > - Nayiem Willems is the only director and the only person with significant control, holding 75% or more of the shares and votes. > - **Mike does not appear**, under any name: not as Michael Osullivan, not as Paul Vernon, and not in any other role. > - The company never filed accounts or a confirmation statement. It was struck off and dissolved on 17 May 2022. > - The chat never mentions this UK company. There are also no messages between 2 and 18 December 2020, so the incorporation date falls in a gap in the export. > - Willems Ventures Ltd was incorporated the same day. In the chat Nayiem tied it to his tourist resort [#1579](https://altillyfiles.com/chat#1579) [#1583](https://altillyfiles.com/chat#1583). He says it had nothing to do with Altilly. > > **Altilly itself was never on a register we could find.** In 2019 Nayiem wrote that Altilly was "still incorporated in Hongkong" [#759](https://altillyfiles.com/chat#759). But on 28 December 2020, when Chuck asked about a Hong Kong address [#1776](https://altillyfiles.com/chat#1776) [#1777](https://altillyfiles.com/chat#1777), Mike said it was "maybe for a company registration service i was going to use originally to form a company in hk. never did do that tho" [#1778](https://altillyfiles.com/chat#1778). The two statements conflict, and the later one is Mike's own. > > **The bank account was Nayiem's too.** The Revolut Business account was in Nayiem's business name, and he was its admin. Mike was a team member with a card. When Revolut asked Mike to verify his ID in March 2021, he put it off: "can't do it right now, my passport is at the china visa office" [#4414](https://altillyfiles.com/chat#4414) [#4415](https://altillyfiles.com/chat#4415) [#4416](https://altillyfiles.com/chat#4416). Nayiem then gave his own card instead [#4417](https://altillyfiles.com/chat#4417). No later message shows Mike completing the check. > > **Nayiem's account (not shown in the chat).** > > - Nayiem says Mike privately promised that, once Nayiem had set up Qredit Ltd, he would formally take over Altilly. The chat has no message that transfers ownership. > - He says Qredit Ltd never traded because his own XQR (Qredit) coins were held on Altilly and lost in the hack. The chat confirms the XQR was lost: Chuck asked "is XQR safe?" and Nayiem answered "Nope" and "All lost" [#1731](https://altillyfiles.com/chat#1731) [#1732](https://altillyfiles.com/chat#1732) [#1733](https://altillyfiles.com/chat#1733) [#1734](https://altillyfiles.com/chat#1734). > - He believes Mike took the XQR along with the rest. That is his belief. The chat shows only that the XQR was lost. > > **Why it matters, both ways.** On paper, every legal and financial responsibility sat with Nayiem: the company, the bank account and the public role. Mike left no trace on any register connected to Altilly. That fits Nayiem's account that Mike kept his name off everything. It also means Nayiem, not Mike, is the one people could hold to account, and the company he formed never filed accounts and was struck off. The incident began on 23 December 2020, twelve days after Qredit Ltd was incorporated. #### Paul Vernon's public record > **Context:** > > The following is documented in court and government records. None of it mentions Altilly, Xeggex or "Mike". > > - **Cryptsy.** Paul E. Vernon founded Cryptsy and ran it as CEO through Project Investors Inc. of Delray Beach, Florida. In January 2016 he disclosed that the exchange had lost about 13,000 BTC in July 2014, which he blamed on a hack. Cryptsy collapsed that month. > - **Default judgment.** In the customer class action (S.D. Fla., no. 9:16-cv-80060), Vernon did not respond. On 27 July 2017 the court entered a default judgment of $8.2 million against him. The court also declared the roughly 11,325 BTC stolen on 29 July 2014 to be property of the customer class (Silver Miller, ). A default judgment means he did not defend the case. It is not a trial finding. > - **Indictment.** A 17-count federal indictment was filed on 15 August 2019, unsealed in January 2022 and announced by the DOJ on 26 January 2022 (S.D. Fla., no. 1:19-cr-20509). The charges are wire fraud, money laundering, computer fraud, tax evasion and destroying records. The indictment alleges that Vernon: > - stole more than $1 million from customer wallets; > - presented the 2014 loss as a hack by outsiders to hide it; > - moved to China around November 2015; > - in April 2016, after a receiver was appointed, remotely destroyed Cryptsy's customer database. > - Sources: DOJ () and IRS-CI (). > - **Fugitive status.** The plaintiffs' lawyers describe him as a fugitive believed to be in China (Silver Miller, 27 January 2022, ). We found no report of an arrest or a trial. > - **His side.** In 2016 Vernon denied theft. He said the losses came from a real cyber attack and that the money he took was salary. > - **He is presumed innocent** of the criminal charges. #### Details that fit, but prove little > **Weak evidence:** > > - **Location.** Mike lived in north-east China [#2674](https://altillyfiles.com/chat#2674) [#3639](https://altillyfiles.com/chat#3639) and gave a Dalian mailing address [#3663](https://altillyfiles.com/chat#3663). Vernon is reported to have moved to China in late 2015. Dalian also appears in 2016 press reporting on Vernon's activities in China (CoinJournal, ). > - **Age.** Mike said he joined the army in 1991 [#5456](https://altillyfiles.com/chat#5456). The Companies House officer was born in 1973. The DOJ gave Vernon's age as 48 in January 2022. These fit together, but many people were born around 1973. We have not verified Vernon's military record, and one published source gives a different enlistment year. > - **Knowledge.** Mike had been looking at the Cryptsy theft and linked its exact transaction [#4525](https://altillyfiles.com/chat#4525) [#4526](https://altillyfiles.com/chat#4526). > > Each of these would be unremarkable on its own. #### Common names and a one-letter typo > **Points the other way:** > > - "Paul", "Mike", "Michael" and "O'Sullivan" are very common names. So is the Dalian addressee's name. > - The link from Mike's email to Vernon's company depends on reading "satotechlt" as "satotechltd". That is a reasonable reading, but it is still a reading. > - The envelope shows only the name Paul Vernon. There are many people with that name. Nayiem says that when he searched it in 2021 he found a British blues musician [#7585](https://altillyfiles.com/chat#7585). > > The case rests on several independent items pointing the same way, not on any single one. Each item alone could be a coincidence. #### The house videos do not show where the money came from > **Points the other way:** > > On 16 May 2021 Mike said he had "moved half my stuff to new house today" [#5094](https://altillyfiles.com/chat#5094), and the team saw videos of the new house, still under renovation, including a very large bath, an indoor pool, the garden and his room [#5099](https://altillyfiles.com/chat#5099) [#5106](https://altillyfiles.com/chat#5106) [#5114](https://altillyfiles.com/chat#5114) [#5115](https://altillyfiles.com/chat#5115) [#5123](https://altillyfiles.com/chat#5123) [#5125](https://altillyfiles.com/chat#5125). Chuck joked, "Im moving in with mike either in this life or the next" [#5111](https://altillyfiles.com/chat#5111). The work was still being finished in September 2021 [#7430](https://altillyfiles.com/chat#7430) [#7431](https://altillyfiles.com/chat#7431). > > In 2026 Nayiem added notes calling these "5 months after the hack" [#7589](https://altillyfiles.com/chat#7589) [#7590](https://altillyfiles.com/chat#7590) [#7591](https://altillyfiles.com/chat#7591), and in 2025 he wrote that Mike lived in a villa paid for with stolen funds. Those claims leave out what Mike said at the time: > > - He was selling another house. He had cut its price in February 2021 [#4204](https://altillyfiles.com/chat#4204), hoped to sell it over the summer and "live off that cash" [#5471](https://altillyfiles.com/chat#5471) [#5472](https://altillyfiles.com/chat#5472), and found a buyer in September 2021 [#7535](https://altillyfiles.com/chat#7535) [#7544](https://altillyfiles.com/chat#7544). > - Of that house, he said it was bought "like 9 years ago" [#6163](https://altillyfiles.com/chat#6163)–[#6166](https://altillyfiles.com/chat#6166). > - The furniture for the new house had been "sitting in a warehouse for a year" by September 2021 [#7431](https://altillyfiles.com/chat#7431). Taken literally, the furniture was bought before the December 2020 loss. > > In context, the "nine years" remark was about the house he was selling, not the new one. The chat does not show when or how the new house was bought, or how the renovation was paid for. The house does not show that Mike took Altilly money, and this page does not claim that it does. #### No authority has confirmed any of this > **Points the other way:** > > - No court, police force or government body has said that Mike is Paul Vernon, or that Mike was involved in the Altilly loss. > - The charges against Vernon concern Cryptsy only. > - Nayiem says he reported his information to the FBI and the US Marshals Service in early 2025. He says the Marshals opened a two-way dialogue and issued a tip reference, 777-W77728, but never responded in it beyond that, and that the FBI gave him no case number. A tip reference confirms only that a report was filed. > - Community write-ups that link Vernon to Altilly or Xeggex, such as Rekt News (), describe it as an allegation. Most of them trace back to Nayiem's own 2025 posts, so they are not independent confirmation. > - Mike denied any part in the Altilly hack. According to Nayiem's screenshots, he did so on Discord on 3 December 2022. Mike's account is deleted, and he has not answered here. #### Nayiem trusted Mike for years > **Points the other way:** > > A fair reader will ask why, if the signs were there, Nayiem did not act on them at the time. The chat shows that he did not suspect Mike during the period it covers: > > - On 25 December 2020 he told Mike, "don't be ashamed or whatever Mike. It's not your fault" [#1256](https://altillyfiles.com/chat#1256). > - In May 2021 he told Mike, "I trust you with the hosting panel. It's not like something bad ever happened before." [#5658](https://altillyfiles.com/chat#5658), and accepted Mike's offer of "that 10k", and "a little extra", towards the crypto licence for a new venture [#5728](https://altillyfiles.com/chat#5728) [#5735](https://altillyfiles.com/chat#5735) [#5737](https://altillyfiles.com/chat#5737). > - In September 2021 he was still planning work with Mike [#7428](https://altillyfiles.com/chat#7428). > - He held the "PAUL Vernon" envelope in his hands in February 2021 [#3833](https://altillyfiles.com/chat#3833). He wrote in 2026 that he "always knew that Mike never used his real name" [#7595](https://altillyfiles.com/chat#7595). > > Nayiem says he worked with Mike in other channels into 2022. He says the relationship ended after Solar (SXP), a project he led, found in November 2022 that funds had been taken. Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png), posted in the Solar validator group on Discord and titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS", says that on 29 November 2022 unauthorised swaps were detected which took place between 12 August and 29 November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins, and that "In total, 1,878,477 SXP was fraudulently swapped". It says "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." It does not name Mike or anyone else. That Mike was the perpetrator comes from Nayiem's Discord screenshots in his February 2025 write-up, not from the statement. In them, on 29 November 2022 at 22:45, Nayiem asks "Why did you do it Mike?"; at 00:17 on 30 November he writes "We are not going to say anything if you can return the funds in 24hrs."; and at 05:43 MikeO replies "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." On 3 December 2022 MikeO wrote "I had nothing to do with the altilly hack." By Nayiem's account, Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft; the final payments can be checked on the Solar blockchain (see the [Solar repayment ledger](https://altillyfiles.com/story#after-altilly)). Nayiem says that after the business relationship ended in late 2022, he stayed in contact with Mike for one reason: getting money back. First the Solar funds, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck, which Mike never followed up on. Nayiem did not warn Xeggex users in that time. The screenshots are Nayiem's own evidence, and the ledger is his own record: the final transactions can be looked up, but a transaction does not show who sent it. Mike's role is unconfirmed on this site. > > **What follows from this.** Nayiem's belief that Mike is Paul Vernon, and that the Altilly "hack" was an inside job, formed years after the events. His 2026 notes in the chat state some of this as fact: "Mike/Paul" [#7595](https://altillyfiles.com/chat#7595), and "orchestrate" [#7587](https://altillyfiles.com/chat#7587). Read those notes as his beliefs. Nayiem is also an interested party. He was Altilly's public CEO, many people blame him, and he curated this export. ### What this page does not claim - It does not claim that Mike is Paul Vernon. It claims that the documents above make that a reasonable question, and it shows how far they go. - It does not claim that Mike, or anyone, took the Altilly funds. The chat shows that Mike alone controlled the systems that were wiped. It does not show what happened to the money. - It does not accuse anyone named Michael O'Sullivan, or anyone named in the Cryptsy court record other than Vernon himself. - It does not ask anyone to find, contact or visit anyone. Please don't. If you have information, give it to the authorities. ### What would settle this Any one of these would settle the identity question far better than this page can. Most of them are held by companies or authorities, not by Nayiem. 1. **Revolut's records.** The team member who ordered the "PAUL Vernon" card [#3693](https://altillyfiles.com/chat#3693) [#3833](https://altillyfiles.com/chat#3833) went through Revolut's onboarding. If he later completed the ID check he put off in March 2021 [#4414](https://altillyfiles.com/chat#4414) [#4415](https://altillyfiles.com/chat#4415), Revolut holds the verified name and identity document. Authorities can request them. 2. **Cherry Servers' records.** These would show who registered the paul@satotechlt.com email on the hosting account, and the full login history Mike said only went back five days [#1509](https://altillyfiles.com/chat#1509) [#1749](https://altillyfiles.com/chat#1749). 3. **The original files.** This means the envelope photo with its metadata, and a full, unedited export of this chat from another former member, such as Chuck, to compare against the gaps. 4. **Checks by the authorities.** Law enforcement can compare the identity documents behind the Revolut account, the Companies House filings and the Dalian address with the identity of the indicted Paul Vernon. 5. **On-chain tracing.** Tracing the Altilly hot and "safe" wallets lost in December 2020 [#1299](https://altillyfiles.com/chat#1299) [#1600](https://altillyfiles.com/chat#1600) might show where the funds went, and whether any of them reached addresses tied to Mike, to Nayiem or to anyone else. 6. **Mike's own answer.** A statement from Mike, under any name, would help, especially if it came with a verifiable identity. **What would count against Nayiem's belief:** - a verified Revolut identity under a different legal name; - proof that the Dalian addressee is a different person from the one in the Cryptsy filings; - a documented reason for the paul@satotechlt.com email that has nothing to do with Vernon. > **Note:** > > The private name, address and phone number withheld on this page, the unredacted chat, including deleted messages, and the original photos are available to any authority that asks, via Telegram at [@nayiem](https://t.me/nayiem). --- # Timeline Source: https://altillyfiles.com/timeline Markdown: https://altillyfiles.com/content/timeline.md ## Timeline Numbers like [#1056](https://altillyfiles.com/chat#1056) open that message in the published chat. Chat times are UTC-8; in Sweden, where Nayiem lived, it was about 9 hours later. Apart from a few messages in 2025 and 2026, events before July 2019 and after October 2021 are outside the chat. For those, the source is given as a link, or the entry says it is Nayiem's own account. > **Caveat:** > > This timeline mixes three kinds of source: messages in the chat, public records, and Nayiem's own memory. Each entry says which. Nayiem believes that "Mike" is Paul Vernon and that Mike took the Altilly funds. **These are beliefs.** No court or authority has confirmed either one. A "Michael O'Sullivan" appears in several records below. Nayiem believes it is an alias Mike used. That may also be a real, separate person whose name was used, and nothing here accuses such a person. ### Before Altilly: Cryptsy and Paul Vernon (2013-2019) #### 2013-2015 Paul E. Vernon runs Cryptsy, a crypto exchange, through his company Project Investors Inc. The US Department of Justice later alleges that he took more than $1M from customer wallets between May 2013 and May 2015. It also alleges that he hid a 2014 breach and told staff a false "hack" story around 29 July 2014, and that he moved to China around November 2015. These are allegations from an indictment, not findings. ([DOJ/IRS-CI release](https://www.irs.gov/compliance/criminal-investigation/ceo-of-major-online-cryptocurrency-exchange-company-indicted-for-defrauding-companys-customers-destroying-evidence-and-tax-evasion)) #### January-April 2016 Vernon discloses that Cryptsy lost a large amount of BTC in the 2014 breach. Customers file a class action (Leidel v. Project Investors Inc., S.D. Florida). In April 2016 the court appoints a receiver and freezes assets. The indictment later alleges that in April 2016 he remotely hacked Cryptsy's servers and destroyed its customer database. ([SiliconANGLE](https://siliconangle.com/2016/04/05/court-appoints-receiver-in-ongoing-case-against-failed-bitcoin-exchange-cryptsy/)) #### 27 July 2017 (key) Judge Kenneth Marra enters an $8.2 million default judgment against Vernon in the Cryptsy class action, after he does not defend it. The order says more than 11,000 BTC are owed to customers. This is a civil court finding. ([CoinDesk](https://www.coindesk.com/markets/2017/07/28/82-million-court-orders-default-judgment-against-cryptsy-ceo/)) #### January 2018 Nayiem starts Qredit (XQR). (Nayiem's account.) #### August 2018 A person called Mike offers Qredit a free listing on the Altilly exchange, and Nayiem accepts. Nayiem later helps Altilly with front-end design and marketing. As he remembers it, Mike suggested in late 2018 that Nayiem become Altilly's CEO and public face, with XQR as the exchange's own coin, while Mike ran development from the background. That conversation was private and is not in the chat. (Nayiem's account.) #### 18 December 2018 The Altilly coin announcement on Bitcointalk names "Michael Osullivan" as the developer. ([Bitcointalk](https://bitcointalk.org/index.php?topic=5086735)) #### 15 August 2019 (key) A sealed 17-count federal indictment against Vernon is filed in Florida (case 1:19-cr-20509): wire fraud, money laundering, computer fraud, destruction of records and tax evasion. On 16 September 2019 the court places him in fugitive status. He has not been convicted, and no filing in the case mentions Altilly or Xeggex. ([CourtListener docket](https://www.courtlistener.com/docket/62621434/united-states-v-vernon/)) ### Running Altilly (2019-2020) #### 8 July 2019 (key) Chuck creates the management group. Its first members are Chuck, Nayiem and an account now shown as "Deleted Account" [#2](https://altillyfiles.com/chat#2) [#4](https://altillyfiles.com/chat#4). Chuck says Mike "should be back tomorrow sometime" [#10](https://altillyfiles.com/chat#10) [#16](https://altillyfiles.com/chat#16). In the export, Mike appears as "Deleted Account". #### 12 July-25 August 2019 Listing fees and competition fees are charged in XQR [#183](https://altillyfiles.com/chat#183) [#583](https://altillyfiles.com/chat#583). #### 15 July 2019 Asked about outside audits, Mike writes "we are too small to worry about audits yet" and "too small to even start moving to safe storage" [#215](https://altillyfiles.com/chat#215) [#216](https://altillyfiles.com/chat#216). Nobody insists otherwise. #### 4-5 September 2019 Nayiem plans to remove some mentions of Hodler Enterprises from the site. Chuck wants to keep a line saying Altilly is a Hodler Enterprises company "for trust reasons" [#702](https://altillyfiles.com/chat#702) [#705](https://altillyfiles.com/chat#705). Nayiem says Altilly operates out of Sweden but is "still incorporated in Hongkong, until I have the things sorted here" [#759](https://altillyfiles.com/chat#759). In December 2020 Mike says the Hong Kong company was never formed [#1776](https://altillyfiles.com/chat#1776) [#1778](https://altillyfiles.com/chat#1778). #### 15 September 2019 Nayiem flags 38 pending withdrawals to Mike, who runs the servers [#790](https://altillyfiles.com/chat#790). #### 2020 A quiet year in the chat. Chuck relays that another exchange, Crex, was hacked [#884](https://altillyfiles.com/chat#884). #### 11 December 2020 (key) Nayiem incorporates Qredit Ltd (company 13077371) in the UK, at a London formation-agent address. The register lists him as sole director and as the only person with significant control, holding 75% or more of the shares. Mike does not appear on it, and he appears on no other company register found for this site. This is 12 days before the incident starts, and before any formal acquisition of Altilly. ([Companies House](https://find-and-update.company-information.service.gov.uk/company/13077371)) Nayiem says the plan was that he would be CEO and take ownership of the whole project once he had set up the company. No message in the chat records a transfer of ownership, and the chat never mentions Qredit Ltd; it also has no messages between 2 and 18 December 2020 [#998](https://altillyfiles.com/chat#998) [#999](https://altillyfiles.com/chat#999). (Nayiem's account.) Willems Ventures Ltd was incorporated the same day. Nayiem says it was the company for his tourist resort, Voyager Park, not for Altilly [#1579](https://altillyfiles.com/chat#1579) [#1583](https://altillyfiles.com/chat#1583). ### The incident (23-26 December 2020) #### 23 December 2020 (key) Users start reporting failed withdrawals and zero balances. (Nayiem's account; the calls he remembers are not in the chat.) Mike later says a suspicious login on the 23rd ran from 18:00 to 22:00 UTC [#2899](https://altillyfiles.com/chat#2899) [#2900](https://altillyfiles.com/chat#2900). #### 24 December 2020 (key) - Nayiem's first message already calls it "the hack" [#1031](https://altillyfiles.com/chat#1031). - Mike's first report, forwarded under Chuck's name, blames "an insecure recue port" and says three machines are affected [#1033](https://altillyfiles.com/chat#1033) [#1034](https://altillyfiles.com/chat#1034). - EXMO and Livecoin were also hacked that week [#1053](https://altillyfiles.com/chat#1053) [#1088](https://altillyfiles.com/chat#1088). Mike calls it "state sponsored for sure" [#1054](https://altillyfiles.com/chat#1054). - Nayiem asks, "Is it really under 10k Mike?" [#1056](https://altillyfiles.com/chat#1056). Mike: "might be 15", "wont know for sure until i get everything moved" [#1059](https://altillyfiles.com/chat#1059) [#1060](https://altillyfiles.com/chat#1060). The message just before Nayiem's question is missing from the export. - Mike suggests telling users "we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057). He drafts a line about removing data "due to the suspicious outage", and Nayiem works on the wording with him [#1065](https://altillyfiles.com/chat#1065) [#1072](https://altillyfiles.com/chat#1072). #### 25 December 2020 (key) - Mike: "somebody hacked into their systems. deleted all the servers" [#1103](https://altillyfiles.com/chat#1103). The host is Cherry Servers. All backups are gone [#1108](https://altillyfiles.com/chat#1108). - Cherry's first email blames non-payment. Mike: "there were no overdue invoices, so thats a lie" [#1110](https://altillyfiles.com/chat#1110) [#1111](https://altillyfiles.com/chat#1111). He says he "was still in the process of moving stuff" to a new host [#1121](https://altillyfiles.com/chat#1121). - Mike suggests a change he made kept the attackers out, "so i guess they got pissed off and just deleted everything" [#1132](https://altillyfiles.com/chat#1132). - Nayiem wants to tell users the hackers could not reach the funds. Mike replies "we don't know this" [#1180](https://altillyfiles.com/chat#1180) [#1183](https://altillyfiles.com/chat#1183). - Nayiem writes and posts the public notice: the system "was hacked above OS level", and "We are not sure yet if funds are lost" [#1232](https://altillyfiles.com/chat#1232). The notice says the domain was lost, while Mike is repointing that same domain [#1206](https://altillyfiles.com/chat#1206). #### 26 December 2020 (key) - Mike says the attacker got in through an old email still attached to the hosting account [#1289](https://altillyfiles.com/chat#1289). - He writes the address paul@satotechlt.com, then "history on that domain probably has my name" [#1326](https://altillyfiles.com/chat#1326) [#1328](https://altillyfiles.com/chat#1328). The messages just before it are missing from the export. - Without the config files, the saved data cannot be decrypted [#1353](https://altillyfiles.com/chat#1353). - Nayiem says he never had access to those servers: "Mike didn't allow me, because I break things" [#1492](https://altillyfiles.com/chat#1492) [#1493](https://altillyfiles.com/chat#1493). - Mike says the old email had no 2FA and that Cherry told him the deletion request came from it over a Tor IP [#1504](https://altillyfiles.com/chat#1504) [#1508](https://altillyfiles.com/chat#1508). > **Note:** > > In 2026 Nayiem found that satotechltd.com, one letter off, is registered to Paul Vernon / Project Investors Inc. [#7577](https://altillyfiles.com/chat#7577). He reads the missing letter as a typo. That reading is his, not a finding. ### Claims and refunds (2021) #### 27 December 2020 Mike estimates the loss at "around 31 bitcoins, the rest i have no idea" [#1600](https://altillyfiles.com/chat#1600). Nayiem asks the team to commit to repaying about $1 million [#1626](https://altillyfiles.com/chat#1626) and estimates the loss at $1 million or more [#1677](https://altillyfiles.com/chat#1677). Mike posts a wallet balance sheet [#1719](https://altillyfiles.com/chat#1719) and a list of 137 saved assets [#1757](https://altillyfiles.com/chat#1757). Mike says the host's login history "only went back 5 days" [#1749](https://altillyfiles.com/chat#1749). No login records are ever posted. #### 27 December 2020: the XQR loss (key) Chuck asks, "is XQR safe?" Nayiem: "Nope", "All lost" [#1731](https://altillyfiles.com/chat#1731) [#1732](https://altillyfiles.com/chat#1732) [#1733](https://altillyfiles.com/chat#1733). He adds that it happened "right before a swap" and that he knows most Qredit holders [#1734](https://altillyfiles.com/chat#1734). XQR was Altilly's own fee coin, and Nayiem says he had moved his own XQR to Altilly because he trusted its setup. With those coins gone, he says, Qredit Ltd never traded, which is why it never filed accounts. (Nayiem's account.) He believes Mike took the XQR along with the rest. **That is a belief.** The chat shows only that the XQR was lost. #### 27 December 2020-3 January 2021 Nayiem's address is public through his company registrations [#1579](https://altillyfiles.com/chat#1579). Threats follow [#2155](https://altillyfiles.com/chat#2155)–[#2160](https://altillyfiles.com/chat#2160) [#2385](https://altillyfiles.com/chat#2385). On 3 January two people run through his garden with flashlights, and he calls the police [#2471](https://altillyfiles.com/chat#2471). #### 28 December 2020-9 January 2021 The claim form goes up on the website on 28 December [#2029](https://altillyfiles.com/chat#2029), first with 60 days to claim, as Mike suggested [#1973](https://altillyfiles.com/chat#1973). Chuck suggests asking for deposit-confirmation emails, which become the main check [#2146](https://altillyfiles.com/chat#2146). On 3 January Nayiem cuts the claim window, and the notice sets a final date of 9 January [#2438](https://altillyfiles.com/chat#2438) [#2443](https://altillyfiles.com/chat#2443). Chuck thinks changing the date is a mistake [#2444](https://altillyfiles.com/chat#2444). #### 8 January 2021 A seller offers a copy of the Altilly database. Mike sends about $1k as a deposit [#2925](https://altillyfiles.com/chat#2925). Nayiem asks what to tell people about the database, and the team discusses saying they "recovered an sql dump" rather than that they bought it [#2967](https://altillyfiles.com/chat#2967) [#2968](https://altillyfiles.com/chat#2968) [#2972](https://altillyfiles.com/chat#2972). The seller disappears with the deposit [#3037](https://altillyfiles.com/chat#3037). #### 27 January 2021 Chuck asks Mike to remove the claim form from the website, post that the claim period has expired, and make a new link that "only us 3" know about, for "special circumstances only" [#3355](https://altillyfiles.com/chat#3355)–[#3358](https://altillyfiles.com/chat#3358). #### 28 January 2021 Nayiem: "anything between 50-200 usd I don't check at all" [#3564](https://altillyfiles.com/chat#3564); he only checks that each coin's total claims match what is left in its wallet [#3558](https://altillyfiles.com/chat#3558). At Chuck's request he removes the dated repayment promise from the site [#3418](https://altillyfiles.com/chat#3418) [#3421](https://altillyfiles.com/chat#3421). #### 19 February 2021 Nayiem tells Chuck to refund a pushy user from a country on the banking partner's 139-country high-risk list (not a sanctions list) "but not by email and remove all traces" [#4028](https://altillyfiles.com/chat#4028) [#4029](https://altillyfiles.com/chat#4029), and describes putting another user on a separate list and deleting the messages [#4032](https://altillyfiles.com/chat#4032). (Nayiem says the users on that list were paid.) The same day he confirms the BTC, ETH, DASH and DOGE wallets are gone [#4094](https://altillyfiles.com/chat#4094) [#4095](https://altillyfiles.com/chat#4095). #### 9 March 2021 Nayiem shares Cherry Servers' liability notice [#4349](https://altillyfiles.com/chat#4349) and says it contradicts an earlier email in which Cherry "clearly stated it was their fault" [#4350](https://altillyfiles.com/chat#4350). #### 1 April 2021 Mike brings up the stolen Cryptsy bitcoin: "we had noticed they hadn't moved years ago" [#4525](https://altillyfiles.com/chat#4525) [#4529](https://altillyfiles.com/chat#4529). His "we" may simply mean people who were watching the coins; it is not proof of anything. #### 1-3 April 2021 (key) Mike sends saved-asset refunds from the recovered wallets, about 60 coins one after another [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). Some fall short: the MRX wallets hold zero [#4849](https://altillyfiles.com/chat#4849). #### 15 May 2021 Chuck offers to "drag it out forever", and Nayiem replies "Go for it." [#5017](https://altillyfiles.com/chat#5017) [#5020](https://altillyfiles.com/chat#5020) The next day Nayiem sets out a refund-token plan [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), to be bought back on the new exchange; Altfenix never launched. #### 16 May 2021 Mike says he has "moved half my stuff to new house today" [#5094](https://altillyfiles.com/chat#5094). Chuck posts a video of a large indoor pool under construction, which they call Mike's "tub" [#5103](https://altillyfiles.com/chat#5103) [#5106](https://altillyfiles.com/chat#5106) [#5107](https://altillyfiles.com/chat#5107), and Mike posts videos of the garden and a room [#5114](https://altillyfiles.com/chat#5114) [#5115](https://altillyfiles.com/chat#5115) [#5125](https://altillyfiles.com/chat#5125). In the following weeks he says he is selling his other house, which he says was bought about nine years earlier [#5471](https://altillyfiles.com/chat#5471) [#6163](https://altillyfiles.com/chat#6163)–[#6166](https://altillyfiles.com/chat#6166). Nothing in the chat shows how the new house or its renovation was paid for. #### 17-18 May 2021 Nayiem and Mike plan a new exchange, Altfenix [#5235](https://altillyfiles.com/chat#5235). Nayiem pushes for cold wallets and manual withdrawals [#5666](https://altillyfiles.com/chat#5666). He tells Mike, "I trust you with the hosting panel. It's not like something bad ever happened before." [#5658](https://altillyfiles.com/chat#5658) Mike says he can "probably get that 10k by the end of the week" [#5728](https://altillyfiles.com/chat#5728). #### 26 June 2021 Nayiem tells Chuck to price claims at the lower of the open and close values, "the most beneficial for us". Chuck adds to pick 25 or 26 December, "Whichever is better for us", and Nayiem agrees [#6842](https://altillyfiles.com/chat#6842) [#6846](https://altillyfiles.com/chat#6846) [#6847](https://altillyfiles.com/chat#6847). Nayiem says altcoin prices were spiking around the hack, and they did not want a one-day spike to set the value. #### September 2021 The refunds are not finished. Chuck is still building the non-saved asset sheets [#7426](https://altillyfiles.com/chat#7426) and a BTC claim page [#7517](https://altillyfiles.com/chat#7517). Altfenix has not launched [#7428](https://altillyfiles.com/chat#7428). ### The Revolut card (February-March 2021) #### 2 February 2021 Nayiem, as admin of his Revolut Business account, invites Chuck and Mike [#3625](https://altillyfiles.com/chat#3625) and sets up Mike's accounts [#3638](https://altillyfiles.com/chat#3638) [#3644](https://altillyfiles.com/chat#3644). Mike asks whether Revolut sends cards to China [#3639](https://altillyfiles.com/chat#3639), and Revolut shows him that its service is not offered in his country [#3646](https://altillyfiles.com/chat#3646). Nayiem says to send the card to his own address and he will forward it [#3647](https://altillyfiles.com/chat#3647). Mike registers and orders the card [#3693](https://altillyfiles.com/chat#3693). #### 4 February 2021 (key) Nayiem posts a photo of the card envelope, addressed to "PAUL Vernon": "That was really quick." [#3833](https://altillyfiles.com/chat#3833) He forwards it, and Mike receives it on 19 February [#3960](https://altillyfiles.com/chat#3960). Nayiem says he searched the name and found only a British musician [#7585](https://altillyfiles.com/chat#7585) [#7595](https://altillyfiles.com/chat#7595). He did not act on it. #### 25 March 2021 Asked to complete an identity check, Mike says, "my passport is at the china visa office" [#4414](https://altillyfiles.com/chat#4414) [#4415](https://altillyfiles.com/chat#4415). ### The end of the chat (October 2021) #### 20-21 September 2021 Mike says people may buy his current house, then "A deal was made", and that he expects to move in to the new one within a couple of weeks [#7535](https://altillyfiles.com/chat#7535) [#7544](https://altillyfiles.com/chat#7544) [#7558](https://altillyfiles.com/chat#7558). #### 26 October 2021 (key) Mike's last message in the group: "yes, the dev got the whole thing" [#7570](https://altillyfiles.com/chat#7570) [#7571](https://altillyfiles.com/chat#7571). The chat then goes silent until February 2025. Nayiem kept working with Mike in other channels into 2022. #### Late 2021 onwards Nayiem says that from late 2021 he paid refunds himself, mainly from his share of the 2022 sale of his mining businesses after the investors were paid. He says all of that share went to refunds except about $25,000 for personal debt, about $900,000 in total by his count. He has statements for some of the payments, not a full ledger, and the figure cannot be verified from this site. Treat it as his claim. (Nayiem's account.) #### 1 March-17 May 2022 Companies House gives notice on 1 March 2022 that Qredit Ltd will be struck off. On 17 May 2022 the company is dissolved by compulsory strike-off. It never filed a confirmation statement or accounts. ([Companies House filing history](https://find-and-update.company-information.service.gov.uk/company/13077371/filing-history)) #### 2022-2023: refunds wind down Nayiem says he stopped paying refunds around 2022/2023 and made only a handful after that. He estimates the unpaid claims left at around $50,000–60,000 in total, but they are now close to impossible to check: many of the coins' chains no longer exist, including the old Qredit chain, and the Altilly database was lost. He says many of the last claims he received were fake. He also says he lost the energy to go on once he came to believe who Mike was, and saw Xeggex carry on. No further refunds are promised. (Nayiem's account.) See [Refunds](https://altillyfiles.com/refunds). ### Xeggex and Dokdo (2021-2022) #### 31 August-20 September 2021 The xeggex.com domain is registered (31 August), and the Xeggex GitHub organisation is created (20 September). Both dates are months before Mike tells Nayiem about Xeggex. #### Early 2022 Mike tells Nayiem that an exchange called Xeggex wants to list Qredit for free and that he has checked it. About a month later he says "Karl from Xeggex" might sell the exchange. Mike proposes that he and Nayiem work on Xeggex together and approach Karl, and introduces him. (Nayiem's account.) #### 6 June 2022 (key) A Xeggex notice posted by "Karl" says Xeggex will be acquired by Dokdo UAB, a Lithuanian company. Dokdo was Nayiem's company, and he announced the plan publicly, on the condition of full KYC/AML compliance. Archived copies of the Xeggex site from 6 June 2022 and from September to December 2022 call it "a service of Dokdo Global". ([Wayback Machine](https://web.archive.org/web/2022*/xeggex.com)) Nayiem says he asked for the backend and wallet code for an audit and received only the frontend. This deal is why people later linked him to Xeggex. #### Around November 2022 (key) Nayiem cancels the Dokdo acquisition. He says that at about the same time as the Solar incident below, he came to believe that Mike was running Xeggex himself, that "Karl" did not exist, and that Mike was Paul Vernon. **These are beliefs.** No authority has confirmed them. (Nayiem's account.) ### The Solar SXP incident (November 2022 onwards) #### 29 November 2022 (key) Solar Network, a project Nayiem led as CEO, detects unauthorised swaps. According to Solar's statement of 30 November 2022, "a series of unauthorised swap transactions were detected which took place between 12th August 2022 and 29th November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins", and "In total, 1,878,477 SXP was fraudulently swapped during this time resulting from a vulnerability detected in the BSC nodes used to provide API data to the swap service." The same evening, at 22:45, Nayiem writes to Mike on Discord: "Why did you do it Mike?" (Nayiem's Discord screenshots, from his February 2025 write-up; his own evidence, not an official record.) #### 30 November 2022 (key) Solar posts a statement in the Solar validator group on Discord, titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS" (not on its public Telegram channel, blog or Twitter): ![Solar statement, 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png) It says the incident "was not due to a hack or breach of security of the Solar mainnet or Solar Core", that "user funds were never at risk", and that it did "not" result "in the creation of new SXP coins". It also says: "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." The statement does not name Mike or anyone else. That the perpetrator was Mike comes from Nayiem's Discord screenshots, not from the statement. At 00:17 on 30 November Nayiem wrote: "We are not going to say anything if you can return the funds in 24hrs." At 05:43 MikeO replied: "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." None of this has been confirmed by any authority. #### 3 December 2022 MikeO asks, "should I start removing references to Dokdo on Xeggex?", and Nayiem answers, "Yes, please." The same day MikeO writes: "I had nothing to do with the altilly hack." (Nayiem's Discord screenshots.) #### 1 December 2022-19 March 2024: repayment (key) By Nayiem's account, Mike repays the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. The final payments can be checked on the Solar blockchain. The dates, amounts and transaction IDs are in the [Solar repayment ledger](https://altillyfiles.com/story#after-altilly) in My story. This money was for the Solar incident, not for Altilly. Nayiem did not warn Xeggex users during this time. He says he had no proof that Mike ran Xeggex, was afraid of him and expected not to be believed, that his only contact with Mike after the business relationship ended was about getting money back, and that he put getting the money back first. ### The end of the relationship (2022-2024) #### After the Solar incident Nayiem says the business relationship ended in late 2022 and he stopped trusting Mike. After that, he stayed in contact with Mike for one reason: getting money back. First the Solar funds, which Mike repaid in full by 19 March 2024, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck. Mike never followed up on it. In 2025 Nayiem wrote that after the repayment "we never spoke again"; the account here is the more complete one. (Nayiem's account.) #### December 2022-January 2023: Hetzner and Xeggex While they worked together, Mike had his own project inside Nayiem's Hetzner account, with its own API key. He could create and manage servers in that project [#5937](https://altillyfiles.com/chat#5937) [#5941](https://altillyfiles.com/chat#5941) [#6040](https://altillyfiles.com/chat#6040)–[#6042](https://altillyfiles.com/chat#6042), but had no access to the rest of the account. That is how Altilly's new servers were set up in 2020 [#1119](https://altillyfiles.com/chat#1119) [#1121](https://altillyfiles.com/chat#1121) [#2586](https://altillyfiles.com/chat#2586). After they split up in late 2022, Nayiem found out that Mike was also using that project for Xeggex, including a Solar node for Xeggex. Nayiem told him to move everything out of it. Mike finished in January 2023, and Nayiem deleted the servers. (Nayiem's account; the chat ends in 2021.) #### 2023-2024: records around Xeggex - UK Companies House lists a director registered as Michael O'Sullivan for XEGGEX SOFTWARE SERVICES LTD (incorporated 2 June 2023, dissolved 31 December 2024) and XGX SOFTWARE LTD (incorporated 18 March 2024, dissolved 26 August 2025). The register does not verify identities. ([Companies House](https://find-and-update.company-information.service.gov.uk/company/14910559/officers)) - On 1 April 2024 the GitHub account mrmikeo ("MikeO"), which Altilly used for development, makes a commit to Xeggex's official GitHub organisation. ([commit d1479b80](https://github.com/xeggex/hummingbot/commit/d1479b80fe4003100502eea94d7142d3de54c7eb)) ### The Xeggex collapse (February-June 2025) #### 2-3 February 2025 (key) Xeggex halts withdrawals, saying its CEO's Telegram account was hacked, and later blames a corrupted database. Blockchain analysts report outflows from its hot wallets on 2-3 February, before the announcement. People start accusing Nayiem because of the Dokdo deal, and threats follow. #### 7 February 2025 A Change.org petition by Xeggex users names the Telegram user "MrMike_O" as Xeggex's business director and links him to Altilly. It does not name Vernon. ([petition](https://www.change.org/p/demand-for-immediate-investigation-and-restitution-for-victims-of-xeggex-crypto-exchange-18ba0d68-051a-44fe-ac1a-8cbbf631f582)) #### 8-11 February 2025 (key) Nayiem posts "Xeggex 'hack'" on Reddit (8 February) and then a longer write-up, "Follow-Up on the Xeggex Story", which he shared with investigators and initially posted on Reddit. Its content is now on this site, corrected against the chat where it was wrong. He wrote it quickly and from memory. It has wrong dates and other errors, including that Vernon had "never been criminally charged", and it states some beliefs as facts. It also names a private person linked to Mike's postal address, links a property listing, and says he would share Mike's personal details "if there was a 100% guarantee that people would visit his location". [My story](https://altillyfiles.com/story) lists the corrections, including these. In the same days he replies to old messages in this chat [#7572](https://altillyfiles.com/chat#7572) [#7574](https://altillyfiles.com/chat#7574). In early 2025 he also reports what he knows to the FBI and the US Marshals Service. The write-up says "a two-way dialogue was officially opened" with the Marshals; he says a two-way dialogue was opened and a tip reference number (777-W77728) issued, but the Marshals never responded in it beyond that. #### 5 March 2025 Rekt News publishes "Plant a Red Flag". It repeats the community claim that "Karl" is Paul Vernon, with no evidence of its own. ([Rekt](https://rekt.news/plant-a-red-flag)) #### 27 June 2025 (key) Xeggex announces that it is shutting down and filing for bankruptcy. No court case or administrator has been made public. No law-enforcement action about Xeggex has been reported. ### Ownership and publication (September 2026) #### 27 September 2026 Nayiem asks Chuck for ownership of this group [#7576](https://altillyfiles.com/chat#7576). Until then he had no admin rights here and could delete only his own messages. He posts the WHOIS record for satotechltd.com [#7577](https://altillyfiles.com/chat#7577). #### 28 September 2026 (key) Chuck transfers ownership to Nayiem [#7578](https://altillyfiles.com/chat#7578). #### 29 September 2026 (key) - Nayiem announces that the group will become public and read-only [#7579](https://altillyfiles.com/chat#7579). In the end the Telegram group stays private: the redacted chat is published on this site instead, and the unredacted chat, including deleted messages, is available to any authority that asks (Telegram [@nayiem](https://t.me/nayiem)). - He removes customer data and third-party data from the export [#7598](https://altillyfiles.com/chat#7598). - He adds notes to old messages, for example [#7585](https://altillyfiles.com/chat#7585), [#7587](https://altillyfiles.com/chat#7587) and [#7595](https://altillyfiles.com/chat#7595). Some of them state his beliefs as facts ("Mike/Paul"). Please read them as beliefs. - He posts in the old public Altilly Telegram group that he believes the Altilly "hack" was an inside job by a developer, and that he will publish this website and the chat. #### 30 September 2026 This website goes live, with the chat published read-only. --- # Refunds Source: https://altillyfiles.com/refunds Markdown: https://altillyfiles.com/content/refunds.md ## How the refunds were handled > **Note:** > > **Editorial summary.** This page is the site's summary of what the management chat shows about refunds after the December 2020 Altilly loss. It is not written in Nayiem's voice; his own account is on the story page. Every factual statement links to the chat message it rests on. Where a point comes only from Nayiem's own statements made later, it is labelled as his claim. ### In short - A claim form went up within days of the loss. It first allowed 60 days; on 3 January 2021 the deadline was cut to 9 January [#1973](https://altillyfiles.com/chat#1973), [#2029](https://altillyfiles.com/chat#2029), [#2443](https://altillyfiles.com/chat#2443). In late January 2021 Chuck asked for the public form to be taken down, and Nayiem said he would do it [#3355](https://altillyfiles.com/chat#3355)–[#3358](https://altillyfiles.com/chat#3358), [#3362](https://altillyfiles.com/chat#3362). - Claims were checked mainly against users' original deposit-confirmation emails [#2146](https://altillyfiles.com/chat#2146), [#3965](https://altillyfiles.com/chat#3965). - Coins that were saved were paid back in kind. Many were sent directly by Mike from the recovered wallets, about 60 coins in early April 2021 alone [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). Others were handed to the coins' own developers to distribute [#2149](https://altillyfiles.com/chat#2149), [#6739](https://altillyfiles.com/chat#6739), [#7037](https://altillyfiles.com/chat#7037)–[#7038](https://altillyfiles.com/chat#7038). - Several saved wallets did not hold enough to cover every claim [#4686](https://altillyfiles.com/chat#4686), [#4849](https://altillyfiles.com/chat#4849), [#6750](https://altillyfiles.com/chat#6750), [#7450](https://altillyfiles.com/chat#7450). - When the refund work in the chat stops in September 2021, refunds for coins that were not saved had still not been paid, and some saved-coin payments were still pending [#6876](https://altillyfiles.com/chat#6876), [#7421](https://altillyfiles.com/chat#7421), [#7426](https://altillyfiles.com/chat#7426), [#7517](https://altillyfiles.com/chat#7517). - Nayiem says he stopped processing refunds around 2022/2023, with only a handful after that. He estimates the remaining unpaid claims at around $50,000–60,000, but most can no longer be checked. See "Where refunds stand today" below. - Some messages from the team about refunds are bad. They are listed below and remain in the published chat. ### The claim form and deadline On 27 December 2020, the day the loss was estimated at about $1 million [#1677](https://altillyfiles.com/chat#1677), Nayiem told the team "1 million usd can be done. It's not impossible" and asked them to stay on to earn the money to pay everyone back [#1626](https://altillyfiles.com/chat#1626). On 28 December 2020 a repay@ mailbox was set up [#1988](https://altillyfiles.com/chat#1988)–[#2028](https://altillyfiles.com/chat#2028) and a Google claim form was added to the website [#2029](https://altillyfiles.com/chat#2029). The same day he created a sheet of deposit addresses "for the teams that are willing to pay out their users if we just send them the balance" [#2030](https://altillyfiles.com/chat#2030). Mike had suggested giving people 60 days to fill in the form [#1973](https://altillyfiles.com/chat#1973), and posts from the time show that the form first ran to 26 February 2021 ([r/garlicoin](https://old.reddit.com/r/garlicoin/comments/kmban0/), [Quadriga Initiative](https://quadrigainitiative.com/casestudy/altillyhotwalletshackedandcoldwalletslost.php)). Nayiem wanted a minimum claim of 25 or even 50 USD, partly so that airdrop holders could not claim [#1964](https://altillyfiles.com/chat#1964)–[#1970](https://altillyfiles.com/chat#1970). Altilly's public notice set the minimum at 10 USD: "Only users that had a balance with a value of more than 10 USD will be paid back" (quoted on [r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/), 30 December 2020). On 3 January 2021 Nayiem said he was going to "change the window for the refund" [#2438](https://altillyfiles.com/chat#2438). The site notice he then posted told users they had "14 days from today", with a final date of 9 January 2021, 23:59 CET, six days away [#2443](https://altillyfiles.com/chat#2443) (image). Chuck thought changing the date was a mistake that people would read as "a desperation act" [#2444](https://altillyfiles.com/chat#2444), [#2445](https://altillyfiles.com/chat#2445). Nayiem said he would add a form that people could still fill in after the 14 days [#2447](https://altillyfiles.com/chat#2447). On 27 January 2021 Chuck asked Mike to remove the form link from the website completely, with a notice that the claim period had expired, and to make a new link that "only us 3 can be aware of", for "special circumstances only" [#3355](https://altillyfiles.com/chat#3355)–[#3358](https://altillyfiles.com/chat#3358). In May 2021 Chuck said "thousands" had been too late for the form [#5052](https://altillyfiles.com/chat#5052). The user database had been lost with the servers, so balances had to be rebuilt from what users sent in. Mike provided a list of 137 saved assets for the website [#1757](https://altillyfiles.com/chat#1757), [#1758](https://altillyfiles.com/chat#1758). ### Checking claims: deposit emails Chuck suggested asking each claimant to forward the deposit-confirmation email they had received from Altilly, to "eliminate fake screenshots" [#2146](https://altillyfiles.com/chat#2146). That became the main check, although Nayiem had noted on the first day of planning that "not everyone received those emails" [#1962](https://altillyfiles.com/chat#1962). In February 2021 he said of claimants who could not fully prove their balance: "we don't have a method yet and are not going to think about refunding those people yet" [#4313](https://altillyfiles.com/chat#4313). By February 2021 Chuck described the process: find everyone who listed a given coin on the claim form, email them for their deposit confirmations, enter the amount on the email into the sheet, and approve that amount for refund [#3965](https://altillyfiles.com/chat#3965). Chuck also wanted transaction IDs linked to each Altilly username [#3993](https://altillyfiles.com/chat#3993). Payouts were capped at what the user had claimed on the form, even if they later showed more deposit emails [#4828](https://altillyfiles.com/chat#4828). For example, when a zcore claim showed 4,600 on the form but 15,702 owed, Chuck said "send 4600" [#4869](https://altillyfiles.com/chat#4869), [#4870](https://altillyfiles.com/chat#4870). Chuck also noted the weakness of the method: some users sent deposit emails but not their withdrawal emails [#4665](https://altillyfiles.com/chat#4665). The checks were not always applied, as the section on bad messages below shows [#3564](https://altillyfiles.com/chat#3564), [#3953](https://altillyfiles.com/chat#3953). ### Saved coins paid in kind Most of the saved-coin refunds in the chat were sent directly to users by Mike from the recovered wallets. Over 1-3 April 2021 he reports coin after coin as "done" in the group, around 60 in total, with Chuck working through the sheets and user addresses alongside him [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). Some coins were handed to their project's developers, who then paid their own users: - **Beyondcoin (BYND).** Chuck posted a message, marked as coming from the developer, saying "practically all the BYND lost in the hack" was accounted for and asking for an address to receive the coins [#2149](https://altillyfiles.com/chat#2149)–[#2151](https://altillyfiles.com/chat#2151). Nayiem later posted the on-chain address for follow-up [#3224](https://altillyfiles.com/chat#3224). - **Goldcoin.** In January 2021 the team chased the Goldcoin developer, who had deleted his chat history with Chuck [#3245](https://altillyfiles.com/chat#3245)–[#3252](https://altillyfiles.com/chat#3252), and kept screenshots showing he had received the funds [#3253](https://altillyfiles.com/chat#3253), [#3258](https://altillyfiles.com/chat#3258)–[#3269](https://altillyfiles.com/chat#3269) (images). - **HONK.** Nayiem gave the private keys for the SLP token wallet to the HONK developer, who chose to pay the users himself [#6739](https://altillyfiles.com/chat#6739), [#6761](https://altillyfiles.com/chat#6761). - **WRKZ.** The WRKZ developer received the wallet [#7037](https://altillyfiles.com/chat#7037), [#7038](https://altillyfiles.com/chat#7038). When the saved and non-saved asset lists dropped off the website in August 2021, Chuck asked for them back "until all are refunded", and Nayiem agreed to re-add them [#7156](https://altillyfiles.com/chat#7156)–[#7163](https://altillyfiles.com/chat#7163). ### Shortfalls Several saved wallets held less than was owed: - Betller: "betler sent 90700.5, thats all we had" [#4686](https://altillyfiles.com/chat#4686). - MRX: "mrx wallets say 0" [#4849](https://altillyfiles.com/chat#4849), while users were still asking Chuck about MRX [#4580](https://altillyfiles.com/chat#4580). The chat does not explain why. - HONK: "We recovered 5.25 billion honk. The rest was lost." [#6750](https://altillyfiles.com/chat#6750) - Blocknet: "does not have enough in wallet to cover refunds", so Chuck opened a sheet for partially saved assets [#7450](https://altillyfiles.com/chat#7450). ### Not every approved user got their saved assets Not every approved user got their saved assets back. In January 2021 Nayiem did some refunds himself [#3215](https://altillyfiles.com/chat#3215), [#3514](https://altillyfiles.com/chat#3514), but most of the saved-asset keys stayed with Mike, who kept them on his own machines [#1621](https://altillyfiles.com/chat#1621), [#3917](https://altillyfiles.com/chat#3917). Mike did the bulk sends in one push from 1 to 3 April 2021 [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903), and by May Chuck said most approved users had been paid [#4966](https://altillyfiles.com/chat#4966). The rest stalled. Mike promised a program for the leftovers "tomorrow" [#4875](https://altillyfiles.com/chat#4875), TUSC had "not yet" gone out [#4906](https://altillyfiles.com/chat#4906), and Chuck kept asking him about RDD, HONK and unpaid first rounds [#5951](https://altillyfiles.com/chat#5951), [#6432](https://altillyfiles.com/chat#6432)–[#6433](https://altillyfiles.com/chat#6433), [#6876](https://altillyfiles.com/chat#6876). In the end Nayiem got HONK moving and handed its keys to the developer himself [#6731](https://altillyfiles.com/chat#6731), [#6739](https://altillyfiles.com/chat#6739). Part of the blame is Nayiem's: when Chuck pushed, he put refunds behind QSLP and other work [#7050](https://altillyfiles.com/chat#7050)–[#7053](https://altillyfiles.com/chat#7053), [#7142](https://altillyfiles.com/chat#7142)–[#7144](https://altillyfiles.com/chat#7144), [#7180](https://altillyfiles.com/chat#7180)–[#7181](https://altillyfiles.com/chat#7181). Chuck's last request to Mike to clear everything pending got no answer in the chat [#7421](https://altillyfiles.com/chat#7421). Coin by coin, the chat shows the keys for the unpaid saved assets with Mike: - **TUSC.** Mike: "i have the keys to both wallets" [#4878](https://altillyfiles.com/chat#4878), [#1781](https://altillyfiles.com/chat#1781), [#1799](https://altillyfiles.com/chat#1799). Moved back to the saved list [#4885](https://altillyfiles.com/chat#4885); 45 users [#4900](https://altillyfiles.com/chat#4900); "Have not yet" sent on 20 April [#4906](https://altillyfiles.com/chat#4906). No send is recorded. - **HIVE.** Mike: "I have the keys on my computer" [#3917](https://altillyfiles.com/chat#3917). No balance or send is recorded, and in June Chuck still did not know where it was [#6724](https://altillyfiles.com/chat#6724). - **COLX.** Mike said the wallet held "like 100m" [#5915](https://altillyfiles.com/chat#5915). No payout is recorded. - **PYRK.** Mike said he had moved the user funds "to community fund wallet awhile back" [#7096](https://altillyfiles.com/chat#7096). No payout is recorded. - **Cryptonote coins (such as Aeon) and RDD stragglers.** Put off until Mike could write a program or "go thru all from time to time" [#4621](https://altillyfiles.com/chat#4621), [#4875](https://altillyfiles.com/chat#4875), [#5956](https://altillyfiles.com/chat#5956). - **Mooncoin straggler.** Chuck's request to "send some Moon to a user" got no reply [#6880](https://altillyfiles.com/chat#6880), [#6881](https://altillyfiles.com/chat#6881). On the other side, Nayiem held the Hetzner hosting account and was closing down the saved-wallet servers in June 2021 [#5656](https://altillyfiles.com/chat#5656)–[#5658](https://altillyfiles.com/chat#5658), [#6672](https://altillyfiles.com/chat#6672). He handled Goldcoin and MRX himself in January [#3215](https://altillyfiles.com/chat#3215), [#3193](https://altillyfiles.com/chat#3193), [#3492](https://altillyfiles.com/chat#3492). When he took on HONK, he had it working in about 30 minutes [#6734](https://altillyfiles.com/chat#6734). Blocknet was short of funds as well as late [#7450](https://altillyfiles.com/chat#7450). **Banano.** Banano does not appear anywhere in the chat, so the chat cannot show who held its keys or whether it was saved. Nayiem says Mike kept access to the Banano wallet and never completed the refund, as with the other saved assets left unpaid. That is his account, not something the chat shows. ### The support desk (Freshdesk) The Freshdesk help desk, where claims came in as support tickets, was set up and run by Mike, who called the admin login "my login" [#83](https://altillyfiles.com/chat#83), [#4421](https://altillyfiles.com/chat#4421). At first he paid for it and the team's Fastmail himself [#3229](https://altillyfiles.com/chat#3229), [#3288](https://altillyfiles.com/chat#3288). In March 2021 a card payment failed, so Nayiem gave Mike his own card, and Mike used it for both services [#4417](https://altillyfiles.com/chat#4417), [#4419](https://altillyfiles.com/chat#4419), [#4420](https://altillyfiles.com/chat#4420). Nayiem says he remembered this only vaguely; the chat confirms it. After that, keeping the service running depended on Nayiem putting money on that card. When he had none, Freshdesk was disabled [#5602](https://altillyfiles.com/chat#5602), [#5971](https://altillyfiles.com/chat#5971), [#6029](https://altillyfiles.com/chat#6029), and it came back once he paid [#6901](https://altillyfiles.com/chat#6901). Even then, with his card charged and all invoices shown as paid, the account once still showed as "inactive" [#6903](https://altillyfiles.com/chat#6903). Chuck could use it anyway [#6904](https://altillyfiles.com/chat#6904), and Nayiem says he never found out why it showed that. It was suspended again in August 2021, and Freshworks said it had emailed "Michael", meaning Mike, and got no reply [#7345](https://altillyfiles.com/chat#7345). Nayiem paid again [#7319](https://altillyfiles.com/chat#7319), [#7357](https://altillyfiles.com/chat#7357). The chat does not show when the ticket history was lost for good. ### After Freshdesk - **A refunds group.** In May 2021 Chuck set up a Telegram group for refunds, to keep refund questions out of the ideas group, and monitored it himself [#5003](https://altillyfiles.com/chat#5003), [#5006](https://altillyfiles.com/chat#5006). - **Claim-form data only.** In May 2021 Nayiem wrote that they "couldnt send emails to everyone. Because we don't have the database" [#5011](https://altillyfiles.com/chat#5011). The team's refund data covered only the people who had filled in the claim form, and "thousands" had been too late for it [#5050](https://altillyfiles.com/chat#5050), [#5052](https://altillyfiles.com/chat#5052). Nayiem now says he still had all the customer emails; the chat does not show that. - **A refund token.** For coins that were not saved, Nayiem planned a refund token that could trade on the new exchange, Altfenix [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), [#6657](https://altillyfiles.com/chat#6657)–[#6660](https://altillyfiles.com/chat#6660). Under the fee plan, 25% of Altfenix's fees would go to a rainy-day fund that would also pay claims from the hack, and 50% to operations [#5535](https://altillyfiles.com/chat#5535), [#5882](https://altillyfiles.com/chat#5882), [#5883](https://altillyfiles.com/chat#5883). - **ALT2020.** The name "ALT2020" appears once in the chat, in a question from Chuck that got no answer [#7208](https://altillyfiles.com/chat#7208). The token was never launched. In September 2021 the plan still had Altfenix going live some weeks later [#7428](https://altillyfiles.com/chat#7428), and the chat never shows it running. ### What was unfinished by September 2021 The refund work in the chat stops in September 2021, incomplete (the last messages, in October 2021, are brief): - In July, Chuck wrote that some assets had "not been paid first round" [#6876](https://altillyfiles.com/chat#6876). In September he told Mike that all pending saved assets needed to go out first: "Weve made alot of promises we are not keeping and natives are starting to get very restless. Losing trust" [#7421](https://altillyfiles.com/chat#7421). - For coins that were not saved, Chuck was about 80% done with the non-saved asset sheets and conversion tables on 8 September [#7426](https://altillyfiles.com/chat#7426). On 16 September he finished a BTC refund request page with "800+ users for now" from "over 1600 entries" [#7517](https://altillyfiles.com/chat#7517)–[#7519](https://altillyfiles.com/chat#7519). - Plans for paying non-saved assets included a refund token and QSLP tokens [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), [#6807](https://altillyfiles.com/chat#6807), [#6836](https://altillyfiles.com/chat#6836). The chat shows no payment of non-saved assets. > **Caveat:** > > **Nayiem's $900,000 figure is a claim, not a proven number.** Nayiem says that from late 2021 he paid refunds from his own income, and that when he sold his mining businesses in 2022 he used the proceeds first to pay back the investors and then his own share of the sale to pay Altilly refund users, all of it except about $25,000 that covered his personal debt, and that by his own count this comes to about $900,000. All of this happened after the chat ends, so the chat cannot confirm it. He says he has statements for some of the payments but no complete ledger, and the sale of the mining company is not documented on this site. The only amounts in the chat are the loss estimate of about $1 million [#1677](https://altillyfiles.com/chat#1677) and remarks such as "we can not mine for 200k usd in a short period of time" [#5184](https://altillyfiles.com/chat#5184). Until redacted statements with totals are published, read the $900,000 as his claim; it cannot be verified from this site. Not everyone was paid, and people who say so publicly may have real grievances. ### Messages that reflect badly on the team These messages are part of the published chat. They are listed here so readers do not have to find them. - **Stalling claimants, May 2021.** After Nayiem complained that people were only now finding their balances [#5011](https://altillyfiles.com/chat#5011), Chuck wrote "I can drag it out forever if you want. Im pretty good with word play", "they will feel good about it" and "Hang the carrot out front and they will follow". Nayiem replied "Go for it." [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020). There was a plan behind the waiting: since January Nayiem had talked about repaying non-saved assets with a token [#2442](https://altillyfiles.com/chat#2442), [#2853](https://altillyfiles.com/chat#2853), and the next day he set it out as an "Altilly refund token", pegged to a value, listed on the new exchange (later Altfenix) and bought back "at 1usd for example", including from users willing to take less [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203). 25% of the new exchange's fees was set aside partly for hack claims [#5535](https://altillyfiles.com/chat#5535), [#5882](https://altillyfiles.com/chat#5882). There were no funds to pay otherwise [#5184](https://altillyfiles.com/chat#5184), [#5602](https://altillyfiles.com/chat#5602). In June the plan became tokens per coin with bid markets on Altfenix [#6657](https://altillyfiles.com/chat#6657)–[#6665](https://altillyfiles.com/chat#6665). Chuck also described stretching out the saved-asset rounds to buy time [#5962](https://altillyfiles.com/chat#5962), [#6027](https://altillyfiles.com/chat#6027), [#6811](https://altillyfiles.com/chat#6811), and Nayiem called that "a good thing, because the next solution will be better and easier for all of us" [#6813](https://altillyfiles.com/chat#6813). Altfenix never launched. For the people told to wait, it was still stalling. - **Choosing the lowest price, June 2021.** To value claims, the team used CoinGecko's price history for the days of the hack [#6838](https://altillyfiles.com/chat#6838)–[#6841](https://altillyfiles.com/chat#6841). Nayiem told Chuck to take the lower of the day's open and close prices — "the most beneficial for us. So the lowest one" — and, "if there is a massive difference with the day before, then again, the lowest value" [#6842](https://altillyfiles.com/chat#6842). Chuck suggested 25 or 26 December, "whichever is better for us", and Nayiem agreed [#6844](https://altillyfiles.com/chat#6844)–[#6847](https://altillyfiles.com/chat#6847). The hack fell in a period when altcoin prices were spiking, and the team did not want a one-day spike to set the value. Valuing at the date of the loss is normal, but choosing the lowest of the available prices "for us" favoured the exchange over the people owed money, and Nayiem should have picked one neutral rule instead. - **Loose checks, January 2021.** The team had thousands of claims, many sent as screenshots, so Nayiem did not check every transaction: "We will be here for another 10 years if we start checking all txid's" [#3566](https://altillyfiles.com/chat#3566). Instead he checked each coin as a whole: after collecting all claims for a coin, the total had to match what was left in that coin's wallet — "I make sure that the end balance matches with what Im going to refund" [#3558](https://altillyfiles.com/chat#3558) — and if it did not, "then its fucked up", which had not happened yet [#3570](https://altillyfiles.com/chat#3570). Claims without an amount were held back until the team found the deposit email [#3555](https://altillyfiles.com/chat#3555). Within that check, Nayiem did not look at individual small claims: "anything between 50-200 usd I don't check at all" [#3563](https://altillyfiles.com/chat#3563), [#3564](https://altillyfiles.com/chat#3564). He kept no separate payout ledger beyond marking addresses with users [#3574](https://altillyfiles.com/chat#3574), [#3575](https://altillyfiles.com/chat#3575), and team members who had bought on Altilly did not have to send deposit emails [#3951](https://altillyfiles.com/chat#3951)–[#3953](https://altillyfiles.com/chat#3953). Checking the totals stopped anyone from claiming more than a wallet held, but it could not stop one person's inflated claim from being paid out of other people's share, and the missing payout ledger is why Nayiem cannot show today who was paid what. - **"Remove all traces", February 2021.** The team's banking partner gave them a list of 139 high-risk countries, including Nigeria [#4020](https://altillyfiles.com/chat#4020)–[#4028](https://altillyfiles.com/chat#4028). Most of Altilly's users were from Nigeria, and the team decided not to refuse them refunds [#4021](https://altillyfiles.com/chat#4021), [#4034](https://altillyfiles.com/chat#4034)–[#4036](https://altillyfiles.com/chat#4036). Nayiem's worry was that small payments into listed countries could get their accounts closed [#4028](https://altillyfiles.com/chat#4028) while they were setting up a regulated business with a new banking partner [#4083](https://altillyfiles.com/chat#4083). For "a really pushy person", Nayiem told Chuck to "do the refund, but not by email and remove all traces" [#4029](https://altillyfiles.com/chat#4029); Chuck replied "Wait" / "what?" [#4030](https://altillyfiles.com/chat#4030), [#4031](https://altillyfiles.com/chat#4031). Nayiem had already done this once for a long-time user who had become very offensive: he put him on a separate list to be paid at the end and deleted the messages [#4032](https://altillyfiles.com/chat#4032), [#4033](https://altillyfiles.com/chat#4033); Nayiem says that user was later paid. The people were owed that money and, by Nayiem's account, they got it. But paying the loudest people quietly and erasing the record was unfair to those who waited, and hiding payments is not how a business that wants a licence should operate. - **Dismissing a threat, December 2020.** When Chuck showed him a threat from a user, Nayiem wrote "What an idiot." and "Let him do his thing." [#2155](https://altillyfiles.com/chat#2155)–[#2160](https://altillyfiles.com/chat#2160). Other messages in the same vein include telling a new admin not to say how many people had filled in the form [#2453](https://altillyfiles.com/chat#2453)–[#2456](https://altillyfiles.com/chat#2456), saying "we are not telling when it will be distributed" [#2217](https://altillyfiles.com/chat#2217), removing a dated repayment promise from the website [#3418](https://altillyfiles.com/chat#3418)–[#3421](https://altillyfiles.com/chat#3421), removing a public post at Chuck's suggestion [#1911](https://altillyfiles.com/chat#1911)–[#1918](https://altillyfiles.com/chat#1918), "don't worry about the users… I will come up with a clever solution" [#5051](https://altillyfiles.com/chat#5051), planning a refund token partly to "create some trading activity on it" [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), and asking to announce a two-week pause in refund support for product work, to which Chuck replied that it would not be wise to tell users they were pausing "for any reason" [#6035](https://altillyfiles.com/chat#6035)–[#6037](https://altillyfiles.com/chat#6037). ### Money was short on both sides The chat shows that the people handling refunds had little money themselves: - On 27 December 2020, two days after the servers were deleted, Chuck said: "I just have to be able to pay my bills" [#1627](https://altillyfiles.com/chat#1627). - In January 2021, when the team had 72 hours to download a copy of the database, Nayiem wrote "Because I have no money at all", and Mike said he could come up with the cost [#2800](https://altillyfiles.com/chat#2800)–[#2806](https://altillyfiles.com/chat#2806). - In May 2021, when Freshdesk was about to charge the support card, Nayiem wrote "I have zero cash, I'm sure they can wait a few days" [#5600](https://altillyfiles.com/chat#5600)–[#5602](https://altillyfiles.com/chat#5602). - Nayiem still paid some running costs, such as topping up the company card [#4386](https://altillyfiles.com/chat#4386), [#4387](https://altillyfiles.com/chat#4387). The chat records Chuck saying, in January 2021, that he had to go to the food bank to get some food [#3430](https://altillyfiles.com/chat#3430). Nayiem says Chuck used a food bank between December 2020 and December 2021, and that they both collected bottles for the deposit to add a little to refunds and bills. The management chat does not record that, but Nayiem says it was posted at the time in the main Altilly Telegram group ([message link](https://t.me/c/1308041716/180323); the link only opens for members of that group). ### Where refunds stand today Everything in this section comes from Nayiem, not from the chat, because the chat ends in October 2021. It is his account and should be read that way. **Refunds stopped around 2022/2023.** Nayiem says he stopped processing refunds around 2022/2023, and that only a handful were paid after that. He says he lost the energy to go on once he came to believe that "Mike" was Paul Vernon and saw Xeggex keep running. That is his belief about Mike; no court or authority has confirmed it. Whatever the reason, the result is the same for the people still waiting: they were not paid. **What is left.** Nayiem estimates that the claims still unpaid add up to around $50,000–60,000 in total. This is his estimate. There is no ledger on this site that shows it, and it should not be read as a checked figure. **Why most remaining claims can no longer be checked.** - *No user database.* Claims were rebuilt from the claim form and users' deposit emails [#1962](https://altillyfiles.com/chat#1962), [#2146](https://altillyfiles.com/chat#2146), [#3965](https://altillyfiles.com/chat#3965). In May 2021 Nayiem wrote that users could not all be emailed "because we don't have the database" [#5011](https://altillyfiles.com/chat#5011), and added "Something tells me this is going to take a few years" [#5012](https://altillyfiles.com/chat#5012). (In January 2021 the team also discussed buying a copy of the database [#2800](https://altillyfiles.com/chat#2800)–[#2806](https://altillyfiles.com/chat#2806), [#2967](https://altillyfiles.com/chat#2967)–[#2972](https://altillyfiles.com/chat#2972); the chat does not show it being used to check claims.) - *Chains that no longer exist.* Many of the coins listed on Altilly in 2020–21 have since shut down, including the old Qredit chain. With no chain, there is nothing left to check a deposit or a refund against. - *Fake and late claims.* From the start the team worried about fake screenshots [#2146](https://altillyfiles.com/chat#2146). Nayiem says that many of the claims that arrived near the end were fake or fraudulent. The chat cannot confirm this, as it happened later. **Why refund transaction IDs often cannot be shown.** People regularly ask for the on-chain transaction ID (txid) of a refund. For coins whose chain has stopped, there is no working block explorer and often no node left to look the transaction up, so the txid proves nothing even if it can be found. The team also kept poor records at the time: Nayiem said he would not retype transaction IDs from screenshots and kept no record of payouts beyond marking addresses with users [#3566](https://altillyfiles.com/chat#3566), [#3574](https://altillyfiles.com/chat#3574), [#3575](https://altillyfiles.com/chat#3575). And some coins were handed to their developers to pay their own users [#2149](https://altillyfiles.com/chat#2149), [#6739](https://altillyfiles.com/chat#6739), [#7037](https://altillyfiles.com/chat#7037)–[#7038](https://altillyfiles.com/chat#7038), so those payments were never made by the Altilly team. For the coins still alive, some payments in the chat can be traced; for many others, they cannot. ### Check the refunds yourself One person collecting testimonials proves little. Any screenshot or single testimony can be called fake, and the answer is the same whether it comes from Nayiem or from someone defending him. The people who can settle whether refunds were paid are the thousands of former Altilly users and the projects that were listed on Altilly. Many of those projects still have Telegram or Discord groups, where their users and developers can be asked directly whether refunds arrived. Projects are invited to ask in their own community and send a short summary: how many people answered, how many say they were refunded, in full or in part, and how many say they were not. The summary will be published on this page with a link to the project's own post, including answers that are unfavourable to Nayiem. Communities where this could start include Mooncoin, Banano, Beyondcoin, Garlicoin, Dogecoin, Namecoin, ColossusXT, 42 coin, Metrix, Aeon, Alias, Afro, PacGlobal and Paccoin (PXC). Summaries can be sent to Nayiem on Telegram at [@nayiem](https://t.me/nayiem) or through the [questions page](https://altillyfiles.com/ask). Please leave out email addresses, home addresses, per-person amounts and anything else private. #### What counts as hard-to-fake evidence - **Cryptographic proof.** Refunds paid in coins whose chains still run can be checked on-chain. Control of a sending wallet can be proven by signing a message with its key, which screenshots or AI cannot fake. - **An independent accountant's letter** that reviews the bank and exchange records, including the 2022 sale of Nayiem's mining businesses and the refund payments he says he made from it. - **Official records of the business sale.** - **Posts made at the time (2021–2023)** by long-standing accounts saying refunds were received. - **Confirmations from project developers** who received coins to distribute to their users. Nayiem plans to add what he can of this to the site. Screenshots of private messages on their own are not offered here as proof, because nobody else can verify them. #### Projects and what the chat shows The table below goes through every asset on the saved list of 137 that Mike provided [#1757](https://altillyfiles.com/chat#1757), [#1758](https://altillyfiles.com/chat#1758). The version of that list pinned in the chat [#1766](https://altillyfiles.com/chat#1766) also has Hive, TUSC and Xenios, and 01coin was refunded although it is not on the list, so the table has 141 rows. It covers **saved assets only**. Assets that were not saved are not in it: their refunds were to be paid through a refund token on Altfenix, and since Altfenix never launched, they were never paid that way (see "After Freshdesk" above). | Status | On the 137 list | Extras | Total | |---|---|---|---| | Sent to users by the team | 66 (Reddcoin is inferred) | 01coin | 67 | | Partly sent | 3 | — | 3 | | Handed to the project's developers | 4 | — | 4 | | Still pending at chat end | 9 | Hive, TUSC | 11 | | No record | 55 | Xenios | 56 | | **Total** | **137** | **4** | **141** | How to read it: - **"No record"** means the chat never reports the coin as sent, partly sent or handed over. Most of these coins are never mentioned at all; a few appear only in passing or in plans that are never reported as carried out (Alias, Kryptokrona). It does not prove nothing was sent; it means the chat does not show it. - **"Still pending at chat end"** is limited to coins the chat names as outstanding and never reports as finished. Several messages say some assets were still unpaid without naming them, for example "28 assets still green" [#4874](https://altillyfiles.com/chat#4874) and "about 14 of these assets" [#6876](https://altillyfiles.com/chat#6876)–[#6877](https://altillyfiles.com/chat#6877); see also [#4971](https://altillyfiles.com/chat#4971), [#6026](https://altillyfiles.com/chat#6026), [#7139](https://altillyfiles.com/chat#7139)–[#7141](https://altillyfiles.com/chat#7141), [#7180](https://altillyfiles.com/chat#7180)–[#7182](https://altillyfiles.com/chat#7182), [#7341](https://altillyfiles.com/chat#7341)–[#7344](https://altillyfiles.com/chat#7344), [#7421](https://altillyfiles.com/chat#7421). Some coins marked "sent" may therefore have had stragglers left over. - **"Handed to the project's developers"** means the coins went to the project, which paid its own users. Those payments do not appear in the chat, so the project's community is the place to ask. - **Tickers.** A "—" means the chat gives no ticker and none could be confirmed. The other tickers come from the chat or from general knowledge. - The list marks some names with `*`. The chat never explains what that means. | Project | Ticker | Status | Date(s) | Messages | Note | |---|---|---|---|---|---| | 42 coin | 42 | Sent to users by team | 01.04.2021 | [#3472](https://altillyfiles.com/chat#3472), [#4612](https://altillyfiles.com/chat#4612), [#4613](https://altillyfiles.com/chat#4613) | | | 01coin (not on list) | ZOC | Sent to users by team | 01–02.04.2021 | [#4596](https://altillyfiles.com/chat#4596)–[#4597](https://altillyfiles.com/chat#4597), [#4608](https://altillyfiles.com/chat#4608), [#4700](https://altillyfiles.com/chat#4700) | | | Aeon | AEON | Still pending at chat end | 28.01.2021, 01.04.2021 | [#3500](https://altillyfiles.com/chat#3500), [#4620](https://altillyfiles.com/chat#4620)–[#4621](https://altillyfiles.com/chat#4621) | Held back because it needed a custom sending tool. | | Afro | AFRO | Sent to users by team | 01.04.2021 | [#4614](https://altillyfiles.com/chat#4614), [#4618](https://altillyfiles.com/chat#4618) | | | Alias | ALIAS | No record | 28.01.2021 | [#3500](https://altillyfiles.com/chat#3500), [#6066](https://altillyfiles.com/chat#6066) | Announced as "soon", never reported as done. | | Anon | ANON | No record | — | — | | | Argoneum | AGM | Sent to users by team | 02.04.2021 | [#4622](https://altillyfiles.com/chat#4622), [#4701](https://altillyfiles.com/chat#4701) | | | Auroracoin | AUR | Sent to users by team | 01.04.2021 | [#4623](https://altillyfiles.com/chat#4623)–[#4628](https://altillyfiles.com/chat#4628), [#4688](https://altillyfiles.com/chat#4688) | Wallet upgraded and resynced first. | | Axe | AXE | Sent to users by team | 01.04.2021 | [#4632](https://altillyfiles.com/chat#4632) | | | Bare | BARE | Sent to users by team | 01.04 and 03.04.2021 | [#4635](https://altillyfiles.com/chat#4635), [#4810](https://altillyfiles.com/chat#4810), [#4815](https://altillyfiles.com/chat#4815)–[#4816](https://altillyfiles.com/chat#4816) | One missed send was done on 03.04. | | BCHSLP (HonkHonk) | HONK | Handed to project devs | 17.06.2021 | [#3936](https://altillyfiles.com/chat#3936), [#4997](https://altillyfiles.com/chat#4997)–[#5002](https://altillyfiles.com/chat#5002), [#6731](https://altillyfiles.com/chat#6731)–[#6739](https://altillyfiles.com/chat#6739), [#6745](https://altillyfiles.com/chat#6745)–[#6761](https://altillyfiles.com/chat#6761), [#6929](https://altillyfiles.com/chat#6929) | Private keys given to the project dev to pay the 7 claimants. Only part of the HONK was recovered; the rest was moved to non-saved ([#6750](https://altillyfiles.com/chat#6750)–[#6754](https://altillyfiles.com/chat#6754)). | | Beam | BEAM | Sent to users by team | Jan 2021 | [#2569](https://altillyfiles.com/chat#2569), [#2576](https://altillyfiles.com/chat#2576), [#3230](https://altillyfiles.com/chat#3230), [#3242](https://altillyfiles.com/chat#3242)–[#3243](https://altillyfiles.com/chat#3243), [#3275](https://altillyfiles.com/chat#3275)–[#3278](https://altillyfiles.com/chat#3278) | Sent directly to the few holders. A late claimant was being checked ([#3275](https://altillyfiles.com/chat#3275)–[#3278](https://altillyfiles.com/chat#3278)). | | BetllerCoin | — | Partly sent | 01.04.2021 | [#4643](https://altillyfiles.com/chat#4643)–[#4645](https://altillyfiles.com/chat#4645), [#4654](https://altillyfiles.com/chat#4654)–[#4667](https://altillyfiles.com/chat#4667), [#4686](https://altillyfiles.com/chat#4686) | Everything in the wallet was sent, but it did not cover the claim. | | Beyondcoin | BYND | Handed to project devs | 30.12.2020 – 19.01.2021 | [#2149](https://altillyfiles.com/chat#2149)–[#2151](https://altillyfiles.com/chat#2151), [#3192](https://altillyfiles.com/chat#3192), [#3212](https://altillyfiles.com/chat#3212)–[#3214](https://altillyfiles.com/chat#3214), [#3223](https://altillyfiles.com/chat#3223)–[#3225](https://altillyfiles.com/chat#3225), [#3228](https://altillyfiles.com/chat#3228), [#3234](https://altillyfiles.com/chat#3234), [#3273](https://altillyfiles.com/chat#3273)–[#3274](https://altillyfiles.com/chat#3274), [#3305](https://altillyfiles.com/chat#3305) | Funds went to the dev, who distributed to about 10 addresses. A declined claim was being followed up. | | BigDataCash | BDCASH | Sent to users by team | 01.04.2021 | [#4661](https://altillyfiles.com/chat#4661), [#4668](https://altillyfiles.com/chat#4668), [#4673](https://altillyfiles.com/chat#4673), [#4689](https://altillyfiles.com/chat#4689) | | | BitBlocks | BBK | Sent to users by team | 01.04.2021 | [#4670](https://altillyfiles.com/chat#4670), [#4672](https://altillyfiles.com/chat#4672) | | | Bitcoindiamond | BCD | Sent to users by team | 01.04.2021 | [#4690](https://altillyfiles.com/chat#4690) | | | BitcoinGold | BTG | No record | — | — | | | Bitcoinmono | — | No record | — | — | | | BitcoinPlus | XBC | Sent to users by team | 01.04.2021 | [#4691](https://altillyfiles.com/chat#4691) | | | Bitcoinz | BTCZ | Sent to users by team | 02.04.2021 | [#4702](https://altillyfiles.com/chat#4702) | | | BitZyon | — | No record | — | — | | | Blocknet | BLOCK | Still pending at chat end | 02.04.2021, 10.09.2021 | [#4717](https://altillyfiles.com/chat#4717), [#7450](https://altillyfiles.com/chat#7450), [#7454](https://altillyfiles.com/chat#7454) | Wallet too small to cover claims; moved to the partially-saved sheet. | | Chimera | — | Still pending at chat end | 02.04.2021 | [#4717](https://altillyfiles.com/chat#4717) | Asked about, never reported done. | | ColosusXT | COLX | Still pending at chat end | 22.05.2021 | [#5912](https://altillyfiles.com/chat#5912)–[#5916](https://altillyfiles.com/chat#5916) | Funds held; the team refused to give them to the dev. | | Cpuchain | CPU | Still pending at chat end | 02.04.2021 | [#4717](https://altillyfiles.com/chat#4717) | | | Crystaleum | — | Still pending at chat end | 30.12.2020, 02.04.2021 | [#2145](https://altillyfiles.com/chat#2145), [#4717](https://altillyfiles.com/chat#4717) | | | Dapscoin | DAPS | Still pending at chat end | 02.04.2021 | [#4703](https://altillyfiles.com/chat#4703) | Wallet was being upgraded; no "done" follows. | | DeepOnion | ONION | Sent to users by team | 01.04.2021 | [#4692](https://altillyfiles.com/chat#4692) | | | Deflacash | — | Sent to users by team | 02.04.2021 | [#4725](https://altillyfiles.com/chat#4725) | | | Delion | DLN | Sent to users by team | 02.04.2021 | [#4726](https://altillyfiles.com/chat#4726) | | | Denarius | D | No record | — | — | | | Dextro | DXO | Sent to users by team | 02.04.2021 | [#4727](https://altillyfiles.com/chat#4727) | | | Dimecoin | DIME | Sent to users by team | 01–02.04.2021 | [#4693](https://altillyfiles.com/chat#4693), [#4711](https://altillyfiles.com/chat#4711)–[#4713](https://altillyfiles.com/chat#4713), [#4720](https://altillyfiles.com/chat#4720) | One claim paid up to the amount claimed. | | Divi | DIVI | No record | — | — | | | DMS (Documentchain) | DMS | Sent to users by team | 02.04.2021 | [#4730](https://altillyfiles.com/chat#4730) | | | Elyacoin | — | No record | — | — | | | Euno | EUNO | Sent to users by team | 01.04.2021 | [#3103](https://altillyfiles.com/chat#3103)–[#3106](https://altillyfiles.com/chat#3106), [#4694](https://altillyfiles.com/chat#4694) | The dev asked for users to be paid first. | | Evergreencoin | EGC | Sent to users by team | 01.04.2021 | [#4695](https://altillyfiles.com/chat#4695) | | | FanaticosCash | — | No record | — | — | | | FDReserve (French Digital Reserve) | FDR | Sent to users by team | 01–02.04.2021 | [#4696](https://altillyfiles.com/chat#4696), [#4721](https://altillyfiles.com/chat#4721) | | | Feathercoin | FTC | No record | — | — | | | Fedoracoin | TIPS | No record | — | [#2580](https://altillyfiles.com/chat#2580) | Mentioned only. | | Feirm | XFE | Sent to users by team | 02.04.2021 | [#4728](https://altillyfiles.com/chat#4728) | | | FiveG (5gcash) | — | Sent to users by team | 02.04.2021 | [#2172](https://altillyfiles.com/chat#2172)–[#2174](https://altillyfiles.com/chat#2174), [#4729](https://altillyfiles.com/chat#4729), [#4733](https://altillyfiles.com/chat#4733), [#4740](https://altillyfiles.com/chat#4740) | Only claim paid; rest of the wallet held for a second round. | | FtsCoin | FTS | No record | — | — | | | Galilel | GALI | No record | — | — | | | Garlic | GRLC | Sent to users by team | 02.04.2021 | [#4735](https://altillyfiles.com/chat#4735) | | | Gauntlet | — | No record | — | — | | | Globaltoken | GLT | Sent to users by team | 01.04.2021 | [#4697](https://altillyfiles.com/chat#4697) | | | GoByte | GBX | Sent to users by team | 01–02.04.2021 | [#4698](https://altillyfiles.com/chat#4698), [#4790](https://altillyfiles.com/chat#4790), [#4794](https://altillyfiles.com/chat#4794) | Sent after an invalid address was replaced. | | Goldcash | — | Sent to users by team | 02.04.2021 | [#4737](https://altillyfiles.com/chat#4737) | | | Goldcoin | GLC | Handed to project devs | 18–19.01.2021 | [#3215](https://altillyfiles.com/chat#3215)–[#3216](https://altillyfiles.com/chat#3216), [#3245](https://altillyfiles.com/chat#3245)–[#3269](https://altillyfiles.com/chat#3269), [#3285](https://altillyfiles.com/chat#3285)–[#3286](https://altillyfiles.com/chat#3286), [#3305](https://altillyfiles.com/chat#3305) | The dev confirmed receipt ([#3269](https://altillyfiles.com/chat#3269)) and posted an announcement ([#3285](https://altillyfiles.com/chat#3285)). The team noted the dev wanted the funds in a dev fund ([#3305](https://altillyfiles.com/chat#3305)). | | HelpTheHomeLess | HTH | Sent to users by team | 02.04.2021 | [#4749](https://altillyfiles.com/chat#4749) | | | Hive (pinned list only) | HIVE | Still pending at chat end | 28.12.2020 – 17.06.2021 | [#1833](https://altillyfiles.com/chat#1833), [#3916](https://altillyfiles.com/chat#3916), [#6724](https://altillyfiles.com/chat#6724) | Server location was unknown in June 2021. | | Horizon | — | Sent to users by team | 02.04.2021 | [#2312](https://altillyfiles.com/chat#2312), [#4750](https://altillyfiles.com/chat#4750) | Logged as "horizen done"; whether the name is Horizon or Horizen was raised in [#2312](https://altillyfiles.com/chat#2312). | | Htmlcoin | HTML | Sent to users by team | 02.04.2021 | [#3557](https://altillyfiles.com/chat#3557)–[#3559](https://altillyfiles.com/chat#3559), [#4751](https://altillyfiles.com/chat#4751) | | | Hush | HUSH | No record | — | — | | | Ilcoin | ILC | No record | — | — | | | IQcash | IQ | Sent to users by team | 02–03.04.2021 | [#4752](https://altillyfiles.com/chat#4752), [#4810](https://altillyfiles.com/chat#4810), [#4815](https://altillyfiles.com/chat#4815) | | | Jackpot | 777 | Sent to users by team | 02.04.2021 | [#4753](https://altillyfiles.com/chat#4753) | | | KnoxFS | KFX | No record | — | — | | | Kryptokrona | XKR | No record | Jan 2021 | [#1817](https://altillyfiles.com/chat#1817), [#3140](https://altillyfiles.com/chat#3140), [#6066](https://altillyfiles.com/chat#6066) | Said to be "on the list" for processing; never reported done. | | Litebit | — | Sent to users by team | 02.04.2021 | [#4754](https://altillyfiles.com/chat#4754) | Logged as "lightbit done". | | Livenodes | — | No record | — | — | | | Malwarecoin | — | No record | — | — | | | Mangocoin | — | No record | — | — | | | Masterwin | — | Sent to users by team | 02.04.2021 | [#4755](https://altillyfiles.com/chat#4755) | | | MChain | — | No record | — | — | | | MCPCoin | — | Sent to users by team | 02.04.2021 | [#4771](https://altillyfiles.com/chat#4771) | Logged as "mobilecryptopaycoin done". | | Merebel | — | No record | — | — | | | Metrix | MRX | Partly sent | Jan 2021 (wallet empty by 03.04.2021) | [#3187](https://altillyfiles.com/chat#3187)–[#3193](https://altillyfiles.com/chat#3193), [#3488](https://altillyfiles.com/chat#3488)–[#3492](https://altillyfiles.com/chat#3492), [#3553](https://altillyfiles.com/chat#3553), [#4580](https://altillyfiles.com/chat#4580), [#4844](https://altillyfiles.com/chat#4844)–[#4849](https://altillyfiles.com/chat#4849), [#5013](https://altillyfiles.com/chat#5013) | Paid directly to users in Jan 2021. The wallets were empty by April while users were still asking. | | Mintcoin | MINT | Sent to users by team | 02.04.2021 | [#4765](https://altillyfiles.com/chat#4765) | | | MMOcoin | MMO | Sent to users by team | 02.04.2021 | [#4767](https://altillyfiles.com/chat#4767), [#5970](https://altillyfiles.com/chat#5970) | | | Modic | — | No record | — | — | | | Monacoin | MONA | No record | — | — | | | MonetaryUnit | MUE | Still pending at chat end | 02.04.2021 | [#4772](https://altillyfiles.com/chat#4772)–[#4773](https://altillyfiles.com/chat#4773) | Stopped on a bad address; no "done" follows. | | MoneyByte | — | Sent to users by team | 02.04.2021 | [#4775](https://altillyfiles.com/chat#4775) | | | Monkey | MONK | No record | — | [#2594](https://altillyfiles.com/chat#2594) | Mentioned only. | | Mooncoin | MOON | Sent to users by team | 02–03.04.2021 | [#4299](https://altillyfiles.com/chat#4299), [#4320](https://altillyfiles.com/chat#4320), [#4778](https://altillyfiles.com/chat#4778)–[#4783](https://altillyfiles.com/chat#4783), [#4788](https://altillyfiles.com/chat#4788), [#4799](https://altillyfiles.com/chat#4799)–[#4800](https://altillyfiles.com/chat#4800), [#4819](https://altillyfiles.com/chat#4819)–[#4824](https://altillyfiles.com/chat#4824), [#4851](https://altillyfiles.com/chat#4851), [#4859](https://altillyfiles.com/chat#4859) | Two "not received" reports were answered with the on-chain outputs. | | Mota | MOTA | Sent to users by team | 02.04.2021 | [#4789](https://altillyfiles.com/chat#4789) | | | Myce | YCE | Sent to users by team | 02.04.2021 | [#4793](https://altillyfiles.com/chat#4793) | | | Namecoin | NMC | No record | — | — | | | Navcoin | NAV | No record | — | — | | | Neet | — | No record | — | — | | | NestEgg | EGG | Sent to users by team | 02.04.2021 | [#4797](https://altillyfiles.com/chat#4797), [#4801](https://altillyfiles.com/chat#4801) | | | Ninja | — | No record | — | — | | | Niobio | NBR | No record | — | — | | | Noir | NOR | Sent to users by team | 02.04.2021 | [#4802](https://altillyfiles.com/chat#4802) | | | Odinycoin | — | No record | — | — | | | PacGlobal | PAC | Sent to users by team | 02.04.2021 | [#4804](https://altillyfiles.com/chat#4804) | | | Pawcoin | — | Sent to users by team | 02.04.2021 | [#4803](https://altillyfiles.com/chat#4803) | | | Peercoin | PPC | No record | — | — | | | Peony | PNY | Sent to users by team | 02.04.2021 | [#4805](https://altillyfiles.com/chat#4805) | | | Pepscoin | — | Sent to users by team | 02.04.2021 | [#4808](https://altillyfiles.com/chat#4808) | | | Piratecash | PIRATE | Sent to users by team | 02.04.2021 | [#4806](https://altillyfiles.com/chat#4806) | | | Platinum | — | Sent to users by team | 03.04.2021 | [#4836](https://altillyfiles.com/chat#4836) | | | PowerBalt | — | No record | — | — | | | Pyrk | PYRK | Still pending at chat end | Feb – Jul 2021 | [#3947](https://altillyfiles.com/chat#3947)–[#3948](https://altillyfiles.com/chat#3948), [#4807](https://altillyfiles.com/chat#4807), [#4811](https://altillyfiles.com/chat#4811)–[#4814](https://altillyfiles.com/chat#4814), [#7095](https://altillyfiles.com/chat#7095)–[#7096](https://altillyfiles.com/chat#7096) | Claims were disputed. In July 2021 the funds were said to be in a "community fund wallet". | | Qnode | — | No record | — | — | | | Qtum | QTUM | Sent to users by team | 03.04.2021 | [#4903](https://altillyfiles.com/chat#4903) | | | Ragnarok | — | Sent to users by team | 03.04.2021 | [#4837](https://altillyfiles.com/chat#4837)–[#4840](https://altillyfiles.com/chat#4840) | | | Rapids | RPD | Sent to users by team | 03.04.2021 | [#2786](https://altillyfiles.com/chat#2786), [#4841](https://altillyfiles.com/chat#4841) | [#2786](https://altillyfiles.com/chat#2786) is a separate return of the project's own trade-competition funds. | | RavenDark | XRD | Sent to users by team | 03.04.2021 | [#4842](https://altillyfiles.com/chat#4842) | | | Reddcoin | RDD | Sent to users by team (inferred) | by 25.05.2021 | [#5923](https://altillyfiles.com/chat#5923), [#5951](https://altillyfiles.com/chat#5951)–[#5958](https://altillyfiles.com/chat#5958) | No "done" message. The wallets were confirmed empty, with one straggler left for round 2. | | RPICoin | — | No record | — | — | | | Safedeal | — | Sent to users by team | 03.04.2021 | [#4843](https://altillyfiles.com/chat#4843) | | | Safeinsure | SINS | No record | — | — | | | Saving | — | No record | — | [#3294](https://altillyfiles.com/chat#3294)–[#3296](https://altillyfiles.com/chat#3296) | The dev only showed interest in distributing. | | SecureCloud | — | No record | — | — | | | Seed2Need | — | No record | — | — | | | Shard | — | No record | — | — | | | Sharkcoin | — | Sent to users by team | 03.04.2021 | [#4845](https://altillyfiles.com/chat#4845)–[#4848](https://altillyfiles.com/chat#4848) | | | Smartcash | SMART | No record | — | — | | | Sovereign | — | No record | — | — | | | Spacecoin | — | Partly sent | 03.04.2021 | [#4855](https://altillyfiles.com/chat#4855)–[#4858](https://altillyfiles.com/chat#4858), [#4866](https://altillyfiles.com/chat#4866) | One approved claimant never sent an address. | | Stakecube | SCC | No record | — | — | | | Stakenet | XSN | No record | — | — | | | StealthCoin | XST | Sent to users by team | 03.04.2021 | [#4864](https://altillyfiles.com/chat#4864) | | | Sugarchain | SUGAR | Sent to users by team | 03.04.2021 | [#4860](https://altillyfiles.com/chat#4860) | | | Swampcoin | — | Sent to users by team | 03.04.2021 | [#4861](https://altillyfiles.com/chat#4861) | | | Terracoin | TRC | Sent to users by team | 03.04.2021 | [#4862](https://altillyfiles.com/chat#4862) | | | Tickets | TIX | No record | — | — | | | Trezarcoin | TZC | Sent to users by team | 03.04.2021 | [#4863](https://altillyfiles.com/chat#4863) | | | TUSC (pinned list only) | TUSC | Still pending at chat end | 03.04 – 17.06.2021 | [#2308](https://altillyfiles.com/chat#2308), [#4876](https://altillyfiles.com/chat#4876)–[#4886](https://altillyfiles.com/chat#4886), [#4900](https://altillyfiles.com/chat#4900), [#4905](https://altillyfiles.com/chat#4905)–[#4906](https://altillyfiles.com/chat#4906), [#6724](https://altillyfiles.com/chat#6724) | Moved back to the saved list with 45 claimants; "not yet" distributed as of 20.04.2021. | | Turbo | — | No record | — | — | | | Ultraclear | UCR | Sent to users by team | 03.04.2021 | [#4865](https://altillyfiles.com/chat#4865) | | | Ultragate | ULG | No record | — | — | | | Vertcoin | VTC | No record | — | — | | | Wrkzcoin | WRKZ | Handed to project devs (after a partial first round) | 25.06 – 26.10.2021 | [#6779](https://altillyfiles.com/chat#6779)–[#6780](https://altillyfiles.com/chat#6780), [#6909](https://altillyfiles.com/chat#6909)–[#6935](https://altillyfiles.com/chat#6935), [#6990](https://altillyfiles.com/chat#6990), [#7033](https://altillyfiles.com/chat#7033), [#7037](https://altillyfiles.com/chat#7037)–[#7038](https://altillyfiles.com/chat#7038), [#7566](https://altillyfiles.com/chat#7566), [#7570](https://altillyfiles.com/chat#7570)–[#7571](https://altillyfiles.com/chat#7571) | First round was partly sent by the team. The wallet went to the dev on 10–11.07.2021 for the remaining claims, and on 26.10.2021 it was confirmed the dev "got the whole thing". | | x42 | X42 | No record | — | — | | | Xazab | — | No record | — | — | | | Xcash | XCASH | No record | — | — | | | Xchainz | — | Sent to users by team | 03.04.2021 | [#4867](https://altillyfiles.com/chat#4867) | | | Xenios (pinned list only) | — | No record | — | [#1791](https://altillyfiles.com/chat#1791), [#1836](https://altillyfiles.com/chat#1836), [#6724](https://altillyfiles.com/chat#6724)–[#6727](https://altillyfiles.com/chat#6727) | "Done already I think" ([#6726](https://altillyfiles.com/chat#6726)) was never confirmed. | | Xuez | XUEZ | No record | — | — | | | Ycash | YEC | Sent to users by team | 03.04.2021 | [#4868](https://altillyfiles.com/chat#4868) | | | Zcore | ZCR | Sent to users by team | 03.04.2021 | [#4869](https://altillyfiles.com/chat#4869)–[#4872](https://altillyfiles.com/chat#4872) | One claim paid at the amount claimed. | | Zelantus | — | Sent to users by team | 03.04.2021 | [#4873](https://altillyfiles.com/chat#4873) | | | Zelcash | ZEL | No record | — | — | | | ZeroOne | — | No record | — | [#2269](https://altillyfiles.com/chat#2269) | Name mention only. | #### Public statements from the time These are public posts that say whether refunds were received. Both kinds are listed, and neither list is complete. Posts by Altilly's own staff are marked as such; they show the timeline, not independent confirmation. Where only a paraphrase was available, there are no quotation marks. **Posts saying refunds were received, in full or in part** - [r/Beyondcoin](https://old.reddit.com/r/Beyondcoin/comments/kuqxnc/updates_on_the_altilly_exchange_hack/), 11 January 2021, the project's official account: "updates on the Altilly exchange hack and how we are reimbursing people that lost BYND in the hack." The post does not say whether Beyondcoin or Altilly paid the holders. - [Bitcointalk, Altilly announcement thread](https://bitcointalk.org/index.php?topic=5166945.0), 3 February 2021, *Altilly's own account*: refunds under way for 42 coin, MRX, Aeon, Alias and Afro. - [Bitcointalk, same thread](https://bitcointalk.org/index.php?topic=5166945.0), 21 February 2021, a user: received 507,000 of 999,990 PAC. A partial refund, so it is also in the second list. - [r/MoonCoin](https://old.reddit.com/r/MoonCoin/comments/mtxr3d/altilly_exchange_scammers/), 19 April 2021, a user: "They refunded me only a small part and they don't want to refund any more." Also partial. - [r/dogecoin](https://old.reddit.com/r/dogecoin/comments/krtg1u/anyone_else_lose_all_their_doge_to_the_altilly/gx0r8zu/), 5 May 2021, a user: "on the bright side Altilly has been working very hard to make this right -- they were able to refund me 999,999 Mooncoins." - [r/livecoin](https://old.reddit.com/r/livecoin/comments/n2zvam/livecoin_has_responded_to_me_and_is_asking_me_to/gz8qm1a/), 24 May 2021, a user: "all they asked for was a Coin withdrawal email old exchange and a coin deposit email to Altilly. Had some of my coins returned already". In the [same thread](https://old.reddit.com/r/livecoin/comments/n2zvam/livecoin_has_responded_to_me_and_is_asking_me_to/gzx5gql/) on 29 May another user wrote "Pretty simple. Livecoin is scamming, Altilly is not." That is an opinion, not a refund receipt. - [Bitcointalk](https://bitcointalk.org/index.php?topic=5385112.0), 9–10 February 2022, *Altilly's customer-service manager*: "After the hack occured most of the rest of the team moved on. Myself and nayiem are doing the best we can to refund users." It shows refunds were still being made in 2022. - [r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/xeggex_dev_mike_is_linked_to_altilly_rug_pull/), 7 February 2025, a user critical of both exchanges: "Altilly refunded part of the funds when the community became loud." In a [reply in that thread](https://old.reddit.com/r/pepecoin/comments/1ik58q6/xeggex_dev_mike_is_linked_to_altilly_rug_pull/mbjkngi/), a community member wrote: "the people who stayed with Altilly tried their butts off to refund as many people as possible with the resources and help (none) available". - [r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iohp76/mega_thread_withdraws_are_active_keep_all_xeggex/mcjh339/), 13 February 2025, a critical commenter: "This will cost you lots of nerves and only fraction will be reimbursed,. like with Altilly." It confirms refunds, but only partial ones. - [Trustpilot](https://www.trustpilot.com/review/altilly.com), February 2023 and August–September 2025: some reviewers say they got funds back after years via an "account merger". These reviews are unverified and may come from the copycat site described below. **Posts saying refunds were not received, or only partly received** - [r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/altilly_hack/), 30 December 2020, quoting Altilly's notice: "Only users that had a balance with a value of more than 10 USD will be paid back." Small balances were never covered. - [Trustpilot](https://www.trustpilot.com/review/altilly.com), December 2020 to December 2021: one-star reviews saying there was no refund or no reply, including one reviewer who missed the claim deadline. - [r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/altilly_hack/gnubr3x/), 18 February 2021, a user: "requesting confirmation emails for the funds that I deposited to them a year ago. Without them they refuse to return the funds." - [Bitcointalk, Altilly announcement thread](https://bitcointalk.org/index.php?topic=5166945.0), 21 February 2021, the same PAC user as above: only 507,000 of 999,990 PAC received, and "Admins delete my questions in the telegram." - [r/Crypto_General](https://old.reddit.com/r/Crypto_General/comments/m23xc6/earn_free_bitcoin_and_ether_at_duckdice_the_dd/gqhbta8/), 10 March 2021, a user: "Altilly got hacked hard abd the team are struggling to refund their customers. I lost my money there." - [r/MoonCoin](https://old.reddit.com/r/MoonCoin/comments/mtxr3d/altilly_exchange_scammers/), 19 April 2021, a reply: "me also Still Waiting on any news Active wallet i had a rough 200 million mooncoins there" - [r/altillyhack](https://old.reddit.com/r/altillyhack/comments/my974f/has_anyone_received_their_altilly_refunds_yet/), 25 April 2021, a user: "Altilly claimed to start reimbursing funds on April. I am wondering if this has happened yet" - [r/altillyhack](https://old.reddit.com/r/altillyhack/comments/my9l2v/what_are_the_options_for_altilly_customers_who/), 25 April 2021, a user asking about assets outside the saved list: "Altilly said they will be refunding some customers who had assets in their 'Saved Assets' group" - [Bitcointalk, "Altilly Exchange FAKE Refunds, Possible Exit Scam"](https://bitcointalk.org/index.php?topic=5385112.0), 9 February 2022, a user: PXC holders were refused refunds without deposit-confirmation emails, and proof by signed message was rejected. - [r/banano](https://old.reddit.com/r/banano/comments/10j6wjo/altilly_wallet_they_said_all_customer_funds_got/j5ivzku/), 23 January 2023, the Banano team: "were supposedly able to refund all of the saved assets. They still have not refunded Banano despite refund confirmations over a year ago." - [r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/xeggex_hack/mbqeo5d/), 8 February 2025, a user: "You never refunded me for Altilly, so this is suspicious." - [Reddit](https://old.reddit.com/r/u_blueorigintospace/comments/1ikv8a5/xeggex_hack/mcrzh67/), 14 February 2025, a user replying to a post on Nayiem's own profile: "I guess you missed mine total 5725 $." - [r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/nayiem_doesnt_pass_the_sniff_test/mcoa9r9/), 14 February 2025, a hostile commenter in a thread mainly about Xeggex: "These scammers think they'll shut us up by refunding 1% of the community." > **Caveat:** > > **A probable copycat site.** In July 2023, posts on r/Altilly_Exchange said "Payment received" and pointed to "altilly.net", which asked people to "merge your account" (for example [this post](https://old.reddit.com/r/Altilly_Exchange/comments/156z9dk/payment_received/) and [this one](https://old.reddit.com/r/Altilly_Exchange/comments/14wnkmt/altillynet/)). It looks like a copycat or phishing site. Those posts are left out of both lists, and the 2023 and 2025 Trustpilot reviews that mention an "account merger" may come from the same scheme. Do not give any site like it your keys or account details. > **Note:** > > **Closing statement from Nayiem** > > I am closing the Altilly refund process. I stopped paying refunds around 2022/2023, and I paid only a handful after that. I want to say plainly why, and what that means. > > The user database was lost with the servers. Many of the coins people held no longer have a working chain, so deposits and refunds cannot be checked any more. Near the end, many of the claims I received were fake. I also ran out of strength. When I came to believe who Mike really was, and watched Xeggex keep going, I could not keep carrying this. That is my belief about Mike, not a proven fact, and it is not an excuse. > > Some people were not paid. I estimate the unpaid claims at around $50,000–60,000, but I cannot prove that figure, and the number does not change what it means for each of you. If you lost money on Altilly and never got it back, that is real harm, and I am sorry. > > If you still have your original deposit-confirmation email from Altilly, or other evidence from the time, you can reach me through the [questions page](https://altillyfiles.com/ask). Please do not post private details such as your email, address or wallet keys in public. I will read what you send and answer. I cannot promise a payment or a timeline, and nothing on this site is an offer to pay. > **Note:** > > **What the chat does not settle.** It does not show who took the funds, and it does not show refunds paid after September 2021. No court or authority has confirmed who was responsible for the Altilly loss. --- # Independent assessment Source: https://altillyfiles.com/assessment Markdown: https://altillyfiles.com/content/assessment.md ## An independent-style assessment > **Note:** > > **How this assessment was made.** At the author's request, this assessment was produced by an AI-assisted review of the full, unredacted management chat and of public sources (company registers, court records, news reports, Reddit and forum posts, and Solar's statement of 30 November 2022). The review deliberately looked for evidence against the author as well as for him. It is not a legal finding and it is not neutral in origin: the author asked for it and published it. Please check the linked messages and sources yourself and reach your own view. > **Caveat:** > > **No court or authority has confirmed that Mike is Paul Vernon, or that Mike took the Altilly funds.** Where this page says something is "likely" or "probable", that is the reviewer's judgement of the evidence, not an established fact. The author's own beliefs are labelled as his beliefs. ### Scope and method - The review read the whole exported chat, including the notes the author added in September 2026, and checked disputed items against the raw export and the attached images. - Message numbers are written like [#1232](https://altillyfiles.com/chat#1232); each one links to the message. Items marked "(image)" come from photos or screenshots, not message text. - Timestamps in the export are in UTC-8 (US Pacific). Add 9 hours for Central European Time. - Some messages and images were redacted before publication to remove customer data, third-party personal data and credentials. See [the Transparency page](https://altillyfiles.com/transparency). ### 0. Corrections found while checking These points were misread in earlier drafts or are easy to misread. They change the analysis. 1. **The "PAUL Vernon" Revolut envelope [#3833](https://altillyfiles.com/chat#3833) is Mike's card, not Nayiem's.** The surrounding messages settle it: - Nayiem tells Mike to order a card [#3638](https://altillyfiles.com/chat#3638). Mike asks "they send physical cards to china?" [#3639](https://altillyfiles.com/chat#3639), then reports "Sorry, our service is not offered in your country" [#3646](https://altillyfiles.com/chat#3646). - Nayiem: "Send it to my address, I will send it to you then" [#3647](https://altillyfiles.com/chat#3647), and gives his own address [#3648](https://altillyfiles.com/chat#3648). Mike: "ok, done" [#3653](https://altillyfiles.com/chat#3653). Nayiem: "Mike is registered and ordered his card" [#3693](https://altillyfiles.com/chat#3693). - Two days later a Revolut envelope arrives at that address, addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833) (image). Chuck: "card already?" [#3834](https://altillyfiles.com/chat#3834). Chuck's own card came separately in the US [#3846](https://altillyfiles.com/chat#3846). - Mike later says "Here can take a few days to clear customs" [#3837](https://altillyfiles.com/chat#3837) and "i got my revolut card today" [#3960](https://altillyfiles.com/chat#3960). That fits the card being forwarded to China. - So in February 2021 the person known as Mike held a Revolut card in the name "Paul Vernon". This is a record made at the time, not a later claim. The export shows no edit marker on [#3833](https://altillyfiles.com/chat#3833). 2. **[#1033](https://altillyfiles.com/chat#1033)-[#1034](https://altillyfiles.com/chat#1034) are forwarded messages from Mike, not Chuck's own words.** They were originally sent on 23 December 2020 at 22:11 (UTC-8): "I think the attack came in from maybe an insecure recue port at the host level" and "i've only found 3 machines affected". So Mike had reported an attack by the evening of 23 December. The next day he told the team to call it an "outage" [#1057](https://altillyfiles.com/chat#1057). 3. **"it's okay if I only get half back" [#5203](https://altillyfiles.com/chat#5203) is a hypothetical claimant speaking, not Nayiem.** The full text reads: "So for example when a user just says: it's okay if I only get half back of what I've lost." 4. **[#6813](https://altillyfiles.com/chat#6813) is ambiguous.** Nayiem says "I know you purposely strung it out to buy time. That's a good thing, because the next solution will be better", then "But I meant your time, yes" [#6814](https://altillyfiles.com/chat#6814). It still approves of a delay, but the full wording matters. 5. **Mike's house was not shown to be bought with money from after the hack.** In May 2021 Mike moved into a "new house" [#5094](https://altillyfiles.com/chat#5094); the renovation and an indoor pool are documented [#5106](https://altillyfiles.com/chat#5106)-[#5125](https://altillyfiles.com/chat#5125). At the same time he was selling another house, which he said had been bought about nine years earlier, and he found a buyer in September 2021 [#4204](https://altillyfiles.com/chat#4204), [#5471](https://altillyfiles.com/chat#5471), [#6163](https://altillyfiles.com/chat#6163)-[#6166](https://altillyfiles.com/chat#6166), [#7544](https://altillyfiles.com/chat#7544). (An earlier draft of this review applied the "nine years" remark to the new house; in context it refers to the house being sold.) In September 2021 he said the furniture for the new house had been "sitting in a warehouse for a year" [#7431](https://altillyfiles.com/chat#7431). The author's 2026 notes, which present the house as "5 months after the hack" and say Mike "suddenly" had "10k out of nowhere" [#7589](https://altillyfiles.com/chat#7589)-[#7592](https://altillyfiles.com/chat#7592), leave all this out. Nothing in the chat shows how the new house or the renovation was paid for. ### 1. What the chat establishes with high confidence - **"Deleted Account" is Mike (@MrMike_O), a different person from Nayiem.** - He answers when @MrMike_O is tagged or Mike is addressed by name, all through the chat ([#790](https://altillyfiles.com/chat#790) → [#792](https://altillyfiles.com/chat#792) → [#794](https://altillyfiles.com/chat#794) "Well done Mike"; [#1056](https://altillyfiles.com/chat#1056) → [#1059](https://altillyfiles.com/chat#1059); [#3162](https://altillyfiles.com/chat#3162) → [#3163](https://altillyfiles.com/chat#3163); [#4045](https://altillyfiles.com/chat#4045) → [#4048](https://altillyfiles.com/chat#4048)). - He laughs at praise of "Mike" [#304](https://altillyfiles.com/chat#304) and links github.com/mrmikeo [#4380](https://altillyfiles.com/chat#4380). - A Fastmail ticket is addressed "Hi Michael" [#3288](https://altillyfiles.com/chat#3288), and he signs a whitepaper "Michael Osullivan @MrMikeO" [#5529](https://altillyfiles.com/chat#5529). - He says he lives in China [#1559](https://altillyfiles.com/chat#1559), [#2674](https://altillyfiles.com/chat#2674), [#3639](https://altillyfiles.com/chat#3639). He received his own card abroad [#3960](https://altillyfiles.com/chat#3960). - Nayiem was in Sweden at the time [#5733](https://altillyfiles.com/chat#5733)-[#5735](https://altillyfiles.com/chat#5735). The claim that "Nayiem is Mike" is not supported by this record. - **Mike was the lead developer and technical operator from 2019:** code deploys [#22](https://altillyfiles.com/chat#22)-[#23](https://altillyfiles.com/chat#23), the admin panel [#611](https://altillyfiles.com/chat#611), database payouts [#416](https://altillyfiles.com/chat#416), [#434](https://altillyfiles.com/chat#434), market structure [#498](https://altillyfiles.com/chat#498) and payment settings [#697](https://altillyfiles.com/chat#697). - **There was no audit and no real cold storage.** Mike, 15 July 2019: "we are too small to worry about audits yet" [#215](https://altillyfiles.com/chat#215) and "heck we are too small to even start moving to safe storage" [#216](https://altillyfiles.com/chat#216). The public About page said the opposite [#721](https://altillyfiles.com/chat#721) (image). - **The incident was on 23-25 December 2020, not 12 December.** Mike's attack report dates from 23 December and was forwarded the next day [#1033](https://altillyfiles.com/chat#1033)-[#1034](https://altillyfiles.com/chat#1034), a first, low estimate ("under 10k", "might be 15") came on 24 December [#1056](https://altillyfiles.com/chat#1056)-[#1059](https://altillyfiles.com/chat#1059), and the servers were deleted on 25 December [#1103](https://altillyfiles.com/chat#1103), [#1106](https://altillyfiles.com/chat#1106). - **The loss was about USD 1 million.** - "around 31 bitcoins" [#1600](https://altillyfiles.com/chat#1600), and a USDT withdrawal wallet that still showed about $13k [#1616](https://altillyfiles.com/chat#1616)-[#1624](https://altillyfiles.com/chat#1624). - The team's own figure: "We lost 1mln" [#1677](https://altillyfiles.com/chat#1677). The BTC, ETH, DASH and DOGE wallets were "gone" [#4094](https://altillyfiles.com/chat#4094), [#4095](https://altillyfiles.com/chat#4095). About 137 assets were "saved" [#1757](https://altillyfiles.com/chat#1757). - The author's own XQR (Qredit) coins held on Altilly were lost too: Chuck asks "is XQR safe?", Nayiem answers "Nope" / "All lost" [#1731](https://altillyfiles.com/chat#1731)-[#1734](https://altillyfiles.com/chat#1734). - **The user database and the decryption settings were lost** [#1308](https://altillyfiles.com/chat#1308), [#1353](https://altillyfiles.com/chat#1353), [#5309](https://altillyfiles.com/chat#5309). This is the root of the later problems with checking refund claims. - **Refunds of saved assets were actually sent in 2021, mostly by Mike.** - About 60 coins were marked "done" on 1-3 April 2021 [#4613](https://altillyfiles.com/chat#4613)-[#4903](https://altillyfiles.com/chat#4903). - The Goldcoin team confirmed receipt [#3260](https://altillyfiles.com/chat#3260)-[#3267](https://altillyfiles.com/chat#3267) (image). - Some refunds went through the coins' own developers (BYND [#2149](https://altillyfiles.com/chat#2149), HONK [#6761](https://altillyfiles.com/chat#6761), WRKZ [#7037](https://altillyfiles.com/chat#7037)-[#7038](https://altillyfiles.com/chat#7038)). - **Refunds were incomplete and late.** "thousands who were too late" [#5052](https://altillyfiles.com/chat#5052); first-round assets were still unpaid in July 2021 [#6876](https://altillyfiles.com/chat#6876). Chuck, September 2021: "Weve made alot of promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). - **Nayiem kept working closely with Mike until at least September 2021**, on Qredit Motion, Altfenix, hosting and money [#1885](https://altillyfiles.com/chat#1885), [#2128](https://altillyfiles.com/chat#2128), [#5658](https://altillyfiles.com/chat#5658), [#5728](https://altillyfiles.com/chat#5728), [#7428](https://altillyfiles.com/chat#7428). ### 2. Who controlled funds, wallets, servers and keys **Mike, according to the chat (strong, consistent, and recorded at the time):** - The Cherry Servers account was set up with his email three years earlier [#1504](https://altillyfiles.com/chat#1504); "Mike uses cherry" [#1483](https://altillyfiles.com/chat#1483). - Backups: "i should have had the backblaze api keys so you couldn't delete" [#1271](https://altillyfiles.com/chat#1271). - The "safe" wallets: "I also had a VPS server there holding the 'safe' wallets" [#1299](https://altillyfiles.com/chat#1299). He held keys outside the database [#1615](https://altillyfiles.com/chat#1615), [#1621](https://altillyfiles.com/chat#1621). - The encryption settings file was his, and he says he never kept a copy [#1353](https://altillyfiles.com/chat#1353), [#3086](https://altillyfiles.com/chat#3086). - He handled Cloudflare DNS [#1206](https://altillyfiles.com/chat#1206), the database ("would have required me to do it in the db", [#4344](https://altillyfiles.com/chat#4344)), Fastmail billing [#3163](https://altillyfiles.com/chat#3163), [#3946](https://altillyfiles.com/chat#3946), help-desk billing notices [#5600](https://altillyfiles.com/chat#5600), and the Twitter recovery email [#4989](https://altillyfiles.com/chat#4989). - Keys he held later: TUSC [#4878](https://altillyfiles.com/chat#4878), HIVE [#3917](https://altillyfiles.com/chat#3917), the SLP deposit wallet [#5186](https://altillyfiles.com/chat#5186)-[#5190](https://altillyfiles.com/chat#5190). - He ran the sweeper by hand: "i just did it whenever funds were needed in wd wallet… entirely possible that i swept a large amount at some point and just don't remember" [#6717](https://altillyfiles.com/chat#6717)-[#6718](https://altillyfiles.com/chat#6718). - He moved funds on his own: PYRK to a "community fund wallet" [#7096](https://altillyfiles.com/chat#7096); XNC coins to a developer [#1814](https://altillyfiles.com/chat#1814), hours after Nayiem said not to transfer anything yet [#1725](https://altillyfiles.com/chat#1725). **Nayiem, according to the chat:** - At the time of the loss he said he had no access to the Cherry servers: "I never had access to those servers. Mike didn't allow me" [#1492](https://altillyfiles.com/chat#1492)-[#1493](https://altillyfiles.com/chat#1493). He had to ask which host was used [#1105](https://altillyfiles.com/chat#1105) and whether keys existed [#1285](https://altillyfiles.com/chat#1285). - He did have some access: - hosting-panel snapshots [#1695](https://altillyfiles.com/chat#1695)-[#1696](https://altillyfiles.com/chat#1696), a root password reset on one server [#2569](https://altillyfiles.com/chat#2569), and DNS/Cloudflare jointly with Mike [#7119](https://altillyfiles.com/chat#7119)-[#7120](https://altillyfiles.com/chat#7120); - the SLP wallet by June 2021 [#6731](https://altillyfiles.com/chat#6731), [#6739](https://altillyfiles.com/chat#6739), and root access and snapshots on the staging server [#6519](https://altillyfiles.com/chat#6519), [#6607](https://altillyfiles.com/chat#6607); - he said he could do some batch refund sends himself [#3540](https://altillyfiles.com/chat#3540). - The Hetzner account [#6040](https://altillyfiles.com/chat#6040) and the Cherry client relationship were in his name or Qredit's. Cherry's letter is addressed to Qredit and to Nayiem's Qredit email [#4349](https://altillyfiles.com/chat#4349) (image). - **Assessment:** control of the systems that were wiped sat with Mike. Nayiem's access after the incident was real but limited. Nothing in the chat shows Nayiem had access to the lost BTC/ETH wallets or the safe-wallet server before the loss. **Companies (public registers and the author's account):** - The chat presents Altilly as a Hodler Enterprises company [#702](https://altillyfiles.com/chat#702), [#705](https://altillyfiles.com/chat#705), and in 2019 Nayiem wrote that it was "still incorporated in Hongkong" [#759](https://altillyfiles.com/chat#759). In December 2020 Mike said a Hong Kong address came from "a company registration service i was going to use originally to form a company in hk. never did do that tho" [#1778](https://altillyfiles.com/chat#1778) (context [#1776](https://altillyfiles.com/chat#1776)-[#1779](https://altillyfiles.com/chat#1779)). These two statements conflict. No register we checked lists Altilly as a company. - UK Companies House lists QREDIT LTD (no. 13077371), incorporated on 11 December 2020 at a London formation-agent address, with Nayiem Willems as sole director and the only person with significant control (75% or more). Mike does not appear on it, or on any register we found connected to Altilly. It never filed accounts and was struck off on 17 May 2022. The chat never mentions this company, and the export has no messages from 2 to 18 December 2020. Register: - The Revolut Business account was also Nayiem's; Mike was a cardholder on it. When Revolut asked Mike to verify his ID in March 2021, he put it off: "my passport is at the china visa office" [#4414](https://altillyfiles.com/chat#4414)-[#4416](https://altillyfiles.com/chat#4416). Nayiem paid with his own card instead [#4417](https://altillyfiles.com/chat#4417). No later message shows Mike completing the check. - The author says he was to receive ownership of the whole project once he had set up the company, which he did around December 2020. That is his account. The chat contains no message transferring ownership. - The author says Qredit Ltd never traded because his XQR coins, which it depended on, were lost in the hack [#1731](https://altillyfiles.com/chat#1731)-[#1734](https://altillyfiles.com/chat#1734). He believes Mike took the XQR along with the rest. That is a belief; the chat only shows that the XQR was lost. - In December 2020 Nayiem wrote that "Willems Ventures" was registered at his home address, where his tourist resort was [#1579](https://altillyfiles.com/chat#1579), [#1583](https://altillyfiles.com/chat#1583). Per the author, Willems Ventures was the company for that resort and unrelated to Altilly. A UK company, Willems Ventures Ltd, was incorporated on the same day as Qredit Ltd, with a London registered office. The Revolut Business account the team used showed the name Willems Ventures [#3686](https://altillyfiles.com/chat#3686). ### 3. The December 2020 incident: timeline and conduct | When (UTC-8) | What | Message | |---|---|---| | 23 Dec 22:11 | Mike to Chuck (forwarded the next day): attack via "insecure recue port", "3 machines affected" | [#1033](https://altillyfiles.com/chat#1033)-[#1034](https://altillyfiles.com/chat#1034) | | 24 Dec 07:12 | Nayiem: "Mike, can you give me more details about the hack that happened?" | [#1031](https://altillyfiles.com/chat#1031) | | 24 Dec 17:12 | "Is it really under 10k Mike?" / "might be 15" / "wont know for sure until i get everything moved" | [#1056](https://altillyfiles.com/chat#1056)-[#1060](https://altillyfiles.com/chat#1060) | | 24 Dec 17:12 | Mike: "Just tell them that we are still investigating the outage, and we have full control of our systems." | [#1057](https://altillyfiles.com/chat#1057) | | 24 Dec 17:21 | Chuck: the status page shows missing assets. Mike: "yea, ill fix that soon" | [#1077](https://altillyfiles.com/chat#1077)-[#1079](https://altillyfiles.com/chat#1079) | | 25 Dec 14:12-14:41 | Mike: the host "deleted all the servers", backups gone. The host's first email said cancelled for non-payment; Mike: "that's a lie". Then: "a change i made didn't allow them to access - so i guess they got pissed off and just deleted everything" | [#1103](https://altillyfiles.com/chat#1103)-[#1132](https://altillyfiles.com/chat#1132) | | 25 Dec 15:44 | Nayiem: "it will backfire if we don't tell the truth." | [#1163](https://altillyfiles.com/chat#1163) | | 25 Dec 16:29 | Nayiem wants to say "hackers were unable to access funds". Mike: "we don't know this" | [#1180](https://altillyfiles.com/chat#1180)-[#1183](https://altillyfiles.com/chat#1183) | | 25 Dec 17:18 | Public notice: suspicious activity, a new system user, lost "the domain, several wallets and the whole codebase", "not sure yet if funds are lost" | [#1167](https://altillyfiles.com/chat#1167), [#1232](https://altillyfiles.com/chat#1232) | | 26 Dec 01:48-02:15 | Mike: the attacker came in through an old email on the account, "paul@satotechlt.com"; "history on that domain probably has my name" | [#1289](https://altillyfiles.com/chat#1289), [#1326](https://altillyfiles.com/chat#1326)-[#1328](https://altillyfiles.com/chat#1328) | | 26 Dec 16:12-16:33 | Mike: DIME funds went to a wallet that is "ours"; Backblaze cannot recover; Cherry says the deletion came from the inactive email over Tor | [#1497](https://altillyfiles.com/chat#1497)-[#1513](https://altillyfiles.com/chat#1513) | | 27 Dec 00:01 | Nayiem, on Cherry's reply that "all of your servers data was cleaned" [#1564](https://altillyfiles.com/chat#1564): "Don't share this with anyone yet until I have my stuff ready." | [#1566](https://altillyfiles.com/chat#1566) | | 27 Dec 03:09 | Mike: "around 31 bitcoins"; "i have no access to that wallet to even check" | [#1600](https://altillyfiles.com/chat#1600)-[#1601](https://altillyfiles.com/chat#1601) | **Mike's conduct:** - Every technical fact came from him alone, and his explanations changed: a rescue port, then Cherry's "non-payment", then "they got pissed off", then the old email, then Tor. - He recommended calling it an "outage" and changing the status page. - He could not name the address of the BTC safe wallet he says he kept [#1615](https://altillyfiles.com/chat#1615), [#2121](https://altillyfiles.com/chat#2121), and suggested "just say we are investigating" [#2124](https://altillyfiles.com/chat#2124). - He disabled command history and kept a full-access backup key in a shared server guide [#2587](https://altillyfiles.com/chat#2587). (That Backblaze key was revoked long ago; the key in the guide no longer works.) - He talked about quitting crypto within a day [#1332](https://altillyfiles.com/chat#1332). - Each of these fits negligence, and each also fits insider action. None of them proves insider action. **Nayiem's conduct:** - He pushed for disclosure [#1163](https://altillyfiles.com/chat#1163), stayed on as public admin [#1245](https://altillyfiles.com/chat#1245), argued against going silent [#1249](https://altillyfiles.com/chat#1249), and pressed for the BTC to be traced [#1511](https://altillyfiles.com/chat#1511), [#1599](https://altillyfiles.com/chat#1599), [#2113](https://altillyfiles.com/chat#2113). - He also accepted the "outage" wording without objecting [#1057](https://altillyfiles.com/chat#1057)-[#1075](https://altillyfiles.com/chat#1075) and helped word the softened notice ("Like this maybe?" [#1072](https://altillyfiles.com/chat#1072)). He was ready to publish an unverified reassurance [#1180](https://altillyfiles.com/chat#1180). He asked to delay telling users that the data could not be recovered [#1566](https://altillyfiles.com/chat#1566). - The technical claims in the public notice ("new system user", "above OS level") appear to come from Mike's reports [#1033](https://altillyfiles.com/chat#1033); he described the same rescue-mode method again the next day [#1510](https://altillyfiles.com/chat#1510). The claim that the domain was lost was wrong: Mike was repointing its DNS at the time [#1206](https://altillyfiles.com/chat#1206). **Chuck** handled messaging and moderation and was alert to liability ("they will be expecting you to pay up", [#1190](https://altillyfiles.com/chat#1190)). He flagged the MOON and DIME movements himself [#1278](https://altillyfiles.com/chat#1278), [#1494](https://altillyfiles.com/chat#1494). The chat shows no sign that he controlled any wallet. ### 4. Mike's identity, and the question of Paul Vernon **Established from the chat:** "Deleted Account" = Mike = @MrMike_O = GitHub "mrmikeo", who presented himself as Michael O'Sullivan (§1). Public records add that a "Michael Osullivan" was listed as Altilly's developer on Bitcointalk in December 2018, and that UK Companies House lists a director registered as Michael O'Sullivan for Xeggex Software Services Ltd ([Companies House](https://find-and-update.company-information.service.gov.uk/company/14910559/officers)). The register does not verify identities. The author believes "Michael O'Sullivan" is an alias Mike used. **That name may belong to a real, separate person whose name was used. Nothing here accuses any such person.** **Evidence that the person behind "Mike" used the name Paul Vernon:** 1. **26 December 2020** [#1326](https://altillyfiles.com/chat#1326)-[#1328](https://altillyfiles.com/chat#1328): Mike himself names the old hosting-account email "paul@satotechlt.com" and says "history on that domain probably has my name". This was written before anyone had a reason to point at him. 2. **February 2021** [#3646](https://altillyfiles.com/chat#3646)-[#3693](https://altillyfiles.com/chat#3693), [#3833](https://altillyfiles.com/chat#3833) (image): Mike's Revolut card, sent to Nayiem's address at Mike's request, is addressed to "PAUL Vernon" (see §0). 3. **Public records (not court findings):** The DOJ alleges that Paul Vernon of Cryptsy moved to China around November 2015. The domain satotechltd.com is linked to Vernon by an anonymous 2016 forum post and by a WHOIS record the author posted in 2026 [#7577](https://altillyfiles.com/chat#7577) (image). 4. [#4529](https://altillyfiles.com/chat#4529): on Cryptsy's stolen coins, Mike writes "we had noticed they hadn't moved years ago". This is ambiguous. 5. Mike says he joined the army in 1991 [#5456](https://altillyfiles.com/chat#5456). That is broadly consistent with Vernon's age (born about 1973). One published source puts Vernon's enlistment in 1994, a small unverified difference. A further name match involves a private person. It is withheld here and not relied on. **What this does and does not show:** - Items 1 and 2 were recorded at the time and do not depend on Nayiem's later account. In the reviewer's judgement they make it **highly likely that Mike used the name Paul Vernon**, and probable that he is the Cryptsy founder of that name. - Reading "satotechlt" as a typo for "satotechltd" is the author's 2026 interpretation [#7595](https://altillyfiles.com/chat#7595). - **No court or authority has confirmed this.** A card name reflects what the account holder registered, and it is not known how strictly Revolut checked team members' names in 2021. When Revolut did ask Mike to verify his ID in March 2021, he deferred it [#4415](https://altillyfiles.com/chat#4415), and the chat does not show him completing it. - Public record: Paul Vernon was indicted in Florida (filed 2019, made public January 2022) over Cryptsy. He has not been convicted, and the charges are allegations. No filing in that case mentions Altilly. - The chat does not show Mike staging the loss. If Mike is Vernon, an insider theory becomes more plausible. It would still not be proven. - **This also cuts against Nayiem.** He held an envelope reading "PAUL Vernon" in February 2021, and he says he "always knew that Mike never used his real name" [#7595](https://altillyfiles.com/chat#7595). He says he searched the name and found only a blues musician [#7585](https://altillyfiles.com/chat#7585), [#7595](https://altillyfiles.com/chat#7595). That is plausible but cannot be checked. It weakens any claim that he had no clue about Mike's identity. It supports his claim that he could not *prove* who Mike was at the time. ### 5. Refund handling **What was done:** - A claim form was opened [#2029](https://altillyfiles.com/chat#2029) with a repay mailbox [#2025](https://altillyfiles.com/chat#2025)-[#2028](https://altillyfiles.com/chat#2028). The deadline was cut to 9 January 2021 [#2443](https://altillyfiles.com/chat#2443) (image), and a quieter late form followed [#2447](https://altillyfiles.com/chat#2447), [#3357](https://altillyfiles.com/chat#3357). - Claims were checked against deposit-confirmation emails and capped at the amount on the form [#2146](https://altillyfiles.com/chat#2146), [#4665](https://altillyfiles.com/chat#4665), [#4828](https://altillyfiles.com/chat#4828), [#4870](https://altillyfiles.com/chat#4870). - Saved assets were paid: - directly to users, mostly by Mike [#4613](https://altillyfiles.com/chat#4613)-[#4903](https://altillyfiles.com/chat#4903); - or handed to the coins' developers (BYND [#2149](https://altillyfiles.com/chat#2149), Goldcoin [#3260](https://altillyfiles.com/chat#3260)-[#3267](https://altillyfiles.com/chat#3267), HONK keys given to its developer [#6739](https://altillyfiles.com/chat#6739), [#6761](https://altillyfiles.com/chat#6761), WRKZ wallet [#7037](https://altillyfiles.com/chat#7037)-[#7038](https://altillyfiles.com/chat#7038)). - Saved wallets were often short: Betller "thats all we had" [#4686](https://altillyfiles.com/chat#4686), Blocknet [#7450](https://altillyfiles.com/chat#7450), HONK only 5.25B recovered [#6750](https://altillyfiles.com/chat#6750), MRX wallets at 0 [#4849](https://altillyfiles.com/chat#4849). - By September 2021 Chuck had built sheets for non-saved assets and a BTC claim page with "800+ users… over 1600 entries" [#7426](https://altillyfiles.com/chat#7426), [#7517](https://altillyfiles.com/chat#7517)-[#7519](https://altillyfiles.com/chat#7519). The chat shows no payment for non-saved assets. **The separate list [#4029](https://altillyfiles.com/chat#4029)-[#4033](https://altillyfiles.com/chat#4033):** Nayiem told Chuck to refund a "really pushy person" "not by email and remove all traces" [#4029](https://altillyfiles.com/chat#4029). The list in question was the banking partner's 139-country high-risk list, not a sanctions list, though Chuck said he got "a sense this list covers all sanctions of any type" [#4023](https://altillyfiles.com/chat#4023), [#4027](https://altillyfiles.com/chat#4027), [#4028](https://altillyfiles.com/chat#4028). Nayiem explained that one long-standing user with proof of saved assets was on that list (he called it "the sanctioned list"); he put him on a "separated list" to "pay out eventually in the end" and deleted the messages [#4032](https://altillyfiles.com/chat#4032). **The author says the users on that separate list were paid.** The chat does not show the payment. The instruction to "remove all traces" and the off-record handling of a user on the bank's list remain fair grounds for criticism. **Amounts in the chat:** a loss of about $1M [#1677](https://altillyfiles.com/chat#1677); "1 million usd can be done" [#1626](https://altillyfiles.com/chat#1626); "we can not mine for 200k usd" [#5184](https://altillyfiles.com/chat#5184). **Nothing in the chat supports "$900K paid from my own pocket".** The author says the 2025 phrase "$2.4M saved assets" was wrong: $2.4M was the team's final total of all claims, saved and non-saved assets together, not the saved assets alone and not the loss. That claims sheet is not in the chat; the chat shows the valuation being set up [#2534](https://altillyfiles.com/chat#2534), [#2553](https://altillyfiles.com/chat#2553) and the non-saved-asset and conversion sheets being built [#7426](https://altillyfiles.com/chat#7426). Claims can exceed the loss because they include saved assets that still existed and were valued at a later date. Until the sheet is published, $2.4M is the author's figure. - In January 2021 Nayiem wrote that he had "no money at all" [#2805](https://altillyfiles.com/chat#2805), and in May 2021 "zero cash" [#5602](https://altillyfiles.com/chat#5602). - He paid some running costs, such as topping up the company card [#4387](https://altillyfiles.com/chat#4387) and paying the help-desk and email bills with his own card [#4417](https://altillyfiles.com/chat#4417)-[#4420](https://altillyfiles.com/chat#4420). - Personal repayments, if they happened, would be after October 2021 and outside this record. They are the author's claim until documents are published. - The author says he stopped paying refunds around 2022/2023, with only a handful after that, and estimates the claims still unpaid at around $50,000–60,000. That estimate cannot be checked: the database was lost and many of the chains no longer exist. See [Refunds](https://altillyfiles.com/refunds). **How it went, weighed both ways:** - *For good faith:* a structured process [#3965](https://altillyfiles.com/chat#3965), with a transaction ID per username [#3993](https://altillyfiles.com/chat#3993); checking developer refunds on-chain [#3224](https://altillyfiles.com/chat#3224); keeping the saved-asset lists public at Chuck's insistence [#7159](https://altillyfiles.com/chat#7159); and confirmations from third parties. - *Against:* - Delay as a tactic: "I can drag it out forever" / "Go for it." [#5017](https://altillyfiles.com/chat#5017)-[#5020](https://altillyfiles.com/chat#5020); a refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)-[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched; also [#6811](https://altillyfiles.com/chat#6811)-[#6813](https://altillyfiles.com/chat#6813), [#5962](https://altillyfiles.com/chat#5962), [#6027](https://altillyfiles.com/chat#6027). - The lowest valuation described as "most beneficial for us" [#6842](https://altillyfiles.com/chat#6842), though the author says the aim was to keep a one-day altcoin price spike around the hack from setting the value. - Dated repayment promises removed [#3418](https://altillyfiles.com/chat#3418)-[#3421](https://altillyfiles.com/chat#3421); a public repayment promise removed [#1911](https://altillyfiles.com/chat#1911)-[#1918](https://altillyfiles.com/chat#1918). - Loose checks: "anything between 50-200 usd I don't check at all" [#3564](https://altillyfiles.com/chat#3564), with only each coin's total claims checked against its wallet balance [#3558](https://altillyfiles.com/chat#3558); no payout ledger [#3575](https://altillyfiles.com/chat#3575). - Insiders exempted from proof [#3953](https://altillyfiles.com/chat#3953). - The off-record payout above [#4029](https://altillyfiles.com/chat#4029)-[#4032](https://altillyfiles.com/chat#4032). - Refund support paused for product work [#6035](https://altillyfiles.com/chat#6035). - Refunds for non-saved assets tied to future ventures and IOU tokens [#5201](https://altillyfiles.com/chat#5201)-[#5203](https://altillyfiles.com/chat#5203), [#5878](https://altillyfiles.com/chat#5878)-[#5883](https://altillyfiles.com/chat#5883), [#6806](https://altillyfiles.com/chat#6806). ### 6. The author's 2025 statement, claim by claim | Claim (2025 statement or follow-up) | Verdict | Evidence | |---|---|---| | Nayiem is not Mike | **Supported** | §1; [#3646](https://altillyfiles.com/chat#3646)-[#3693](https://altillyfiles.com/chat#3693) | | Mike was the developer who controlled operations, wallets and servers | **Supported** | §2 | | Nayiem had no access to Cherry | **Supported** for Cherry; other access existed | [#1492](https://altillyfiles.com/chat#1492)-[#1493](https://altillyfiles.com/chat#1493), [#1105](https://altillyfiles.com/chat#1105); compare [#2569](https://altillyfiles.com/chat#2569), [#7119](https://altillyfiles.com/chat#7119) | | The collapse began on 12 Dec 2020; $10k/$15k on 13 Dec | **Contradicted**: 23-25 Dec | [#1033](https://altillyfiles.com/chat#1033), [#1056](https://altillyfiles.com/chat#1056)-[#1059](https://altillyfiles.com/chat#1059), [#1103](https://altillyfiles.com/chat#1103) | | Collapse came "twelve days after forming the company" | **Supported** by the register: Qredit Ltd was incorporated on 11 Dec 2020, and the incident began on 23 Dec, twelve days later. The "12 December" date in the same statement looks like a mix-up with the incorporation date. The chat itself never mentions the company | Companies House 13077371; [#1033](https://altillyfiles.com/chat#1033) | | Registered "Altilly" in the UK | **Not supported**: the UK company was Qredit Ltd, not Altilly. In 2019 Nayiem said Altilly was incorporated in Hong Kong [#759](https://altillyfiles.com/chat#759); Mike said the HK company was never formed [#1778](https://altillyfiles.com/chat#1778) | [#759](https://altillyfiles.com/chat#759), [#1778](https://altillyfiles.com/chat#1778) | | Official story was a hosting breach / "database corruption" | **Partly**: servers deleted and data wiped, not "corruption" | [#1103](https://altillyfiles.com/chat#1103), [#1564](https://altillyfiles.com/chat#1564), [#2493](https://altillyfiles.com/chat#2493) | | Mike was "fixing" the database and never did | **Partly**: the database was said to be lost; he chased a possibly unwiped disk; no follow-up | [#1353](https://altillyfiles.com/chat#1353), [#2491](https://altillyfiles.com/chat#2491)-[#2511](https://altillyfiles.com/chat#2511) | | Only low-cap coins were saved because migration started with them | **Partly**: recent bitcoin-clone listings were on the new host | [#1297](https://altillyfiles.com/chat#1297)-[#1301](https://altillyfiles.com/chat#1301), [#1370](https://altillyfiles.com/chat#1370) | | $900K refunds paid from his own income | **Not supported by the chat**: later payments would fall outside this record | [#2805](https://altillyfiles.com/chat#2805), [#5602](https://altillyfiles.com/chat#5602) | | $2.4M "saved assets" (the author now says: total of all claims, saved and non-saved) | **Not checkable**: the final claims sheet is not in the chat; the chat's loss figure is about $1M | [#1677](https://altillyfiles.com/chat#1677), [#2534](https://altillyfiles.com/chat#2534), [#7426](https://altillyfiles.com/chat#7426) | | Paid refunds from his own funds over 2-3 years | **Not supported by the chat**: he was broke in 2021, and Mike sent refunds in kind | [#2805](https://altillyfiles.com/chat#2805), [#5602](https://altillyfiles.com/chat#5602), [#4836](https://altillyfiles.com/chat#4836) | | Mike showed off his house, pool and office while the team struggled | **Partly**: May 2021 videos show a new house, still under renovation, with an indoor pool. Mike was also selling another house, which he said had been bought about nine years earlier. Nothing links either house to Altilly funds, and the 2025 claim of a villa bought with stolen funds is **not supported** | [#5094](https://altillyfiles.com/chat#5094), [#5106](https://altillyfiles.com/chat#5106)-[#5125](https://altillyfiles.com/chat#5125), [#5471](https://altillyfiles.com/chat#5471), [#6163](https://altillyfiles.com/chat#6163)-[#6166](https://altillyfiles.com/chat#6166), [#7430](https://altillyfiles.com/chat#7430)-[#7431](https://altillyfiles.com/chat#7431), [#7544](https://altillyfiles.com/chat#7544) | | The Altilly "hack" was a cover / inside job | **Not established**: circumstantial only, and at odds with Nayiem's own conduct and Altilly's public line in 2020-21 | §3, [#1256](https://altillyfiles.com/chat#1256), [#2128](https://altillyfiles.com/chat#2128) | | Mike offered money after the hack | **Supported** ("that 10k", "send a little extra"); the stated purpose was licence costs | [#5728](https://altillyfiles.com/chat#5728)-[#5738](https://altillyfiles.com/chat#5738) | | Mike = Paul Vernon | **Partly supported**: strong name evidence; legal identity unconfirmed | §4 | | Karl = Mike; GitHub; Xeggex | **Not addressed** by the chat (after it ends) | - | | Mike asked him to be CEO in 2018 | **Not addressed, and inconsistent with his other statements**: the chat starts in 2019; Nayiem acts as CEO; Hodler Enterprises named as owner. His personal website says "I acquired Altilly in 2018 and invested $175,000 personally", and Altilly's 2020 notice said it "was acquired in 2019" | [#702](https://altillyfiles.com/chat#702), [#705](https://altillyfiles.com/chat#705) | | A "two-way dialogue" was opened with the US Marshals | **Partly supported, by the author's account**: a two-way dialogue was opened and tip reference 777-W77728 issued, with no response beyond that; the 2025 wording implied more | - | | Chosen as a scapegoat because he was the public face | **Partly**: he was the public face and his address was public [#1579](https://altillyfiles.com/chat#1579); team faces were removed from websites [#1264](https://altillyfiles.com/chat#1264)-[#1265](https://altillyfiles.com/chat#1265) | [#1579](https://altillyfiles.com/chat#1579), [#1264](https://altillyfiles.com/chat#1264) | | Some stolen funds went to the EXMO/Livecoin hackers' wallets | **Not supported by the chat**: only "state sponsored" speculation | [#1054](https://altillyfiles.com/chat#1054) | | MRX/FARM taken over-the-counter by Mike | **Not supported**: MRX wallets at 0; no OTC evidence | [#4849](https://altillyfiles.com/chat#4849) | | Vernon "never criminally charged" | **Contradicted** by the public record (indictment made public January 2022) | - | | (Conduct in the 2025 write-up) It named a private person linked to Mike's postal address, linked a property listing, and said Mike's details would be shared "if there was a 100% guarantee that people would visit his location" | **Documented in the write-up itself.** The author now says this was wrong. This site withholds those details | - | ### 7. Reddit and public allegations | Allegation | Status against the chat | |---|---| | Nayiem is Mike, or Mike was invented | **Contradicted** (§1, §4) | | Nayiem and his wife stole the funds / exit scam | **Not supported**: no message shows Nayiem moving customer funds, and he appears broke. It cannot be ruled out, because the record is one chat, curated by him | | Negligence (no 2FA on the host, no backups) | **Supported**: the old hosting login had no 2FA, and the backups could be deleted along with the servers [#215](https://altillyfiles.com/chat#215)-[#216](https://altillyfiles.com/chat#216), [#1271](https://altillyfiles.com/chat#1271), [#1299](https://altillyfiles.com/chat#1299), [#1504](https://altillyfiles.com/chat#1504) | | 14-day claim window, short deadline | **Supported** [#2443](https://altillyfiles.com/chat#2443); softened by the quiet late form [#2447](https://altillyfiles.com/chat#2447), [#3357](https://altillyfiles.com/chat#3357) | | Deposit-email proof used to keep payouts low | **Partly supported**: a stated anti-fraud reason [#5867](https://altillyfiles.com/chat#5867) alongside minimising language [#6842](https://altillyfiles.com/chat#6842), [#5017](https://altillyfiles.com/chat#5017)-[#5020](https://altillyfiles.com/chat#5020) | | Only partial refunds; some never paid (Banano, TUSC, etc.) | **Supported** [#5052](https://altillyfiles.com/chat#5052), [#6876](https://altillyfiles.com/chat#6876), [#7377](https://altillyfiles.com/chat#7377), [#7421](https://altillyfiles.com/chat#7421) | | Payment priority by country | **Partly**: country screening (Chuck: "declined refunds due to sanctioned countries") [#4005](https://altillyfiles.com/chat#4005) and the banking partner's 139-country high-risk list [#4028](https://altillyfiles.com/chat#4028); Nigeria deliberately not marked [#4034](https://altillyfiles.com/chat#4034) | | Admins deleted critics and class-action talk | **Supported** [#2679](https://altillyfiles.com/chat#2679)-[#2683](https://altillyfiles.com/chat#2683), [#3929](https://altillyfiles.com/chat#3929)-[#3934](https://altillyfiles.com/chat#3934) | | Deposits and withdrawals failing days before | **Not addressed** directly; the 38-pending-withdrawal event is from 2019 [#790](https://altillyfiles.com/chat#790) | | Nayiem knew about Mike and stayed silent (re Xeggex) | **Partly admitted, outside the chat.** In the 2025 statement a Discord message of 30 November 2022, 00:17, reads "We are not going to say anything if you can return the funds in 24hrs" (image). It concerned the 1,878,477 SXP fraudulently swapped from Solar, as described in Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png); by the author's account Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024. He admits he put recovering that money ahead of warning Xeggex users. See §9 on what could be checked | | A CEO without server access is implausible | **Addressed**: the chat shows it at the time [#1492](https://altillyfiles.com/chat#1492)-[#1493](https://altillyfiles.com/chat#1493), [#2572](https://altillyfiles.com/chat#2572), [#6557](https://altillyfiles.com/chat#6557) | | Screenshots not from Nayiem's device | **Not addressed** | | Karl = Nayiem; Dokdo/Xeggex links | **Not addressed** by the chat (2022 onwards) | ### 8. How Nayiem comes across - **Business-focused, and a delegator.** He set direction and fees and left technical matters to Mike ("I don't know. Mike knows", [#3841](https://altillyfiles.com/chat#3841)). He did not insist on audits or proper custody, although he did raise BitGo and Chainalysis [#961](https://altillyfiles.com/chat#961)-[#964](https://altillyfiles.com/chat#964) and, later, manual cold-wallet withdrawals [#5666](https://altillyfiles.com/chat#5666). - **During the crisis** he pushed for disclosure and stayed reachable [#1163](https://altillyfiles.com/chat#1163), [#1245](https://altillyfiles.com/chat#1245), [#1249](https://altillyfiles.com/chat#1249). He was supportive of colleagues ("It's not your fault", [#1256](https://altillyfiles.com/chat#1256)). He was distressed and frightened by threats [#2366](https://altillyfiles.com/chat#2366)-[#2471](https://altillyfiles.com/chat#2471): "I don't know what i will do to myself if it ever happens again" [#5361](https://altillyfiles.com/chat#5361). He was short of money. - **Also:** - impulsive and sometimes careless: the unverified "funds safe" line [#1180](https://altillyfiles.com/chat#1180); blaming Mike over DNS and then correcting himself [#7119](https://altillyfiles.com/chat#7119)-[#7123](https://altillyfiles.com/chat#7123); posting his own card details in the group [#4417](https://altillyfiles.com/chat#4417); - focused on PR and at times opaque [#2968](https://altillyfiles.com/chat#2968), [#2973](https://altillyfiles.com/chat#2973), [#3147](https://altillyfiles.com/chat#3147), [#4029](https://altillyfiles.com/chat#4029)-[#4032](https://altillyfiles.com/chat#4032), [#7179](https://altillyfiles.com/chat#7179); - dismissive or mocking towards some claimants: "What an idiot" [#2158](https://altillyfiles.com/chat#2158); "I like it when Altilly users are saying that they are going to sue me" [#6386](https://altillyfiles.com/chat#6386); "10% approval… more than enough" [#5059](https://altillyfiles.com/chat#5059); - quick to move on to new ventures while refunds were pending [#2304](https://altillyfiles.com/chat#2304), [#5236](https://altillyfiles.com/chat#5236)-[#5257](https://altillyfiles.com/chat#5257), [#6035](https://altillyfiles.com/chat#6035). - **Fair summary:** the chat reads like an overstretched operator who trusted and depended on a technical partner, and who then handled the fallout with a mix of real effort, self-protection and messaging that users would reasonably call evasive. It does not read like the planner of a theft, but that impression has limits (§9). ### 9. Limits of this evidence - **One source, curated by an interested party.** Nayiem became owner of the group on 28 September 2026 [#7576](https://altillyfiles.com/chat#7576)-[#7578](https://altillyfiles.com/chat#7578), removed messages to protect customer and third-party data [#7598](https://altillyfiles.com/chat#7598), and added notes in 2026 written with hindsight [#7576](https://altillyfiles.com/chat#7576)-[#7598](https://altillyfiles.com/chat#7598). - **Who could delete what.** Before 28 September 2026 Nayiem had no admin rights in the group [#7576](https://altillyfiles.com/chat#7576)-[#7578](https://altillyfiles.com/chat#7578); like any member, he could delete his own messages. Chuck created and owned the group until then, and Mike could delete his own messages until his account was deleted. At least one missing message number, #7582, comes after Nayiem became owner. The export does not show who deleted what, or when. - **Some gaps (missing message numbers, so they cannot be linked) fall at sensitive points:** around the 24 December wording (#1030, #1055, #1058, #1061-#1064, #1066-#1070); around the paul@satotechlt.com email (#1323, #1325, #1327, #1329-#1331, #1333); and #3095-#3101 with several more up to #3116, #3402, and #7499, #7502-#7503 and #7506-#7507. Customer data does not obviously explain these gaps. - **Much happened outside this chat:** Mike's direct messages and calls [#2716](https://altillyfiles.com/chat#2716)-[#2718](https://altillyfiles.com/chat#2718), [#6561](https://altillyfiles.com/chat#6561), Discord, the public groups, the help desk, forms and spreadsheets. - Mike's account is deleted and he cannot respond here. Several key items are images. - **The November 2022 Solar incident: what is documented and what rests on the author.** Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png), posted in the Solar validator group on Discord and titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS", says that on 29 November 2022 unauthorised swaps were detected which took place between 12 August and 29 November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins; that "In total, 1,878,477 SXP was fraudulently swapped" through a vulnerability in the BSC nodes that provided API data to the swap service; that this was not a hack of the Solar mainnet or Solar Core, "user funds were never at risk" and no new SXP was created; and that "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." The statement does not name Mike. Mike's identity as the perpetrator comes from the author's Discord screenshots in his February 2025 write-up: on 29 November 2022 at 22:45 the author wrote "Why did you do it Mike?", and at 05:43 on 30 November MikeO replied "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." These screenshots are the author's evidence and were not independently verified here. The repayment rests on the author's account: he says Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. His [repayment ledger](https://altillyfiles.com/story#after-altilly) gives transaction IDs for the final five payments, which can be checked on the Solar blockchain; the first seven have no published IDs, and a transaction alone does not show who sent it. - **Law enforcement.** The author says he reported to the FBI and the US Marshals Service in early 2025, that the Marshals opened a two-way dialogue and issued tip reference 777-W77728, and that there was no response beyond that. No authority has made any public statement about Altilly, Xeggex or Mike. - **Cannot be proven from this record:** who deleted the servers; where the 31 BTC went; whether Mike acted deliberately; whether any funds reached Nayiem; the $900K in personal repayments. **What would strengthen the author's case:** - a full export from another member (such as Chuck), with a checksum, to compare the gaps; - Revolut records for the "Paul Vernon" team member, and the original envelope photo with its metadata; - Cherry Servers records showing the account owner, logins, and who registered the paul@satotechlt.com email; - on-chain tracing of the Altilly BTC/ETH hot and safe wallets and of the DIME destination wallet [#1497](https://altillyfiles.com/chat#1497); - bank and exchange records of personal refund payments, with a ledger; - for the Solar incident: transaction IDs for the loss and for the seven earlier repayments (the receiving wallet and the final five repayments are listed in the author's [ledger](https://altillyfiles.com/story#after-altilly)); - any acknowledgement from law enforcement. **What would weaken it:** another member's export showing incriminating deleted content; on-chain links from Altilly outflows to addresses Nayiem controls; or evidence that he held the Cherry credentials or safe-wallet keys before 25 December 2020. ### 10. Overall conclusion - **High confidence:** Nayiem is not Mike. Mike, not Nayiem, ran and held the keys to the wiped servers and the lost wallets. The loss was about $1M, in late December 2020. Nayiem appeared short of money through 2021. - **Moderate to high confidence:** the chat contains no evidence that Nayiem stole Altilly funds. His conduct at the time (pushing for disclosure, chasing the BTC, staying reachable, and being short of money through 2021) fits someone who did not. - **Highly likely in the reviewer's judgement, but not legally established:** Mike used the name "Paul Vernon" [#1326](https://altillyfiles.com/chat#1326)-[#1328](https://altillyfiles.com/chat#1328), [#3833](https://altillyfiles.com/chat#3833) with [#3646](https://altillyfiles.com/chat#3646)-[#3653](https://altillyfiles.com/chat#3653). Probable, but unconfirmed, that he is the indicted Cryptsy founder. - **Not established:** that Mike orchestrated the "hack". There is suspicious circumstantial material: sole control, changing explanations, a BTC wallet he could not recall, the "outage" wording, the status-page fix, missing records, and the possible Vernon identity. There is also material that fits an outside attack: Cherry confirms an earlier intrusion [#4353](https://altillyfiles.com/chat#4353) (image), Mike reported a Tor source, and EXMO and Livecoin were hacked in the same days. Nayiem trusted Mike through 2021, so his inside-job theory is a later reinterpretation, not a view he held at the time. It remains his belief. - **Fair criticisms of Nayiem that the evidence supports:** poor governance as CEO; accepting a partner under an assumed name; refund management that was opaque, sometimes stalled, and aimed at limiting liability; refunds that were never completed; an off-record payout with an instruction to "remove all traces"; several factual errors in his 2025 statement (the 12 December date, "never criminally charged", figures the chat does not support, wording that made the "two-way dialogue" with the Marshals sound like more than it was); publishing a private person's details and inviting people to visit Mike's location in 2025; and, by his own account, offering in 2022 to stay silent if Mike returned the Solar funds, while Xeggex users went unwarned. - **Fair headline:** *not shown to have stolen; shown to have failed on governance and on refund transparency; his central claim about Mike's identity is better supported than his critics allow; his central "inside job" claim is plausible but unproven.* --- # Frequently asked questions Source: https://altillyfiles.com/faq Markdown: https://altillyfiles.com/content/faq.md ## Questions a sceptical reader should ask These are short answers. The longer version is in [my story](https://altillyfiles.com/story), and the evidence about Mike is on [Who was Mike?](https://altillyfiles.com/mike). Numbers like [#1326](https://altillyfiles.com/chat#1326) open that message in the chat. Chat times are UTC-8. > **Note:** > > Where I say "I believe", that is my belief. No court or authority has confirmed that Mike is Paul Vernon, that "Karl" is Mike, or that Mike took the Altilly or Xeggex funds. ### Why should I trust a chat you control? You shouldn't take it on trust. I have owned this group only since 28 September 2026, when Chuck, who created it, handed it over [#7576](https://altillyfiles.com/chat#7576) [#7578](https://altillyfiles.com/chat#7578). The export shows who wrote each message and when, and I kept messages that make me look bad, for example [#2968](https://altillyfiles.com/chat#2968), [#4029](https://altillyfiles.com/chat#4029), [#5020](https://altillyfiles.com/chat#5020) and [#6842](https://altillyfiles.com/chat#6842). My own 2026 notes are marked as notes, not as part of the original chat [#7585](https://altillyfiles.com/chat#7585) [#7595](https://altillyfiles.com/chat#7595). Every redaction and gap is listed on the [Transparency page](https://altillyfiles.com/transparency). If you were in this group, compare it with your own copy, and please tell me if anything differs. ### What did you delete? I removed customer data, personal data about unrelated people, and data about early team members [#7598](https://altillyfiles.com/chat#7598). Other text is redacted, and those redactions are listed on the [Transparency page](https://altillyfiles.com/transparency). 663 message numbers are missing from the export. Some of the gaps fall at sensitive points, around the 24 December wording [#1055](https://altillyfiles.com/chat#1055) [#1058](https://altillyfiles.com/chat#1058) and around the paul@satotechlt.com email [#1323](https://altillyfiles.com/chat#1323) [#1325](https://altillyfiles.com/chat#1325) [#1327](https://altillyfiles.com/chat#1327). I cannot see who deleted what, or when. Mike could delete his own messages, and Chuck, as owner, could delete any. At least one gap, [#7582](https://altillyfiles.com/chat#7582), comes after I became owner, so that one was mine. I understand why the gaps raise questions. The unredacted chat is available to authorities. ### Can I see the original Telegram group? No. Before preparing this site, I deleted some messages from the group that contained customer data or details about early staff and unrelated people [#7598](https://altillyfiles.com/chat#7598). That did not remove all personal data: many of the remaining messages still contain customer names, emails, balances, support tickets and screenshots. On this site those are redacted (436 text redactions and 148 images masked or withheld, all listed on the Transparency page) so that every message can still be read in context; deleting all of them instead would have removed most of the record. The authorities will get everything, including the messages I deleted. That is why the original group stays private: it still contains customer data and data about third parties. This site is the complete redacted copy: everything in my export is here, except the removals listed on the [Transparency page](https://altillyfiles.com/transparency). There is no public invite link. If you are from law enforcement, contact me and I can give you access to the original group. If you are a journalist, all the messages are on this site; if you want to check a specific message against the original, contact me. ### Can you show what Mike promised you in private? No. The promises I describe, such as that I would own Altilly once I had set up a company, were made in a one-to-one Telegram chat between Mike and me. Mike deleted the entire history of that chat for both of us, so it cannot be recovered. What I say about it is my memory. Only fragments survive: screenshots of part of that private chat that I posted in this group in May 2021 [#5025](https://altillyfiles.com/chat#5025) [#5028](https://altillyfiles.com/chat#5028), which are about the Estonian licence and a new exchange, not about Altilly's ownership, and my Discord screenshots from November and December 2022. ### Why didn't you publish this earlier? Partly fear, and partly shame. I have received threats for years, from the first days after the hack [#2155](https://altillyfiles.com/chat#2155) [#2160](https://altillyfiles.com/chat#2160) [#2471](https://altillyfiles.com/chat#2471) until now. Reading my own messages from that time was hard; many of them are naive or worse. I also had to go through thousands of messages to remove customer data first. Ownership was not the reason. Chuck owned the group until 28 September 2026 [#7578](https://altillyfiles.com/chat#7578), but I was still a member and in touch with him, and in 2025 I used the chat to take screenshots and post them online. People still did not believe me: whatever facts or screenshots I showed, someone could say they were fabricated. So I stopped arguing online. By 2026 I was still having nightmares about that time, still receiving threats on Telegram, and still unable to run a legitimate business without being connected to Altilly. I decided to settle it once and for all: publish the whole team chat, including my own shortcomings and how naively I ran the business, so people can read it for themselves. For a long time I assumed that if I left it behind and kept handling the refunds myself, it would fade away. After I came to believe who Mike really was, from late 2022, I also stayed away from saying it publicly: I was running a legitimate business and did not want my name connected to his real name, or the reputation of my future projects to suffer for it. For me the most important thing was to refund users, and I believed I could do it by staying positive and running real businesses. That is what I did: when I sold my mining businesses in 2022, I used the proceeds first to pay back the investors, and then used my own share to pay Altilly refund users, roughly $900,000 by my own count (see [Refunds](https://altillyfiles.com/refunds) on what can and cannot be proven). The original group stays private because it contains customer data, but it is available to law enforcement, and to journalists and others who want to verify specific messages one-to-one with me. ### Did you steal the funds? No. That is my answer, and I know you cannot simply accept it. What the chat shows is this. Mike ran the servers, the backups and the wallet keys [#1271](https://altillyfiles.com/chat#1271) [#1299](https://altillyfiles.com/chat#1299) [#1353](https://altillyfiles.com/chat#1353). At the time of the loss I wrote "I never had access to those servers" [#1492](https://altillyfiles.com/chat#1492) [#1493](https://altillyfiles.com/chat#1493). In January 2021 I wrote that I had "no money at all" [#2805](https://altillyfiles.com/chat#2805), and in May 2021 "zero cash" [#5602](https://altillyfiles.com/chat#5602). The chat does not show me moving customer funds. It cannot prove a negative, and it does not cover what happened outside this group. ### Where did Altilly's fees go? Didn't listing fees in XQR benefit you? As far as I know, the listing and trading fees went to Mike. That is my account: no message in the chat names the wallet that received them. What the chat does show fits it. When we changed our listing offer in 2019, it was Mike who changed the payment info [#697](https://altillyfiles.com/chat#697), and he held the keys to a wallet he kept some funds in [#1615](https://altillyfiles.com/chat#1615). After the hack, when I asked how much of the 31 lost BTC was ours, he answered "i think around 0.8 was mine … exchange fees, not much" [#1663](https://altillyfiles.com/chat#1663). Listing fees were priced in XQR [#183](https://altillyfiles.com/chat#183) [#583](https://altillyfiles.com/chat#583). The Qredit ICO ended in 2018, so I was not selling new XQR at the time; by my account, projects paid with XQR that was already in circulation. But demand for XQR did benefit people who held it, and I was one of them. I also once suggested making users apply for Qredit KYC, "which also costs money" [#198](https://altillyfiles.com/chat#198). So yes, I benefited indirectly as an XQR holder. My own XQR, which I kept on Altilly, was lost in the hack [#1733](https://altillyfiles.com/chat#1733). The chat shows no fee money reaching me, but some messages were removed before publication [#7598](https://altillyfiles.com/chat#7598), so that is not proof on its own. ### Are you Mike, or "Karl"? No. Mike and I appear in the same chat as different people, talking to each other. He lived in China [#3639](https://altillyfiles.com/chat#3639) [#4415](https://altillyfiles.com/chat#4415), and I lived in Sweden [#5735](https://altillyfiles.com/chat#5735). His Revolut card was sent to my address because Revolut showed that its service was not offered in his country [#3646](https://altillyfiles.com/chat#3646), and I forwarded it [#3647](https://altillyfiles.com/chat#3647) [#3960](https://altillyfiles.com/chat#3960). On "Karl", see the Dokdo/Xeggex question below. ### Is Mike really Paul Vernon? I believe so, but it is not proven. The strongest items are in the chat from the time. On 26 December 2020 Mike named the old hosting login "paul@satotechlt.com" and wrote "history on that domain probably has my name" [#1326](https://altillyfiles.com/chat#1326) [#1328](https://altillyfiles.com/chat#1328). In February 2021 his Revolut card arrived addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). Paul Vernon, the Cryptsy founder, is under a US federal indictment and has not been convicted. No court or authority has linked him to Altilly or Xeggex. The full evidence, including what points the other way, is on [Who was Mike?](https://altillyfiles.com/mike). ### If you had that envelope in 2021, why did you keep working with Mike? Because I trusted him and did not want to see it. I knew "Mike" was not his real name [#7595](https://altillyfiles.com/chat#7595); he told me he kept his real name private because he also ran adult websites and did not want that linked to the exchange (his explanation, which I cannot verify). When the "PAUL Vernon" envelope arrived [#3833](https://altillyfiles.com/chat#3833), as I remember it, I searched the name, found a British blues musician, and let it go (my 2026 note [#7585](https://altillyfiles.com/chat#7585)). Days after the hack I told him "It's not your fault" [#1256](https://altillyfiles.com/chat#1256), and in May 2021 I wrote "I trust you with the hosting panel" [#5658](https://altillyfiles.com/chat#5658). We kept planning a new exchange together [#5666](https://altillyfiles.com/chat#5666) [#7428](https://altillyfiles.com/chat#7428). I call that wilful blindness, and it is my fault. ### Did Mike send you money after the hack? He offered to, and I said yes. In May 2021 he wrote "i think i can probably get that 10k by the end of the week", "ill send a little extra if i can" and "you have no problems cashing out btc right?" [#5728](https://altillyfiles.com/chat#5728) [#5737](https://altillyfiles.com/chat#5737) [#5738](https://altillyfiles.com/chat#5738). It was for the Estonian licence I was applying for, for our next venture together [#5735](https://altillyfiles.com/chat#5735) [#5745](https://altillyfiles.com/chat#5745). In August 2021 I wrote "We already have the funding for the crypto license" [#7230](https://altillyfiles.com/chat#7230); by my account, that was the money Mike had offered. The chat itself does not show the payment. In 2026 I added a note calling it "10k out of nowhere" [#7592](https://altillyfiles.com/chat#7592). That leaves out that Mike said at the time he was selling a house and planned to "live off that cash" [#5471](https://altillyfiles.com/chat#5471) [#5472](https://altillyfiles.com/chat#5472). The chat does not show where the money came from. ### Why were refunds partial? The user database and its decryption config were lost [#1352](https://altillyfiles.com/chat#1352) [#1353](https://altillyfiles.com/chat#1353), so we rebuilt claims by hand from claim forms and deposit-confirmation emails [#2146](https://altillyfiles.com/chat#2146) [#4665](https://altillyfiles.com/chat#4665). Only about 137 assets were saved [#1757](https://altillyfiles.com/chat#1757). Many saved-asset refunds went out in 2021, mostly sent by Mike [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). Some saved wallets were short or empty [#4849](https://altillyfiles.com/chat#4849). Thousands of people missed the deadline [#5052](https://altillyfiles.com/chat#5052). By July 2021, first-round assets were still unpaid [#6876](https://altillyfiles.com/chat#6876), and in September Chuck wrote "Weve made alot of promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). Some of it was also our fault. I agreed to "drag it out" [#5017](https://altillyfiles.com/chat#5017) [#5020](https://altillyfiles.com/chat#5020) (the refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched), I told Chuck to use the lowest price "the most beneficial for us" [#6842](https://altillyfiles.com/chat#6842) [#6847](https://altillyfiles.com/chat#6847), partly so a one-day spike in altcoin prices would not set the value, and I did not check individual claims between 50 and 200 USD [#3564](https://altillyfiles.com/chat#3564), only that each coin's total matched its wallet [#3558](https://altillyfiles.com/chat#3558). Those messages stay published. ### Did you really pay about $900,000 in refunds yourself? Yes. The figure comes from my own records. Most of the money came from selling my mining businesses in 2022: after paying back the investors, I used my share for Altilly refunds, all of it except about $25,000 that went to my personal debt. The payments were made from late 2021 onwards, after this chat ends; the chat itself shows me broke in 2021 [#2805](https://altillyfiles.com/chat#2805) [#5602](https://altillyfiles.com/chat#5602). I know a reader cannot check that from this site. Even if I published amounts and transaction IDs, someone could say I sent random amounts to random wallets. The better test is the communities themselves: projects that were listed on Altilly can ask in their own groups whether their members received refunds, including for non-saved assets, and a trusted member saying yes is worth more than anything I post. See [Check the refunds yourself](https://altillyfiles.com/refunds#check-the-refunds-yourself). ### Did you hide some refunds? Yes. In February 2021 I told Chuck that, for "a really pushy person" in a country on our banking partner's 139-country high-risk list (not a sanctions list), he should refund "but not by email and remove all traces" [#4028](https://altillyfiles.com/chat#4028) [#4029](https://altillyfiles.com/chat#4029). I had already done this for one loyal user, whom I put on a separate list and whose messages I deleted [#4032](https://altillyfiles.com/chat#4032) [#4033](https://altillyfiles.com/chat#4033). The users were paid, but the chat does not show it, and I have not published proof. The chat also does not show how many people were handled this way after my instruction. It was wrong to work around our own rules and hide it. ### Why can't you show refund txids? For many refunds, I can't. Several of the chains we paid out on in 2020-21 no longer run, including the old Qredit chain, so those transactions can no longer be looked up. Many saved-asset refunds were sent by Mike, not by me [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903), and the user database was lost in the hack [#1352](https://altillyfiles.com/chat#1352) [#1353](https://altillyfiles.com/chat#1353). Where a chain still exists and I have the records, I can look up a specific refund if you ask. I know "the proof is gone" is exactly what a dishonest person would also say. So treat refunds I cannot document as my claim, not as fact. ### What about the Dokdo/Xeggex acquisition? In 2022 Mike introduced me to "Karl" from Xeggex. My company, Dokdo, announced that it would acquire Xeggex, on the condition of full KYC/AML compliance. Xeggex's own site said so at the time, and for a while it described itself as a Dokdo service. I asked for the backend and wallet code for an audit and received only the frontend, and I did not complete the acquisition. That is my account; there are no chat messages about it, because this chat ends in 2021. Two things count against me. The Dokdo references stayed on Xeggex until December 2022. On 3 December Mike asked me on Discord whether to start removing them, and I said "Yes, please" (a screenshot is in my February 2025 write-up). That was days after the Solar incident. And in February 2025 I wrote that I had "no connection with Mike whatsoever", which left out this history. The business relationship ended in late 2022; after that, my only contact with him was about getting money back (see below). Public records show that the Xeggex domain (August 2021) and its GitHub organisation (September 2021) existed before Mike told me about "Karl", and that Mike's GitHub account "mrmikeo" made a commit to Xeggex's GitHub organisation in April 2024. I believe "Karl" was Mike. That is not proven. ### Did Xeggex run on your servers? While we worked together, Mike had his own project inside my Hetzner account, with its own API key. He could create and manage servers in that project [#5937](https://altillyfiles.com/chat#5937) [#5941](https://altillyfiles.com/chat#5941) [#6040](https://altillyfiles.com/chat#6040)–[#6042](https://altillyfiles.com/chat#6042), but he had no access to the rest of my account. That is how Altilly's new servers were set up in 2020 [#1119](https://altillyfiles.com/chat#1119) [#1121](https://altillyfiles.com/chat#1121) [#2586](https://altillyfiles.com/chat#2586). After we split up in late 2022, I found out that he was also using that project for Xeggex, including a Solar node for Xeggex. I told him to move everything out of it. He finished in January 2023, and I deleted the servers. The chat ends in 2021, so this part is my account. ### What happened at Solar in November 2022? Solar (SXP) was a project I led. On 30 November 2022 Solar posted a statement in the Solar validator group on Discord, titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS" ([the statement](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png)). It says that on 29 November 2022 "a series of unauthorised swap transactions were detected which took place between 12th August 2022 and 29th November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins", and that "In total, 1,878,477 SXP was fraudulently swapped during this time resulting from a vulnerability detected in the BSC nodes used to provide API data to the swap service." It says this was not a hack of the Solar mainnet or Solar Core, that "user funds were never at risk", and that no new SXP coins were created. It also says: "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." It does not name anyone. That the perpetrator was Mike comes from my own Discord screenshots, which are in my February 2025 write-up, not from the statement. On 29 November 2022 at 22:45 I wrote to him: "Why did you do it Mike?" At 00:17 on 30 November I wrote: "We are not going to say anything if you can return the funds in 24hrs." At 05:43 MikeO replied: "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." On 3 December 2022 he wrote: "I had nothing to do with the altilly hack." These screenshots are my evidence; they are not part of this chat, and no authority has confirmed any of it. ### When did you realise who Mike was? In stages, and too late. In December 2020 Mike named the old hosting login "paul@satotechlt.com" [#1326](https://altillyfiles.com/chat#1326) [#1328](https://altillyfiles.com/chat#1328), and in February 2021 his Revolut card arrived addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). I saw both and let them go. As best I can place it, it came together around November 2022, at the time of the Solar incident: I came to believe that Mike was running Xeggex himself, that "Karl" did not exist, and that Mike was Paul Vernon. I then cancelled the Dokdo acquisition. These are my beliefs; no authority has confirmed them. ### Why did you stay silent while the Solar funds were being repaid? Because I put getting the money back first. I wrote to him, "We are not going to say anything if you can return the funds in 24hrs." It took far longer than 24 hours. By my account, Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. The final payments can be checked on the Solar blockchain; the dates, amounts and transaction IDs are in the [Solar repayment ledger](https://altillyfiles.com/story#after-altilly). The business relationship ended in late 2022. After that, I stayed in contact with him for one reason: getting money back. First the Solar funds, which he repaid in full by 19 March 2024, and later a promise he made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck. He never followed up on it. ### Why didn't you warn Xeggex users? I should have. From late 2022 I believed Mike ran Xeggex, and I said nothing publicly for over two years while it took deposits. My reasons were these. I had no proof. I was running Solar, a legitimate project, and did not want it tied to someone I believed was Paul Vernon. I was afraid of him. I had a young child and a family to protect, and Solar to run. I believed Mike was Paul Vernon, whom a US court had placed in fugitive status, and I feared he might have access to large funds: in March 2022 bitcoin from the 2014 Cryptsy theft started moving, as [Elliptic reported](https://www.elliptic.co/blog/bitfinex-2.0-elliptic-traces-bitcoin-worth-512-million-from-2014-cryptsy-exchange-theft). Nobody has shown who moved those coins, and my fear that Mike could reach them was only a fear. I also remember Mike once saying, in a private conversation, that he could make someone disappear. That is my memory, not something in the chat or something I can prove, and I do not know what he meant. I mention it because the memory of that remark frightened me. Above all, I expected nobody to believe me. The business relationship had ended, and the only contact I kept with him was about getting money back. My expectation turned out to be right. When I did go public, in February 2025 after Xeggex collapsed, and said that I believed Mike, "Karl" and Paul Vernon were the same person, many people did not believe me. On Reddit they wrote that I was "the perpetrator" and "Karl" myself ([r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1il8ei9/), [r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iisdmd/)), and that I did not "pass the sniff test" ([r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/)). That disbelief is exactly what I had expected. I also expected that going public would hurt me more than it would help anyone, and in 2025 it did: after my statement, people came to my properties, and I moved house because my address was public. Those are reasons, not excuses. I also doubt that a warning from me would have stopped many people. When I went public in February 2025, Xeggex had already frozen withdrawals. Even so, when its website came back in March, people kept using it. Users asked on Reddit about buying there again ([r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1jceats/)), and in May 2025 a coin project still listed Xeggex as one of the places to trade its coin ([r/BonkcoinPoW](https://old.reddit.com/r/BonkcoinPoW/comments/1kq3wgx/)). In 2026 the Xeggex domain came back with a "refund" offer, and an old user wrote that he paid it a deposit, despite warnings all over Reddit ([r/Crypto_Scam_Exchange](https://old.reddit.com/r/Crypto_Scam_Exchange/comments/1qwi92l/comment/oohcpxo/)). I cannot prove that an earlier warning would have changed nothing. People who lost money on Xeggex may still blame my silence, and I understand that. ### Are you accusing "Michael O'Sullivan"? No. Mike used that name: he signed a whitepaper "Michael Osullivan" [#5529](https://altillyfiles.com/chat#5529), and within weeks of the hack a hostile message, which Chuck relayed to this group, posted that name along with accusations [#2679](https://altillyfiles.com/chat#2679). This site does not repeat or endorse those accusations. UK Companies House lists a director registered as Michael O'Sullivan as an officer of two Xeggex companies. The register does not verify identities. I am convinced "Michael O'Sullivan" was an alias Mike used, possibly with a false passport; that needs investigation by law enforcement. That name may belong to a real, separate person whose details were used, and I am not accusing any such person. ### Did Mike buy his house with Altilly money? I cannot show that, and I no longer claim it. In 2025 I wrote that he lived in a villa paid for with stolen funds, and my 2026 notes suggested the renovation was funded from the hack [#7589](https://altillyfiles.com/chat#7589) [#7592](https://altillyfiles.com/chat#7592). What the chat shows is a new house with an indoor pool, filmed in May 2021 [#5094](https://altillyfiles.com/chat#5094) [#5106](https://altillyfiles.com/chat#5106) [#5125](https://altillyfiles.com/chat#5125), and more work later that year [#7430](https://altillyfiles.com/chat#7430) [#7431](https://altillyfiles.com/chat#7431). It also shows Mike selling another house, which he said had been bought about nine years earlier, and finding a buyer in September 2021 [#6163](https://altillyfiles.com/chat#6163)–[#6166](https://altillyfiles.com/chat#6166) [#7544](https://altillyfiles.com/chat#7544). My notes left that out, and I should not have implied it. The chat does not show how the new house was paid for. The interior videos are published [#5106](https://altillyfiles.com/chat#5106) [#5123](https://altillyfiles.com/chat#5123) [#5125](https://altillyfiles.com/chat#5125); one video of the garden is withheld because it could reveal where the house is [#5114](https://altillyfiles.com/chat#5114). I am not asking anyone to take my word either way. Read the chat, look at the dates, do your own research, and draw your own conclusion. ### Why did Qredit Ltd never file accounts? Qredit Ltd (UK company 13077371) was incorporated on 11 December 2020, with me as sole director and the only person with significant control. Mike does not appear on it. It filed nothing after incorporation, no accounts and no confirmation statement, and it was struck off on 17 May 2022. That is on the public register, and it is a failure on my part. My explanation is that the company never traded. I had moved my own Qredit (XQR) coins onto Altilly, because XQR was Altilly's own fee coin, and all the XQR on Altilly was lost in the hack [#1731](https://altillyfiles.com/chat#1731) [#1732](https://altillyfiles.com/chat#1732) [#1733](https://altillyfiles.com/chat#1733) [#1734](https://altillyfiles.com/chat#1734). I believe Mike took it along with everything else, but the chat shows only that it was lost. I was still arranging a banking partner for Qredit in February 2021 [#4083](https://altillyfiles.com/chat#4083), but it never got going. The chat never mentions the UK company. ### What was Willems Ventures? Willems Ventures was my company for Voyager Park, the tourist resort I ran [#1579](https://altillyfiles.com/chat#1579) [#1583](https://altillyfiles.com/chat#1583). It was not an Altilly company. But I should be clear that it was not kept fully separate. In February 2021 I gave Mike and Chuck cards on a Revolut Business account that showed the name Willems Ventures, and paid team costs from it [#3644](https://altillyfiles.com/chat#3644) [#3686](https://altillyfiles.com/chat#3686) [#3732](https://altillyfiles.com/chat#3732). I called it "my account" [#3732](https://altillyfiles.com/chat#3732). A UK company, Willems Ventures Ltd, was incorporated the same day as Qredit Ltd. ### Have you gone to the authorities? Yes. In early 2025 I reported what I knew to the FBI and the U.S. Marshals Service. The Marshals opened a two-way dialogue and gave me a tip reference, 777-W77728, but they never responded in it beyond that number. That reference only confirms my report was received. It does not confirm any investigation or any of my beliefs. My 2025 write-up made the dialogue sound like more than it was. The FBI has not given me a case number. I can give any authority the unredacted chat, the envelope photo and the 2022 screenshots. Please do not contact, confront or visit anyone named here. In 2025 I published a private person's name and a property listing, and said I would share Mike's details if people would visit him. That was wrong, and this site does not repeat it. ### Are refunds still being paid? Mostly no. I stopped regular refunds around 2022/2023, and have paid only a handful since. I estimate that the claims still unpaid are around $50,000–60,000 in total, but that is my estimate and I cannot prove it. They are now very hard to check: the user database is gone [#1352](https://altillyfiles.com/chat#1352) [#1353](https://altillyfiles.com/chat#1353) and some chains no longer exist. Many of the late claims I received were fake. I will also be honest about the rest: after I came to believe who Mike was, and watched Xeggex carry on, I lost the energy to keep going. That is not a good reason for the people still waiting, and I know it. ### I lost funds on Altilly. Can I still claim a refund? Ask me through the question form on [this page](https://altillyfiles.com/ask), and say which assets and roughly what balance you had. Do not post private details such as your email, address or wallet keys in public. I will answer there. I cannot promise a refund or a timeline, and nothing on this site is an offer of payment. ### Is xeggex.com back? Can I get my old balance through its refund page? Be careful. The xeggex.com domain is active again in 2026 and asks old users for deposits or "release fees" to get their old balances back. Reports on Reddit call it a scam ([r/pepecoin, Feb 2026](https://old.reddit.com/r/pepecoin/comments/1r5apv7/), [r/Crypto_Scam_Exchange](https://old.reddit.com/r/Crypto_Scam_Exchange/comments/1qwi92l/)), and its Windows app has been flagged as malware ([r/CryptoScams](https://reddit.com/r/CryptoScams/comments/1u6oghx/)). The volume and user numbers on its homepage are typed-in text, not live data: its own API shows a few dozen markets created in 2026 with empty order books. Do not send it money. --- # Community questions Source: https://altillyfiles.com/community Markdown: https://altillyfiles.com/content/community-faq.md ## Questions from the community ### How we made this page After Altilly went down, and again after Xeggex collapsed, people asked a lot of hard questions. Many of them were aimed at me. This page tries to answer all of them, including the ones I would rather not answer. - **What we collected.** We collected every question and allegation we could find: on Reddit, on Bitcointalk, in news articles and forum posts, and in the user complaints that were forwarded into the management chat as screenshots or copied text (many of those came from Altilly's public Telegram groups, Discord and support tickets). - **How we sorted them.** Many questions were asked again and again in different words. We merged the duplicates into 79 questions and grouped them by theme. Questions about Nayiem's other projects and businesses that are unrelated to Altilly are outside the scope of this page, which covers Altilly, Mike and Xeggex. - **How we checked them.** We compared each question with the full management chat and with public records, such as Companies House, court records, archived web pages and news reports. Where the chat does not cover something, we say so. - **How to read the verdicts.** Each answer starts with a label: - **Answered by the chat**: the chat answers the question. - **Partly answered**: the chat answers part of it; the rest stays open. - **Not in the chat**: the chat does not cover it, so we give what public records show and say what is still unknown. - **The critic is right**: the evidence supports the criticism. - **The critic is partly right**: the evidence supports some of the criticism, but not all of it. - **Who wrote the answers.** The answers were written with AI assistance and then checked against the chat. You don't have to trust them: every number like [#1057](https://altillyfiles.com/chat#1057) opens that message in the chat, so you can read it in context yourself. - **My own view.** Where I disagree or want to add context, it appears separately as "Nayiem's note". That is my account, not a finding. > **Caveat:** > > The public Altilly Telegram groups were not available as an export; questions from those groups are included where users repeated them on Reddit or where the team quoted them in the management chat. > **Note:** > > Where an answer or a note says "believes", that is a belief. No court or authority has confirmed that Mike is Paul Vernon, that "Karl" is Mike, or that Mike took the Altilly or Xeggex funds. Usernames of private people are left out. **Contents:** [The questions people ask most](https://altillyfiles.com/community#the-questions-people-ask-most) · [The hack](https://altillyfiles.com/community#the-hack) · [Mike and Paul Vernon](https://altillyfiles.com/community#mike-and-paul-vernon) · [Nayiem's role and money](https://altillyfiles.com/community#nayiems-role-and-money) · [Refunds](https://altillyfiles.com/community#refunds) · [Deleted messages and transparency](https://altillyfiles.com/community#deleted-messages-and-transparency) · [Xeggex and Dokdo](https://altillyfiles.com/community#xeggex-and-dokdo) · [Solar](https://altillyfiles.com/community#solar) · [Other](https://altillyfiles.com/community#other) ### The questions people ask most These ten came up most often. We ranked the questions by how many separate sources are listed under "Where this was asked", then by how many of Reddit, Bitcointalk and the user complaints forwarded into the management chat they came up in. Most questions have two or three sources, so this is a rough guide, not a count of everyone who asked. 1. [Was Altilly negligent, with plain-text passwords and a hosting login without 2FA?](https://altillyfiles.com/community#was-altilly-negligent-examples-include-passwords-sent-in-plain-t) 2. [When would refunds actually happen?](https://altillyfiles.com/community#when-would-refunds-actually-happen-did-the-promised-april-2021-s) 3. [Was the hack real, or a staged exit scam?](https://altillyfiles.com/community#was-the-december-2020-altilly-hack-real-or-was-it-a-staged-exit-) 4. [How can an exchange lose its database with no usable backups?](https://altillyfiles.com/community#how-can-an-exchange-lose-its-database-with-no-usable-backups-no-) 5. [Why did the claim rules ask for a user's country, set a minimum balance and require a Google sign-in?](https://altillyfiles.com/community#why-did-the-claims-rules-include-a-users-country-with-users-in-c) 6. [Why were refunds only partial?](https://altillyfiles.com/community#why-were-refunds-only-partial-for-example-507-000-of-999-990-pac) 7. [Did Nayiem steal Altilly users' funds?](https://altillyfiles.com/community#did-nayiem-and-his-family-simply-steal-altilly-users-funds) 8. [Who controls altilly.com, and why did it redirect elsewhere?](https://altillyfiles.com/community#who-controls-altilly-com-why-is-its-whois-private-why-did-it-red) 9. [Were the servers deleted by an attacker, or cancelled for non-payment?](https://altillyfiles.com/community#were-the-servers-deleted-by-an-attacker-using-an-old-login-witho) 10. [How much was actually stolen, and where did it go?](https://altillyfiles.com/community#how-much-was-actually-stolen-about-1m-30-btc-and-12k-usdt-2-4m-9) ### The hack #### Was the December 2020 Altilly hack real, or was it a staged exit scam? There were no records afterwards, and the owning organisation was renamed just before it. **Partly answered** The chat cannot settle whether the loss was an outside attack or staged. There were two events. On 24 Dec, after an earlier intrusion that Mike put down to an insecure rescue port on "3 machines" (his report, forwarded by Chuck) [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034), Mike suggested telling users it was an "outage" under investigation [#1057](https://altillyfiles.com/chat#1057). On 25 Dec, all servers at the host (Cherry Servers) were deleted, and the backups at Backblaze were gone too [#1103](https://altillyfiles.com/chat#1103), [#1108](https://altillyfiles.com/chat#1108). This happened while Mike was still moving wallets to a new host [#1121](https://altillyfiles.com/chat#1121), [#1297](https://altillyfiles.com/chat#1297)–[#1299](https://altillyfiles.com/chat#1299). The host first said the servers were cancelled for non-payment, which Mike called "a lie" [#1110](https://altillyfiles.com/chat#1110)–[#1111](https://altillyfiles.com/chat#1111). Later, as Mike relayed it, the host said the deletion request came from an old, inactive login email over a Tor IP [#1504](https://altillyfiles.com/chat#1504), [#1508](https://altillyfiles.com/chat#1508). Mike explained that portal access would allow rescue-mode access to the machines [#1510](https://altillyfiles.com/chat#1510). Almost all detail about the attack reached the group through Mike, and none of it was independently verified. The "no records" point is true: the database and the config needed for decryption were lost [#1348](https://altillyfiles.com/chat#1348), [#1352](https://altillyfiles.com/chat#1352)–[#1353](https://altillyfiles.com/chat#1353). Points against staging: Chuck reported that Livecoin was hit the same day and used the same host [#1113](https://altillyfiles.com/chat#1113)–[#1125](https://altillyfiles.com/chat#1125). Mike said about 0.8 of the 31 BTC was his, and that 1.2m PYRK of his was lost [#1663](https://altillyfiles.com/chat#1663), [#1745](https://altillyfiles.com/chat#1745), though these are his own statements. 24 ETH in the Altilly wallet was not taken [#2861](https://altillyfiles.com/chat#2861). The chat records no organisation being renamed. It does show Nayiem saying in 2019 that Altilly was "still incorporated in Hongkong", with a plan to change that later [#759](https://altillyfiles.com/chat#759)–[#761](https://altillyfiles.com/chat#761), but a later message says no Hong Kong company was ever formed [#1778](https://altillyfiles.com/chat#1778). Separately, public Companies House records (outside the chat) show Qredit Ltd, a new company in Nayiem's name, incorporated on 11 Dec 2020. The chat supports negligence: no audits and no cold storage [#215](https://altillyfiles.com/chat#215)–[#216](https://altillyfiles.com/chat#216), and backups were not protected against deletion [#1271](https://altillyfiles.com/chat#1271), [#1501](https://altillyfiles.com/chat#1501). Insider action is possible, but the chat does not prove it. **Nayiem's note:** The author's account: he now believes the "hack" was an inside job by a developer. He says it happened just before the high-value assets were due to move to his Hetzner hosting, and that only low-value coins had been moved. He says this is his belief. The chat shows the migration pattern [#1297](https://altillyfiles.com/chat#1297), [#2518](https://altillyfiles.com/chat#2518)–[#2519](https://altillyfiles.com/chat#2519), but no message sets a date for moving BTC or ETH. **Where this was asked:** - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/_/giel58l/): "Really funny how the owner renamed the organization right before the magical hack." - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.40): "the transfer process to new servers someone made a mistake and deleted important files...Exit Scam?" - [Reddit, r/CryptoMarkets](https://old.reddit.com/r/CryptoMarkets/comments/ogw26p/_/h4o81ea/): "altilly claims a HACK at the server, no records available, I almost wonder if thats really what happened." #### Was the hack an inside job? In 2020 Altilly called that suggestion 'totally untrue and unfounded'. Why does Nayiem now say it was an inside job? **The critic is partly right** The critic is right that this is a change of position. In December 2020 Nayiem backed the official line and defended Mike ("It's not your fault" [#1256](https://altillyfiles.com/chat#1256)). His inside-job view is a later reinterpretation, not a view he held at the time. The chat does not prove an inside job. Points that raised questions later: - Nayiem himself had no access to the Cherry servers that were wiped. He wrote that "Mike didn't allow me" [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). - Mike said Cherry told him the deletion request came from an old login on his hosting account, over Tor [#1504](https://altillyfiles.com/chat#1504), [#1508](https://altillyfiles.com/chat#1508). - The wipe happened in the middle of a server migration. Mike said coins added in the last 30 days were already on the new host [#1297](https://altillyfiles.com/chat#1297)–[#1298](https://altillyfiles.com/chat#1298). - Mike estimated the Bitcoin loss at about 31 BTC [#1600](https://altillyfiles.com/chat#1600). - A day earlier, after the first attack, Mike suggested telling users "we are still investigating the outage" [#1057](https://altillyfiles.com/chat#1057). Evidence for an outside attack: - Mike reported signs of an attack through the host's rescue port the day before; Chuck forwarded his messages [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034). - Mike explained that the old login had no 2FA and that Cherry's portal had been breached before [#1504](https://altillyfiles.com/chat#1504), [#1507](https://altillyfiles.com/chat#1507), [#1510](https://altillyfiles.com/chat#1510). - Cherry's own first explanation was non-payment, which Mike disputed [#1110](https://altillyfiles.com/chat#1110)–[#1111](https://altillyfiles.com/chat#1111). - Chuck reported that Livecoin used the same host and was hit the same day, which suggests a common vulnerability [#1113](https://altillyfiles.com/chat#1113)–[#1124](https://altillyfiles.com/chat#1124). - Mike said he lost some of his own funds [#1663](https://altillyfiles.com/chat#1663), [#1745](https://altillyfiles.com/chat#1745). - 24 ETH in the Altilly wallet was not taken [#2861](https://altillyfiles.com/chat#2861). Our assessment is that the inside-job claim is possible but unproven. The chat also contains substantial evidence for an outside attack. **Nayiem's note:** The author's account: he says he trusted Mike "like family" and was "too naive to believe that he could have orchestrated all of it." He says he changed his view only after going back through the team chat years later and finding what he calls hints. On 29 Sep 2026 he wrote publicly that he "believe[s]" the hack was an inside job by a developer. That is his belief, not a finding. **Where this was asked:** - [Quadriga Initiative](https://quadrigainitiative.com/casestudy/altillyhotwalletshackedandcoldwalletslost.php): "suggestions of the attack being an inside job are totally untrue and unfounded" - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.60): "Seems another inside job here...Wanting to get out of this altilly project" - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.60): "probably someone on the inside...the domain was basically stolen through an old inactive email" #### Were funds moved before the hack was announced? Deposits and withdrawals failed for days, the LTC wallet was already empty on 24 December, and the DIME and MOON wallets were emptied or moved. **The critic is partly right** Partly. Funds did move on 24 December, after the outage began but before the server deletion (25 Dec) was disclosed. The team was already talking about "the hack that happened" and an attack on three machines on the morning of 24 Dec [#1031](https://altillyfiles.com/chat#1031), [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034). That afternoon Mike asked the team to tell users "we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057). Asked whether the loss was under 10k, he said "might be 15" and "wont know for sure until i get everything moved" [#1059](https://altillyfiles.com/chat#1059), [#1060](https://altillyfiles.com/chat#1060). Mike called the move unplanned [#1065](https://altillyfiles.com/chat#1065), but his later messages say some wallets had been moving for a while [#1371](https://altillyfiles.com/chat#1371), [#1447](https://altillyfiles.com/chat#1447). On 25 Dec he said he "was still in the process of moving stuff" [#1121](https://altillyfiles.com/chat#1121). For DIME, Chuck reported that the main Altilly wallet had been emptied around the time things froze [#1494](https://altillyfiles.com/chat#1494). Mike said DIME was one he was moving, confirmed the receiving wallet was "ours", and said the DIME deposit wallet had not been moved yet [#1495](https://altillyfiles.com/chat#1495), [#1497](https://altillyfiles.com/chat#1497). For MOON, Chuck flagged that all Mooncoin went to a new address on 24 Dec [#1278](https://altillyfiles.com/chat#1278). Mike did not call that a migration: he said it was "prob from withdraws, but can't check db" [#1284](https://altillyfiles.com/chat#1284). Only the Mooncoin deposit wallet appears on the saved-wallet list [#1454](https://altillyfiles.com/chat#1454), [#1457](https://altillyfiles.com/chat#1457). MOON and DIME refunds were later paid [#4720](https://altillyfiles.com/chat#4720), [#4788](https://altillyfiles.com/chat#4788). A later request from Chuck to Mike to "send some Moon to a user" got no reply in the chat [#6880](https://altillyfiles.com/chat#6880)–[#6881](https://altillyfiles.com/chat#6881). The chat has nothing about the Litecoin wallet, and nothing about deposits failing for days before 23 Dec. Messages are missing from the 24 Dec exchange [#1058](https://altillyfiles.com/chat#1058), [#1061](https://altillyfiles.com/chat#1061)–[#1064](https://altillyfiles.com/chat#1064). A public notice drafted on 24 Dec said services were being moved to "a more reliable source" [#1084](https://altillyfiles.com/chat#1084). It did not mention a hack or wallet funds being moved. **Nayiem's note:** The author's account: servers and wallets were being moved to the author's Hetzner hosting. Mike moved the low-cap and newly listed coins first and never moved the high-value assets. Then the "hack" happened. In the chat, only the move itself and which coins were saved can be checked. No message gives a date for when the high-value assets were due to move. **Where this was asked:** - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.60): "Litecoin address was already empty on december 24th" - Chat [#1494](https://altillyfiles.com/chat#1494) (forwarded from a coin developer): "So our Asset is not on the safe list. But our Main Altilly wallet was zero'd out yesterday." - Chat [#1278](https://altillyfiles.com/chat#1278), [#1279](https://altillyfiles.com/chat#1279) (forwarded, with explorer screenshot): "All mooncoin send to new adress the 24 December...." #### Nayiem's own timeline puts the first signs of the hack on 12 December 2020, but users were told on 26 December. What happened during those 13 days? Were funds being moved? **The critic is partly right** The "12 December" date in Nayiem's 2025 statement is wrong, and he now says so himself. He believes he confused it with the date Qredit Ltd was incorporated. The team chat has no messages at all between 2 and 18 December [#997](https://altillyfiles.com/chat#997)–[#999](https://altillyfiles.com/chat#999), and the messages from 18 to 23 December are about other topics [#1000](https://altillyfiles.com/chat#1000)–[#1028](https://altillyfiles.com/chat#1028). The incident first comes up on 24 December, when Nayiem asks "can you give me more details about the hack that happened?" [#1031](https://altillyfiles.com/chat#1031). The reply is that the attack "came in from maybe an insecure recue port at the host level" and that "3 machines" were affected [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034). The way he phrases the question shows the team already knew about the hack from outside this chat. The public notice also says the suspicious activity was noticed "earlier this week", and that the servers had been rebooted and reinstalled before the activity came back [#1167](https://altillyfiles.com/chat#1167), [#1232](https://altillyfiles.com/chat#1232). So some things happened in the days before 24 December that the chat does not record. The chat does not support a 13-day gap, but it cannot account for every day either. On 24 December Mike estimated the loss at under 10k, "might be 15", and added: "wont know for sure until i get everything moved" [#1056](https://altillyfiles.com/chat#1056)–[#1060](https://altillyfiles.com/chat#1060). Assets were being moved to a new host at that point. Mike proposed telling users "we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057). The proposed user text also said "we felt it was best to remove data from those machines immediately" [#1065](https://altillyfiles.com/chat#1065). Chuck pointed out that the status page showed missing assets, and Mike replied "ill fix that soon" [#1077](https://altillyfiles.com/chat#1077)–[#1079](https://altillyfiles.com/chat#1079). On 25 December the servers at the old host were gone. Mike said "somebody hacked into their systems. deleted all the servers" [#1103](https://altillyfiles.com/chat#1103), [#1132](https://altillyfiles.com/chat#1132). The host later replied that the data "was cleaned when they were deleted from your client portal. This a standard procedure when our clients decide to cancel the services" [#1564](https://altillyfiles.com/chat#1564). The chat does not show who deleted them. Nayiem pushed to inform users, saying "it will backfire if we don't tell the truth" [#1162](https://altillyfiles.com/chat#1162)–[#1163](https://altillyfiles.com/chat#1163). The notice went up on 25 December at 17:18 in the chat export's clock, which is 26 December 01:25 CET according to the notice's own timestamp [#1232](https://altillyfiles.com/chat#1232)–[#1233](https://altillyfiles.com/chat#1233). On 27 December he replied to the host's message with "Don't share this with anyone yet until I have my stuff ready" [#1566](https://altillyfiles.com/chat#1566). The chat does not show where the lost funds went. **Nayiem's note:** The author's account: he agrees the "12 December" date was an error. Qredit Ltd was incorporated on 11 December 2020 (Companies House no. 13077371), 12 days before the incident began on 23 December, and he thinks he mixed up the incorporation date with the incident date. He says the servers were being moved to his hosting provider, and that Mike moved the small, recently listed coins first and never moved the high-value assets. The chat supports part of this, but only in messages written after the outage. There is nothing about the move before 24 December. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "What was happening during those 13 days of silence? ... Were you moving funds? Covering tracks? Delaying withdrawals?" #### How can an exchange lose its database with no usable backups, no cold-storage backups and backups kept on the same provider? Is 'no backup' just an excuse for not refunding people? **The critic is partly right** On backups, the critics are largely right. The chat shows no working disaster recovery. Backups did exist, but at Backblaze, a separate provider from the Cherry Servers host [#1269](https://altillyfiles.com/chat#1269)–[#1271](https://altillyfiles.com/chat#1271). The problem was that the credentials used for them could delete as well as upload. When the loss was found, the developer suspected a hack but also raised a possible Backblaze billing issue, so the cause was unclear at the time [#1103](https://altillyfiles.com/chat#1103), [#1108](https://altillyfiles.com/chat#1108). Backblaze later said deleted files could not be recovered and that "object lock", which blocks deletion for a set period, had not been turned on [#1498](https://altillyfiles.com/chat#1498), [#1501](https://altillyfiles.com/chat#1501). The developer called the delete-capable keys his own mistake [#1271](https://altillyfiles.com/chat#1271). (Those Backblaze keys, including the one in Mike's server guide [#2587](https://altillyfiles.com/chat#2587), were revoked long ago.) The backups of the "safe" wallets were lost as well [#1299](https://altillyfiles.com/chat#1299). The config file needed to decrypt the database had no copy anywhere [#1353](https://altillyfiles.com/chat#1353), [#3086](https://altillyfiles.com/chat#3086). Even a database backup would not have helped without those keys [#4103](https://altillyfiles.com/chat#4103). A critic's message, relayed into the team chat by a team member, called it "sloppy and amateur" [#2679](https://altillyfiles.com/chat#2679), and that criticism holds up. Was "no backup" invented later as an excuse? The chat doesn't support that. The loss was reported in the internal team chat as it happened, 25-26 Dec 2020 [#1103](https://altillyfiles.com/chat#1103)–[#1108](https://altillyfiles.com/chat#1108), [#1299](https://altillyfiles.com/chat#1299). In early January 2021 the developer asked the host whether a separate database SSD might still hold data [#2491](https://altillyfiles.com/chat#2491)–[#2511](https://altillyfiles.com/chat#2511). Refunds of saved assets were started, but many other refunds were never completed (see the Refunds FAQ). **Nayiem's note:** The author's account: many of the chains used for refunds in 2020-21 no longer exist. Together with the lost database, this makes the remaining claims (which he estimates at around $50,000–60,000) nearly impossible to verify, and many late claims were fake. He says he stopped doing refunds around 2022/2023. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbpss8s/): "How the heck does an exchange not have hourly backups? ... They are rugging if there is any talks about lost database." - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.60): "you storage the backup in the same server where the Database is located?" - [Bitcointalk](https://bitcointalk.org/index.php?topic=5385112.0): "Claiming you don't have backup...proves how incompetent your developer is...bullshit excuse." #### Were the servers deleted by an attacker using an old login without 2FA, or cancelled for non-payment, which is what Cherry Servers first said? Who was Cherry's client of record, and what came of the promised 'settlement' with the host? **Partly answered** Cherry Servers gave two different accounts. Its first email, as Mike relayed it on 25 Dec 2020, said the servers "were cancelled by the system due to non-payment and not by anyone accessing the systems". Mike replied that there were no overdue invoices and that this was "a lie" [#1110](https://altillyfiles.com/chat#1110)–[#1111](https://altillyfiles.com/chat#1111). The next day Mike said Cherry had traced the deletion request to an old, inactive email login on the hosting account. It was an address he had used when first setting up the service, it had no 2FA, and the request came from a Tor IP [#1504](https://altillyfiles.com/chat#1504), [#1508](https://altillyfiles.com/chat#1508). He also said Cherry's portal had itself been breached about a year earlier [#1507](https://altillyfiles.com/chat#1507). Cherry later partly backed this up in writing. In a reply to Nayiem's email of 15 Feb 2021, which Nayiem posted in the chat, Cherry said it "was aware of the fact of the attacker accessing your account the year before". It said it had forced a systemwide password reset after that event. It also said its action logs were too limited "to double-check what might have happened" [#4353](https://altillyfiles.com/chat#4353)–[#4354](https://altillyfiles.com/chat#4354). Cherry's formal letter of 5 March 2021 [#4349](https://altillyfiles.com/chat#4349) (attached PDF) says the client "had access to his servers through his two accounts". It says all servers "were deleted using one of the Client's accounts" and refers to an "(il)legal login". It does not name who logged in. It adds that the client acknowledged the deletion came from its own account, and it blames the client for keeping no backups. On paper the client of record was Qredit, since the letter is addressed to Qredit. In the chat, though, Mike ran the Cherry servers, and Nayiem said he never had access to them [#1483](https://altillyfiles.com/chat#1483), [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). Nayiem nevertheless corresponded with Cherry directly from his Qredit address. The critic is therefore right that Qredit was Cherry's client of record. On the settlement: Qredit emailed Cherry on 22 Feb 2021. It raised Cherry's liability and asked for a settlement "for the Qredit and/or for its clients", saying it had lost its business and "over 1mln usd in clients funds". Cherry's 5 March letter rejected any liability and any duty to compensate. Nayiem had earlier said he would "sue Cherry" [#2875](https://altillyfiles.com/chat#2875). The chat shows no lawsuit and no compensation after that. **Nayiem's note:** The author's account: in a note added to the chat in 2026, the author calls Cherry's email the "first response ... after I reached out to them on behalf of Altilly" [#7587](https://altillyfiles.com/chat#7587). This would explain why the letter is addressed to Qredit. The same note claims Mike used the situation to "orchestrate" the hack. That is the author's belief, and the chat does not establish it. **Where this was asked:** - Cherry Servers liability notice (2021-03-05); PDF p.4 - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/_/gief7eg/): "We are working on a settlement with the hosting provider without using any legal actions at this stage." - Chat [#2714](https://altillyfiles.com/chat#2714)–[#2729](https://altillyfiles.com/chat#2729) (group screenshots): "cherryservers is shit isn't it" #### Was Altilly negligent? Examples include passwords sent in plain text, a hosting login without 2FA, and an ignored security-testing offer. Was it insured, and can victims claim against Willems Ventures? **The critic is partly right** On negligence, the critic is right. In 2019 the developer ("Mike") wrote "we are too small to worry about audits yet" and "heck we are too small to even start moving to safe storage" [#215](https://altillyfiles.com/chat#215)–[#216](https://altillyfiles.com/chat#216). After the incident he said an old, inactive email address still had login access to the hosting account, while "the email i currently use has 2fa" [#1504](https://altillyfiles.com/chat#1504). According to Mike, the host told him the servers were deleted from that address over Tor [#1508](https://altillyfiles.com/chat#1508). The backups were set up so they could be deleted [#1271](https://altillyfiles.com/chat#1271), and they were deleted as well [#1342](https://altillyfiles.com/chat#1342). At first Mike was not sure whether this was the hacker or a billing problem [#1108](https://altillyfiles.com/chat#1108). Outside critics said the same at the time. One message, which Chuck copied into the chat from another group, said: "Who runs a server without backups? Its sloppy and amateur" [#2679](https://altillyfiles.com/chat#2679). The chat does not show the plain-text password emails. Those come from a public forum post (bitcointalk). The security-testing offer appears only as a third party's claim in a screenshot from September 2021 [#7380](https://altillyfiles.com/chat#7380). The chat never shows the offer being made or turned down. The chat shows no evidence that Altilly was insured. Liability insurance comes up only as a question [#1309](https://altillyfiles.com/chat#1309), and later talk of insurance is about future plans [#2873](https://altillyfiles.com/chat#2873), [#5030](https://altillyfiles.com/chat#5030). Whether victims can bring a claim against Willems Ventures is a legal question that this evidence cannot settle. **Nayiem's note:** The author's account: Altilly was never registered as a company. Mike privately promised that the author would formally acquire it once Qredit Ltd was set up. Qredit Ltd and Willems Ventures Ltd were both incorporated on 11 Dec 2020, 12 days before the incident, and Companies House lists no role for Mike in either company. The author says he never earned anything from Altilly. He also admits to what he calls naive management at the time. **Where this was asked:** - [Reddit, r/altillyhack](https://old.reddit.com/r/altillyhack/comments/my9l2v/): "they were clearly negligent, and must be insured if they are operating a company. so I guess we must put forward a claim against the main company, which is still operating called Willems Ventures" - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.40): "I registered to this site and got an email WITH MY PASSWORD INSIDE IN PLAIN TEXT!" - Chat [#7380](https://altillyfiles.com/chat#7380) (Telegram screenshot): "if people see a asecurity company was wanting to test and help you before the issue happened it would not look good on altilly" #### Why did Altilly talk about everything except catching the hacker? Why was there no police report or legal action? **The critic is right** On the main point, the critic is right. The management chat records no police report, criminal complaint or legal action against whoever carried out the December 2020 hack. The chat's only calls to the police concern a separate break-in at the author's home in January 2021 [#2380](https://altillyfiles.com/chat#2380)–[#2477](https://altillyfiles.com/chat#2477). Chuck suggested getting a statement from the hosting company for "any legal proceedings that might happen later" [#1319](https://altillyfiles.com/chat#1319)–[#1322](https://altillyfiles.com/chat#1322). Nayiem noted "Lawyers are all on holiday" [#2183](https://altillyfiles.com/chat#2183). Nothing in the chat shows a lawyer being engaged over the hack or a report being filed. Legal pressure that did come up was aimed at the hosting company, not at the hacker. Nayiem wrote "I'm still going to sue Cherry" and said the company would "receive an ultimatum" [#2875](https://altillyfiles.com/chat#2875)–[#2876](https://altillyfiles.com/chat#2876). Days later he concluded "We are not going to get money from this shit company" [#3092](https://altillyfiles.com/chat#3092). In March 2021 he shared a "Notice regarding liability" from Cherry Servers, which he said contradicted an earlier email in which they admitted fault [#4349](https://altillyfiles.com/chat#4349)–[#4356](https://altillyfiles.com/chat#4356). The technical trail was left mostly to Mike, who controlled the hosting account. He reported that the attacker used a Tor exit IP and logged in through an old, inactive email address on the account [#1450](https://altillyfiles.com/chat#1450), [#1504](https://altillyfiles.com/chat#1504)–[#1508](https://altillyfiles.com/chat#1508). He asked the host for the login history but got only five days of it [#1509](https://altillyfiles.com/chat#1509), [#1749](https://altillyfiles.com/chat#1749). When Nayiem asked where the BTC went [#1511](https://altillyfiles.com/chat#1511), Mike said he hadn't written it down [#1516](https://altillyfiles.com/chat#1516). He also said he couldn't remember the address of the wallet he had been "keeping some safe in" [#1615](https://altillyfiles.com/chat#1615). Nayiem himself asked around about who knew the company used Cherry [#2715](https://altillyfiles.com/chat#2715), [#3038](https://altillyfiles.com/chat#3038) and looked into a Cherry employee [#3093](https://altillyfiles.com/chat#3093)–[#3108](https://altillyfiles.com/chat#3108). When Nayiem asked what to tell users, Mike suggested: "just say we are investigating and information collected from user submissions will help in this" [#2124](https://altillyfiles.com/chat#2124), and Nayiem agreed [#2125](https://altillyfiles.com/chat#2125). So there were informal inquiries and a dispute with the host. But neither Mike nor Nayiem, who both ran the company, took any formal step toward identifying or prosecuting the hacker at the time. That was a shared failure. **Nayiem's note:** Author's account: in the 2025 write-up, the author says the FBI and the US Marshals were contacted. That tip was about the author's belief concerning Mike's identity, not a report filed over the hack in 2020. The author says the Marshals opened a two-way dialogue and issued tip reference 777-W77728, with no response beyond that. Nothing public confirms the tip or the reference. **Where this was asked:** - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/_/giel79n/): "You dont find it funny theyre talking about everything BUT finding justice and identifying the hacker? As if it would be impossible?" #### How much was actually stolen: about $1M (30 BTC and 12k USDT), $2.4M, $900K or $6.7M? Where did it go? Will the compromised hot-wallet address and the trail of the 30 BTC be published? **The critic is partly right** About $1M is the only loss figure in the chat. On 27 Dec 2020 Nayiem told the team "1 million usd can be done" when he talked about paying users back [#1626](https://altillyfiles.com/chat#1626). Later that day he wrote "We lost 1mln, but we should know that it will be more. Not everyone will be honest about what they've deposited" [#1677](https://altillyfiles.com/chat#1677). The chat mentions 31 BTC ("How much of the 31 btc was ours?" [#1662](https://altillyfiles.com/chat#1662)). The developer replied that about 0.8 BTC was his own and that the exchange's own share was only fees [#1663](https://altillyfiles.com/chat#1663). The developer appears as "Deleted Account" in the export and is understood to be Mike. For USDT, the only address anyone knew was the USDT withdraw wallet [#1616](https://altillyfiles.com/chat#1616)–[#1617](https://altillyfiles.com/chat#1617). When it was checked after the hack it showed about $13.2k in tether [#1624](https://altillyfiles.com/chat#1624). Nayiem had guessed less than $2k [#1622](https://altillyfiles.com/chat#1622). So the chat does not confirm exactly how much USDT was taken. The public figure of roughly 30 BTC plus 12k USDT (Quadriga Initiative) is broadly consistent with the chat, but the chat does not prove it. The $2.4M is not a loss figure. The author says it was the team's final total of all claims, saved and non-saved assets together; his 2025 write-up wrongly called it "saved" assets and his personal website wrongly calls it a loss. Claims can exceed the loss because they include saved assets that still existed and were valued at a later date. The final claims sheet is not in the chat, so the $2.4M cannot be checked here; the chat shows only the valuation being set up [#2534](https://altillyfiles.com/chat#2534), [#2553](https://altillyfiles.com/chat#2553) and the non-saved-asset and conversion sheets being built [#7426](https://altillyfiles.com/chat#7426). Nothing in the chat supports a $900K personal payout. The $900K figure comes from the author's own 2025 write-up and refers to refunds he says he later paid from his own income. We found no source at all for $6.7M. The critic is right that the BTC trail was never published. A user asked the team to "post your now compromised hotwallet address and the location of the stolen 30 BTC" [#2112](https://altillyfiles.com/chat#2112). Nayiem said "We should really find out what the btc wallet was." Chuck agreed but said "im not sure how". He added that the BTC was not in the deposit or withdraw wallets but "in safe storage", with maybe 0.3 BTC in the withdraw wallet at a time [#2113](https://altillyfiles.com/chat#2113)–[#2119](https://altillyfiles.com/chat#2119). Mike had said he kept the safe wallet's address in a database table but could not remember it [#1615](https://altillyfiles.com/chat#1615). He also said that even with the address, change outputs would make the funds hard to trace [#2121](https://altillyfiles.com/chat#2121). The team's agreed public answer was only that they were "investigating" [#2124](https://altillyfiles.com/chat#2124). The chat shows no BTC address for the stolen funds and no trace of where they went. It does not support the claim that the funds were routed to Exmo or Livecoin wallets. Some funds were not taken, for example 24 ETH in the Altilly wallet [#2861](https://altillyfiles.com/chat#2861). **Nayiem's note:** Author's account: in his Feb 2025 document the author says he paid about $900K of refunds "out of my own pocket". The chat does not show this. The author also says all XQR held on Altilly was lost in the hack. The chat backs that part: "All lost" [#1732](https://altillyfiles.com/chat#1732)–[#1733](https://altillyfiles.com/chat#1733). **Where this was asked:** - [Quadriga Initiative](https://quadrigainitiative.com/casestudy/altillyhotwalletshackedandcoldwalletslost.php): "The total amount stolen is circa 1mln USD… 30 BTC and 12,000 USDT" - Chat [#2112](https://altillyfiles.com/chat#2112) (forwarded user message): "please also post you now compromised hotwallet address and the location of the stolen 30 BTC on your site" - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/_/gid7raa/): "Folks waited 2 years for Bitcoin to jump...then exit scam 12k and 30 Bitcoin lolz...." #### Why did some stolen Altilly funds go to wallets linked to the Exmo/Livecoin hackers, and was the same-day Livecoin hack connected? Was that trail laid deliberately as cover? **The critic is partly right** The chat supports only part of this. EXMO and Livecoin were both hacked within days of the Altilly incident in late December 2020, and the team discussed both. The author posted CoinDesk's article on the EXMO hack [#1053](https://altillyfiles.com/chat#1053). Chuck, a co-founder, relayed that Livecoin "was hacked" [#1088](https://altillyfiles.com/chat#1088). He also passed on a report from a third person that Livecoin used "the same host" [#1113](https://altillyfiles.com/chat#1113), [#1124](https://altillyfiles.com/chat#1124), and said it was hit the "same day" [#1122](https://altillyfiles.com/chat#1122). The author himself wrote that Livecoin used TransIP, Hetzner and Cherry [#1480](https://altillyfiles.com/chat#1480). Altilly was itself partly moving to Hetzner at the time [#1119](https://altillyfiles.com/chat#1119). The account the author identifies as Mike wrote "this is state sponsored for sure" [#1054](https://altillyfiles.com/chat#1054). Nothing in the chat shows Altilly funds reaching wallets linked to the EXMO or Livecoin attackers. There are no addresses, no tracing output and no screenshots. The 2025 Follow-Up PDF says the funds went there "as cover", but it gives no exhibits. The critic is right that this claim is unproven. Whether the trail was laid on purpose is not established either way. The hosting evidence is mixed as well. Cherry's first email apparently blamed overdue invoices, which the Mike account called a lie [#1110](https://altillyfiles.com/chat#1110), [#1111](https://altillyfiles.com/chat#1111). That account was also unsure whether the backups were lost to the hacker or to a billing issue [#1108](https://altillyfiles.com/chat#1108). Later, Cherry sent a formal "Notice regarding liability" [#4349](https://altillyfiles.com/chat#4349), which the author said contradicted an earlier Cherry email that had admitted fault [#4350](https://altillyfiles.com/chat#4350). A shared host and the timing fit a wider outside attack. They are also consistent with other explanations. The chat does not settle it. **Nayiem's note:** In the author's account, he was told later that some Altilly funds reached wallets tied to those attackers. He has no addresses or tracing report, so this is hearsay. In 2020-21 it convinced him that Altilly was part of a wider attack, and he told Mike "It's not your fault" [#1256](https://altillyfiles.com/chat#1256). Only years later (he dates it to 2024) did he come to believe the link might have been used as cover. That is his hindsight belief. No authority has confirmed it. **Where this was asked:** - Nayiem's Follow-Up PDF (Feb 2025) - Chat [#1088](https://altillyfiles.com/chat#1088), [#1124](https://altillyfiles.com/chat#1124) (forwarded): "Maybe a hack attemp, livecoin was hacked" ### Mike and Paul Vernon #### Is 'Mike' real? Nobody had heard of him before February 2025. How do we know Nayiem is not Mike or Karl himself? **Partly answered** The chat shows that "Mike" existed long before February 2025. From July 2019, Chuck, a third team member, refers to him and tags him as @MrMike_O [#10](https://altillyfiles.com/chat#10), [#17](https://altillyfiles.com/chat#17), [#175](https://altillyfiles.com/chat#175). Nayiem also addresses him directly [#794](https://altillyfiles.com/chat#794). The same account links github.com/mrmikeo [#4380](https://altillyfiles.com/chat#4380) and pastes a support ticket addressed "Hi Michael" [#3288](https://altillyfiles.com/chat#3288). In December 2020 Chuck asks "Does Michael have access to both TUSC wallets?" [#1796](https://altillyfiles.com/chat#1796). A "Michael Osullivan" was also publicly listed as the Altilly developer in the Bitcointalk AltillyCoin announcement of December 2018 (bitcointalk.org topic 5086735). Mike and Nayiem appear as two separate people talking to each other, and Chuck talks to both of them: Nayiem says "Mike didn't allow me" access to the servers [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493), and Mike says he set up the hosting account [#1504](https://altillyfiles.com/chat#1504). There is counter-evidence too. In January 2021 Chuck relayed a message from an outside user who named "Michael Osullivan" and also suggested the team might be "an accomplice" [#2679](https://altillyfiles.com/chat#2679). Nayiem himself wrote in 2026 that he "always knew that Mike never used his real name" [#7595](https://altillyfiles.com/chat#7595), so "Michael Osullivan" may itself have been an alias. The critic has a fair point on several things. The export was published by Nayiem and redacted by him: some messages were deleted [#7598](https://altillyfiles.com/chat#7598), and it includes notes he added in September 2026 [#7581](https://altillyfiles.com/chat#7581)–[#7598](https://altillyfiles.com/chat#7598). Mike's account shows as "Deleted Account", so it can only be identified from context. "Karl" never appears in the chat, so the chat cannot show that Nayiem is not Karl. Chuck is the independent witness who could confirm that Mike and Nayiem were different people. Whether Mike and Karl are the same person, or whether either is Paul Vernon, remains an allegation that no court has ruled on. **Nayiem's note:** The author's account: Mike suggested they work on Xeggex together and approach "Karl", and Nayiem publicly announced a plan for Dokdo to acquire Xeggex. The author says that around November 2022 he found out Mike was running Xeggex himself and that "Karl" never existed, so the acquisition was cancelled. He says he did not warn Xeggex users for more than two years. His reason is that he expected people would not believe him. He says the business relationship ended in late 2022, and that after that he stayed in contact with Mike only to get money back: the Solar funds, repaid in full by 19 March 2024, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck, which Mike never followed up on. He also says Mike deleted their private Telegram chat history, so the private conversations cannot be shown. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbqduik/): "How do we know Mike is even real, and that you're actually not Mike like you say in your post?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbrx2v3/): "'Mike' is just another story. ... no one knew about Mike before you made this post." - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1imyfqw/_/mccvosd/): "Doesn't mean that Nayiem is off the hook though. Why doesn't Nayiem = Mike?" #### Users publicly named Michael O'Sullivan as the culprit in January 2021, in Altilly's own channels. Why claim nobody knew about Mike? Was management his accomplice? **The critic is partly right** The critic is right on the core fact. On 6 Jan 2021 Chuck posted a photo [#2678](https://altillyfiles.com/chat#2678) in the management chat, followed by text that appears to come from a user in a public channel [#2679](https://altillyfiles.com/chat#2679). The text named "Michael Osullivan", said he was trying to sell BTC, and called management "very likely" an accomplice. Chuck removed the user ("removing this guy and his idiot freind", [#2680](https://altillyfiles.com/chat#2680)) and Nayiem answered with a thumbs-up [#2681](https://altillyfiles.com/chat#2681). Nayiem then asked him not to delete the messages because "It will make them look like fools" [#2682](https://altillyfiles.com/chat#2682), which dismissed the accusation. Chuck replied "too late" [#2683](https://altillyfiles.com/chat#2683), so the messages had already been removed. The chat records no follow-up on the name. The developer's name was not secret either: a 2018 Bitcointalk announcement lists "Michael Osullivan" as the developer ([Bitcointalk, Dec 2018](https://bitcointalk.org/index.php?topic=5086735)). The site should not say nobody knew who Mike was. What stayed unproven then, and in this chat, was whether he took the funds. The chat does not show management working with him on the loss. Nayiem pressed for the missing BTC to be traced [#1511](https://altillyfiles.com/chat#1511), [#1599](https://altillyfiles.com/chat#1599), [#2113](https://altillyfiles.com/chat#2113), and he said at the time that Mike held the server access and he did not [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). The user's point about backups is backed only by Mike's own account: he wrote that the backups were gone and that it was unclear whether the hacker or a billing problem at Backblaze caused it [#1108](https://altillyfiles.com/chat#1108), [#1299](https://altillyfiles.com/chat#1299). Management, Nayiem included, kept working with Mike afterwards. In September 2021 Chuck was still assigning him work on the recovery with Nayiem tagged [#7421](https://altillyfiles.com/chat#7421), [#7435](https://altillyfiles.com/chat#7435), and Mike was still posting in the chat [#7430](https://altillyfiles.com/chat#7430)–[#7431](https://altillyfiles.com/chat#7431). **Nayiem's note:** Author's account: at the time, Nayiem saw Mike as family and was "too naive to believe that he could have orchestrated all of it." He says he only came to believe who Mike really was around Nov 2022, and he went public in Feb 2025. His reply in the chat was "Don't delete the messages" [#2682](https://altillyfiles.com/chat#2682), and that points to embarrassment about the accusation, not to hiding it. **Where this was asked:** - Chat [#2679](https://altillyfiles.com/chat#2679) (forwarded user message): "you want to know the guys name, its Michael Osullivan... Unless of course you are an accomplice in this" - Chat [#2678](https://altillyfiles.com/chat#2678), [#2679](https://altillyfiles.com/chat#2679) (group screenshot and forwarded text): "Their negligence is what got you in this position. Who runs a server without backups?" #### Where is the proof that Mike was part of Altilly: logs of GitHub backdoors, a legal document, proof he returned funds? Why would he refuse KYC yet offer full ownership? Did Nayiem ever meet him or verify his identity? **The critic is partly right** The chat clearly shows that someone called Mike worked on Altilly's technical side from 2019. His messages come from an account that now shows as "Deleted Account". We link that account to Mike from context: Nayiem calls him "Mike" [#3691](https://altillyfiles.com/chat#3691), [#3693](https://altillyfiles.com/chat#3693), and Chuck addresses him as @MrMike_O [#17](https://altillyfiles.com/chat#17), [#175](https://altillyfiles.com/chat#175). In the chat he releases code [#22](https://altillyfiles.com/chat#22)–[#23](https://altillyfiles.com/chat#23), runs queries on user data [#416](https://altillyfiles.com/chat#416) and builds admin tools [#611](https://altillyfiles.com/chat#611). He links a repository called altillypwa under the GitHub account mrmikeo [#4380](https://altillyfiles.com/chat#4380). He shares a whitepaper cover for a separate project, "Altfenix", that names "Michael Osullivan, @MrMikeO" as author [#5529](https://altillyfiles.com/chat#5529). None of this proves his legal identity. On the other points, the critic is right: - We have no logs of GitHub backdoors. That claim comes from one unnamed reviewer, and we hold no artifacts. - No legal document ties Mike to Altilly, and we found no company register entry naming him. - The chat contains no proof that he returned any funds. - The chat contains no offer of "full ownership" (see the ownership questions under "Nayiem's role and money"). - No message shows Mike openly refusing KYC. [#7383](https://altillyfiles.com/chat#7383) ("he wont KYC") follows a screenshot of a third party threatening legal action and appears to be about that person, but the chat does not say who "he" is. What the chat does show: in March 2021, the Revolut Business team account that Nayiem had set up asked Mike to verify his ID. Mike put it off because his passport was "at the china visa office" [#4414](https://altillyfiles.com/chat#4414)–[#4416](https://altillyfiles.com/chat#4416). Nayiem did not insist. Instead he let Mike use his own card details to pay for a service [#4417](https://altillyfiles.com/chat#4417). In hindsight that was a mistake. We found no record of an in-person meeting, a video call or any identity check. Team Revolut cards were shipped to Nayiem's address for forwarding [#3647](https://altillyfiles.com/chat#3647), [#3657](https://altillyfiles.com/chat#3657). One Revolut envelope that arrived there was addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). The thread around it shows it was the card Mike ordered [#3638](https://altillyfiles.com/chat#3638)–[#3693](https://altillyfiles.com/chat#3693), [#3960](https://altillyfiles.com/chat#3960); see the Paul Vernon questions below. We do not treat the name as proof of who Mike is. No authority has confirmed Mike's identity. **Nayiem's note:** The author's account (not verified by the chat): Mike privately promised that the author could acquire Altilly once Qredit Ltd was set up, which Companies House dates to 11 Dec 2020. The author says Mike later deleted their private chat history, so that promise cannot be shown. The author also says Mike repaid the 1,878,477 SXP fraudulently swapped in the Nov 2022 Solar incident ([Solar's statement of 30 Nov 2022, posted in the Solar validator group on Discord](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png)). By the author's account, Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. The final payments can be checked on the Solar blockchain (see the [Solar repayment ledger](https://altillyfiles.com/story#after-altilly)). The author confirms there are no screenshots of the GitHub/"Karl" episode. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbrx2v3/): "show us proof that Mike existed during Altilly. Show us the logs of him installing 'backdoors' on GitHub." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "Mike refused to complete KYC, yet offered Nayiem 'full ownership' - how does that make sense?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "Did you ever meet Mike in person, do a video call, or was this entire partnership just an online crypto bromance" #### Does the GitHub account mrmikeo belong to Nayiem, including a recent Xpense commit? Did he use the identity of a director registered as Michael O'Sullivan (Ecuadorian and Vanuatu passports, as critics put it) to register UK companies? **Partly answered** The chat does not support the claim that the GitHub account mrmikeo is Nayiem's. Nayiem posts under his own name throughout, and he talks about "Mike" as a separate person, for example "it's for mike" [#4385](https://altillyfiles.com/chat#4385) and "Just need Mike to work on the account connector" [#7205](https://altillyfiles.com/chat#7205). A developer addressed as @MrMike_O joined the group in 2019 ([#17](https://altillyfiles.com/chat#17), [#190](https://altillyfiles.com/chat#190)), and his account has since been deleted. In March 2021 a now-deleted account posted a link to github.com/mrmikeo/altillypwa [#4380](https://altillyfiles.com/chat#4380). Every deleted account shows up with the same label in the export, so the chat alone cannot prove which person posted it. For completeness: Nayiem also once linked an mrmikeo repo (github.com/mrmikeo/qredit-dataserver, [#5196](https://altillyfiles.com/chat#5196)) while asking a technical question. Linking to a repo does not show who owns it. From our own check of public sources (not the chat): GitHub metadata for mrmikeo ("MikeO") points to the Altilly developer email address, and the 2018 Bitcointalk Altilly announcement names "Michael Osullivan" as developer. We did not examine any "Xpense" commit and cannot confirm it. The newest mrmikeo commit we checked is in xeggex/hummingbot (1 Apr 2024). UK Companies House lists a director registered as Michael O'Sullivan, with non-UK nationality and residence, for Xeggex Software Services Ltd (14910559). Nayiem's own UK companies (13077371, 13078483) list him under his real name. Filings are self-declared, and nothing we hold shows whether that identity is real, borrowed or fake. We make no claim that any passport is fraudulent, and a real Michael O'Sullivan may be an unrelated person. In January 2021 an outsider named "Michael Osullivan" as the thief [#2679](https://altillyfiles.com/chat#2679). The same outsider also suggested Nayiem might be an accomplice. Both are unverified accusations. **Nayiem's note:** The author's account: he believes "Mike" (mrmikeo), and later "Karl" at Xeggex, was Paul Vernon, and that the O'Sullivan identity was Mike's, not his. This is the author's belief, not an established fact. The author has no screenshots of the GitHub/"Karl" episode. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1immi9m/_/mc4a39b/): "the GitHub profile most likely belongs to Nayiem ... I'm guessing Nayiem is using a stolen identity and goes by Michael O'Sullivan to register companies in England" - [UK Companies House](https://find-and-update.company-information.service.gov.uk/company/14910559/officers) - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1imsux4/): "Karl => NAYIEM !!! Mike_O => Michael O'Sullivan !!!" #### Is the XeggeX 'Mike' (Telegram MrMike_O, Qredit API contributor) the same person who ran Altilly's back end? Is Karl a separate person or just Mike? **Partly answered** Yes on the first question, with caveats. In the chat, the Telegram user @MrMike_O (whose account now shows as "Deleted Account") ran Altilly's back end. He talks about releasing new code [#22](https://altillyfiles.com/chat#22)–[#23](https://altillyfiles.com/chat#23) and explains the hosting account and its login emails after the December 2020 incident [#1503](https://altillyfiles.com/chat#1503)–[#1504](https://altillyfiles.com/chat#1504). Chuck asks him to change admin rights in the Altilly group [#1263](https://altillyfiles.com/chat#1263), [#1317](https://altillyfiles.com/chat#1317). He links code in the github.com/mrmikeo repositories [#4380](https://altillyfiles.com/chat#4380). He posts a white-paper cover for a planned exchange, "AltFenix", signed "Michael Osullivan @MrMikeO" [#5529](https://altillyfiles.com/chat#5529), and forwards a support email addressed "Hi Michael" [#3288](https://altillyfiles.com/chat#3288). Outside the chat, the public GitHub account mrmikeo has code for Altilly and Qredit and, according to our separate check, a commit to the xeggex organisation's repository in April 2024 ([GitHub commit d1479b80](https://github.com/xeggex/hummingbot/commit/d1479b80fe4003100502eea94d7142d3de54c7eb)). That links one developer to all three projects. It does not prove he ran XeggeX. The chat cannot answer the Karl question. Its messages from the time end in October 2021, before XeggeX existed. Later replies in the group were added by Nayiem in 2025–2026 and are not evidence from the time. The claim that "Karl = Mike" comes from a single anonymous page (xeggex.cpuchain.org), which we could not load or check. On the name Paul Vernon: in December 2020 Mike said an old login email for the hosting account was "paul@satotechlt.com", and that "history on that domain probably has my name" [#1324](https://altillyfiles.com/chat#1324)–[#1328](https://altillyfiles.com/chat#1328). In February 2021 Nayiem posted a photo of a Revolut delivery addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). The thread around it shows this was the card Mike ordered: Revolut did not ship to his country, so Nayiem had it sent to his own address to forward, Nayiem confirmed Mike had ordered his card, and on 19 February Mike said his Revolut card had arrived [#3638](https://altillyfiles.com/chat#3638)–[#3693](https://altillyfiles.com/chat#3693), [#3960](https://altillyfiles.com/chat#3960). None of this proves that Mike and Paul Vernon are the same person. No court or authority has linked Paul Vernon to Altilly or XeggeX. It remains an allegation, and it reflects the author's belief. **Nayiem's note:** The author's account: Mike suggested they work on XeggeX together and approach "Karl". Around November 2022 the author came to believe that Mike ran XeggeX himself, that "Karl" never existed, and that Mike was Paul Vernon. The author says there are no screenshots of the Karl episode and admits he did not warn XeggeX users until February 2025. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iic1wh/): "This Mike guy from the xeggex Team worked on the qredit api which is connected to atillys native crypto." - [change.org](https://www.change.org/p/demand-for-immediate-investigation-and-restitution-for-victims-of-xeggex-crypto-exchange-18ba0d68-051a-44fe-ac1a-8cbbf631f582) - [xeggex.cpuchain.org](https://xeggex.cpuchain.org/) (page returned 403 when checked) #### Nayiem believed Mike stole almost $1M from Altilly. Why did he keep working with him afterwards (Altfenix, a gaming project, XeggeX talks) and still coordinate Dokdo references on XeggeX in December 2022? **The critic is partly right** The chat runs from Jul 2019 to Oct 2021. It also includes a few short replies from Feb 2025 and notes added in 2026. In 2020-2021 it mostly shows Nayiem relying on Mike and speaking warmly to him: "I just need you Mike" [#1885](https://altillyfiles.com/chat#1885), "I believe in you Mike" [#3340](https://altillyfiles.com/chat#3340), "I trust you with the hosting panel" [#5658](https://altillyfiles.com/chat#5658). The two planned Altfenix together in May 2021 [#5235](https://altillyfiles.com/chat#5235)–[#5628](https://altillyfiles.com/chat#5628). They were still working together in Sep 2021, when Nayiem posted a plan with Mike working full time on Qredit Motion [#7428](https://altillyfiles.com/chat#7428). There is also a remark that cuts the other way. In May 2021 Nayiem handed Mike access to the hosting panel and added "It's not like something bad ever happened before" [#5658](https://altillyfiles.com/chat#5658). It reads as a sarcastic nod to the incident, so he was aware of it and trusted Mike anyway. Nothing in the chat mentions a gaming project, XeggeX or Dokdo, so the December 2022 coordination cannot be checked here. The criticism is fair on several points. Nayiem's own 2025 PDF says Mike's story "made no sense" in Dec 2020 and that "we had our doubts" in 2021. So he kept working with Mike, including on Altfenix, after he had doubts. The PDF also gives two different dates for when he became convinced: once "2024" and once late 2022. He did not warn XeggeX users until Feb 2025. None of this establishes who Mike is or that he took the funds. **Nayiem's note:** Author's account (not verifiable from the chat): after the loss he trusted Mike again, partly because he was told some of the stolen funds had been traced to wallets tied to the Exmo and Livecoin hackers. He saw Mike as "family". He says Mike brought him XeggeX in 2022 and presented it as a chance to repay Altilly users. Around Nov 2022, at the time of the Solar (SXP) loss that Mike later repaid, he concluded that "Karl" did not exist, and the Dokdo acquisition was cancelled. Any contact in Dec 2022 was about unwinding things, for example getting the Altilly domain handed over. After that, he says, he stayed in contact with Mike only to get money back: the Solar funds, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck, which Mike never followed up on. He stayed silent until 2025 because he expected not to be believed. He calls himself "super naive" for missing the hints. **Where this was asked:** - [publish0x.com](https://www.publish0x.com/crypto-musings-consumer-impacts/the-xeggex-drama-continues-xevwkno): "why Willem went back to working with Mike again, knowing he was already involved in heisting almost a $1 million from Altilly" - Nayiem's Follow-Up PDF (Feb 2025) (2022-12-03 Dokdo references coordinated with Mike) #### Nayiem believed Mike had stolen before and was building XeggeX. Why did he warn nobody until after it collapsed? Does that make him an accessory with foreknowledge? **The critic is partly right** On the silence, the critic is right. The contemporaneous Telegram chat ends in October 2021 [#7571](https://altillyfiles.com/chat#7571), before Xeggex existed, so it cannot answer this question. The only later entries are a few short replies posted on 8-9 Feb 2025, days after the collapse [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575), and his 2026 annotations [#7576](https://altillyfiles.com/chat#7576)–[#7598](https://altillyfiles.com/chat#7598). None of them is a warning from before the collapse. The author admits that from about November 2022 he believed Mike was running Xeggex. He did not warn its users until after withdrawals stopped on 3 Feb 2025. His own follow-up PDF (Feb 2025, p.15, an image), which he shared with investigators and initially posted on Reddit, shows him writing to Mike on Discord about the Solar (SXP) swap incident ([Solar's statement of 30 Nov 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png)): "Why did you do it Mike?" (29 Nov 2022, 22:45), then "We are not going to say anything if you can return the funds in 24hrs." (30 Nov 2022, 00:17). Silence was offered in exchange for repayment. The same PDF shows that he stayed in contact with Mike afterwards. On 3 Dec 2022 Mike asked, "should I start removing references to Dokdo on Xeggex?", and Nayiem answered "Yes, please." By his own account, Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. He has published transaction IDs only for the final five payments, which can be checked on the Solar blockchain ([Solar repayment ledger](https://altillyfiles.com/story#after-altilly)). So during the years he stayed quiet, he was also being repaid. Over time he has given different reasons for not speaking out. In Feb 2025 he cited fear for his safety and a lack of proof. Now he also cites not wanting Solar associated with the matter and expecting not to be believed. He says that after the business relationship ended in late 2022, his only contact with Mike was about getting money back. Xeggex users had a real stake in knowing what he suspected, and they have a fair complaint. Whether any of this makes him an "accessory" is a legal question this record cannot settle. We found no public report of a court or law-enforcement body acting on Xeggex or naming anyone as responsible for it. The DOJ/IRS releases we reviewed concern Cryptsy only. Nayiem says he filed a tip with the US Marshals Service, but only after the collapse, in Feb 2025. That Mike is Paul Vernon is still an allegation, not an established fact. **Nayiem's note:** The author's account: around November 2022, at the time of the Solar SXP loss, he came to believe that "Karl" did not exist and that Mike was running Xeggex himself. The planned Dokdo acquisition was then cancelled. He did not go public for two reasons. He was running a separate, legitimate project (Solar) and did not want to be associated with the matter. And he expected not to be believed, which he says the Reddit reactions in Feb 2025 later confirmed. He says the business relationship ended in late 2022, and that after that his only contact with Mike was about getting money back. He says Mike repaid the full 1,878,477 SXP by 19 March 2024. He accepts that he did not warn Xeggex users for more than two years. He gives these as reasons, not excuses. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbrp780/): "You knew Mike the scammer ripped off users and stole funds, caught him in the midst of creating a new exchange ... and did and said nothing until after it happened again?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbsikr3/): "What you have just admitted to is foreknowledge of a federal offense." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbqlc3s/): "If this is true it would of been nice to know 9 months ago and not today." #### If Nayiem knows the thief's identity and has evidence, why not go to the police instead of threatening him on social media? Has any authority acted on the FBI case ID he cites? Why is the man not in jail? **The critic is partly right** The critic is largely right. The management chat has no report of the December 2020 "hack" to police or any other authority. On 30 Dec 2020 the author tried to reach lawyers, but they were on holiday [#2183](https://altillyfiles.com/chat#2183). The police were contacted twice on 3 Jan 2021, both times about threats and intruders, not about the hack. After an angry user had called and emailed him [#2339](https://altillyfiles.com/chat#2339) [#2341](https://altillyfiles.com/chat#2341), someone had been on his property. Police treated it as not urgent and told him to come to the station [#2380](https://altillyfiles.com/chat#2380) [#2389](https://altillyfiles.com/chat#2389) [#2420](https://altillyfiles.com/chat#2420). That evening he called them again about two people with flashlights in his garden [#2471](https://altillyfiles.com/chat#2471). By his own account, the author came to believe Mike was Paul Vernon around November 2022. He did not report this until early 2025, after Xeggex stopped withdrawals in February 2025. "777-W77728" is not an FBI case ID. It is a US Marshals tip reference number. It confirms that a tip was received, not that anyone is investigating. By the author's account, a two-way dialogue was opened and the reference issued, with no response beyond that; his February 2025 wording made the dialogue sound like more than that. No authority has publicly acted on the tip. No court or agency has linked Vernon to Altilly or Xeggex, and none has confirmed that Mike is Vernon. On "threatening him on social media": the author's 2025 posts did more than report. They published a private person's name and a property listing, and they offered to share Mike's details if people would visit him. The author now says that was wrong, and this site does not repeat it. The public record on Vernon is a separate matter. Paul E. Vernon, the former Cryptsy CEO, was indicted on 17 counts in S.D. Fla. (case 1:19-cr-20509). The indictment was filed under seal in August 2019 and unsealed in January 2022. In September 2019 the court moved him to fugitive status. DOJ says he moved to China in or around November 2015. No arrest or extradition has been reported. The charges concern Cryptsy only and are allegations; he is presumed innocent. **Nayiem's note:** In the author's words: he reported to the FBI and the US Marshals in early 2025. The Marshals opened a two-way dialogue and issued tip reference 777-W77728, with no response beyond that, and the FBI gave him no case number. He says that in 2022 he stayed silent because he was running a legitimate project (Solar) and did not want to be associated with Vernon. He also expected people would not believe him, and the Reddit reactions in 2025 confirmed that. He admits that publishing a private person's details in 2025 was wrong, and says the unredacted chat and the "PAUL Vernon" envelope are available to any authority. These are his beliefs and explanations. They have not been verified. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "If you knew for months that 'Mike' was really Paul Vernon, why didn't you report him to authorities? Why did you only expose him when it became necessary to clear your own name?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mc24rqc/): "you know the identity of the person and have evidence of theft from your clients ... and your action us to threaten to make his name public!!" - Nayiem's Follow-Up PDF (Feb 2025) (FBI / US Marshals case ID 777-W77728) #### Why did Paul Vernon appear only after Nayiem was questioned? Is Vernon a convenient scapegoat, a disappeared villain used to take the heat off Nayiem? **The critic is partly right** The critic is partly right about timing. Nayiem named Paul Vernon publicly only in February 2025, after Xeggex collapsed. In February 2021 he had received a Revolut envelope addressed to "PAUL Vernon" (photo attached to [#3833](https://altillyfiles.com/chat#3833)) and said nothing about it in public at the time. The name was not made up later, though. It shows up in the chat years before anyone accused Nayiem. The account shown as "Deleted Account" in the export is Mike's: Nayiem addresses Mike by name and that account replies [#3638](https://altillyfiles.com/chat#3638)–[#3639](https://altillyfiles.com/chat#3639), [#3691](https://altillyfiles.com/chat#3691)–[#3693](https://altillyfiles.com/chat#3693). In December 2020 that account gave "paul@satotechlt.com" as an old email address and said the domain's history "probably has my name" [#1324](https://altillyfiles.com/chat#1324), [#1326](https://altillyfiles.com/chat#1326), [#1328](https://altillyfiles.com/chat#1328). In February 2021 Revolut said its service was not offered in Mike's country [#3639](https://altillyfiles.com/chat#3639), [#3646](https://altillyfiles.com/chat#3646). Nayiem offered to have Mike's card sent to his own address in Sweden and to forward it [#3647](https://altillyfiles.com/chat#3647), [#3657](https://altillyfiles.com/chat#3657), and Nayiem then wrote that Mike had registered and ordered his card [#3693](https://altillyfiles.com/chat#3693). Two days later a Revolut express envelope arrived at Nayiem's address, addressed to "PAUL Vernon" (photo attached to [#3833](https://altillyfiles.com/chat#3833)). Mike later said his card was held up in customs, then that it had arrived [#3837](https://altillyfiles.com/chat#3837), [#3960](https://altillyfiles.com/chat#3960). Taken together, these messages make it likely that Mike used the name Paul Vernon. There is one limit. Nayiem administered the Revolut Business account [#3644](https://altillyfiles.com/chat#3644)–[#3645](https://altillyfiles.com/chat#3645), and the chat does not show who typed the cardholder name. It only shows that Mike registered and ordered the card himself [#3693](https://altillyfiles.com/chat#3693). No court has confirmed that Mike is Vernon, or that Mike or Vernon took part in the Altilly or Xeggex losses (Rekt News, Plisio). The original chat ends in October 2021 [#7571](https://altillyfiles.com/chat#7571), so it cannot answer the Xeggex-ownership theory in either direction. Even if Mike is Vernon, Nayiem's own failures as CEO still stand. **Nayiem's note:** The author's account: around November 2022 he concluded that Mike was running Xeggex, that "Karl" never existed, and that Mike was Paul Vernon. He says he kept quiet because he was running a legitimate project (Solar) and did not want to be linked to Vernon. He also expected people not to believe him, and they did not believe him when he went public in February 2025. He says he googled the name on the envelope in 2021 and found only a blues musician [#7585](https://altillyfiles.com/chat#7585), [#7595](https://altillyfiles.com/chat#7595). This cannot be checked. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "At first, Nayiem never mentions Paul Vernon. ... He needed a bigger villain to take the blame" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1inxb8g/_/mcgul9r/): "Paul has already disappeared, so it's easy to make him the scapegoat" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ljmhjx/_/mzna6o5/): "there are theories Nayiem Willems was the owner of Xeggex and just using Paul Vernon as a Scape goat and it was actually Nayiem behind the hack." #### What hard proof is there that Paul Vernon was Mike/Karl and ran XeggeX? The evidence cited is a 'paulv' code signature, a GitHub slip, villa matching and a phone call. Is that strong enough? **The critic is partly right** On the four items named, the critic is right: none of them is hard proof. No screenshot of the "paulv" code signature exists, and Mike reportedly said the Mac was second-hand. There are no screenshots of the GitHub/"Karl" slip either. The villa match comes second-hand from a broker. The phone call is an inference drawn from how the person who answered reacted. No court or agency has linked Paul Vernon to Xeggex, and press coverage calls it an allegation. (see [Rekt News, 5 Mar 2025](https://rekt.news/plant-a-red-flag), [Quadriga Initiative](https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Xeggex_Exchange_Collapses_After_Suspicious_Withdrawals) and [Plisio](https://plisio.net/profiles/xeggex-exchange), which all describe the link as an allegation). The chat log has two better pieces of material. Both date from 2020–2021, years before any public dispute: - On 26 Dec 2020, right after the Altilly hack, Mike said the compromised old email address was "paul@satotechlt.com" and added "history on that domain probably has my name" [#1324](https://altillyfiles.com/chat#1324) [#1326](https://altillyfiles.com/chat#1326) [#1328](https://altillyfiles.com/chat#1328). Caveat: the author now thinks the domain was a typo for satotechltd.com; he says his own WHOIS lookup at the time showed nothing because of the missing letter [#7595](https://altillyfiles.com/chat#7595). A historical WHOIS record for satotechltd.com, which the author posted in 2026, lists Paul Vernon / Project Investors Inc [#7577](https://altillyfiles.com/chat#7577), and a January 2016 Bitcointalk post lists a Hong Kong "Satotech Limited" linked to Vernon, with the same phone number as that WHOIS record ([Bitcointalk](https://bitcointalk.org/index.php?topic=1173703.msg13568578#msg13568578), [#7583](https://altillyfiles.com/chat#7583)). Reading "satotechlt" as a typo for "satotechltd" is the author's interpretation, not a proven fact. See [Who is Mike?](https://altillyfiles.com/mike). - In Feb 2021 Nayiem set Mike up with a card on the Altilly team's Revolut Business account. Revolut would not ship to China [#3639](https://altillyfiles.com/chat#3639) [#3646](https://altillyfiles.com/chat#3646), so Nayiem told Mike to have it sent to Nayiem's address [#3647](https://altillyfiles.com/chat#3647). Mike replied "ok, done" [#3653](https://altillyfiles.com/chat#3653), and Nayiem confirmed Mike had registered and ordered his card [#3693](https://altillyfiles.com/chat#3693). Two days later a Revolut envelope arrived there addressed to "PAUL Vernon" (photo in [#3833](https://altillyfiles.com/chat#3833), home address redacted). Mike later confirmed he had received his Revolut card [#3960](https://altillyfiles.com/chat#3960). Read together, the thread shows the envelope held the card Mike ordered [#3638](https://altillyfiles.com/chat#3638)–[#3693](https://altillyfiles.com/chat#3693), [#3960](https://altillyfiles.com/chat#3960). Caveat: the chat does not show who entered the cardholder name, and it does not show Revolut checking anyone's ID. The chat also shows Mike used the "mrmikeo" GitHub account [#4380](https://altillyfiles.com/chat#4380) and the @MrMike_O handle [#3831](https://altillyfiles.com/chat#3831). Taken together, this makes it likely that the person we knew as "Mike" used the name Paul Vernon. The author says he always knew "Mike" was not his real name [#7595](https://altillyfiles.com/chat#7595). This is not proof of anyone's legal identity. It does not prove that the real person named Paul Vernon ran Xeggex or did anything wrong. Those points remain the author's belief and an allegation. **Nayiem's note:** The author says that around Nov 2022 they came to believe that "Karl" never existed, that Mike ran Xeggex, and who Mike was. The author did not go public until Feb 2025. They expected people not to believe them. They say that after the business relationship ended in late 2022, their only contact with Mike was about getting money back. The author also confirms that no screenshots of the GitHub/Karl episode exist. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "Do you have ANY proof that Paul Vernon was actually behind Xeggex? Why is there no FBI, Interpol, or financial crime agency interest" - [Reddit, r/Bitcoin](https://www.reddit.com/r/Bitcoin/comments/1inqdx4/) - [rekt.news](https://rekt.news/plant-a-red-flag): "'Karl' has been alleged to be Paul Vernon" #### Why did Nayiem's write-up say Vernon 'has never been criminally charged', when he was indicted on 17 counts in 2019 (unsealed in 2022)? **The critic is right** The critic is right. The February 2025 write-up said Paul Vernon "has never been criminally charged", and that was false. A sealed 17-count federal indictment against Paul E. Vernon, the founder of Cryptsy, was filed in the Southern District of Florida on 15 August 2019 (case 1:19-cr-20509). On 16 September 2019 the court placed him in fugitive status, according to the CourtListener docket. The indictment was unsealed and announced on 26 January 2022 (DOJ SDFL and IRS-CI press releases). The counts include wire fraud, money laundering, computer fraud, destruction of records and tax evasion. These are allegations, and there has been no conviction. No filing in that case mentions Altilly or Xeggex. The chat does not explain why the write-up used those words. No original chat message types the name "Paul Vernon", but the name does appear in the original record: the Revolut card envelope Nayiem photographed on 4 February 2021, the card Mike had ordered, is addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833). On 26 December 2020 Mike also shared the email address paul@satotechlt.com and said "history on that domain probably has my name" [#1326](https://altillyfiles.com/chat#1326), [#1328](https://altillyfiles.com/chat#1328). Nayiem's 2026 note on the envelope photo adds the full name in text [#7585](https://altillyfiles.com/chat#7585). Whether Mike is the indicted Cryptsy founder has not been legally established. Our review lists "never charged" among several factual errors in the 2025 statement, and the new story corrects it. **Nayiem's note:** The author's account, from the revised story draft: he meant that Vernon "never faced justice", but he accepts that the words he used were false. The new story says plainly that Vernon was indicted in 2019, that the indictment was made public in 2022, and that he remains in fugitive status. **Where this was asked:** - [US Department of Justice](https://www.justice.gov/usao-sdfl/pr/ceo-major-online-cryptocurrency-exchange-company-indicted-defrauding-company-s) #### Is the story of Mike hiding in China under a false passport credible? If Nayiem feared him, why send people from the Chinese community to confront him and publish his address and villa location? **The critic is partly right** The critic is partly right. On the first point, the chat shows Mike living fairly openly in China on a visa rather than hiding there. He talks about extending his visa and the registration with the local police it required [#894](https://altillyfiles.com/chat#894) [#900](https://altillyfiles.com/chat#900), gives a mailing address in China (not shown on this site), and says his passport is "at the china visa office" [#4415](https://altillyfiles.com/chat#4415). Revolut told him its service was not offered in his country [#3646](https://altillyfiles.com/chat#3646), so Nayiem offered to receive the card at his own address and forward it [#3647](https://altillyfiles.com/chat#3647) [#3657](https://altillyfiles.com/chat#3657). The envelope that arrived was addressed to "PAUL Vernon" [#3833](https://altillyfiles.com/chat#3833) (photo on file, with the address redacted), and Mike later confirmed he had got his card [#3960](https://altillyfiles.com/chat#3960). Separately, the US Department of Justice says Paul Vernon, the former Cryptsy CEO, moved to China in about November 2015. He was indicted in 2019 (the indictment was unsealed in 2022) and has not been tried. The US has no extradition treaty with China. The UK Companies House record for Xeggex Software Services Ltd lists a director registered as Michael O'Sullivan as a citizen of Vanuatu ([Companies House](https://find-and-update.company-information.service.gov.uk/company/14910559/officers)). That record says nothing about Vernon. That Mike is Paul Vernon is Nayiem's conclusion, drawn largely from the card label. It is circumstantial and no court has confirmed it. Nothing we checked shows that any passport was false, so the "false passport" part of the story is unverified. On the second point, the critic is right. In the 2025 PDF, Nayiem wrote that he would share Mike's personal details "if there was a 100% guarantee that people would visit his location". He also wrote that the "Chinese community has the resources to track down Paul" and that he was "the only person who knows exactly who Paul is, where he is". He had held Mike's China mailing address since 2021. The PDF also printed a villa address, while saying he was "genuinely afraid for my safety". The PDF says he feared Mike and also points toward Mike's location. The author describes this as a change over time rather than a contradiction (see his note below). This site redacts that address and all other home addresses, and asks readers not to contact or visit anyone. **Nayiem's note:** He says he was afraid of Mike for a long time and kept quiet. After Xeggex collapsed, he was being threatened over something he had no control over, and he decided that Mike's identity and location should be known. He says members of the Chinese community later reported that the property matched the house in Mike's videos; this site cannot verify that and does not publish any address. In his own words, the author says he has been getting threatening messages for years, including threats linked to the Xeggex hack. He says that working through this material brings back fear, sleepless nights and PTSD. His 2025 PDF gives his reasoning at the time. He held back Mike's identity at first because of the risk to himself. Then, in February 2025, he was being threatened and publicly blamed for Xeggex, so he decided to go public together with community members who were Xeggex victims. That is his explanation, not a justification this site endorses. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbsggmr/): "China doesn't let anyone hide unless they have paid 75M. ... Story comes across as bullshit to me" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "why would he send members of the Chinese community to track him down and confront him?" - Nayiem's Follow-Up PDF (Feb 2025), pp.18, 26, 45 #### Is Karl, Mike or Paul actually Nayiem's brother? **Partly answered** Nothing in the chat suggests it, and a few messages point the other way, though none of them settle it. When the team wishes Mike a happy birthday, Nayiem says it falls two days after his "youngest brother's" birthday [#3748](https://altillyfiles.com/chat#3748)–[#3752](https://altillyfiles.com/chat#3752). That at least means Mike is not his youngest brother. Elsewhere Nayiem mentions a brother in the Netherlands in passing, with no link to anyone in the team [#6194](https://altillyfiles.com/chat#6194). A participant now shown as "Deleted Account", apparently Mike, talks about his military service and upstate New York [#6193](https://altillyfiles.com/chat#6193), [#6195](https://altillyfiles.com/chat#6195). He also gives an old email address, paul@satotechlt.com, and says that domain's history "probably has my name" [#1324](https://altillyfiles.com/chat#1324)–[#1328](https://altillyfiles.com/chat#1328). That is the only identity trace in the original chat's text, and it gives a first name, not a surname. No 2019-2021 message types the full name "Paul Vernon"; it appears on the Revolut envelope Nayiem photographed in February 2021 [#3833](https://altillyfiles.com/chat#3833) and in his own 2026 annotation [#7585](https://altillyfiles.com/chat#7585). Public reporting describes "Karl = Paul Vernon" as a community allegation that no court has confirmed. The name "Karl" never appears in the chat, so nothing there links Karl to Nayiem's family. The rumour, as the author's rebuttal PDF describes it, rested on a 2018 article about Nayiem working with his brother and on the word "brother" in Karl's Discord bio. That doesn't show the two are related. To be fair, a chat log can't prove a negative, the identity links above are inferences rather than proof, and Karl's time at Xeggex comes after the chat ends. **Nayiem's note:** The author's account: in his Follow-Up PDF rebuttal, Nayiem calls the brother claim a rumour and says the only "proof" offered was a 2018 news article about him working with his brother and the word "brother" in Karl's Discord bio. He says he believes Mike/Karl is Paul Vernon, and that he saw Mike "as family" in the emotional sense, not as a relative. These are his own statements and have not been independently verified. **Where this was asked:** - Nayiem's Follow-Up PDF (Feb 2025), addendum rebuttal ### Nayiem's role and money #### Did Nayiem, and his family, simply steal Altilly users' funds? **Partly answered** None of the surviving messages shows that Nayiem, or any member of his family, took users' funds, and no family member plays any role in the chat. The servers and wallets that were wiped were run by the lead developer, "Mike". His account now shows as "Deleted Account", and the chat's context identifies it as his. He held the "safe" wallet keys and ran the sweeps by hand [#1299](https://altillyfiles.com/chat#1299), [#1615](https://altillyfiles.com/chat#1615), [#6717](https://altillyfiles.com/chat#6717). Nayiem wrote "I never had access to those servers" and "Mike didn't allow me, because I break things" [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). No surviving message shows him receiving fees, a salary or any payout. He describes himself as "1mln usd in debt" [#1882](https://altillyfiles.com/chat#1882) and having "no money at all" [#2805](https://altillyfiles.com/chat#2805). He also said he was "done paying for all those 3rd parties" [#6772](https://altillyfiles.com/chat#6772), which suggests he had been covering some outside support costs, though at one point he said he had "zero cash" and the Freshdesk bill could wait [#5602](https://altillyfiles.com/chat#5602). The chat does not support the "several million euros" figure. Nayiem's own estimate was "We lost 1mln, but we should know that it will be more", because not every claim would be honest [#1677](https://altillyfiles.com/chat#1677). The critic does have a point. Users lost real money, and the saved-asset refunds were incomplete. The chat shows the keys for the unpaid saved coins, such as TUSC and HIVE, were with Mike, and Chuck's September request to him to send the pending saved assets got no reply in the chat [#4878](https://altillyfiles.com/chat#4878), [#3917](https://altillyfiles.com/chat#3917), [#7421](https://altillyfiles.com/chat#7421); Nayiem says Mike never completed those refunds. Nayiem also handled refund approvals himself, which means he could move at least some user funds [#3563](https://altillyfiles.com/chat#3563)–[#3564](https://altillyfiles.com/chat#3564). He barely checked individual claims ("anything between 50-200 usd I don't check at all", [#3564](https://altillyfiles.com/chat#3564)), checking only that each coin's total matched its wallet [#3558](https://altillyfiles.com/chat#3558), and he approved stalling tactics ("Go for it", [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020); a refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched), followed by "This will be a multi million dollar baby" [#5021](https://altillyfiles.com/chat#5021). He also ordered one payout with "remove all traces" [#4029](https://altillyfiles.com/chat#4029), [#4032](https://altillyfiles.com/chat#4032)–[#4033](https://altillyfiles.com/chat#4033); the users concerned were in countries on a banking partner's 139-country high-risk list, not a sanctions list, and by the author's account they were paid; the chat does not show the payments. Some messages were deleted [#7598](https://altillyfiles.com/chat#7598), so the chat's silence proves nothing either way. **Nayiem's note:** The author's account: he says he never drew a salary or any income from Altilly, and that all listing and trading fees went to Mike. He says he lost his own XQR in the hack ([#1732](https://altillyfiles.com/chat#1732)–[#1733](https://altillyfiles.com/chat#1733) record only that it was lost). He accepts that not every approved user got their saved assets back: the chat shows some still unpaid in September 2021 [#7180](https://altillyfiles.com/chat#7180), [#7421](https://altillyfiles.com/chat#7421). He says he stopped refunds around 2022/23 with around $50,000–60,000 in claims left that can no longer be verified. The chat does not confirm these points; they are his own statements. **Where this was asked:** - Reddit (post on a private user's profile; link and username left out): "User stolen at altilly.com by Mr Nayiem Willems on Twitter" - [Reddit, r/banano](https://old.reddit.com/r/banano/comments/kr9tm9/_/gin5jqj/): "Altilly.com is a big scam by Mr Nayiem Willems" - Chat [#2689](https://altillyfiles.com/chat#2689), [#2777](https://altillyfiles.com/chat#2777) (@AltillyComScam tweets): "has been a successful scammer with a net worth of several million euros stolen from us" #### Who actually owned Altilly: Hodler Enterprises, 'the Qredit team', nobody officially, or Nayiem as founder? Nayiem later said he 'acquired it in 2018 for $175,000', and critics say he founded it rather than being asked by Mike to be CEO. **The critic is partly right** The chat does not settle who owned Altilly, and the public accounts contradict each other. Altilly's 2019 Bitcointalk post said it was "owned and operated by Hodler Enterprises". Its post-hack notice said it "was acquired in 2019" but also that there was no "official ownership by either of the 2 parties". Nayiem's personal site said he "acquired Altilly in 2018 and invested $175,000". None of these claims comes with documents, and the $175,000 figure does not appear anywhere in the chat. In the chat, Nayiem acts as Altilly's CEO and public face, but not clearly as its sole owner. In 2019 he edits Altilly's company text. He wants to cut the Hodler Enterprises wording ("nobody cares who Hodler Enterprises is") [#702](https://altillyfiles.com/chat#702). When Chuck insists on calling Altilly "a Hodler Enterprises owned company", Nayiem agrees to put that on the About page [#705](https://altillyfiles.com/chat#705)–[#706](https://altillyfiles.com/chat#706). In the same period he asks Mike to approve new listing fees and to push the changes live [#755](https://altillyfiles.com/chat#755). He also writes that Altilly is "still incorporated in Hongkong, until I have the things sorted here" [#759](https://altillyfiles.com/chat#759). In December 2020, Mike says he had meant to use a registration service "to form a company in hk" but "never did do that tho" [#1778](https://altillyfiles.com/chat#1778). Two days later Nayiem says "We are not incorporated in Sweden", and he and Chuck agree not to mention that to anyone [#2164](https://altillyfiles.com/chat#2164), [#2166](https://altillyfiles.com/chat#2166)–[#2167](https://altillyfiles.com/chat#2167). After the hack, Chuck talks about the team "taking responsability and paying back" [#1690](https://altillyfiles.com/chat#1690)–[#1694](https://altillyfiles.com/chat#1694). The chat starts in July 2019, so it cannot show who founded Altilly or whether Mike asked Nayiem to be CEO. The critics are right that Nayiem's own statements conflict: his claim of a 2018 acquisition and his Hong Kong incorporation claim are not supported by the chat. No message records a planned transfer of ownership. **Nayiem's note:** The author's account: Altilly was never registered as a company. The author was CEO and the public face and handled the company formation, while Mike directed development. Mike privately promised that the author would get full ownership once the author had set up a company (Qredit Ltd, around December 2020). The author says Mike later deleted that private chat. The author also says that he never received a salary or fee income, and that he meant the Hong Kong incorporation claim [#759](https://altillyfiles.com/chat#759) in good faith but now believes it was untrue. This explanation does not account for the author's earlier public statement "acquired in 2018 for $175,000". **Where this was asked:** - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/): "The exchange was acquired in 2019." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbrx2v3/): "He is the FOUNDER of Altilly, yet he claims Mike came to him and asked him to be CEO." - [Quadriga Initiative](https://quadrigainitiative.com/casestudy/altillyhotwalletshackedandcoldwalletslost.php): "without any official ownership by either of the 2 parties" #### What was Altilly's legal entity? Nayiem says he registered it in the UK 12 days before the hack, but Companies House shows only Qredit Ltd. Why a Hong Kong address, a UK PO box, EUR 2,000 of capital and no board? **The critic is partly right** Largely, the critic is right. No evidence shows Altilly ever had a legal entity. In Sept 2019 the website mentioned Hodler Enterprises [#702](https://altillyfiles.com/chat#702), and Chuck wanted it to keep saying Altilly was owned by that parent company "for trust reasons" [#705](https://altillyfiles.com/chat#705). At the same time Nayiem wrote that Altilly "operates out of Sweden" but was "still incorporated in Hongkong, until I have the things sorted here" [#759](https://altillyfiles.com/chat#759). That statement does not hold up. In Dec 2020 Chuck asked about the Hong Kong (Mong Kok) address shown for Altilly [#1776](https://altillyfiles.com/chat#1776)–[#1777](https://altillyfiles.com/chat#1777). Mike (who appears in the log as "Deleted Account") replied that it was probably from a registration service he had planned to use to form an HK company, but he "never did do that" [#1778](https://altillyfiles.com/chat#1778)–[#1779](https://altillyfiles.com/chat#1779). Two days later Nayiem confirmed "We are not incorporated in Sweden" [#2164](https://altillyfiles.com/chat#2164). Nayiem's 2019 description of Altilly as an HK-incorporated company was therefore inaccurate. When Chuck asked about the company address, Nayiem answered that it was where his own business, Willems Ventures, is registered [#1578](https://altillyfiles.com/chat#1578)–[#1579](https://altillyfiles.com/chat#1579). Companies House lists only QREDIT LTD (13077371), incorporated 11 Dec 2020, 12 days before the incident began. It is not Altilly. Its registered office is a London virtual-office address, and Nayiem is its only director and its 75%+ PSC. So "no board" is accurate. It never filed accounts and was dissolved by compulsory strike-off in May 2022. The register records its capital as GBP 100, not EUR 2,000. The "fake PO box" claim comes from a screenshot posted in the chat [#7418](https://altillyfiles.com/chat#7418) and has not been verified. The chat never mentions the UK company. Nayiem's account is that Qredit Ltd was set up so it could take Altilly over, and that it never traded because its XQR was held on Altilly and lost [#1732](https://altillyfiles.com/chat#1732)–[#1733](https://altillyfiles.com/chat#1733). No message in the chat confirms that takeover plan. **Nayiem's note:** The author's account: Altilly was never registered as a company. Mike privately promised that the author would formally acquire Altilly once the author had set up Qredit Ltd, and the two were moving servers and wallets to the author's hosting when the 'hack' happened. According to the author, Qredit Ltd never traded because its XQR coins were held on Altilly and lost [#1732](https://altillyfiles.com/chat#1732)–[#1733](https://altillyfiles.com/chat#1733). Willems Ventures Ltd was his resort business and was not connected to Altilly [#1579](https://altillyfiles.com/chat#1579). The chat has no message that confirms the acquisition promise. **Where this was asked:** - [UK Companies House](https://find-and-update.company-information.service.gov.uk/) (only Qredit Ltd, 11 Dec 2020) - Chat [#1776](https://altillyfiles.com/chat#1776) (forwarded): "are you based in hong kong, and operate in sweden ??" - Chat [#7418](https://altillyfiles.com/chat#7418) (Telegram screenshot): "You use fake post office box in england, started company with 2000 ueros, and have no board" #### How could Nayiem be CEO without access to the Cherry servers holding BTC, ETH, DASH and LTC, and why didn't he demand control? **The critic is partly right** The chat shows that Nayiem says he had no access, and nothing in it contradicts that. On 26 Dec 2020 he wrote "Mike uses cherry" [#1483](https://altillyfiles.com/chat#1483), then "I never had access to those servers. Mike didn't allow me, because I break things" [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). Nobody else in the chat confirms or disputes this. Mike (shown as "Deleted Account") said the hosting account had been set up about three years earlier using an old, inactive email he had used [#1504](https://altillyfiles.com/chat#1504). According to Mike, Cherry said the server deletion request came from that email [#1508](https://altillyfiles.com/chat#1508). Mike also held a VPS with the "safe" wallets [#1299](https://altillyfiles.com/chat#1299). The chat shows Nayiem did not know the setup: he asked which provider was used [#1105](https://altillyfiles.com/chat#1105), what had been moved to Hetzner the day before [#1119](https://altillyfiles.com/chat#1119), and whether any keys existed [#1285](https://altillyfiles.com/chat#1285). Mike said wallets were being moved to "the new host", but only "any bitcoin clone that was added in the last 30 days" had moved, and the move was still in progress [#1297](https://altillyfiles.com/chat#1297)–[#1298](https://altillyfiles.com/chat#1298). BTC, ETH, DASH and DOGE wallets are reported lost [#1600](https://altillyfiles.com/chat#1600), [#4094](https://altillyfiles.com/chat#4094)–[#4095](https://altillyfiles.com/chat#4095). The chat does not show what happened to LTC. On the second half of the question, the critic is right. The chat has no message from before the loss in which Nayiem asks for control of the servers or keys. Even afterwards, on 4 Jan 2021, he wrote that he "could also reset the credentials my self.. but don't want to give you the feeling that I don't trust you" [#2571](https://altillyfiles.com/chat#2571), and that he wished he had known earlier how things were set up [#2572](https://altillyfiles.com/chat#2572). A CEO letting high-value wallets sit under one person's sole control was a governance failure. **Nayiem's note:** Author's account (not in the chat): Nayiem says he was CEO and the public face and handled the company formation. He says Mike decided what was built and which direction to take, and presented himself as not interested in money or in being seen in public. Nayiem believed that once he had set up Qredit Ltd, around December 2020, he would take over the whole exchange. He says that is why servers and wallets were being moved to his Hetzner account. The promise of a handover was made in private and does not appear in the chat. His view that the "hack" came just as the high-value assets were due to move is his own reading. No message in the chat gives a date for that move. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "If he was the CEO, why did he allow high-value assets to be stored in a system he couldn't control?" #### Why would Nayiem pay refunds from his own pocket for a hack he says was not his fault? Was it to delay legal action? **The critic is partly right** The chat does not show refunds paid from Nayiem's own pocket. Through 2021 he says "I have no money at all" [#2805](https://altillyfiles.com/chat#2805) and "I have zero cash" [#5602](https://altillyfiles.com/chat#5602). The saved-asset refunds that were paid were sent in kind from recovered exchange wallets, mostly by Mike [#4593](https://altillyfiles.com/chat#4593), [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). The ones left unpaid, such as TUSC and HIVE, were also coins whose keys Mike held [#4878](https://altillyfiles.com/chat#4878), [#3917](https://altillyfiles.com/chat#3917); Nayiem says Mike never completed them. In some cases wallet contents were handed to the project's developers to distribute [#2145](https://altillyfiles.com/chat#2145), [#2149](https://altillyfiles.com/chat#2149)–[#2151](https://altillyfiles.com/chat#2151), [#6760](https://altillyfiles.com/chat#6760)–[#6761](https://altillyfiles.com/chat#6761). Refunds for non-saved assets were not paid within this record. They were put off ("Rest of the shit storm will come later" [#4582](https://altillyfiles.com/chat#4582)–[#4583](https://altillyfiles.com/chat#4583); "We will deal with it once we have the funds" [#6754](https://altillyfiles.com/chat#6754)). Proposed sources included selling leftover coins [#4738](https://altillyfiles.com/chat#4738), future exchange profits [#5878](https://altillyfiles.com/chat#5878) and QSLP tokens rather than cash [#6807](https://altillyfiles.com/chat#6807). Nayiem says that from late 2021 he paid refunds from his own income, about $900K by his count, but that falls outside this record and the chat cannot confirm it. Paying refunds does not prove he caused the loss, because an exchange operator faces pressure to make users whole whatever the cause of a hack. On the delay point, the critic is partly right. Chuck raised the risk of lawsuits when discussing how to hand out recovered assets [#2035](https://altillyfiles.com/chat#2035) and pointed to another exchange's refund process as designed to prevent lawsuits [#3576](https://altillyfiles.com/chat#3576). Chuck said "I can drag it out forever" and Nayiem answered "Go for it." [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020). A refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched. Chuck also spoke of stringing the process out to "buy time" [#5962](https://altillyfiles.com/chat#5962), [#6027](https://altillyfiles.com/chat#6027), [#6811](https://altillyfiles.com/chat#6811), though he also said the phased schedule was meant to spread the workload [#5960](https://altillyfiles.com/chat#5960)–[#5961](https://altillyfiles.com/chat#5961). At Chuck's request, dated promises were replaced in public posts with "as quickly as possible" [#3418](https://altillyfiles.com/chat#3418)–[#3421](https://altillyfiles.com/chat#3421). None of this shows Nayiem was responsible for the loss. It does show that buying time was one reason refunds were paced as they were. **Nayiem's note:** Author's account: the author says that he and Chuck were both struggling financially while doing refunds between December 2020 and December 2021. They collected bottles to return for deposit money, which went back into refunds or bills (he says this was posted in the main Altilly Telegram group at the time: [message link](https://t.me/c/1308041716/180323), members only). He stopped refunds around 2022/2023, with a handful after that. He estimates the unpaid claims left at around $50,000–60,000, but these can no longer be verified because the chains are dead and the database was lost. Many refund chains from 2020-21, including the old Qredit chain, no longer exist, so txid proof often cannot be shown. The chat supports none of the specific personal-payment figures he has given elsewhere. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "If he wasn't responsible for the hack, why did he take on the financial burden? ... Because Nayiem WAS responsible for the hack and was trying to delay legal action." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbz5rer/): "why u pay from ur own pocket.... sounds likly more scammy then ur story.." #### What did Nayiem mean in May 2021 by 'I can't pull this twice. Next time will be one way ticket to Russia or China'? Is that an admission of complicity? **The critic is partly right** The quote is accurate [#5354](https://altillyfiles.com/chat#5354). It was written on 17 May 2021, during a design discussion about a new exchange. In the messages just before it, Nayiem says he wishes withdrawals could run from something "disconnected from the internet", using a scheduled file and a script [#5334](https://altillyfiles.com/chat#5334)–[#5340](https://altillyfiles.com/chat#5340). That way, "if someone hacks the platform. They will only get access to hot wallets" [#5344](https://altillyfiles.com/chat#5344). He says he means "the hack that happened", not a customer withdrawal [#5345](https://altillyfiles.com/chat#5345)–[#5346](https://altillyfiles.com/chat#5346). Mike suggests letting the Oracle decide whether funds go to hot or cold wallets [#5350](https://altillyfiles.com/chat#5350). Nayiem adds "Just need to be careful in trying something new" [#5353](https://altillyfiles.com/chat#5353). Straight after the quote, Mike says "If there is a next time I'll probably have a heart attack". Nayiem replies "Same for me. I don't know what i will do to myself if it ever happens again" [#5356](https://altillyfiles.com/chat#5356), [#5361](https://altillyfiles.com/chat#5361). A few minutes later he writes "We have some sort of protection now with the insurance and licensing. But still.. need to be careful" [#5364](https://altillyfiles.com/chat#5364). A critic can read "I can't pull this twice" as "I can't get away with this twice". In context, we read it differently. The whole exchange is about stopping an outside attacker from draining wallets again. "Next time" refers to a second hack happening to them, and the reactions around it (heart attack, not knowing what he would do to himself) are about dread, not escape. We do not read the line as an admission of complicity, and nothing in this exchange suggests he took part in the theft. Readers can check the full context in the messages cited. The critic has a fair point on tone, though. "Damage control" and "pull this twice" frame the Altilly loss mainly as a reputational problem the team had got through. That matches a dismissive, flippant tone towards affected users that the chat shows elsewhere [#2158](https://altillyfiles.com/chat#2158), [#6386](https://altillyfiles.com/chat#6386). It was a poor choice of words, but on its own it is not evidence of complicity. **Nayiem's note:** The author's account: in his statement for the website, Nayiem says the years after the Altilly hack brought threats, sleepless nights, financial ruin and what he describes as PTSD. He also says he is ashamed of how naively he wrote at the time, and compares reading his old messages to "reading messages from a child pretending to run an exchange." Nothing in his statements speaks to this particular line. **Where this was asked:** - Chat [#5354](https://altillyfiles.com/chat#5354): "We managed so far with the damage control of Altilly. I can't pull this twice. Next time will be one way ticket to Russia or China" #### Was 'Charles' (Hodler Company / Hodler Enterprises, 'Altilly support') a fake persona run by Nayiem? Is Hodler Enterprises a real company? **The critic is partly right** The chat does not support the idea that "Charles" was a fake persona run by Nayiem. The group was created by the account "Chuck" (service message), and Chuck wrote its first message asking Nayiem to add managers [#2](https://altillyfiles.com/chat#2). Across the chat he posted about 2,800 messages. He openly disagrees with Nayiem [#705](https://altillyfiles.com/chat#705), and Nayiem addresses him by his own Telegram handle [#1819](https://altillyfiles.com/chat#1819), [#4907](https://altillyfiles.com/chat#4907). He introduced himself to a KYC vendor by name, "from Altilly Exchange" [#661](https://altillyfiles.com/chat#661). He was added to the team's Revolut Business account and ordered his own card [#3709](https://altillyfiles.com/chat#3709)–[#3723](https://altillyfiles.com/chat#3723), then reported receiving it [#3846](https://altillyfiles.com/chat#3846). He also describes personal hardship, such as going to a food bank [#3430](https://altillyfiles.com/chat#3430). All of this is consistent with a separate person, not an alias. The critic is right that Hodler Enterprises links to Nayiem. Nayiem wanted to remove most references to Hodler Enterprises from the Altilly site ("nobody cares who Hodler Enterprises is") [#702](https://altillyfiles.com/chat#702). Chuck objected that the site should still say Altilly was "a Hodler Enterprises owned company or a subsidary of" for trust reasons [#705](https://altillyfiles.com/chat#705), and Nayiem agreed to keep that on the About page [#706](https://altillyfiles.com/chat#706). Chuck later asked about accounts that were "yours or hodler?" [#1489](https://altillyfiles.com/chat#1489). The only "HodlerCompany" handle in the chat belongs to another member close to Nayiem, not to Chuck [#5104](https://altillyfiles.com/chat#5104), [#5105](https://altillyfiles.com/chat#5105). The chat does not show whether Hodler Enterprises was ever a registered company. Nayiem said Altilly was "still incorporated in Hongkong" [#759](https://altillyfiles.com/chat#759). That conflicts with a later message from a now-deleted account (apparently Mike): the Hong Kong address came from a registration service he had meant to use to form a company in HK, and he "never did do that" [#1776](https://altillyfiles.com/chat#1776)–[#1779](https://altillyfiles.com/chat#1779). **Nayiem's note:** In the author's own account, Chuck is a real teammate who struggled alongside him during the refunds (food bank, collecting bottles), and Chuck agreed to let the food-bank detail be published. The author also says the arrangement was that he would get ownership of Altilly once he had set up a company. The chat has no ownership-transfer message; see [#702](https://altillyfiles.com/chat#702), [#705](https://altillyfiles.com/chat#705) and [#759](https://altillyfiles.com/chat#759). **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbrx2v3/): "a user named Hodler Company (Hodler Enterprises), who introduces himself as Charles, Altilly support. Guess who created Hodler Enterprises? It was Nayiem." - freebitcoins.com blog post (link left out because its address names a private person) - [Reddit, r/ArkEcosystem](https://old.reddit.com/r/ArkEcosystem/comments/d26802/_/ezt65wu/): "Hodler Enterprises does exist, they're the company behind Qredit, Hodler Mining, Altilly, etc" #### Does Nayiem run multiple personas, such as the Karl/NeoSolarX avatars and Turkish-language accounts, with himself as the public face and a back-end persona he also controls? Why did he change his profile picture and remove 'CEO of Solar' from X after being named? **Partly answered** The chat supports one part of this. Nayiem was Altilly's public CEO, and Mike ran the back end. In Nayiem's own words: "I never had access to those servers... Mike didn't allow me" [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493), and "Mike never gave me access to the database" [#6557](https://altillyfiles.com/chat#6557). Those are his own statements, not independent proof. They do fit the "public face / backend operator" split described on Reddit. The chat does not show Nayiem running a back-end persona. It also does not show him with no back-end access at all. After the December 2020 hack he asked for the Altilly.com server login [#1375](https://altillyfiles.com/chat#1375), and on 4 January 2021 he wrote "Mike, I did a root password reset on cnserver02" and asked for the sudo passwords so he could check what had been saved [#2569](https://altillyfiles.com/chat#2569)–[#2570](https://altillyfiles.com/chat#2570). His remark "I wish I knew earlier" [#2572](https://altillyfiles.com/chat#2572) suggests he had not seen that setup before the hack. The chat runs from 2019 to 2021. It has nothing about "Karl", NeoSolarX, Turkish-language accounts or changes to his X profile, so it can neither confirm nor rule out the multiple-persona claim. The avatar similarity is an observation, not evidence of who runs an account. We found no source tying Karl to Nayiem. Karl's link to Mike rests on public GitHub and WHOIS traces plus community allegations, and is unproven. The profile change is real by the critic's account. We have no documented reason for it. **Nayiem's note:** The author says "Karl" was a persona Mike introduced in 2022. In the author's account, Mike proposed they approach Karl together about Xeggex, and around November 2022 the author concluded that Karl never existed and that Mike ran Xeggex himself. This is the author's own account and has not been independently verified. The author does not say why the X profile picture and the "CEO of Solar" line were changed. That still needs an answer. **Where this was asked:** - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1imyfqw/): "NeoSolarX & Karl share similar avatars, hinting that Nayiem may be using multiple online personas." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1immi9m/_/mc5dyvd/): "At Altilly, Nayiem was the public face but a guy named Karl/Mike was working backend operations" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/_/mbked49/): "he changed the description of his profile on X (removing that he is CEO of 'solar network')" #### Were Altilly's team members and Nayiem's back-end developers real, verified people, or fake personas with stock photos? **The critic is partly right** The chat cannot settle whether the faces on Altilly's website were stock photos. It never shows the team page. By December 2020, when Chuck asked whether any team "faces/names" were still on any website, Nayiem answered "Nope, all removed long time ago" [#1264](https://altillyfiles.com/chat#1264)–[#1265](https://altillyfiles.com/chat#1265). The management group shows a small core of real, active people: Nayiem as CEO and public face, Chuck on support and listings, and one lead developer, "Mike" (@MrMike_O). Mike pushed code, ran user payouts, built admin tools and was the person asked about stuck withdrawals [#22](https://altillyfiles.com/chat#22)–[#23](https://altillyfiles.com/chat#23), [#416](https://altillyfiles.com/chat#416), [#611](https://altillyfiles.com/chat#611), [#790](https://altillyfiles.com/chat#790). The critic is right about the developer's identity. Mike went by "Michael Osullivan". That name appears on a May 2021 whitepaper draft he posted for a later project, "AltFenix" [#5529](https://altillyfiles.com/chat#5529), and a community member also named him that way [#2679](https://altillyfiles.com/chat#2679). But on 26 December 2020 Mike himself told the group that an old email of his was paul@satotechlt.com and that "history on that domain probably has my name" [#1324](https://altillyfiles.com/chat#1324)–[#1328](https://altillyfiles.com/chat#1328). On 4 February 2021 Nayiem posted, with only the comment "That was really quick", a photo of a Revolut envelope addressed to "Paul Vernon" [#3833](https://altillyfiles.com/chat#3833). In 2026 Nayiem wrote that he "always knew that Mike never used his real name" [#7595](https://altillyfiles.com/chat#7595). So the team had signs of a different name at the time. The chat shows no public verification of who the developer was. Chuck had proposed that listed projects name a CEO with a verifiable public profile [#85](https://altillyfiles.com/chat#85), but no such check was ever applied to Altilly's own developer. The link from "Mike" to the name "Paul Vernon" is a lead based on Mike's own email remark and the envelope. It is not proof of who he is, and no court or authority has confirmed it. **Nayiem's note:** Author's account: Nayiem says he was told Mike used a pseudonym because he had hosted adult websites and did not want his real name to hurt the exchange's credibility, and that searching the name at the time turned up only a musician [#7595](https://altillyfiles.com/chat#7595). Nayiem says he now believes Mike is Paul Vernon. That is his belief, and no court or authority has confirmed it. **Where this was asked:** - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/_/giel58l/): "they look like all of the generic stock photos every shit coin has on their .io page." - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/): "Or are these back-end developers merely hidden or fake personas with stolen or faked photos?" #### If Mike handled Altfenix with no oversight from Nayiem, why is the Estonian Altfenix company (16269508) registered to Nayiem? Who got the exchange fees? **The critic is partly right** On ownership and oversight, the critic is right. The chat shows Nayiem leading Altfenix, not standing back from it. He came up with the name and the domain [#5235](https://altillyfiles.com/chat#5235), checked the trademark [#5254](https://altillyfiles.com/chat#5254), [#5761](https://altillyfiles.com/chat#5761), wrote the product plan [#5587](https://altillyfiles.com/chat#5587)–[#5634](https://altillyfiles.com/chat#5634) and posted the demo [#5771](https://altillyfiles.com/chat#5771). He was also applying for the Estonian crypto licence with his own e-residency [#5081](https://altillyfiles.com/chat#5081), [#5744](https://altillyfiles.com/chat#5744)–[#5745](https://altillyfiles.com/chat#5745) and said the licence required him to move to Estonia [#7276](https://altillyfiles.com/chat#7276). The build work was given to Mike [#7223](https://altillyfiles.com/chat#7223), [#7428](https://altillyfiles.com/chat#7428). Any "no oversight" wording should be corrected. The company number 16269508 does not appear in the chat, but a company registered in Nayiem's name is consistent with his role in this record. On fees, the chat shows no Altfenix fee income at all. In the last plan in the chat (September 2021), Mike still needed "3 to 4 weeks to go live with Altfenix", so the exchange had not launched by then [#7428](https://altillyfiles.com/chat#7428). The fee splits discussed were plans only. In reply to a question about paying off non-saved assets, Nayiem said "25% of the fees" (apparently for refunds) and "50% operational … in case we get hacked", with the exact split shown in a screenshot [#5876](https://altillyfiles.com/chat#5876)–[#5883](https://altillyfiles.com/chat#5883). For Altilly, the chat does not say who received the fee revenue overall. When Nayiem asked "How much of the 31 btc was ours?" [#1662](https://altillyfiles.com/chat#1662), a now-deleted account (apparently Mike) replied "around 0.8 was mine … exchange fees, not much" [#1663](https://altillyfiles.com/chat#1663). That describes the speaker's own holdings. It does not describe where all fees went. The word "ours" in Nayiem's question also suggests that insiders, possibly including him, held funds on the exchange. Nayiem set Altilly's listing-fee policy [#178](https://altillyfiles.com/chat#178), [#917](https://altillyfiles.com/chat#917), but no message shows fees being paid to him. **Nayiem's note:** Author's account (2026): Nayiem says all Altilly listing and trading fees went to Mike, and that he himself never drew a salary or earned from Altilly. Listing fees were paid in XQR, which was already in circulation, so he says he did not profit from them. He says he did the company formation and acted as CEO, while Mike decided what was built. The chat does not confirm or disprove who received the fees, apart from [#1663](https://altillyfiles.com/chat#1663). **Where this was asked:** - [Reddit, r/cryptsyinsolvency](https://old.reddit.com/r/cryptsyinsolvency/comments/1inrl5y/_/mdn1063/): "Your google docs says that Mike was handling Altfenix and you had no oversight. Why is it then registered to you?" - Chat [#5876](https://altillyfiles.com/chat#5876), [#6443](https://altillyfiles.com/chat#6443) (forwarded): "so the fees earned on the exchange will be shared by qredit and the partners 50/50 ?" #### Is Nayiem the one constant behind a string of failed or scam ventures (Willems Ventures, Qredit, Altilly, Altfenix, Voyager Park, SolarDAO, Bitilly), and is a 2026 project another attempt? **The critic is partly right** The critic is partly right. Nayiem does run through several of these ventures. He started the Qredit ICO, and by his own account in the chat he "lost everything again when dutch SEC came in" [#1882](https://altillyfiles.com/chat#1882). He led Altilly and posted its public hack statement [#1167](https://altillyfiles.com/chat#1167). His company Willems Ventures and his resort Voyager Park are registered at his address [#1579](https://altillyfiles.com/chat#1579). He set up and controlled a Revolut Business "company account" for the team, adding USD and EUR accounts and requiring his own approval for payments over 50 USD [#3603](https://altillyfiles.com/chat#3603), [#3644](https://altillyfiles.com/chat#3644), [#3645](https://altillyfiles.com/chat#3645), [#3723](https://altillyfiles.com/chat#3723). After the hack he planned Altfenix, a new exchange named after Altilly, with Mike [#5236](https://altillyfiles.com/chat#5236), [#5254](https://altillyfiles.com/chat#5254), [#5593](https://altillyfiles.com/chat#5593). The refunds for non-saved assets were to be paid in a refund token listed on that future exchange [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), and later in QSLP tokens [#6806](https://altillyfiles.com/chat#6806), [#6807](https://altillyfiles.com/chat#6807). One version of the plan had him buying tokens back at a discount from users willing to take "only half back" [#5203](https://altillyfiles.com/chat#5203). When the chat ends in 2021, the non-saved refunds were still being prepared [#7426](https://altillyfiles.com/chat#7426). There is no sign in the chat that they were ever finished. The chat also shows him telling Chuck to refund one pushy user from a country on the banking partner's 139-country high-risk list (not a sanctions list) "not by email and remove all traces" [#4028](https://altillyfiles.com/chat#4028)-[#4029](https://altillyfiles.com/chat#4029); the author says the users were paid. "Career scam artist", though, means profiting at customers' expense, and the chat does not show that. Nayiem held the company account and ran the refund wallets himself [#3558](https://altillyfiles.com/chat#3558), [#3570](https://altillyfiles.com/chat#3570), but no message shows him taking a salary, fees or customer funds for himself. When Chuck expected him to sell what was left in the refund wallets, Nayiem replied it would not "buy a full tank of gasoline" [#4738](https://altillyfiles.com/chat#4738), [#4743](https://altillyfiles.com/chat#4743). The only fee balance anyone claims is Mike's [#1663](https://altillyfiles.com/chat#1663). Nayiem says he was "1mln usd in debt" [#1882](https://altillyfiles.com/chat#1882) and had "zero cash" [#5602](https://altillyfiles.com/chat#5602). The chat does not mention Bitilly or SolarDAO. It also cannot say whether a 2026 project will be different; readers should judge that on how open it is from the start. **Nayiem's note:** The author's account: Nayiem says he never earned anything from Altilly and that all listing and trading fees went to Mike. Mike's alleged theft is his belief, not an established fact. On the 2026 project, he says he cannot move forward until this chapter is closed, and that publishing the chat is part of closing it. He admits that from late 2022 he believed Mike was running Xeggex and did not warn its users for more than two years. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ixct4u/_/melnuxb/): "Nayiem and his team are career scam artist and they've done this before." - Nayiem's Follow-Up PDF (Feb 2025), p.43 - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1qx3ld9/_/o3vuz2j/): "It's Nayiem Willems trying to scam people again." #### Did Nayiem run an illegal high-yield investment scheme in Sweden (40% returns), and what happened to the Voyager Park investments offered to crypto contacts and to Altilly's 'Investbox'? **Not in the chat** The management chat does not mention a 40% high-yield scheme, so it can neither confirm nor rule out that part of the Bitcointalk claim. It remains an open allegation. It does contain evidence on the Voyager Park investment question, and that evidence cuts against the author. At [#7494](https://altillyfiles.com/chat#7494) the author posted a screenshot of a tweet asking about "the trailer park investments you offer fewer weeks earlier in December". The tweet includes images of a Willems Ventures page (willems.ventures/invest) that presents Voyager Park, the author's igloo tourist resort in northern Sweden [#1378](https://altillyfiles.com/chat#1378), [#1583](https://altillyfiles.com/chat#1583)–[#1584](https://altillyfiles.com/chat#1584), [#6246](https://altillyfiles.com/chat#6246), [#7127](https://altillyfiles.com/chat#7127). The page says the author is "reaching out to my fellow crypto friends to invest as little as €12,50 in the business so we can reach our hard-cap". The same pitch names the author's crypto projects, Qredit and the Altilly Exchange. So the chat shows that Voyager Park investments were offered to crypto contacts. It does not show who invested, how much was raised, what investors were promised, or what happened to their money. In the chat, the author dismissed the person who posted the tweet as a troll [#7492](https://altillyfiles.com/chat#7492), [#7500](https://altillyfiles.com/chat#7500)–[#7501](https://altillyfiles.com/chat#7501) and did not answer the question there. Willems Ventures and Voyager Park were registered at the same address [#1579](https://altillyfiles.com/chat#1579)–[#1580](https://altillyfiles.com/chat#1580). Investbox was a real Altilly feature. Asked by Chuck, a developer in the chat (shown as "Deleted Account", apparently Mike) said Investbox funds were not in a special wallet: they sat in the two normal hot wallets, held under a different account [#1784](https://altillyfiles.com/chat#1784)–[#1785](https://altillyfiles.com/chat#1785). Chuck also suggested Investbox was funded from users' exchange balances rather than from a separate deposit address, but no confirmation appears in the chat [#3926](https://altillyfiles.com/chat#3926)–[#3928](https://altillyfiles.com/chat#3928). The chat does not say what yield Investbox offered or how Investbox balances were treated after the hack. In May 2021 the author said Investbox "was working actually and was attracting users" but proposed dropping it from a relaunch "just to be safe" [#5319](https://altillyfiles.com/chat#5319)–[#5321](https://altillyfiles.com/chat#5321). Investbox was still present in a June 2021 test build [#6581](https://altillyfiles.com/chat#6581). Readers should get a direct public answer from the author on the Voyager Park investment offer: how many people invested, how much, on what terms, and whether they were repaid. **Nayiem's note:** The author's account: Willems Ventures Ltd was the company for Voyager Park, their tourist resort, and it had nothing to do with Altilly [#1579](https://altillyfiles.com/chat#1579), [#1583](https://altillyfiles.com/chat#1583). In the chat, the author also said they "Moved to Sweden. Made money again, started Voyager Park" and were about $1M in debt after the hack [#1882](https://altillyfiles.com/chat#1882). The author's statements provided so far do not deal with the 40% high-yield claim or with any Voyager Park investors. **Where this was asked:** - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.40): "running an illegal investment scam in Sweden, High Yield with 40% returns" - Chat [#7494](https://altillyfiles.com/chat#7494) (tweet screenshot): "can the user claim the restored balances from your prev. exchange simple on your next project? and whats about the trailer park investments" #### Did Nayiem take public money for a historic building in northern Sweden (a Dokdo/Solar office promising 40 jobs) and then leave? Why is the county pursuing him over repairs? **Not in the chat** The Telegram record can't answer this. The chat runs from 2019 to 2021 and covers Altilly. It never mentions a historic building, a public grant, a Dokdo or Solar office, a promise of 40 jobs, or a county claim over repairs. On Sweden, the chat shows only a little. Nayiem ran a tourist resort called Voyager Park, which was receiving guests in late 2020 and 2021 [#1378](https://altillyfiles.com/chat#1378), [#5156](https://altillyfiles.com/chat#5156). His company Willems Ventures and Voyager Park were registered at the same address where he lived [#1579](https://altillyfiles.com/chat#1579), [#1580](https://altillyfiles.com/chat#1580), and other messages point to that being in Sweden [#1776](https://altillyfiles.com/chat#1776), [#6194](https://altillyfiles.com/chat#6194). In December 2020 he said he expected to end up in "massive debt" [#1533](https://altillyfiles.com/chat#1533). That says nothing either way about whether he ever got public funding. The two Reddit comments are worded as speculation ("There are speculations...", "I know the county wants hold of him..."), and neither links to a source. We have not checked Swedish public records, such as municipal or county grant decisions, property registers or enforcement cases, so we can neither confirm nor rule out the claim. The honest answer is: not covered by the chat, and not yet verified. To settle it, you would need the grant decision and any claim from the county, not the chat. **Nayiem's note:** The author's own statements in the evidence don't cover the building, the grant or the repair claim. The only related point, in the author's words: after the 2025 Reddit statement, people visited the author's properties, and the author moved house because the address had become public. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikmh65/_/mbnuu4r/): "There are speculations he got money from the state to fix the building ... but then just peaced out with the money" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/_/nljwhu1/): "I know the county wants hold of him because of buildings in the city needing repair he won't do." ### Refunds #### Where is the proof that refunds were paid, such as bank records or txids for the roughly $900K Nayiem says he paid personally? Did it take two years or three, and why do people who sent the requested proof say they were never paid? **The critic is right** The critic is right: no proof of the roughly $900K has been published. The chat cannot settle this either way, because it effectively ends in October 2021 and Nayiem says most of his personal payments came after that, from late 2021 and 2022 onwards. What the chat does show: in April 2021, about 60 saved-asset coins were marked refunded, mostly sent by Mike [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903), and some refunds went through project developers [#3258](https://altillyfiles.com/chat#3258)–[#3260](https://altillyfiles.com/chat#3260), [#7570](https://altillyfiles.com/chat#7570). At that time Nayiem said he had "no money at all" [#2805](https://altillyfiles.com/chat#2805) and "zero cash" [#5602](https://altillyfiles.com/chat#5602). He kept no payout ledger ("I just mark the addresses", [#3575](https://altillyfiles.com/chat#3575)) and did not check individual claims of 50-200 USD [#3564](https://altillyfiles.com/chat#3564), only each coin's total against its wallet [#3558](https://altillyfiles.com/chat#3558). The 2025 statement says in one place that refunds took "two years" and in another "three years". It gives no bank records or txids. The chat supports the complaints about unpaid claims. In August-September 2021, Chuck wrote that approved users were still waiting for saved assets and that "Weve made alot of promises we are not keeping" [#7180](https://altillyfiles.com/chat#7180), [#7421](https://altillyfiles.com/chat#7421). Separately, "thousands" of users missed the claim-form deadline [#5052](https://altillyfiles.com/chat#5052). Nayiem answered that he would "take care of that as well" [#5049](https://altillyfiles.com/chat#5049), [#5053](https://altillyfiles.com/chat#5053), and nothing in the chat shows that happening. In the same conversation, after Nayiem said refunds would "take a few years" [#5012](https://altillyfiles.com/chat#5012), Chuck offered "I can drag it out forever... Hang the carrot out front", and Nayiem replied "Go for it" [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020). A refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched. Nayiem says he has statements for some payments, but not a full ledger. He also says many txids can no longer be shown, because chains such as Qredit no longer exist. Until redacted statements are published, the $900K is only his claim. **Nayiem's note:** In the author's own account, from late 2021 he paid refunds from his own income, mainly from his share of the 2022 sale of his mining businesses after the investors were paid (all of it except about $25,000 for personal debt), which he estimates at about $900K. He says he has statements for some of the payments but not a full ledger. Many of the 2020-21 chains used for refunds, including the old Qredit chain, no longer exist, so many txids cannot be shown now. The support tickets were lost when Freshdesk was later shut down, after the chat ends. He stopped refunds around 2022/2023, with only a few after that. He estimates the remaining unpaid claims at around $50,000–60,000, though they are now very hard to verify, and he says many late claims were fake. He makes no promise of further payment. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "Where is the proof that you personally paid users back? Can you show bank transactions, blockchain transactions" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbrx2v3/): "You never refunded me for the Altilly scam despite me sending you and 'Charles' the proof you asked for" - Reddit (post on a private user's profile; link and username left out): "I guess you missed mine total 5725 $." #### Why was the claim window cut from 60 days to 9 January 2021 (about 14 days), and the form removed on 28 January? Is that lawful? **The critic is partly right** The critic is right about what happened. The team first talked about a 60-day window ([#1643](https://altillyfiles.com/chat#1643), [#1973](https://altillyfiles.com/chat#1973)), and the Google form went live on 28 Dec 2020 [#2029](https://altillyfiles.com/chat#2029). On 3 Jan 2021 Nayiem said he would "change the window" for refunds [#2438](https://altillyfiles.com/chat#2438) and that "7 days from today" payouts of saved coins would start [#2439](https://altillyfiles.com/chat#2439). He then posted an image of the new deadline notice [#2443](https://altillyfiles.com/chat#2443). The chat text itself does not state the date; the 9 January date comes from the public notice. The reason he gave was that "the amount of claims dropped a lot" [#2446](https://altillyfiles.com/chat#2446). Chuck objected that "changing date is a mistake" and that people would see it as "a desperation act" [#2444](https://altillyfiles.com/chat#2444)–[#2445](https://altillyfiles.com/chat#2445). Nayiem promised a form people could "still fill in after the 14 days" [#2447](https://altillyfiles.com/chat#2447). On 27 Jan Chuck asked for the public form link to be removed and replaced by a notice that the claim period had expired. He also asked for a new link that "only us 3 can be aware of", "for special circumstances only" [#3355](https://altillyfiles.com/chat#3355)–[#3358](https://altillyfiles.com/chat#3358). Nayiem replied that he would do it himself [#3362](https://altillyfiles.com/chat#3362). On 28 Jan he worked on the website [#3364](https://altillyfiles.com/chat#3364) and removed the homepage line telling people to fill in the Google form [#3422](https://altillyfiles.com/chat#3422)–[#3424](https://altillyfiles.com/chat#3424). The same day he mentioned a "new form link" for one user [#3573](https://altillyfiles.com/chat#3573). In May 2021 Chuck noted there were "thousands who were too late" [#5052](https://altillyfiles.com/chat#5052). The chat shows the late-claim route was meant to stay private, so the critic's point that it was cut quietly is supported. On legality, the chat contains no legal advice and this FAQ cannot give a ruling. As a general point, closing a voluntary claim form does not by itself cancel any legal claims people may have. **Nayiem's note:** The author's account: the window was cut because of fake claims. People copied real transaction IDs from block explorers that pointed to known Altilly wallets and faked deposit-confirmation emails. The chat shows the team expected fake claims from the start ([#1645](https://altillyfiles.com/chat#1645), [#1650](https://altillyfiles.com/chat#1650), [#1960](https://altillyfiles.com/chat#1960)). However, the specific fraud of copying transaction IDs is not described in the chat at that point. The reason recorded on 3 Jan was that claims had dropped off [#2446](https://altillyfiles.com/chat#2446). The author also says refunds mostly stopped around 2022/2023. Remaining claims are now very hard to verify, and no further payouts are promised. **Where this was asked:** - [Twitter/X](https://twitter.com/altillycom/status/1347083240708956161): "They've now quietly changed that to: 14 days from today...Final date is: 9th of January" - [Reddit, r/banano](https://old.reddit.com/r/banano/comments/kr9tm9/_/gin5jqj/): "Only 14 days to claim your founds.? That is illegal, in Europe you have up to several years to claim" - freebitcoins.com blog post (link left out because its address names a private person) #### Why did the claims rules include a user's country (with users in countries on a high-risk list denied refunds), a USD 10 minimum balance, and a required Google sign-up? **The critic is partly right** The chat explains all three rules, and the critics are partly right about them. Minimum: a team member proposed collecting user details, with claims limited to balances "worth more than $1 or $10" [#1972](https://altillyfiles.com/chat#1972). Nayiem had already argued for a USD 25 or 50 minimum, saying "I don't want airdrop users to claim their holdings", and Chuck agreed [#1964](https://altillyfiles.com/chat#1964)–[#1970](https://altillyfiles.com/chat#1970). Nayiem then offered to tell users not to file below USD 10 [#1983](https://altillyfiles.com/chat#1983). So the cut-off was set on purpose, not by accident. Google sign-in: when Chuck asked about users without a Google account, Nayiem answered "They can create one" and said it was meant to cut spam [#2065](https://altillyfiles.com/chat#2065)–[#2069](https://altillyfiles.com/chat#2069). Country: the proposed form included country of residence [#1972](https://altillyfiles.com/chat#1972), and it was used for sanctions screening. At first that was a list of seven countries (Iran, Iraq, Libya, Myanmar, North Korea, Somalia, Syria) that Nayiem said the company was legally barred from sending funds to [#2514](https://altillyfiles.com/chat#2514)–[#2516](https://altillyfiles.com/chat#2516). In practice, only Iran had actually been blocked at Cloudflare [#2515](https://altillyfiles.com/chat#2515). Later, Chuck worked from a 139-country list that he called "EU sanctions" but that was in fact the banking partner's high-risk country list, not a sanctions list [#4016](https://altillyfiles.com/chat#4016), [#4027](https://altillyfiles.com/chat#4027)–[#4028](https://altillyfiles.com/chat#4028). PYRK alone had 15 claims declined on this basis [#4005](https://altillyfiles.com/chat#4005). Chuck remarked that the list seemed to cover "all sanctions of any type", and Nayiem replied "Yes" [#4023](https://altillyfiles.com/chat#4023)–[#4026](https://altillyfiles.com/chat#4026). Nayiem named sending small amounts to Nigeria as the kind of risk he wanted to avoid [#4028](https://altillyfiles.com/chat#4028). Even so, Nigeria was deliberately left unmarked "per our conversation" [#4020](https://altillyfiles.com/chat#4020)–[#4021](https://altillyfiles.com/chat#4021), [#4034](https://altillyfiles.com/chat#4034)–[#4035](https://altillyfiles.com/chat#4035). Nayiem also told Chuck that for "a really pushy person" he should "do the refund, but not by email and remove all traces", and mentioned one such "special case" [#4029](https://altillyfiles.com/chat#4029)–[#4033](https://altillyfiles.com/chat#4033). The author says those users were paid. This was screening, not a payment order. But it was applied broadly and inconsistently. **Where this was asked:** - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/): "At the form to request your funds they ask about your country(payment priority by country!?)." - [Reddit, r/Bitcoin](https://old.reddit.com/r/Bitcoin/comments/kn28kn/): "*Only users that had a balance with a value of more than 10 USD will be paid back." - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.60): "but first you need to sign up to google" #### Why did Altilly demand deposit-confirmation emails from years earlier, and reject blockchain evidence and signed messages proving address ownership? How were balances earned by trading supposed to be proven? **The critic is partly right** The chat explains the rule but does not justify all of it. The user database and its decryption config were lost ("we will have no idea what belongs to who", [#1308](https://altillyfiles.com/chat#1308), [#1353](https://altillyfiles.com/chat#1353)), so there was no internal ledger to check claims against. The first plan was to ask for a txid together with the deposit email, "so we can at least verify the transaction ocurred", and to track which txids had already been used ([#1956](https://altillyfiles.com/chat#1956)–[#1958](https://altillyfiles.com/chat#1958), [#1963](https://altillyfiles.com/chat#1963)). The team expected fake claims ([#1650](https://altillyfiles.com/chat#1650), [#1960](https://altillyfiles.com/chat#1960)). Chuck said a txid on its own proved nothing ("Anybody can grab a tx ID and say its is thiers", [#5866](https://altillyfiles.com/chat#5866)–[#5867](https://altillyfiles.com/chat#5867)). He also worried that users would send in old deposit confirmations for coins they had already withdrawn [#3895](https://altillyfiles.com/chat#3895)–[#3897](https://altillyfiles.com/chat#3897). So the deposit-confirmation email became the main test, and a claimant without one was "marked as invalid" [#3965](https://altillyfiles.com/chat#3965). The team knew this would shut out honest users. Nayiem wrote "not everyone received those emails" [#1962](https://altillyfiles.com/chat#1962), and Chuck called it "the downside to only accepting deposit emails" [#4665](https://altillyfiles.com/chat#4665). Signed messages that prove address ownership are never discussed in the chat, even though they answer the txid-copying worry. On trading balances, the team was warned early. At [#2112](https://altillyfiles.com/chat#2112) Nayiem posts what reads as a user's complaint that "all btc funds were obtained through trading other coins" and could not be verified. When Chuck later asked "Deposits only still or balances from trades also", Nayiem replied: "Both can be done. But we don't have a method yet and are not going to think about refunding those people yet. First those that we can fully verify" [#4311](https://altillyfiles.com/chat#4311)–[#4313](https://altillyfiles.com/chat#4313). The chat does not show such a method being built. Team members who had bought assets on Altilly were excused from sending deposit emails ("we can trust the team", [#3951](https://altillyfiles.com/chat#3951)–[#3956](https://altillyfiles.com/chat#3956)). On this point the critic is mostly right. **Nayiem's note:** The author's account: fake claims were a real problem. Some people copied genuine txids from block explorers that sent coins to known Altilly wallets, and some faked deposit-confirmation emails. The author says this showed up in the Freshdesk support tickets, not in the management chat, and access to Freshdesk was later lost. The chat only shows that fakes were expected [#1645](https://altillyfiles.com/chat#1645), [#1650](https://altillyfiles.com/chat#1650), [#1960](https://altillyfiles.com/chat#1960) and that Chuck said users would send in old deposit confirmations for coins they had already withdrawn [#3895](https://altillyfiles.com/chat#3895)–[#3897](https://altillyfiles.com/chat#3897). The author also says many of the chains from 2020-21 no longer exist, so on-chain proof often can't be checked today. **Where this was asked:** - [Bitcointalk](https://bitcointalk.org/index.php?topic=5385112.0): "I even offered them to sign a message with privkeys...Nope, they rejected." - Chat [#4331](https://altillyfiles.com/chat#4331) (Bitcointalk screenshot): "If anything, blockchain is the best receipt of my deposit. Can't be faked, right?" - Chat [#4332](https://altillyfiles.com/chat#4332) (Bitcointalk screenshot): "How can you prove trading activity and buying made on the market? ... it seems like a perfect exit scam" #### Why were refunds only partial (for example, 507,000 of 999,990 PAC), and why were some users offered their original BTC instead of the coins they held? **Partly answered** The critics are right that many refunds were partial. The chat explains some of the reasons, but it has nothing on the specific PAC case. The rules the team used: a refund was capped at the amount on the claim form, even when deposit emails showed more ("send 4600" [#4869](https://altillyfiles.com/chat#4869)–[#4870](https://altillyfiles.com/chat#4870), [#4828](https://altillyfiles.com/chat#4828)). A claim needed a deposit-confirmation email, or it was marked invalid [#3965](https://altillyfiles.com/chat#3965). Some saved wallets held less than was owed, so the rule was "refund what we can" [#4651](https://altillyfiles.com/chat#4651). For example, the Betller coin wallet did not hold enough for its only claim [#4643](https://altillyfiles.com/chat#4643). The team asked that user whether he had withdrawn or sold some [#4662](https://altillyfiles.com/chat#4662), then sent 90,700.5, "thats all we had" [#4686](https://altillyfiles.com/chat#4686). Coins where only one wallet was saved were moved to the unpaid list [#4073](https://altillyfiles.com/chat#4073), [#4671](https://altillyfiles.com/chat#4671). Why deposits and not coins: users who had bought a coin were often refunded in the asset they had deposited to buy it [#3966](https://altillyfiles.com/chat#3966). The BTC, ETH, DASH and DOGE wallets were lost [#4094](https://altillyfiles.com/chat#4094)–[#4095](https://altillyfiles.com/chat#4095), which made other payouts harder. In September 2021 the team built a "BTC refund request page" with "800+ users" and "over 1600 entries" [#7517](https://altillyfiles.com/chat#7517)–[#7519](https://altillyfiles.com/chat#7519). So BTC refunds were offered, but the chat does not explain why BTC was chosen over the coins users held. The 507,000-of-999,990 PAC case does not appear in the chat. PAC is on the saved-wallet list, with both deposit and withdrawal wallets [#1384](https://altillyfiles.com/chat#1384), [#1457](https://altillyfiles.com/chat#1457). Mike reported "pacglobal done" on 2 April 2021 [#4804](https://altillyfiles.com/chat#4804), but the chat gives no amounts, so it cannot say whether that user got a partial or a full payout. For Mooncoin, Mike reported the main send done [#4788](https://altillyfiles.com/chat#4788), [#4859](https://altillyfiles.com/chat#4859). On 1 July Chuck asked him to "send some Moon to a user", and the chat shows no reply [#6880](https://altillyfiles.com/chat#6880), [#6881](https://altillyfiles.com/chat#6881). The team admitted gaps: "thousands who were too late" [#5052](https://altillyfiles.com/chat#5052), and "promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). **Nayiem's note:** The author's account: fake claims were common. People copied real txids that had sent coins to Altilly wallets and forged deposit-confirmation emails. This is part of why claims were capped at proven amounts. The author stopped refunds around 2022-23 and puts remaining unpaid claims at around $50,000–60,000, though they can no longer be checked. Many refund chains no longer exist, so txids often cannot be produced. **Where this was asked:** - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.80): "they can return 507,000 PAC, but my deposit was 999,990 PAC" - [Reddit, r/MoonCoin](https://old.reddit.com/r/MoonCoin/comments/mtxr3d/): "They refunded me only a small part and they don't want to refund any more." - [Reddit, r/dogecoin](https://old.reddit.com/r/dogecoin/comments/krtg1u/_/gx4t2d4/): "they said they can give me back my initial Bitcoin investment" #### Were refunds paid only to people who shouted loudest? Was a partial 'carrot' used to kill momentum, and was the same playbook reused at XeggeX? **The critic is partly right** The "carrot" criticism is right. On 15 May 2021 Chuck wrote "I can drag it out forever… give them something now and then.. Hang the carrot out front and they will follow", and Nayiem replied "Go for it." [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020). A refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched. Chuck also described a plan to spread refunds over a year "to drag it out buying us time" [#5960](https://altillyfiles.com/chat#5960)–[#5962](https://altillyfiles.com/chat#5962) and said he had "purposely strung it out to buy you extra time" [#6811](https://altillyfiles.com/chat#6811). When valuing claims, Nayiem said to take the price "most beneficial for us. So the lowest one" [#6842](https://altillyfiles.com/chat#6842), [#6846](https://altillyfiles.com/chat#6846); he says altcoin prices were spiking around the hack, and he did not want a one-day spike to set the value. The "loudest got paid" claim is also largely supported. The stated order was: people with deposit emails first, then people without, then teams [#4306](https://altillyfiles.com/chat#4306). Two users who were recruiting for a class action could not produce deposit emails [#4304](https://altillyfiles.com/chat#4304), [#4324](https://altillyfiles.com/chat#4324)–[#4325](https://altillyfiles.com/chat#4325). Nayiem first said "No we dont refund them yet. Let me review them" [#4328](https://altillyfiles.com/chat#4328). Both were then paid. The first was paid on a team member's personal vouch and described as needing payment "or he's gonna pitch a shit" [#4339](https://altillyfiles.com/chat#4339), [#4778](https://altillyfiles.com/chat#4778)–[#4781](https://altillyfiles.com/chat#4781), [#4800](https://altillyfiles.com/chat#4800). The second, whom that team member said he did not know and Chuck had labelled a "squeeky wheel", was paid the next day [#4779](https://altillyfiles.com/chat#4779), [#4851](https://altillyfiles.com/chat#4851)–[#4853](https://altillyfiles.com/chat#4853), [#4859](https://altillyfiles.com/chat#4859). Separately, Nayiem said a "really pushy" person in a country on the banking partner's 139-country high-risk list (not a sanctions list) could be refunded "not by email" and to "remove all traces", citing one "really offensive" user as "a special case" [#4020](https://altillyfiles.com/chat#4020)–[#4033](https://altillyfiles.com/chat#4033). The author says those users were paid; the chat does not show the payments. Team members were excused from showing deposit emails [#3951](https://altillyfiles.com/chat#3951)–[#3956](https://altillyfiles.com/chat#3956). Partly saved wallets were paid first come, first served until they ran out [#6023](https://altillyfiles.com/chat#6023). Refunds ended up partial. Some approved users were still unpaid in Aug-Sep 2021, when Chuck wrote "Weve made alot of promises we are not keeping" [#7180](https://altillyfiles.com/chat#7180), [#7421](https://altillyfiles.com/chat#7421). Among those leftovers were coins whose keys Mike held, such as TUSC and HIVE [#4878](https://altillyfiles.com/chat#4878), [#3917](https://altillyfiles.com/chat#3917), and Chuck's September request to Mike got no reply in the chat. Nayiem says Mike never completed them. XeggeX is outside this chat, which ends in Oct 2021. Public reports describe halted withdrawals, and later the XeggeX domain was reopened with its "refund" posts deleted. Those reports come from a single source that has its own stake. This evidence cannot show that the same playbook was reused. **Nayiem's note:** The author's account: many claims were fake. People copied real txids that had gone to Altilly wallets and forged the deposit emails, which is why proof was required. Many 2020-21 refund chains, including the old Qredit chain, no longer exist, so txids often can't be shown. The author stopped refunds around 2022/23 and estimates unpaid claims at around $50,000–60,000. Those claims cannot be verified now, and nothing is promised. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iyjjil/_/mev38g7/): "they are just giving back the accounts to those that care/insist enough ... That's what happened with Altilly" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/): "Altilly refunded part of the funds when the community became loud." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iusy5a/_/me0srv4/): "Then he threw a carrot, just like in altilly, and every momentum was gone" #### What happens to users whose coins were not 'saved'? Will non-saved assets (partly recovered HONK, 'wiped' MRX) ever be refunded or replaced, and with which coin? **The critic is right** The critic is right that the chat does not show non-saved assets being refunded or replaced. When a user asked which coin would replace lost coins, the only reply was "Info will be available later on the website" [#2344](https://altillyfiles.com/chat#2344), [#2346](https://altillyfiles.com/chat#2346). The stated plan was to pay saved assets first and non-saved later [#3431](https://altillyfiles.com/chat#3431), [#4582](https://altillyfiles.com/chat#4582)–[#4583](https://altillyfiles.com/chat#4583). Assets with only part of their wallets saved were moved to the non-saved list [#4073](https://altillyfiles.com/chat#4073), [#4081](https://altillyfiles.com/chat#4081). After that, several ideas came up: - selling leftover funds to cover some non-saved claims [#4738](https://altillyfiles.com/chat#4738) - a pegged "Altilly refund token" [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), later described as QSLP tokens to be minted for saved and unsaved users [#6806](https://altillyfiles.com/chat#6806)–[#6807](https://altillyfiles.com/chat#6807), [#6836](https://altillyfiles.com/chat#6836) - 25% of the new exchange's fees, after Chuck suggested it [#5878](https://altillyfiles.com/chat#5878)–[#5882](https://altillyfiles.com/chat#5882) By September 2021 there were two-step claim checks [#7209](https://altillyfiles.com/chat#7209)–[#7214](https://altillyfiles.com/chat#7214), conversion sheets valuing assets at late-December-2020 prices [#7426](https://altillyfiles.com/chat#7426) and a BTC refund request page [#7517](https://altillyfiles.com/chat#7517). The chat record effectively ends around then [#7532](https://altillyfiles.com/chat#7532), and it shows no non-saved payout. That is absence of evidence, not proof that nothing was paid. MRX: in January 2021 Nayiem was handling the MRX refunds himself. He said MRX was "being paid directly to users" [#3193](https://altillyfiles.com/chat#3193), and when Chuck asked "When can yopu finish the metrix?" he answered "almost done" [#3488](https://altillyfiles.com/chat#3488), [#3492](https://altillyfiles.com/chat#3492). During the April saved-asset payout run the MRX wallets were reported at 0 [#4849](https://altillyfiles.com/chat#4849), [#5013](https://altillyfiles.com/chat#5013). The chat does not say they were "wiped", and it does not explain the zero balance. Unlike TUSC or HIVE, MRX was not left waiting on Mike. HONK: only 5.25B was recovered [#6750](https://altillyfiles.com/chat#6750). The keys went to the HONK developer [#6739](https://altillyfiles.com/chat#6739), [#6928](https://altillyfiles.com/chat#6928)–[#6929](https://altillyfiles.com/chat#6929), who was himself a claimant. He chose to pay the other claimants and absorb the shortfall himself, keeping about 1.5B left over, which was to be deducted from what Altilly owed him [#6760](https://altillyfiles.com/chat#6760)–[#6761](https://altillyfiles.com/chat#6761). Nayiem said to put the lost HONK on the unsaved list and "deal with it once we have the funds" [#6752](https://altillyfiles.com/chat#6752), [#6754](https://altillyfiles.com/chat#6754). The chat does not show that debt being paid. A QSLP / refund token was named as the planned instrument, but no specific replacement coin or fixed value was ever set. **Nayiem's note:** The author's account (2026-09-30), checked against the chat: not every approved user got their saved assets back. In September 2021 some approved users were still unpaid [#7180](https://altillyfiles.com/chat#7180), [#7421](https://altillyfiles.com/chat#7421), and the chat does not show whether they were all paid later. The planned refund token for unsaved assets was meant to trade on Altfenix [#5202](https://altillyfiles.com/chat#5202), [#6657](https://altillyfiles.com/chat#6657)–[#6660](https://altillyfiles.com/chat#6660). The name "ALT2020" appears only once, in a question from Chuck that got no answer [#7208](https://altillyfiles.com/chat#7208); the token was never launched. The share of fees planned for claims was 25%, not the "about 50%" the author first remembered; 50% was for operations [#5535](https://altillyfiles.com/chat#5535), [#5882](https://altillyfiles.com/chat#5882), [#5883](https://altillyfiles.com/chat#5883). The author stopped refunds around 2022/2023, with only a handful after that. He estimates remaining unpaid claims at around $50,000–60,000. He says these are now nearly impossible to verify because chains are dead (including the old Qredit chain) and the database was lost, and that many late claims were fraudulent. He makes no promise of future refunds. Nayiem also says the saved assets that stayed unpaid were held up because Mike kept access to those wallets and never completed the sends, and that Mike's delays held back refunds more widely. For saved assets the chat largely supports this (see the next question). For non-saved assets it does not. Those wallets were lost, and the reason given at the time was a lack of funds: "We will deal with it once we have the funds" [#6754](https://altillyfiles.com/chat#6754), "People don't understand that there are no funds." [#7407](https://altillyfiles.com/chat#7407). **Where this was asked:** - [Reddit, r/altillyhack](https://old.reddit.com/r/altillyhack/comments/my9l2v/): "does anyone have any information about what they will be doing for the 'Non Saved' assets?" - Chat [#6750](https://altillyfiles.com/chat#6750) (forwarded from the HONK developer): "We recovered 5.25 billion honk. The rest was lost." - Chat [#2344](https://altillyfiles.com/chat#2344) (forwarded): "What coin do you offer to us for replace lost coin ?" #### Why were approved or 'saved' refunds still unpaid months or years later (TUSC approved in April, MRX, FARM), when the team itself admitted it was breaking promises? **The critic is right** The critic is right. The chat confirms the delays, and it shows the team knew about them. On 3 Apr 2021 Chuck said TUSC was "only partially saved", so it was on the non-saved list [#4877](https://altillyfiles.com/chat#4877). Mike answered "i have the keys to both wallets" and "1.5b total from my notes" [#4878](https://altillyfiles.com/chat#4878), [#4880](https://altillyfiles.com/chat#4880), and Chuck moved it back: "I will move it back to saved list" [#4885](https://altillyfiles.com/chat#4885). 45 TUSC users were counted [#4900](https://altillyfiles.com/chat#4900). The chat does not record a formal TUSC approval. On 20 Apr, TUSC had "not yet" been distributed [#4905](https://altillyfiles.com/chat#4905)–[#4906](https://altillyfiles.com/chat#4906). On 1 Jul, Chuck said some assets had still not been paid in the first round [#6876](https://altillyfiles.com/chat#6876), "about 14 of these assets" [#6877](https://altillyfiles.com/chat#6877). On 25 Aug Nayiem posted an image and called it "heartbreaking", and Chuck replied that it was "approved and ready to send" [#7377](https://altillyfiles.com/chat#7377)–[#7379](https://altillyfiles.com/chat#7379). In September Chuck wrote "Weve made alot of promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). The chat gives partial reasons. The user database was gone, so users could not all be emailed [#5011](https://altillyfiles.com/chat#5011). Some saved wallets did not hold enough to cover refunds [#4651](https://altillyfiles.com/chat#4651), [#4663](https://altillyfiles.com/chat#4663). The MRX wallets read 0 [#4849](https://altillyfiles.com/chat#4849). The main reason the chat shows is that the keys for the unpaid saved coins were with Mike, and the chat does not show those sends being finished. He held the TUSC keys from December 2020 ("I have those keys saved in my browser" [#1781](https://altillyfiles.com/chat#1781); "yes" to having access to both wallets [#1796](https://altillyfiles.com/chat#1796), [#1799](https://altillyfiles.com/chat#1799); [#4878](https://altillyfiles.com/chat#4878)) and told Nayiem on 20 Apr that TUSC had "not yet" gone out [#4905](https://altillyfiles.com/chat#4905)–[#4906](https://altillyfiles.com/chat#4906). He held the HIVE keys "on my computer" and said he would post balances, which the chat never shows him doing [#3916](https://altillyfiles.com/chat#3916)–[#3918](https://altillyfiles.com/chat#3918). By June Chuck still did not know which servers held "Hive, Honk Xenios and TUSC" [#6724](https://altillyfiles.com/chat#6724). Mike said the COLX wallet held "like 100m" [#5914](https://altillyfiles.com/chat#5914)–[#5915](https://altillyfiles.com/chat#5915), and the chat records no COLX payout. He said he had moved the PYRK user funds "to community fund wallet awhile back" [#7096](https://altillyfiles.com/chat#7096), and the chat records no PYRK payout. He put the cryptonote coins off until he could "write a program" [#4621](https://altillyfiles.com/chat#4621), [#4875](https://altillyfiles.com/chat#4875), and the RDD stragglers off until he could "go thru all from time to time" [#5956](https://altillyfiles.com/chat#5956). A later Moon send got no reply [#6880](https://altillyfiles.com/chat#6880)–[#6881](https://altillyfiles.com/chat#6881). After the April batch [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903), his later send reports in the chat are about Wrkz only: "I've sent many small transactions already but there's a lot left" in June [#6780](https://altillyfiles.com/chat#6780), and "the dev got the whole thing" in October [#7570](https://altillyfiles.com/chat#7570)–[#7571](https://altillyfiles.com/chat#7571). Chuck's last request, on 6 Sep, asked Mike to "hit 'all' the saved assets and get out whatever is pending" [#7421](https://altillyfiles.com/chat#7421). Mike had said he was "dealing with finishing up house stuff" [#7411](https://altillyfiles.com/chat#7411), and the chat shows no reply from him about the saved assets. Nayiem shares part of the blame. He held the Hetzner hosting account [#5656](https://altillyfiles.com/chat#5656)–[#5658](https://altillyfiles.com/chat#5658), and in June he was the one closing down the bare-metal servers that held the saved wallets [#6672](https://altillyfiles.com/chat#6672)–[#6676](https://altillyfiles.com/chat#6676). In January he handled some refunds himself, including Goldcoin [#3215](https://altillyfiles.com/chat#3215) and MRX [#3193](https://altillyfiles.com/chat#3193), [#3492](https://altillyfiles.com/chat#3492). When Chuck pushed to clear the saved assets, he put refunds behind QSLP and other work: "Until we have qslp running properly with an interface" [#7052](https://altillyfiles.com/chat#7052)–[#7053](https://altillyfiles.com/chat#7053), "3-4 days" [#7144](https://altillyfiles.com/chat#7144), and "Will put my focus on it really soon. I'm rushing to get some funds in" [#7181](https://altillyfiles.com/chat#7181). None of that excuses the rest. Dated promises were removed from the website and replaced with "as quickly as possible" [#3418](https://altillyfiles.com/chat#3418)–[#3421](https://altillyfiles.com/chat#3421). After Nayiem said it would probably "take a few years" [#5012](https://altillyfiles.com/chat#5012), Chuck offered to "drag it out forever" and "hang the carrot", and Nayiem replied "Go for it" [#5017](https://altillyfiles.com/chat#5017)–[#5020](https://altillyfiles.com/chat#5020). A refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched. In May, Nayiem asked to put refund support on a two-week "holiday mode" so the team could work on Qredit Motion [#6035](https://altillyfiles.com/chat#6035). Chuck advised against telling users about any pause [#6036](https://altillyfiles.com/chat#6036)–[#6037](https://altillyfiles.com/chat#6037). FARM does not appear in the chat. The record ends in October 2021. **Nayiem's note:** The author's account: Nayiem says Mike kept access to the TUSC, HIVE and other unpaid saved-asset wallets and never completed those refunds, and that Mike kept delaying them. The chat supports this for the coins listed above. It also shows Nayiem's own deferrals. He stopped doing refunds around 2022/2023, with only a handful after that. He estimates the remaining unpaid claims at around $50,000–60,000 in total. He says they are nearly impossible to verify now, because the old chains no longer exist and the database is lost, and that many late claims were fake. He makes no promise of further payment. **Where this was asked:** - Chat [#7421](https://altillyfiles.com/chat#7421): "Weve made alot of promises we are not keeping and natives are starting to get very restless. Losing trust" - Chat [#7377](https://altillyfiles.com/chat#7377) (Discord screenshot): "I got approved since early April.. i need my Tusc Coin back" - Nayiem's Follow-Up PDF (Feb 2025) (MRX, FARM and another asset never returned) #### If all customer funds were hacked, why does an Altilly wallet still hold a large Banano balance, while Banano holders remain unpaid more than a year after confirmation? **The critic is partly right** The management chat never mentions Banano. It cannot confirm whether the wallet named on Reddit belonged to Altilly, what balance it held, or whether Banano was on the saved list. Banano is not on the 87-name saved list Chuck posted on 26 Dec 2020 [#1457](https://altillyfiles.com/chat#1457), but Mike said that list was incomplete ("wasn't there like 225 in the original list" [#1461](https://altillyfiles.com/chat#1461)), and coins such as TUSC, HIVE and Xenios were added to it later [#1781](https://altillyfiles.com/chat#1781), [#1833](https://altillyfiles.com/chat#1833). The chat does not show who held the Banano keys. It shows how the saved wallets were held in general. Mike kept the "safe" wallets on a VPS of his own [#1299](https://altillyfiles.com/chat#1299) and said "i had keys outside of the db on a server i was using to store 'safer' wallets" [#1621](https://altillyfiles.com/chat#1621). On 3 Jan 2021 Nayiem asked "do we have an export of all private keys from these saved coins? @MrMike_O" [#2440](https://altillyfiles.com/chat#2440)–[#2441](https://altillyfiles.com/chat#2441). Mike said he could "probably write a program to do that" [#2478](https://altillyfiles.com/chat#2478), and the chat shows no export after that. For the other saved coins left unpaid, such as TUSC and HIVE, the keys were with Mike (see the previous question). On the other side, Nayiem held the Hetzner hosting account where the saved-wallet servers ran [#5656](https://altillyfiles.com/chat#5656)–[#5658](https://altillyfiles.com/chat#5658), [#6672](https://altillyfiles.com/chat#6672)–[#6676](https://altillyfiles.com/chat#6676). The chat does not say whether a Banano wallet was on those servers. The chat also shows that the team had no up-to-date list of the assets Altilly held. After the hack the list was rebuilt from CoinGecko [#2210](https://altillyfiles.com/chat#2210), and some coins were placed on the lists from memory [#7532](https://altillyfiles.com/chat#7532). What the chat does contradict is the idea that "all customer funds got hacked". From the start the team split assets into "saved" and "not saved" [#2211](https://altillyfiles.com/chat#2211), [#2439](https://altillyfiles.com/chat#2439), [#3445](https://altillyfiles.com/chat#3445), and saved coins were paid out in kind through 2021, with Mike doing most of the sending [#6026](https://altillyfiles.com/chat#6026), [#7421](https://altillyfiles.com/chat#7421). By May 2021 Chuck said "most saved assets" had been refunded to approved users [#4966](https://altillyfiles.com/chat#4966). On the core complaint, though, the critic is right: saved assets stayed unpaid to users whose claims had already been approved. Chuck later wrote "We still have saved assets that have not been refunded to approved users" [#7180](https://altillyfiles.com/chat#7180), said some had not had their first round sent [#6876](https://altillyfiles.com/chat#6876), [#7344](https://altillyfiles.com/chat#7344), and warned "Weve made alot of promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). He also noted "thousands who were too late" for the claim form [#5052](https://altillyfiles.com/chat#5052). The team discussed plans to refund non-saved assets: tokens [#6807](https://altillyfiles.com/chat#6807), a two-step process [#7209](https://altillyfiles.com/chat#7209), and conversion sheets based on Dec 24-26 values [#7426](https://altillyfiles.com/chat#7426). The chat shows no such payment being made. After October 2021 the chat has nothing on what happened to the remaining wallets. Separately, a Bitcointalk thread from February 2022 also disputes the refunds. **Nayiem's note:** The author's account: he stopped doing refunds around 2022/2023, with only a handful after that. He estimates the remaining unpaid claims at around $50,000–60,000, but says they are now nearly impossible to verify because many 2020-21 chains are dead and the user database was lost. He also says many late claims were fake. On Banano, Nayiem says Mike kept access to the Banano wallet and never completed the refund, and that this is why the Banano holders were not paid. The same, he says, goes for the other saved assets that stayed unpaid. The chat cannot confirm this for Banano, because Banano does not appear in it. It does support it for TUSC, HIVE, COLX, PYRK and others, where Mike held the keys and the sends were never reported. It also shows Nayiem putting refunds behind other work [#7052](https://altillyfiles.com/chat#7052)–[#7053](https://altillyfiles.com/chat#7053), [#7181](https://altillyfiles.com/chat#7181). He makes no promise of further payment. **Where this was asked:** - [Reddit, r/banano](https://old.reddit.com/r/banano/comments/10j6wjo/): "They said all customer funds got hacked a couple years ago... obviously not the banano they had" - [Reddit, r/banano](https://old.reddit.com/r/banano/comments/10j6wjo/_/j5ivzku/): "They didn't backup their Banano seed. ... They still have not refunded Banano despite refund confirmations over a year ago." #### Why did project teams have to chase their coins? Examples include 500M TUSC in a marketing-partner wallet, QPSN and Qredit swaps, and CRFI before its hard fork. Why did saved coins go to developers rather than directly to users? **The critic is partly right** The chat explains the policy but backs up much of the complaint. The team chose to go "project by project", depending on which developers they trusted to "distribute fairly" [#2106](https://altillyfiles.com/chat#2106). The stated plan was to send low-value saved coins back to developers who agreed to distribute them, with Altilly handling the rest itself [#2765](https://altillyfiles.com/chat#2765), [#2769](https://altillyfiles.com/chat#2769). Chuck warned that developers must not "just collect it to use for something else" [#2770](https://altillyfiles.com/chat#2770). The chat shows handoffs to developers for BYND [#2149](https://altillyfiles.com/chat#2149), HONK [#6760](https://altillyfiles.com/chat#6760)–[#6761](https://altillyfiles.com/chat#6761) and WRKZ [#7037](https://altillyfiles.com/chat#7037)–[#7038](https://altillyfiles.com/chat#7038). There was some follow-up: BYND payouts were checked on-chain [#3224](https://altillyfiles.com/chat#3224), and a deleted BYND claim was queried [#3192](https://altillyfiles.com/chat#3192). For MRX, a user complained that the MRX team was blocking them and asked to be paid directly [#3187](https://altillyfiles.com/chat#3187). Nayiem replied that MRX was "being paid directly to users" [#3193](https://altillyfiles.com/chat#3193), but the chat does not confirm that this payment happened. The critic is right that the process was opaque and short of funds. Chuck himself did not know which coins were being refunded [#2775](https://altillyfiles.com/chat#2775). The HONK developer was sent only enough to pay himself. He paid the other users out of it, and Altilly still owed him the difference [#6760](https://altillyfiles.com/chat#6760)–[#6761](https://altillyfiles.com/chat#6761). Around the same time, assets were being moved to "unsaved" until "we have the funds" [#6754](https://altillyfiles.com/chat#6754). TUSC was briefly listed as only partly saved [#4877](https://altillyfiles.com/chat#4877), then moved back to the saved list [#4885](https://altillyfiles.com/chat#4885). Mike held the keys to both TUSC wallets ("i have the keys to both wallets" [#4878](https://altillyfiles.com/chat#4878); see also [#1781](https://altillyfiles.com/chat#1781), [#1799](https://altillyfiles.com/chat#1799)). There were 45 claimants [#4900](https://altillyfiles.com/chat#4900), and Mike told Nayiem it had "not yet" been distributed in April 2021 [#4905](https://altillyfiles.com/chat#4905)–[#4906](https://altillyfiles.com/chat#4906). The chat shows no TUSC send after that. Nayiem says Mike kept access to the TUSC wallets and never completed the refund. The QPSN holder was told to "fill in the form" [#2448](https://altillyfiles.com/chat#2448)–[#2449](https://altillyfiles.com/chat#2449). The chat never says whether the 500M TUSC marketing-partner claim [#2289](https://altillyfiles.com/chat#2289) was repaid. By mid-2021 about 14 first-round assets were still unpaid [#6876](https://altillyfiles.com/chat#6876)–[#6877](https://altillyfiles.com/chat#6877), and Chuck wrote "Weve made alot of promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). The chat does not mention CRFI. **Nayiem's note:** The author's account: not every approved user got their saved assets back; he says Mike kept access to the wallets of the saved assets that stayed unpaid and never completed those sends. Many refund chains from 2020-21, including the old Qredit chain, no longer exist, so transaction IDs often cannot be shown now. The author stopped doing refunds around 2022/2023. They estimate the unpaid claims left over at around $50,000–60,000, but these can no longer be verified. **Where this was asked:** - Chat [#2289](https://altillyfiles.com/chat#2289), [#2290](https://altillyfiles.com/chat#2290) (forwarded from a project team): "There was 500 million TUSC in there. We'd just like those back." - Chat [#3187](https://altillyfiles.com/chat#3187)–[#3189](https://altillyfiles.com/chat#3189) (forwarded): "Please dont give my MRX to the developers . Pay it to me ." - Chat [#2775](https://altillyfiles.com/chat#2775): "I get asked 100 times a day which ones are being refunded now" #### Why did the claims process break down in practice: no confirmation emails, bouncing repay@altilly.com, and no refunds even after tx IDs were sent? **The critic is partly right** The critic is right that the process failed users. The chat explains part of why, but it does not excuse it. The Google Form sent no receipt of its own. Nayiem said: "People don't get a reply or automatic email after filling in the form. They will be contacted later" [#2181](https://altillyfiles.com/chat#2181)–[#2182](https://altillyfiles.com/chat#2182). Chuck reported that many claimants said they got no confirmation. He also warned that many missed the instruction to send documents separately by email [#2179](https://altillyfiles.com/chat#2179), [#2191](https://altillyfiles.com/chat#2191)–[#2192](https://altillyfiles.com/chat#2192). The repay@ Fastmail box was set up in a hurry on 28 Dec 2020, and it had a login mix-up between "replay" and "repay" [#1993](https://altillyfiles.com/chat#1993)–[#2028](https://altillyfiles.com/chat#2028). On 2 Jan 2021, Hotmail and Yahoo users reported that mail to repay@ bounced. The bounce said the message was "blocked because it contains content identified as spam". Nayiem said the inbox was still receiving mail and that the problem was probably not on their side. Users were told to keep their screenshots and wait to be contacted [#2324](https://altillyfiles.com/chat#2324)–[#2337](https://altillyfiles.com/chat#2337). Paying for the Fastmail account comes up again later, with a declined card and an updated card [#3229](https://altillyfiles.com/chat#3229), [#3946](https://altillyfiles.com/chat#3946). Later still, Chuck noted that replies bounced whenever the Freshdesk help desk was down [#7339](https://altillyfiles.com/chat#7339). A txid alone was not enough to get a refund. From February 2021 the team asked claimants for deposit-confirmation emails. Claims without one were marked invalid [#3965](https://altillyfiles.com/chat#3965), [#5867](https://altillyfiles.com/chat#5867). Checks were also uneven. Nayiem said he did not check claims of 50-200 USD at all. He relied on the end balance matching instead [#3558](https://altillyfiles.com/chat#3558), [#3563](https://altillyfiles.com/chat#3563)–[#3566](https://altillyfiles.com/chat#3566). For non-saved assets, the chat shows plans: partially saved wallets were to be paid first come, first served until the funds ran out [#6023](https://altillyfiles.com/chat#6023), and there was later talk of QSLP tokens and a two-step process [#6807](https://altillyfiles.com/chat#6807), [#7209](https://altillyfiles.com/chat#7209)–[#7214](https://altillyfiles.com/chat#7214). It does not show any confirmed payouts for fully non-saved assets. **Nayiem's note:** The author's account: fake claims surfaced in Freshdesk support tickets, not in this chat. People copied real txids that had been sent to Altilly wallets and faked the deposit emails. The Freshdesk account ran on the author's card from March 2021 [#4417](https://altillyfiles.com/chat#4417). It lapsed for lack of payment in mid-2021 [#6770](https://altillyfiles.com/chat#6770)–[#6772](https://altillyfiles.com/chat#6772) and was restored, then lapsed again in August [#7202](https://altillyfiles.com/chat#7202), [#7215](https://altillyfiles.com/chat#7215); the author says access was lost for good later, after the chat ends. The author says many 2020-21 refund chains no longer exist, so payout txids often cannot be shown now. The author stopped doing refunds around 2022-23 and makes no promises about the remaining claims. **Where this was asked:** - Chat [#2095](https://altillyfiles.com/chat#2095), [#2179](https://altillyfiles.com/chat#2179): "after we fill in form och send it, shall we recieve conformation Email that you have recieved our form ?" - Chat [#2324](https://altillyfiles.com/chat#2324), [#2325](https://altillyfiles.com/chat#2325) (forwarded): "repay@altilly.com the email always returns back" - Chat [#3231](https://altillyfiles.com/chat#3231) (forwarded): "I have beam deposit tx id sent to repay@altilly com, but not recieve refund" #### When would refunds actually happen? Did the promised April 2021 start ever take place, and why were users still asking in 2023? **The critic is partly right** Partly. The April start did happen, but only for saved assets. In February 2021 Chuck drafted an update for users saying that "the first refunds for saved assets should begin being sent during the first or second week in APRIL" [#4282](https://altillyfiles.com/chat#4282) (see also [#3983](https://altillyfiles.com/chat#3983), [#4142](https://altillyfiles.com/chat#4142)). On 1-3 April 2021, about 60 coins were marked "done" in the team chat, all by the account believed to be Mike [#4613](https://altillyfiles.com/chat#4613)–[#4903](https://altillyfiles.com/chat#4903). On 1 May Chuck wrote that "most saved assets [were] now refunded to those who were approved" [#4966](https://altillyfiles.com/chat#4966). Further saved-asset and partially-saved-asset payments followed into June [#6023](https://altillyfiles.com/chat#6023), [#6779](https://altillyfiles.com/chat#6779), [#6780](https://altillyfiles.com/chat#6780), [#6910](https://altillyfiles.com/chat#6910). It was still far from complete. Thousands of users missed the claim form [#5052](https://altillyfiles.com/chat#5052). In July, some first-round assets were still unpaid, and a second round promised for July had not gone out [#6872](https://altillyfiles.com/chat#6872), [#6876](https://altillyfiles.com/chat#6876). In August approved users were still waiting [#7180](https://altillyfiles.com/chat#7180). In September Chuck wrote that "weve made alot of promises we are not keeping" [#7421](https://altillyfiles.com/chat#7421). That request was addressed to Mike, who held the keys for the unpaid saved coins such as TUSC and HIVE [#4878](https://altillyfiles.com/chat#4878), [#3917](https://altillyfiles.com/chat#3917). The chat shows no reply from him about the saved assets, and after the April batch his only send reports concern Wrkz [#6780](https://altillyfiles.com/chat#6780), [#7570](https://altillyfiles.com/chat#7570)–[#7571](https://altillyfiles.com/chat#7571). Nayiem says Mike kept access to those wallets and never completed the refunds. Nayiem also put refunds behind other work when Chuck pushed [#7052](https://altillyfiles.com/chat#7052)–[#7053](https://altillyfiles.com/chat#7053), [#7144](https://altillyfiles.com/chat#7144), [#7181](https://altillyfiles.com/chat#7181). For non-saved assets (BTC, ETH, USDT and others), the chat shows no payments. It shows only spreadsheets and a claim page [#7426](https://altillyfiles.com/chat#7426), [#7517](https://altillyfiles.com/chat#7517), plus plans for a refund or QSLP token [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), [#6807](https://altillyfiles.com/chat#6807). The chat also contains an exchange about stalling. Nayiem said the process would "take a few years" [#5012](https://altillyfiles.com/chat#5012). Chuck then offered: "I can drag it out forever if you want... Hang the carrot out front" [#5017](https://altillyfiles.com/chat#5017)–[#5019](https://altillyfiles.com/chat#5019), and Nayiem replied "Go for it." [#5020](https://altillyfiles.com/chat#5020). The refund-token plan followed the next day [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), but Altfenix never launched. Together these help explain why people were still asking in 2023. On this point the critics are largely right. **Nayiem's note:** The author's account: he stopped processing refunds around 2022/2023 and made only a handful after that. He estimates the unpaid claims at around $50,000–60,000 in total, but says they are now nearly impossible to verify because chains have shut down (including the old Qredit chain) and the user database was lost. He also says many of the late claims were fake. No further refunds are promised. The chat cannot confirm any of this, because it effectively ends in October 2021. **Where this was asked:** - [Reddit, r/altillyhack](https://old.reddit.com/r/altillyhack/comments/my974f/): "Altilly claimed to start reimbursing funds on April. I am wondering if this has happened yet" - Chat [#2714](https://altillyfiles.com/chat#2714) (group screenshot): "Will it take six months for the users to pay or will they pay earlier?" - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.100): "So what about refunds?" #### Was refund KYC a way to pay out less? Why did the refund plan (saved coins or XQR tokens) keep changing, and why was a claimant told they were not wanted in the community? **The critic is partly right** The critic is right that the plan kept changing. Over roughly four months in 2021 the team floated several ideas for assets that were not saved. These were an "Altilly refund token" pegged to some value [#5201](https://altillyfiles.com/chat#5201)–[#5203](https://altillyfiles.com/chat#5203), a 25% share of fees from a new exchange [#5879](https://altillyfiles.com/chat#5879)–[#5882](https://altillyfiles.com/chat#5882), and QAE claim tokens that holders could sell at a discount, for example 50% [#6657](https://altillyfiles.com/chat#6657). Later came QSLP tokens for unsaved assets [#6807](https://altillyfiles.com/chat#6807) and a verify-then-Motion-app process [#7209](https://altillyfiles.com/chat#7209)–[#7211](https://altillyfiles.com/chat#7211). Even payouts of saved assets fell behind. In September 2021 Chuck wrote internally that "we need to hit 'all' the saved assets and get out whatever is pending before pushing anything else. Weve made alot of promises we are not keeping and natives are starting to get very restless. Losing trust" [#7421](https://altillyfiles.com/chat#7421). That message was addressed to Mike, who held the keys for the unpaid saved coins, and the chat shows no reply. On KYC: Chuck once asked whether a complaining claimant was upset "because he wont KYC?" [#7380](https://altillyfiles.com/chat#7380)–[#7383](https://altillyfiles.com/chat#7383). That suggests identity checks were being asked of claimants. The chat does not show KYC was chosen to cut payouts. The stated reason for checks was to "verify the claims are legit" [#7210](https://altillyfiles.com/chat#7210), and Nayiem wrote that "there are no funds" [#7407](https://altillyfiles.com/chat#7407). Nobody can check that last statement from the chat alone. On "not wanted in the community": the remark appears only in a screenshot of the claimant's own message, which Nayiem forwarded to the group [#7405](https://altillyfiles.com/chat#7405). In it the claimant writes "you said you don't want me in the community" and asks whether he will be paid "in saved coins or xqr". The chat has no record of the original statement. The same screenshot shows the claimant apologising some days later. Chuck also reported that the claimant threatened a lawyer unless paid immediately for a coin he had never claimed [#7399](https://altillyfiles.com/chat#7399)–[#7403](https://altillyfiles.com/chat#7403). Internally, Nayiem twice called the claimant "a noob" [#7398](https://altillyfiles.com/chat#7398), [#7406](https://altillyfiles.com/chat#7406). When Chuck offered to write him "a detailed explanation what our plan is", Nayiem replied "Don't waste your time" [#7408](https://altillyfiles.com/chat#7408)–[#7409](https://altillyfiles.com/chat#7409). Whatever the dispute was about, that dismissive handling supports the complaint. **Nayiem's note:** The author's account: the checks and deadlines were a response to fake claims, where people copied real txids that sent coins to Altilly wallets and forged deposit emails. The chat shows fakes were expected early on [#1645](https://altillyfiles.com/chat#1645), [#1650](https://altillyfiles.com/chat#1650), [#1960](https://altillyfiles.com/chat#1960), but it does not describe this particular method. The author also says refunds mostly stopped around 2022/23. By their estimate, around $50,000–60,000 in claims remain unpaid, and these can no longer be verified because the chains and the database are gone. **Where this was asked:** - Chat [#7417](https://altillyfiles.com/chat#7417) (Telegram screenshot): "you did kyc because you knew that you would have to pay out less" - Chat [#7405](https://altillyfiles.com/chat#7405), [#7399](https://altillyfiles.com/chat#7399): "will you pay me in saved coins or xqr? because you said you don't want me in the community" - [Bitcointalk](https://bitcointalk.org/index.php?topic=5385112.0): "your entire so-called team consists of 2 people...Invite someone who understands this." #### Why didn't Altilly declare bankruptcy and face the authorities? Customers threatened Swedish, UK, EU and Interpol action and accused the company of blaming them. **The critic is partly right** The chat never explains why no bankruptcy or insolvency was filed, and none took place. Public Companies House records (outside the chat) show that the author's QREDIT LTD (13077371) filed no accounts and was struck off in May 2022, not wound up. The chat shows the author himself dismissing these threats. On 30 Dec 2020 Chuck forwarded a customer ticket that exists only as images [#2155](https://altillyfiles.com/chat#2155)–[#2156](https://altillyfiles.com/chat#2156). The author (Nayiem) replied "What an idiot." and "Let him do his thing." [#2158](https://altillyfiles.com/chat#2158)–[#2159](https://altillyfiles.com/chat#2159), then "He can go to the swedish embassy. We are not incorporated in Sweden" [#2164](https://altillyfiles.com/chat#2164). He did not say where Altilly was incorporated. Chuck answered "Im not mentioning that to anyone", and the author said "Yea better not" and "Ignore him" [#2166](https://altillyfiles.com/chat#2166)–[#2168](https://altillyfiles.com/chat#2168). Chuck then told the customer he would be refunded if he followed the website instructions [#2169](https://altillyfiles.com/chat#2169). The author posted a second threatening email [#2339](https://altillyfiles.com/chat#2339). A team member (Deleted Account) replied "people who actually do anything would not be sending an email like that" [#2340](https://altillyfiles.com/chat#2340). In June 2021 the author wrote "I like it when Altilly users are saying that they are going to sue me. Like it will give them their money back instantly." [#6386](https://altillyfiles.com/chat#6386)–[#6387](https://altillyfiles.com/chat#6387). Chuck said users couldn't sue "for several reasons", and the author agreed [#6388](https://altillyfiles.com/chat#6388)–[#6390](https://altillyfiles.com/chat#6390). In Sept 2021, when another user threatened a lawyer over $10,000, the author wrote "People don't understand that there are no funds." [#7399](https://altillyfiles.com/chat#7399), [#7407](https://altillyfiles.com/chat#7407). Lawyers come up once ("Lawyers are all on holiday", [#2183](https://altillyfiles.com/chat#2183)), with no follow-up. The author said he would sue Cherry Servers [#2875](https://altillyfiles.com/chat#2875). No lawsuit appears, but a "Notice regarding liability" from Cherry Servers was shared in March 2021 [#4349](https://altillyfiles.com/chat#4349)–[#4351](https://altillyfiles.com/chat#4351), which shows the liability question was raised with them. The chat mentions police only about people at the author's property [#2380](https://altillyfiles.com/chat#2380)–[#2471](https://altillyfiles.com/chat#2471), not about reporting the hack. The critic is right on these points. We can't check the ticket's exact wording, including the bankruptcy demand and the "blaming customers" accusation, because it exists only as images. **Nayiem's note:** In the author's account, Altilly itself was never registered as a company. Mike had promised the author would formally take it over once Qredit Ltd was set up, and the incident began 12 days after that company was formed. The author says Qredit Ltd never traded, because its XQR holdings sat on Altilly and were lost [#1732](https://altillyfiles.com/chat#1732)–[#1733](https://altillyfiles.com/chat#1733). The author also says they paid refunds until about 2022/23, estimates the unpaid claims at around $50,000–60,000, and says these can no longer be verified. None of this is a legal explanation for why no insolvency process was started. **Where this was asked:** - Chat [#2155](https://altillyfiles.com/chat#2155), [#2156](https://altillyfiles.com/chat#2156) (support-ticket screenshots): "we are hurt while you point out that it is the customers' fault. you must have the dignity to declare bankruptcy" - Chat [#2339](https://altillyfiles.com/chat#2339) (LinkedIn InMail screenshot): "to prevent any others actions with the Interpol Police and authorities in Sweden, United Kingdom and European Union" ### Deleted messages and transparency #### Why did admins delete refund questions, remove the Discord refund channel and tickets, and delete or ban people discussing a class action? **The critic is partly right** On deleting and banning, the critic is largely right. On 15 Feb 2021 Chuck was deleting messages about "you know what" (a class action) as soon as they appeared. Nayiem warned him that this "might trigger some other suspicious things" and said "you can delete those messages but don't ban the user for saying that word" [#3929](https://altillyfiles.com/chat#3929)–[#3931](https://altillyfiles.com/chat#3931). Chuck replied that anyone promoting a class action "needs to be removed immediately or they will contact everone in the members list". Nayiem answered "yea I understand" [#3932](https://altillyfiles.com/chat#3932)–[#3934](https://altillyfiles.com/chat#3934). Earlier, on 6 Jan 2021, Chuck removed a critic who had named Mike, together with the critic's friend. Nayiem approved the removal with a thumbs-up. He objected only to deleting the messages ("Don't delete the messages"), but Chuck had already deleted them [#2679](https://altillyfiles.com/chat#2679)–[#2683](https://altillyfiles.com/chat#2683). On 28 Feb 2021 Chuck said the two people "making all the noise about class action" were on the refund sheets and that neither could produce a deposit confirmation email. Nayiem replied "No we dont refund them yet. Let me review them" [#4324](https://altillyfiles.com/chat#4324)–[#4328](https://altillyfiles.com/chat#4328). Chuck later described the same two as "trying to recruit for class action suit" [#4853](https://altillyfiles.com/chat#4853). In May 2021 Chuck opened a separate refunds group to keep refund-seekers out of the ideas group. Nayiem said it "wasn't needed" and that Chuck "can just ban them instantly from the ideas group", but he accepted the new group once Chuck said it showed refunds were still going on [#5003](https://altillyfiles.com/chat#5003)–[#5007](https://altillyfiles.com/chat#5007). The reasons stated in the chat are legal risk and how things looked: Chuck wanted to avoid a lawsuit and stop members being contacted, and Nayiem worried that instant deletions looked suspicious. The Discord example is weaker. In [#3191](https://altillyfiles.com/chat#3191)–[#3192](https://altillyfiles.com/chat#3192), from a screenshot, Chuck wrote that it "sounds like beyondcoin deleted this users request for refund". Nayiem asked him to find out why. Altilly's Discord #refunds channel was still active on 28 Jan 2021 [#3572](https://altillyfiles.com/chat#3572). The chat does not show it being removed later. **Nayiem's note:** The author gives his own account: he had no admin rights in the group before September 2026, when Chuck transferred ownership [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578), and like any member could delete only his own messages. His deletions in the published archive are limited to customer and third-party data, and he says so in [#7598](https://altillyfiles.com/chat#7598). His messages from 2021 are shown unedited, including [#3931](https://altillyfiles.com/chat#3931) and [#5005](https://altillyfiles.com/chat#5005). **Where this was asked:** - [Bitcointalk](https://bitcointalk.org/index.php?topic=5166945.80): "Admins delete my questions in the telegram." - Chat [#3929](https://altillyfiles.com/chat#3929)–[#3934](https://altillyfiles.com/chat#3934), [#2680](https://altillyfiles.com/chat#2680)–[#2683](https://altillyfiles.com/chat#2683): "instantly deleting messages about 'you know what' might trigger some other suspicious things" - Chat [#3191](https://altillyfiles.com/chat#3191) (Discord screenshot): "They deleted my ticket and didn't return the coins. Also removed the Altilly channel in discord" #### Was public messaging shaped to mislead? For example, Mike instructed staff to say 'we have full control of our systems' while the loss was already being estimated. **The critic is right** On 24 December 2020 the critic is right, and no one in the chat comes out clean. That morning Nayiem asked Mike for "more details about the hack that happened" [#1031](https://altillyfiles.com/chat#1031). A message sent in Chuck's name said the attack may have come in through an insecure rescue port and that three machines were affected [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034). That evening Nayiem asked whether the loss was "really under 10k" [#1056](https://altillyfiles.com/chat#1056). Mike told the team to say "we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057), then answered "might be 15" and "wont know for sure until i get everything moved" [#1059](https://altillyfiles.com/chat#1059)–[#1060](https://altillyfiles.com/chat#1060). Nayiem and Chuck went along with the "outage" framing. Nayiem drafted wording, Chuck and Mike adjusted it ("frequent is not a good word", "just suspicious is fine"), and Nayiem agreed [#1072](https://altillyfiles.com/chat#1072)–[#1075](https://altillyfiles.com/chat#1075). Chuck pointed out that the status page showed the missing assets, and Mike replied "ill fix that soon" [#1078](https://altillyfiles.com/chat#1078)–[#1079](https://altillyfiles.com/chat#1079). Chuck then drafted a public post that called it an outage, said services were moving "to a more reliable source", and pointed users to the updated status page. Nayiem approved it [#1083](https://altillyfiles.com/chat#1083)–[#1085](https://altillyfiles.com/chat#1085). So "fix" may have meant updating the page, not hiding it. The next day Nayiem pushed for disclosure: "it will backfire if we don't tell the truth" [#1163](https://altillyfiles.com/chat#1163). The notice he drafted and published said the servers had been "hacked above OS level" and that it was not yet known whether funds were lost [#1167](https://altillyfiles.com/chat#1167), [#1232](https://altillyfiles.com/chat#1232). While drafting it, Nayiem proposed saying "hackers were unable to access funds". Mike stopped this with "we don't know this" [#1180](https://altillyfiles.com/chat#1180), [#1183](https://altillyfiles.com/chat#1183). Later, at Chuck's request, Nayiem removed a dated section from a public text and rewrote it with no date ("as quickly as possible") [#3418](https://altillyfiles.com/chat#3418)–[#3421](https://altillyfiles.com/chat#3421). On 28 December Chuck also asked for something to be taken down so that it would not be "put out there" [#1911](https://altillyfiles.com/chat#1911)–[#1918](https://altillyfiles.com/chat#1918). The removed content is not visible in the export. The chat does not show who deleted the servers or what anyone intended. **Nayiem's note:** The author's account: when the "full control" line was written on the evening of 24 December, he believed it. Mike had just put the loss at about 10k, "might be 15" [#1056](https://altillyfiles.com/chat#1056)-[#1060](https://altillyfiles.com/chat#1060), and the servers had not yet been deleted; that only became known the next afternoon [#1103](https://altillyfiles.com/chat#1103). Once it was clear that much more was gone, the public notice said it was not yet known whether funds were lost [#1232](https://altillyfiles.com/chat#1232). At the time he trusted Mike and saw him as family. His view that the "hack" was an inside job came later and is his belief, not a finding. He also says he has owned the channel only since 28 Sep 2026 and, before then, could delete only his own messages [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578). The unflattering 24 Dec messages have been left in the published export. **Where this was asked:** - Chat [#1056](https://altillyfiles.com/chat#1056)–[#1060](https://altillyfiles.com/chat#1060): "Just tell them that we are still investigating the outage, and we have full control of our systems" #### Is the published chat export complete and unaltered, given that messages were deleted and commentary was added in 2026? Will Nayiem screen-record the original chats with timestamps instead of a Google Doc? **The critic is partly right** The critic is right that the export is not complete. There are two questions here, and we answer both. The group chat. Nayiem got ownership of the group only on 28 Sep 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578). He then deleted messages, and said he did so to protect customer data, unrelated third parties and early management staff [#7598](https://altillyfiles.com/chat#7598). 663 message numbers are missing between the first and last message: about 130 before the incident, about 530 after it, and 1 in September 2026. The export cannot show which of these were removed in 2026 and which were removed earlier, by anyone. Some are probably service entries. Telegram also lets any member delete their own messages at any time, so the export cannot rule out earlier deletions by Nayiem or anyone else. The chat also contains later additions by Nayiem, sent as replies: a few in February 2025 [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575) and a set of commentary in September 2026 [#7579](https://altillyfiles.com/chat#7579)–[#7597](https://altillyfiles.com/chat#7597). Their dates make them easy to tell apart from the 2019-2021 messages, but they are interpretation, not evidence. Some of it is one-sided. For example, it calls Mike "Mike/Paul" [#7595](https://altillyfiles.com/chat#7595), and that identification is Nayiem's belief, not something the chat proves. The export format has no edit markers at all, so it can neither prove nor rule out that surviving messages were edited. Our own assessment calls the record "single source, curated by an interested party". The original group stays private. This website is the redacted public copy, and the complete unredacted chat is available to law enforcement on request. The strongest independent check would be a full, hash-verified export from another member, such as Chuck, to compare against. The screen recording. The Reddit question (14 Feb 2025) asked for a screen recording of Nayiem's private chats with Mike. Nayiem says Mike deleted that whole private chat for both sides, so it cannot be recorded or recovered. We cannot verify this. The only fragments left are screenshots Nayiem posted in the group in May 2021, for example [#5025](https://altillyfiles.com/chat#5025) and [#5028](https://altillyfiles.com/chat#5028). Nothing in the chat commits to a screen recording. **Nayiem's note:** Author's account: he says he had no admin rights before 28 Sep 2026 (like any member, he could delete only his own messages), and that he removed customer data before publishing. His 29 Sep 2026 announcement said customer and personal data would be redacted. He also says Mike deleted their entire private Telegram chat for both sides, so that chat cannot be recorded or recovered. Only screenshots posted in the group survive, for example [#5025](https://altillyfiles.com/chat#5025) and [#5028](https://altillyfiles.com/chat#5028). In [#7588](https://altillyfiles.com/chat#7588) he notes he kept a message that might look suspicious rather than remove it. **Where this was asked:** - Chat [#7576](https://altillyfiles.com/chat#7576)–[#7590](https://altillyfiles.com/chat#7590) - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "Will you screen record and scroll through the actual messages between you and Mike which shows dates and timestamps rather than providing a google -hosted version" #### Whose device did the Discord screenshots in Nayiem's document come from? They show 'Nayiem' instead of 'You'. And why did he claim he needed ChatGPT when his chats show fluent English? **Not in the chat** The management chat cannot answer either point. Its regular conversation ends in October 2021 [#7571](https://altillyfiles.com/chat#7571). After that it has only a few messages from February 2025 [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575) and notes Nayiem added in September 2026 before publishing the chat on this site. In one of those notes he says some messages were deleted to protect customer and third-party data [#7598](https://altillyfiles.com/chat#7598). The Discord screenshots are from November and December 2022, so they are not covered. The chat assessment lists "Screenshots not from Nayiem's device" as not addressed. One general point: in Discord, your own messages normally appear under your display name, not as "You", so seeing "Nayiem" does not by itself show the images came from someone else's device. It does not prove they came from his either. Only the original files or a screen recording of the live account would settle it, and neither has been published. On ChatGPT, the critic has a fair point. Over several years, the chat shows Nayiem writing longer English messages clearly and at length (e.g. [#4032](https://altillyfiles.com/chat#4032), [#5605](https://altillyfiles.com/chat#5605), [#5634](https://altillyfiles.com/chat#5634)). These messages also contain occasional non-native mistakes (e.g. "on our eind" in [#2331](https://altillyfiles.com/chat#2331), "explain you more in details" in [#6807](https://altillyfiles.com/chat#6807)), which fits his statement that English is not his first language. The ChatGPT claim itself does not appear in the chat. Writing casual chat messages is not the same as writing a formal public statement, but the chat gives no support for saying he needed ChatGPT to write English. **Nayiem's note:** The author's account: the Discord screenshots from Nov-Dec 2022 are among the few surviving records of his private dealings with Mike. He says Mike deleted their private Telegram history with "delete for both". The author says he has these screenshots. His rewritten story says "English is not my first language" and that the 2025 write-up was written quickly and from memory. The evidence provided does not say whose device took the screenshots, and it does not include his explanation of the ChatGPT remark. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iq9g6t/): "It would have said 'you' not Nayiem. So who's device and screen shots are these?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iq9h5y/_/mcyf51p/): "It seems like Nayiem could write English perfectly fine without ChatGPT." #### Why does Nayiem's PDF contain errors: a December 2020 notice saying 'Xeggex was hacked', a mis-dated 'December 2022' heading, and conflicting timelines (12 Dec versus 23-24 Dec)? **The critic is right** The critic is right: the 2025 PDF has these errors, and the chat corrects them. The chat puts the start of the incident at about 23 December 2020, not 12 December. On 24 Dec, Chuck drafted a post to users that referred to "the past 24 hours since the outage occurred" [#1084](https://altillyfiles.com/chat#1084). That same morning Nayiem asked Mike for details about "the hack that happened" [#1031](https://altillyfiles.com/chat#1031). Two messages that Chuck forwarded in reply said the attack may have come in through an insecure rescue port at the host level, and that 3 machines were affected [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034). The exchange about losses ("Is it really under 10k Mike?" and the reply "might be 15" from the account addressed as Mike) happened on 24 Dec [#1056](https://altillyfiles.com/chat#1056), [#1059](https://altillyfiles.com/chat#1059). On 25 Dec the same account reported its belief that someone had hacked into the host's systems and deleted all the servers at Cherry Servers [#1103](https://altillyfiles.com/chat#1103), [#1106](https://altillyfiles.com/chat#1106). Nayiem drafted a public notice ([#1167](https://altillyfiles.com/chat#1167), stamped 26.12.20 00:09). The final version was addressed to Altilly users and dated 26 Dec 2020, 01:25 CET [#1232](https://altillyfiles.com/chat#1232). It named Altilly, not Xeggex, and it did not promise refunds. It said "We are not sure yet if funds are lost." Nayiem had wanted to add that the hackers could not access funds [#1180](https://altillyfiles.com/chat#1180). His partners objected that this was not known [#1183](https://altillyfiles.com/chat#1183), [#1190](https://altillyfiles.com/chat#1190), so the notice left the question open. The PDF's wording is a paraphrase that uses the wrong exchange name. The "December 2022" heading sits above text about Xeggex users losing funds, which refers to the February 2025 collapse. On timing: according to Companies House (a public record outside the chat), Qredit Ltd was incorporated on 11 Dec 2020. The PDF's phrase "twelve days after forming the company" is therefore roughly consistent with an incident around 23 Dec. The chat has no messages from 2 to 18 Dec 2020, and the author says the "12 December" date was probably a mix-up with the incorporation date. The author says he wrote the PDF from memory in February 2025. This site's timeline follows the dated chat messages rather than the PDF. **Nayiem's note:** The author's account: the PDF was written from memory in February 2025, and a note at the top says ChatGPT was used for readability because the author is not a native English speaker. The author says "12 December" was probably a mix-up with the company's incorporation date (11 Dec 2020), and that the "twelve days after" timing was correct. **Where this was asked:** - Nayiem's Follow-Up PDF (Feb 2025) #### Why did Nayiem's February 2025 livestream disappear, is there a recording, and did it show that the speaker is not Mike or Karl? **Not in the chat** The Telegram chat can't answer this. Most of it is the management group from July 2019 to 2021. It also has a few messages from February 2025 [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575) and notes the author added on 27–29 Sep 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7598](https://altillyfiles.com/chat#7598). It never mentions this livestream. We found no recording, archive or transcript of the stream in any of the material we reviewed. So we can't say why it came down, whether a copy exists, or what it showed about who was speaking. The Reddit claim that the stream "confirms that Mike/Karl is not the person speaking" is still unverified either way. In the chat, "Mike" (@MrMike_O) and Nayiem post from separate accounts. For example, Nayiem addresses @MrMike_O directly [#190](https://altillyfiles.com/chat#190), and other members tag both of them side by side [#214](https://altillyfiles.com/chat#214). Separate accounts don't prove separate people, though, and nothing in the chat identifies a voice from a video. Readers should know that the author's own 2026 notes in the chat say that "Mike" is Paul Vernon ([#7585](https://altillyfiles.com/chat#7585), [#7587](https://altillyfiles.com/chat#7587)). That is Nayiem's assertion, not independent evidence. Based on the sources we reviewed (Rekt News, 5 Mar 2025; the Quadriga wiki), the wider claim Karl = Mike = Paul Vernon has not been publicly backed up or proven in court, as far as we could find. The critics have a fair point here: a public stream that disappears without explanation is a real gap in transparency. Only the people who ran it can close that gap. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ivmmns/): "what happened to the nayiem and [host] livestream I can't find it." - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/_/n2n0t3o/): "Do you or anyone else have a recording of the livestream, or is there an archived version available?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbu241g/): "the stream confirms that Mike/Karl is not the person speaking in the stream... is this the case?" #### Who controls altilly.com? Why is its WHOIS private, why did it redirect to Google and later to Nayiem's Reddit post, and who was the previous owner? **Partly answered** The chat covers only 2020-2021. It does not explain the current WHOIS privacy, who controls the domain today, or who set up the redirect to Reddit. On 25 Dec 2020 Mike offered to point altilly.com at Nayiem's temporary server [#1173](https://altillyfiles.com/chat#1173), [#1181](https://altillyfiles.com/chat#1181). He then repointed the domain's Cloudflare DNS to Nayiem's IP [#1206](https://altillyfiles.com/chat#1206), [#1215](https://altillyfiles.com/chat#1215). That evening Nayiem posted a public notice, which the team had drafted together. It said the team had "lost access to... the domain" along with servers, wallets and code [#1232](https://altillyfiles.com/chat#1232). The chat does not bear out the domain part of that claim, because the team clearly still controlled altilly.com's DNS. The notice may have meant the compromised accounts at the old hosting provider [#1504](https://altillyfiles.com/chat#1504)–[#1513](https://altillyfiles.com/chat#1513), but as worded it does not match the chat. On 26 Dec Mike said he had set up the hosting account "3 years ago" [#1504](https://altillyfiles.com/chat#1504), which is consistent with the domain's 2017 creation date. No message names the domain's registrant. In June 2021 Mike suggested redirecting the altilly domain. Chuck objected that the information about the hack would then disappear, and Nayiem agreed not to do it [#6661](https://altillyfiles.com/chat#6661)–[#6666](https://altillyfiles.com/chat#6666). On 23 Jul 2021 Chuck passed on a user's question about why altilly.com was redirecting to Google, and asked the same himself [#7114](https://altillyfiles.com/chat#7114)–[#7115](https://altillyfiles.com/chat#7115). Nayiem said only he and Mike had DNS access, and at first said he believed Mike had changed it on purpose [#7119](https://altillyfiles.com/chat#7119). After checking the Cloudflare audit log he withdrew that. He said he had himself deleted qae.altilly.com, which he believed the site was running on [#7120](https://altillyfiles.com/chat#7120)–[#7123](https://altillyfiles.com/chat#7123). About an hour later he reported it "fixed" and then "sort of" [#7124](https://altillyfiles.com/chat#7124)–[#7125](https://altillyfiles.com/chat#7125). By then users in the refund group were already remarking on it [#7126](https://altillyfiles.com/chat#7126). This explanation is Nayiem's own account in the chat and has not been independently verified. Public WHOIS shows altilly.com was created in 2017 and is registered at Namecheap. The registrant is not shown, then or now. The author says the domain was handed over through Namecheap in Dec 2022, but that rests only on his own screenshot and is unverified. On this point the critic is right. The site does not document who owned the domain before, who controls it today, or who set up the Reddit redirect, and it should say so plainly. **Nayiem's note:** The author says (in the Feb 2025 PDF) that Mike handed the Altilly.com domain over through Namecheap in Dec 2022, and a Discord screenshot is offered as support. Our checks could not independently confirm this. Namecheap as the registrar does match the public WHOIS. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "Why don't you show us who the previous domain owner actually was." - Reddit (post on a private user's profile; link and username left out): "Altilly.com redirects to this post." - Chat [#7114](https://altillyfiles.com/chat#7114) (forwarded): "why is altilly name redirecting to google?" #### Is Nayiem's whole account a lie? Critics note that CEOs don't fix databases, CoinEx developers were helping XeggeX, and his Reddit account had no history. **Partly answered** The chat record is inconsistent with the claim that Nayiem's whole account is a lie, but it does not settle the question. A separate account, apparently Mike's, acts as the developer throughout. Chuck greets @MrMike_O [#17](https://altillyfiles.com/chat#17), and from then on a user now shown as "Deleted Account" talks about releasing code [#22](https://altillyfiles.com/chat#22)–[#23](https://altillyfiles.com/chat#23) and fixing withdrawals [#792](https://altillyfiles.com/chat#792). Nayiem addresses this account as "Mike" and it answers [#1056](https://altillyfiles.com/chat#1056), [#1059](https://altillyfiles.com/chat#1059). Chuck also asks @MrMike_O whether the data is lost [#1160](https://altillyfiles.com/chat#1160). Matching @MrMike_O to "Deleted Account" is an inference from context, because Telegram hides deleted usernames. On 26 Dec 2020 Nayiem said he "never had access to those servers" because "Mike didn't allow me" [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). The database point cuts both ways. Nayiem did not run the database before the loss [#6557](https://altillyfiles.com/chat#6557). In June 2021 he was root on the server but could not reach the database [#6519](https://altillyfiles.com/chat#6519), and he later moved the v1 database credentials into v2 [#6597](https://altillyfiles.com/chat#6597), so he did some hands-on work. There is also counter-evidence on honesty. On 24 Dec 2020 Mike suggested telling users "we are still investigating the outage, and we have full control of our systems" [#1057](https://altillyfiles.com/chat#1057), and Nayiem helped draft that message [#1072](https://altillyfiles.com/chat#1072). Nothing in the evidence mentions CoinEx developers helping XeggeX, and the chat cannot show why his Reddit account had no history. On transparency, the critic has a fair point: the record comes from one interested party. Nayiem took ownership of the channel in Sep 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578) and has deleted messages [#7598](https://altillyfiles.com/chat#7598), and there are gaps at sensitive points [#1055](https://altillyfiles.com/chat#1055)–[#1070](https://altillyfiles.com/chat#1070), [#1323](https://altillyfiles.com/chat#1323)–[#1333](https://altillyfiles.com/chat#1333). At the time, Chuck removed a critic from the group [#2679](https://altillyfiles.com/chat#2679)–[#2680](https://altillyfiles.com/chat#2680). Nayiem approved the removal [#2681](https://altillyfiles.com/chat#2681) but asked Chuck not to delete the messages [#2682](https://altillyfiles.com/chat#2682). Chuck deleted them anyway [#2683](https://altillyfiles.com/chat#2683). **Nayiem's note:** Author's account: messages were deleted to remove customer data and details of third parties [#7598](https://altillyfiles.com/chat#7598), and he had no admin rights before 28 Sep 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7578](https://altillyfiles.com/chat#7578), so he could delete only his own messages. He says Mike deleted their whole private Telegram history with "delete for both". He also says that after his 2025 Reddit statement people came to his properties and he moved house, which he gives as context for posting from a new, low-profile account. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbqe8tg/): "Now let me tell you why everything you wrote here is a lie. ... Your reddit account has no activity whatsoever." ### Xeggex and Dokdo #### Was XeggeX a restart of Altilly by the same people, possibly funded with Altilly users' stolen altcoins and sharing Altilly's back end? **Partly answered** The chat runs from July 2019 to October 2021, before XeggeX existed, and never mentions it, so it cannot settle this question. It does show that Mike (shown as "Deleted Account") built and ran Altilly's technical side: the servers, the backups, the "safe" wallets and the encryption config [#1271](https://altillyfiles.com/chat#1271), [#1299](https://altillyfiles.com/chat#1299), [#1353](https://altillyfiles.com/chat#1353), [#1504](https://altillyfiles.com/chat#1504). Companies House lists a director registered as Michael O'Sullivan for Xeggex Software Services Ltd ([Companies House](https://find-and-update.company-information.service.gov.uk/company/14910559/officers)). Critics say this is the same Mike, and the name matches the one he is reported to have used. The chat never gives Mike's surname, though, so this link comes from public records and the author's own account, not from the chat. The chat also shows that a restart was discussed, and the author was part of it. In May 2021 the group drafted an announcement asking users "what would you guys feel, if we would start another exchange?" [#5023](https://altillyfiles.com/chat#5023). Nayiem and Mike then planned a new exchange called "Altfenix", with Mike working on the back end [#5235](https://altillyfiles.com/chat#5235), [#5257](https://altillyfiles.com/chat#5257), [#5531](https://altillyfiles.com/chat#5531). Chuck asked whether its profits should go toward repaying the assets that were not saved [#5878](https://altillyfiles.com/chat#5878). He also warned that it could be seen "as just a way to get assets back" [#6667](https://altillyfiles.com/chat#6667). The chat does not show that Altfenix ever launched, or that it is connected to XeggeX. On the back end: the public notice of 26 December 2020 said Altilly's "whole codebase" was lost [#1232](https://altillyfiles.com/chat#1232). In the chat, however, Mike says the code was in a private GitHub repo [#1521](https://altillyfiles.com/chat#1521), and in May 2021 he says "All the code is saved. But the data populating those isn't" [#5316](https://altillyfiles.com/chat#5316). So Altilly's source code survived and could have been reused. The claim that XeggeX actually shares Altilly's back end comes from community investigators (a cpuchain.org page, now returning 403) and could not be verified. Nothing in the chat or in public records shows that XeggeX was funded with lost Altilly coins, so that is unproven either way. Rekt News (5 Mar 2025) points out that both exchanges gave a similar story when they failed (a compromised host, then a recovery that dragged on), but that is a pattern, not proof. Wayback snapshots from 2022 show XeggeX labelled "a service of Dokdo Global", so the author was also publicly linked to it for a time. **Nayiem's note:** In the author's own account, Mike proposed in 2022 that they work on XeggeX together and approach its supposed owner "Karl". The author announced publicly that Dokdo would acquire XeggeX. Around November 2022 the author came to believe that Mike ran XeggeX himself and that "Karl" never existed, and the acquisition was cancelled. The author admits they did not warn XeggeX users until February 2025. Their reasons were that they expected not to be believed and wanted no further association. Their view that Mike took the Altilly funds is a belief, not something the chat shows. **Where this was asked:** - [Reddit, r/PRCYCoin](https://old.reddit.com/r/PRCYCoin/comments/snr1wk/): "We know the people behind Xeggex. long story short, its a sort of restart of Altilly." - [Reddit, r/kaspa](https://old.reddit.com/r/kaspa/comments/11mjzyk/_/jbo7ng1/): "Xeggex is built by the same person that created Altilly." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/_/mbjpllt/): "Pretty sure Altilly stole my 5k in alts and created Xeggex" #### Is Nayiem actually 'Karl', XeggeX's CEO or real owner, repeating the Altilly rug? Should any investigation start with him? **The critic is partly right** The chat can't settle this. It covers July 2019 to October 2021, plus later notes Nayiem added in 2025 and 2026, and it never mentions Xeggex, Karl or Dokdo. Public records answer part of the question. No source we found shows that Nayiem was Karl, Xeggex's CEO or its owner. UK Companies House lists a different person as sole director and majority owner of Xeggex Software Services Ltd (2023-24). The official Xeggex GitHub organisation has a 2024 commit from the account of Altilly's developer "MikeO", not from Nayiem. xeggex.com was registered in August 2021. That date needs context, and it does not clear Nayiem. In mid-2021 the chat shows Nayiem, then acting as CEO, still working with Mike on a successor exchange. In May 2021 they planned an exchange called "Altfenix" [#5235](https://altillyfiles.com/chat#5235), [#5605](https://altillyfiles.com/chat#5605). In August 2021 Nayiem asked Mike about running two exchanges with shared liquidity [#7275](https://altillyfiles.com/chat#7275), and Mike replied that "the system is being setup so you can have multiple frontend exchanges already" [#7293](https://altillyfiles.com/chat#7293). In September 2021 there was talk of "new projects" and a "new dashboard" [#7386](https://altillyfiles.com/chat#7386), [#7389](https://altillyfiles.com/chat#7389). None of these messages names Xeggex. They do show that the two men were still building exchange software together when the domain was registered. The critic also has a point about what came later. In 2022 Nayiem publicly announced that Dokdo would acquire Xeggex, and archived copies of the site from that year say "a service of Dokdo Global". By his own account, from late 2022 he believed Mike ran Xeggex and did not warn its users until February 2025. That makes him a fair person to question and a necessary witness. Nothing we found shows that he was the operator. We are not aware of any court or authority that has named anyone as Xeggex's operator. **Nayiem's note:** The author's account: in 2022 Mike proposed that they work on Xeggex together and approach "Karl", and Nayiem announced the Dokdo acquisition. Around November 2022 he says he found out that "Karl" never existed and that Mike was running Xeggex himself, so he cancelled the deal. He stayed silent until February 2025 because he did not want his project at the time linked to that person, and because he expected not to be believed. He says the Reddit reactions to his 2025 disclosure bore that out. No screenshots of the GitHub "Karl" episode exist. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iisdmd/): "The CEO with the name of 'Karl' has been found to be an individual by the name Nayiem Willems. He has previously rugged a different exchange" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikmh65/_/mbny38b/): "How do we know for a fact Nayiem is the CEO of Xeggex?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iufb0c/_/mdynizd/): "Nayiem Willems. This is who we start with because we know he is involved." #### Dokdo's website listed XeggeX as its product, and XeggeX announced its acquisition by Dokdo. How is that 'no connection'? And if Altilly traumatised him, why did Nayiem take on another exchange? **The critic is partly right** On the Dokdo link, the critic is right. There was a public connection, and the author does not deny it. Wayback snapshots from 6 Jun 2022 and Sep–Dec 2022 show XeggeX described as "a service of Dokdo Global". So in 2022 it was presented publicly as a Dokdo service, not only as a planned acquisition, and the author himself announced the Dokdo acquisition. The author says the plan was later cancelled. If that is so, "no connection" can apply at most to the period after the cancellation. It does not apply to 2022. (These snapshots are external records, not part of the chat.) The Telegram chat cannot settle the XeggeX question. It runs from Jul 2019 to Oct 2021, with annotations the author added in 2025–2026, and it never mentions XeggeX, Dokdo or "Karl". External public records show xeggex.com was registered on 31 Aug 2021 and the xeggex GitHub org was created on 20 Sep 2021, both before the 2022 acquisition talks. They also show the mrmikeo GitHub account had commit access to the Xeggex org in 2024. This fits the author's claim that Mike, not a separate "Karl", was behind XeggeX, but it does not prove it. On "why take on another exchange after Altilly", the chat is relevant, and it does not simply support the trauma framing. In May 2021, about five months after Altilly went down, the group discussed starting "another exchange" [#5023](https://altillyfiles.com/chat#5023). Nayiem actively drove the idea: "think about the product and new exchange" [#5200](https://altillyfiles.com/chat#5200), "I got the new domain for the exchange" [#5228](https://altillyfiles.com/chat#5228), and plans for an invite-only exchange called Altfenix [#5599](https://altillyfiles.com/chat#5599) [#5605](https://altillyfiles.com/chat#5605). In Aug–Sep 2021, Nayiem was still working on an exchange system with Mike. He asked @MrMike_O about running several exchanges [#7275](https://altillyfiles.com/chat#7275). A reply from a now-deleted account said "the system is being setup so you can have multiple frontend exchanges" [#7293](https://altillyfiles.com/chat#7293). Nayiem also wrote "people have their own private key on the exchange" [#7476](https://altillyfiles.com/chat#7476) and "I need a week or so to discuss this with Mike" [#7480](https://altillyfiles.com/chat#7480). The chat shows the author still trusted Mike closely and was building a new exchange with him in 2021. It does not show whether this project was XeggeX. **Nayiem's note:** The author's account: Mike suggested they work on XeggeX together and approach its operator, "Karl". That is why the author announced the Dokdo acquisition. The author says that around Nov 2022, when the Solar SXP theft happened, he concluded that Mike ran XeggeX himself and that "Karl" did not exist, and he then cancelled the acquisition. On why he took on another exchange after Altilly: he says he still saw Mike as "family" and was "too naive" to suspect him. He admits that from late 2022 he believed Mike ran XeggeX and did not warn its users for more than two years. His reason was that he expected nobody would believe him. He says that after the business relationship ended in late 2022, his only contact with Mike was about getting money back. **Where this was asked:** - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/): "Dokdo's website ... explicitly listed the XeggeX exchange and the XeggeX wallet as their products. Likewise, the website of XEGGEX.com announced the acquisition by Dokdo" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/): "If you were so 'traumatized' by Altilly, why were you so easily convinced to take over another exchange?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1immi9m/_/mc4a39b/): "Nayiem said he had no involvement with Xeggex since 2022 but that's a lie" #### Did Nayiem write XeggeX's statement clearing him himself? Why would XeggeX clear him but never say who Karl is, and why do earlier XeggeX posts read like his writing? **Not in the chat** The chat can't settle this. Its regular messages end in October 2021 [#7571](https://altillyfiles.com/chat#7571). After that there are only a few short replies from Nayiem in February 2025 [#7572](https://altillyfiles.com/chat#7572) [#7574](https://altillyfiles.com/chat#7574) [#7575](https://altillyfiles.com/chat#7575) and his own notes added in September 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7598](https://altillyfiles.com/chat#7598). None of these mention XeggeX or "Karl", so the chat can't show who wrote any XeggeX post. One point to be open about: on 8–9 February 2025, the same month as the first XeggeX statement we found, Nayiem replied to several old messages from Mike ("Thank you Mike", "Thanks again") [#7572](https://altillyfiles.com/chat#7572) [#7575](https://altillyfiles.com/chat#7575). Those replies say nothing about XeggeX or its statements. They neither support nor rule out the claim that he wrote one. Our materials don't include the statement that cleared Nayiem, and nobody has run a writing-style comparison. That means we can neither confirm nor rule out the claim that he wrote it. The critics have a fair reason to ask: Wayback snapshots from 2022 show XeggeX as "a service of Dokdo Global", Nayiem publicly announced a planned Dokdo takeover, and he did not warn XeggeX users for more than two years. On "who is Karl": the XeggeX statements we found (February and June 2025) never address who ran it. Public records instead link the developer "MikeO" to XeggeX: a GitHub commit to the xeggex organisation (1 Apr 2024) and a UK company director listing. Those records are verifiable, but they don't show who wrote any post. Nayiem's 2026 notes in the chat call Mike "Mike/Paul". That is his own claim, not independent evidence. Rekt, Warthog and Plisio all describe "Karl = Paul Vernon" as an unproven community allegation. **Nayiem's note:** In Nayiem's account, Mike brought him "Karl from XeggeX" in early 2022. Dokdo's takeover was dropped around November 2022, when Nayiem came to believe that Mike ran XeggeX and that "Karl" never existed. On 3 December 2022 he agreed that the Dokdo references could be removed. He says he had no role at XeggeX after that. He has not directly addressed the claim that he wrote the clearing statement. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1inxb8g/_/mcgmuk9/): "Nayiem most likely wrote this himself. ... Why wouldn't they just say who Karl was?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1inxb8g/_/mcgul9r/): "some previous posts from Xeggex displayed the same writing patterns as Nayiem." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1itk65d/_/mdsd1kv/): "Hehe because HE wrote that message." #### Was XeggeX's 'CEO Telegram/laptop hacked, database corrupted, funds are safe' story true, given orderly hot-wallet outflows on 2-3 February 2025 and Karl moving funds to MEXC 'for safekeeping'? **The critic is partly right** The Telegram chat cannot answer this. Most of it runs from July 2019 to October 2021. The only later messages are a few short replies from 8-9 February 2025 and the author's notes from September 2026, and none of them mention XeggeX. Public sources support the critic's doubts. XeggeX halted on 3 February 2025, blaming a hacked CEO laptop or Telegram account and a corrupted database. Rekt News (5 March 2025) cites Bitrace and Arkham, and screenshots shared by Salvium and Nerva, showing orderly outflows of USDC, USDT, ETH and BNB from the hot wallets on 2-3 February. Rekt and other critics read that pattern as a planned drain, not a sudden hack. We have not checked the raw transfers ourselves. The "funds are safe" line also did not hold. User balances were later replaced with IOU tokens (BTCXX, ETHXX, USDTXX), and on 27 June 2025 XeggeX announced closure and bankruptcy. No court filing has been made public. We found no primary source for Karl's reported "moved to MEXC for safekeeping" remark, so it is unverified. No authority has found the hack story false. The evidence makes it hard to believe, but it does not prove it untrue. **Nayiem's note:** The author's account: around November 2022 the author came to believe that Mike ran XeggeX himself and that "Karl" never existed, so the planned Dokdo acquisition of XeggeX was cancelled. The author did not warn XeggeX users until February 2025. The reason the author gives is that people were expected not to believe it (and later did not). The author says that after the business relationship ended in late 2022, the only contact with Mike was about getting money back. The author has no first-hand knowledge of what happened at XeggeX in February 2025. **Where this was asked:** - [plisio.net](https://plisio.net/profiles/xeggex-exchange) - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikb3ia/): "XeggeX blocked logins and withdrawals, citing a database issue. They claim 'funds are safe,' but offer no real proof." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iic1wh/_/mb5g86m/): "he admitted to MOVING FUNDS TO MEXC in the name of 'Safe keeping'" #### Where did XeggeX's assets go? Questions cover the Arkham-tracked wallets, PEP moved to other exchanges, balances replaced with IOU tokens (BTCXX/ETHXX/USDTXX), and whether volume was manipulated. **Not in the chat** The Telegram chat can't answer this. The main discussion runs from July 2019 to October 2021 and never mentions XeggeX. The author added a few short replies to old messages in February 2025 [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575) and comments in September 2026, and none of these mention XeggeX either. XeggeX collapsed in February 2025. What is public: Rekt News ("Plant a Red Flag", 5 Mar 2025) reported orderly outflows of USDC, USDT, ETH and BNB from XeggeX hot wallets on 2-3 Feb 2025, before the "hack" announcement, citing Bitrace and Arkham. It listed an ETH address, a TRON address and a Pepe wallet that stayed active. We could not check the raw transfers ourselves and did no on-chain tracing of our own. Reports say user BTC/ETH/USDT balances were swapped for IOU tokens (BTCXX/ETHXX/USDTXX). We found no source for the claim that these later lost more than 80%. The ~$80M and ~12,000-user figures were never audited. We found no source showing where the PEP ended up or that trading volume was faked. The critics are right that these assets have never been accounted for, and we found no public record of any court or authority tracing them. Nothing we reviewed links the author to these wallets, though we did not trace the wallets independently. By the author's account, backed by 2022 Wayback snapshots, Dokdo's planned purchase of XeggeX was announced publicly in 2022 and then cancelled. **Nayiem's note:** The author's account: Mike suggested that he and the author approach XeggeX's supposed owner, "Karl". The author then announced publicly that Dokdo would buy XeggeX; Wayback snapshots from 2022 show "a service of Dokdo Global". Around November 2022, the author concluded that Mike ran XeggeX himself and that "Karl" did not exist. He cancelled the deal, and the business relationship ended in late 2022. After that he stayed in contact with Mike only to get money back: the Solar funds, repaid in full by 19 March 2024, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck, which Mike never followed up on. He did not warn XeggeX users until February 2025. He admits this and says he expected people not to believe him. He says he had no role in XeggeX's wallets or its collapse. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1imsux4/_/mc5hyjx/): "End point for the recent XeggeX assets. This is just 1 wallet. (There are many)" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/_/mcp5enk/): "I think nayiem or whoever is running xeggex is transferring pep to other exchanges to sell." - [rekt.news](https://rekt.news/plant-a-red-flag) #### Why is Michael O'Sullivan the director of XeggeX Software Services? Why was it incorporated in 2023 when XeggeX launched in 2021, and dissolved on 31 December 2024, just before the collapse? **Partly answered** The Reddit commenters have the dates right. UK Companies House shows XEGGEX SOFTWARE SERVICES LTD (14910559) was incorporated on 2 Jun 2023 and dissolved by compulsory strike-off on 31 Dec 2024. Companies House usually strikes a company off like this for administrative reasons, such as not filing, and the register does not show that the dissolution was timed to the collapse. From incorporation until 1 Mar 2024 the register lists a director named "JOHN, Michael Osullivan", recorded as Polish and living in England. From 1 Mar 2024 it lists "OSULLIVAN, Michael John", recorded as a citizen of Vanuatu living in China, who was also registered as a person with significant control. A second company, XGX SOFTWARE LTD (15572800), was incorporated on 18 Mar 2024 and dissolved on 26 Aug 2025. It lists "OSULLIVAN, Michael John", recorded there as Ecuadorean, as director and secretary. When these companies were filed, Companies House did not verify identities. The register shows only what the filer declared, and the differing name orders, nationalities and birth months are unexplained. On timing: the xeggex.com domain was registered on 31 Aug 2021, so the UK company came about two years after the exchange launched. In 2022 the Xeggex website described the exchange as "a service of Dokdo Global, Dokdo, UAB". Dokdo was the author's company, during the planned acquisition described below. We found no public record of which legal entity, if any, operated Xeggex after that acquisition was dropped and before the UK company was formed. The chat cannot explain why the company was formed or dissolved, because it ends in 2021. It does show that the Altilly team member "Mike" used the name Michael Osullivan. A support ticket he posted opens "Hi Michael" [#3288](https://altillyfiles.com/chat#3288), and he shared a whitepaper cover signed "Michael Osullivan @MrMikeO" [#5529](https://altillyfiles.com/chat#5529). Separately, on 1 Apr 2024 the GitHub account mrmikeo, which was used for Altilly development, made a commit to Xeggex's official xeggex/hummingbot repository. It was a routine sync merge, but it required write access. This makes it likely, but does not prove, that the director listed on the register is the same person as Mike. Nothing in the public record we found shows that this person is Paul Vernon. **Nayiem's note:** The author's account: Mike proposed that they approach "Karl" together so that Dokdo could acquire Xeggex. Around Nov 2022, the author concluded that Mike was running Xeggex himself, that "Karl" never existed, and that Mike was Paul Vernon. The author then cancelled the Dokdo acquisition. The author admits they did not warn Xeggex users until Feb 2025. They say this was because they expected people not to believe them. They say that after the business relationship ended in late 2022, their only contact with him was about getting money back. All of this is the author's belief and has not been independently established. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/_/mbkz0z0/): "Xeggex dissolved on companies house December 31st 2024. ... This is the KO punch" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/_/mbl5n2t/): "The odd part is the incorporated date of 23 when Xeggex launched in 21." #### Does Nayiem own NonKYC, which shares XeggeX's codebase and design while denying any relationship? Did he personally delist PEP there after being insulted? **Not in the chat** The chat can't settle this. The Telegram group covers 2019 to 2021. It has only a few later messages, from 2025 [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575) and 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7598](https://altillyfiles.com/chat#7598), and none of them mention NonKYC, Pepecoin (PEP), a Discord insult or a delisting. Nothing in the chat or our analysis files shows who owns NonKYC, and nothing links Nayiem to it. We found no evidence either way, so we won't claim a denial or a confirmation. The only NonKYC item we found is a GitHub account called "NonKYCDev". On 22 Dec 2024 it synced one branch of Xeggex's public hummingbot fork (github.com/xeggex/hummingbot). Hummingbot is an open-source trading-bot framework, not the exchange's own code, and anyone can sync a public fork. So this doesn't show a shared exchange codebase. It also doesn't show who runs either exchange, and it doesn't point to Nayiem. We have no record of a PEP delisting or of who made that decision. The "called him fat, then he delisted" comment is an anonymous claim with nothing to back it up. We can't rule out the shared-codebase claim, but we have no evidence of our own for it. On ownership and the delisting, this question is still open. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/_/mcp6quh/): "Xeggex and noKyc are not related in any way... BUT they share the same codebase..." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1indj80/_/mcaz02j/): "making accusations that they are in on what happened to xeggex and that nayiem owns non kyc." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1indj80/_/mcalf8c/): "I called Nayiem fat in the Discord then he delisted Pepe." #### Is the XeggeX account-recovery effort run by Nayiem's team, with a Discord helper talking to 'Karl' and fake accounts claiming recoveries? Why was PEP refunded first, and was there a deal with the PEP side? **Not in the chat** The team chat runs from July 2019 to October 2021. Nayiem added a few notes to it later, in February 2025 and September 2026. We searched all of it, including those later notes, and found no messages about XeggeX, Dokdo, a 2025 recovery helper, "Karl" or a PEP refund. The only "pepe" hit is from November 2020, when Chuck says community members are unhappy about a third party [#975](https://altillyfiles.com/chat#975). It has nothing to do with PEP or XeggeX. The chat does not tell us who runs the recovery effort, whether the accounts claiming recoveries are fake, or whether there was a deal with the PEP side. We therefore make no claim either way. Outside the chat, the public record has one related detail. Rekt News ("Plant a Red Flag", 5 Mar 2025) reports that a XeggeX Pepe wallet stayed active after the halt. That alone does not show a deal. The critic is partly right on one point. XeggeX was publicly linked to Nayiem in 2022. Wayback snapshots from June to December 2022 show the site describing itself as "a service of Dokdo Global". Readers can reasonably take that to mean Dokdo operated XeggeX, or at least presented itself as the operator, during that period. Nayiem says the link came from a planned Dokdo acquisition that he later cancelled; see the author note. No independent source confirms or rules out that account. Whether "Karl" existed is still disputed, and no public source has settled it. **Nayiem's note:** This is Nayiem's account, and the chat does not cover it. He says Mike suggested they work on XeggeX together and approach "Karl", and Nayiem then announced that Dokdo would acquire XeggeX. Around November 2022, he says, he found out that Mike was running XeggeX himself and that "Karl" did not exist, and he cancelled the acquisition. He says he had no role in XeggeX after that, including the 2025 recovery effort. He admits he did not warn XeggeX users until February 2025, and gives his reasons in the story. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iudck5/_/me3s9im/): "Because [recovery helper] is Nayiem and team. There is no Karl." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ip0qha/_/mdbpev1/): "pepe is the only coin that gets refunded asap ... they made a deal with xeggex" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1iudck5/_/mdy1786/): "No one has recovered their accounts. Anyone claiming so in on the scam." #### Is Nayiem involved with Pepecoin (PEP)? Critics point to his closeness with the PEP developer and to solar.org and pepecoin.org sharing a layout and font. **Not in the chat** The evidence can't answer this either way. The chat is the Altilly management chat, mostly from 2019 to 2021, and it never mentions Pepecoin or its developer. The author added some annotations in 2025-2026, and those don't mention Pepecoin either. The only "pepe" in the chat, [#975](https://altillyfiles.com/chat#975), is a 2020 remark in a discussion about faucets, three years before Pepecoin launched. Pepecoin appears in the research files only as context. The research notes say Rekt News, citing Bitrace and Arkham, listed a Pepe wallet that stayed active among the addresses tied to the Xeggex collapse. Nothing we reviewed links Nayiem to PEP's development, funds or governance, and nothing we reviewed rules it out. The site-similarity argument is weak. Solar's site does use Nunito, but Nunito is a free Google Fonts typeface that many unrelated sites use, so a shared font says very little about who runs a project. We did not compare the two page layouts in detail, and a similar layout would be just as weak a signal. Contact or friendship with a developer is also not evidence of involvement. On the other hand, Nayiem has not given a full public account of how he relates to the PEP developer, so critics are right that a clear statement would help. The author's own account of how the contact started is below. **Nayiem's note:** The author's account: in February 2025, after the Xeggex halt, a member of the Pepecoin community invited him onto a livestream. He spoke for about two hours about what he knew from working with Mike at Altilly, and about why he suspected a link to the Cryptsy history. No authority has confirmed that suspicion. After that, community members and Xeggex victims contacted him. He describes his role as CEO of Solar Network. In the material reviewed, he does not claim any role in Pepecoin, and he does not address the font or layout point. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1im7z2r/): "[PEP dev] and Nayiem (obviously one of the masterminds behind the XeggeX scam) have now become best friends." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ilk5ol/): "www.solar.org looks similar to the pepecoin.org site. ... it's the same font (Nunito)." - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1inpr51/_/mchxdnw/): "Could Nayiem be involved w PEP as well?" #### Did XeggeX really go bankrupt, with no court or administrator named? How many users and how much money were affected (about 12k users, about $80M)? Will there be restitution, and should Nayiem pay it from his assets in Sweden? **The critic is partly right** The critic is right on the first point. On 27 Jun 2025 the Xeggex website said it was shutting down and "filing for bankruptcy" (Gate News, UAE Crypto Times). No court, case number or administrator has been made public, and no law-enforcement action against Xeggex has been reported. The figures of about 12,000 users and about $80M come from Xeggex or the press (Plisio). They were never audited, so treat them as claims. No restitution has been announced. The Change.org petition asks for one, and it names Telegram "MrMike_O" as business director, not Nayiem. No court, administrator or claims process has named Nayiem, so there is currently no basis for requiring him to pay from his own assets. This FAQ cannot decide whether he owes anything. That would be for a court or administrator to decide. The team chat's messages from the time run from 2019 to 2021, with a few later messages from 2025 and 2026, the 2026 ones being Nayiem's own notes. None of them mention Xeggex or Dokdo, so the chat can't settle this question. We found nothing public showing that Nayiem owned or controlled Xeggex or held its funds. There is counter-evidence the critic is right to raise: the Wayback Machine shows Xeggex was described as "a service of Dokdo Global" in 2022, and Nayiem had publicly announced a planned Dokdo acquisition. That association was public. **Nayiem's note:** This is the author's own account, not independently verified. Mike proposed working on Xeggex and approaching "Karl", and the author announced a planned Dokdo acquisition. Around Nov 2022 the author came to believe that Mike ran Xeggex himself, and the acquisition was cancelled. The author says he never ran Xeggex. He admits he did not warn Xeggex users for over two years. His reason: he expected people not to believe him. He says that after the business relationship ended in late 2022, his only contact with Mike was about getting money back. **Where this was asked:** - [gate.com](https://www.gate.com/news/detail/11806562) - [change.org](https://www.change.org/p/demand-for-immediate-investigation-and-restitution-for-victims-of-xeggex-crypto-exchange-18ba0d68-051a-44fe-ac1a-8cbbf631f582) - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1immi9m/_/mc3tkkn/): "nayiem has plenty of assets in sweden to refund everyone" #### Why did Dokdo UAB go into liquidation in July 2025? What happened to its EUR 125,000 capital, and why did it owe unpaid social-security (SODRA) contributions? **Not in the chat** The evidence we reviewed does not answer this question. The Altilly management chat covers 2019-2021. It never mentions Dokdo UAB, its liquidation, its EUR 125,000 capital or any SODRA debt. Our own chat assessment lists "Dokdo/Xeggex links" as "Not addressed (2022+)". None of our analysis files contains company-register records, financial statements or liquidation filings for Dokdo UAB. So we cannot say why the company was liquidated in July 2025, whether any of the capital was left, or why social-security contributions went unpaid. The Reddit poster asks whether any of the EUR 125,000 remained after the Xeggex "hack". Nothing we reviewed shows, or rules out, any movement of Dokdo capital into or out of Xeggex. The poster is right that this is unclear. It stays open until the author publishes Lithuanian register extracts, Dokdo's financial statements, the liquidation decision and the SODRA records. The public record does show a real link between Dokdo and Xeggex in 2022. An archived Xeggex notice posted by "Karl" says Xeggex would be acquired by Dokdo UAB. Wayback snapshots of the Xeggex site from 6 June 2022 and from September to December 2022 call it "a service of Dokdo Global". The author publicly announced the planned acquisition. A Reddit poster also says Dokdo's own website listed the Xeggex exchange and wallet as Dokdo products. We have not verified that independently. The author's earlier public line that he had "no connection" to Xeggex was therefore inaccurate. It is an interest he has to disclose. **Nayiem's note:** The author's account: Mike proposed working on Xeggex and introduced "Karl". The author announced that Dokdo would acquire Xeggex, on the condition that it was fully KYC/AML compliant. The author says they were refused access to the backend and wallets for an audit. They say they cancelled the acquisition around November 2022, and that on 3 December 2022 they agreed to remove the Dokdo references from Xeggex. The author has not explained the 2025 liquidation, the use of the EUR 125,000 capital or the SODRA arrears in the material we reviewed. These points should go to the author for a direct answer, with documents. **Where this was asked:** - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/): "It is unclear if any portion of the €125,000 commitment remained after the XeggeX 'hack'." #### Who revived the XeggeX domain in January 2026 and deleted the refund posts on 15 February 2026, and is AnonEx a re-rug built on XeggeX's code? **Not in the chat** The management chat cannot answer this. It covers the Altilly years, and nothing in it mentions AnonEx, Dokdo or the later history of the XeggeX domain. We do not know who revived xeggex.com in January 2026 or who deleted the refund posts on 15 February 2026. Several outside write-ups describe the January 2026 return: the Nerva project (an interested party), Plisio (https://plisio.net/profiles/xeggex-exchange) and, according to Plisio, the Quadriga Initiative. Plisio describes it as the same operator coming back with the same IOU tokens, but none of these sources names that operator. The 15 February deletion is reported by Nerva, and we could not confirm it independently. On AnonEx: community posts allege that it is a clone running on XeggeX's code, and AnonEx is said to have replied that it only bought the software. We could not verify either claim from a primary source. The domain anonex.io was created on 21 November 2025, and whois lists the registrant as Njalla, a privacy service, so the owner is hidden. The shared-code claim remains an unverified allegation. We are not saying AnonEx is a re-rug. On Dokdo, the critic is right about part of it. In 2022 the author publicly announced that Dokdo would acquire XeggeX, and Wayback snapshots show XeggeX as "a service of Dokdo Global". The author says the deal was cancelled around November 2022, when he came to believe that "Karl" did not exist. He admits that he then did not warn XeggeX users for more than two years. A Discord message of 30 November 2022 from the author to Mike, about the Solar SXP swaps described in [Solar's statement of that day](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png), reads "We are not going to say anything if you can return the funds in 24hrs." The author has made no claim about the 2026 domain revival or about AnonEx. **Nayiem's note:** Author's account: Mike proposed that they work on XeggeX together and approach its operator, "Karl". The author then publicly announced that Dokdo would acquire XeggeX in 2022. Around November 2022 the author came to believe that Mike ran XeggeX himself and that "Karl" did not exist, and the acquisition was cancelled. The author admits that he did not warn XeggeX users for more than two years. He says he expected people not to believe him, and that after the business relationship ended in late 2022 his only contact with Mike was about getting money back. He has made no claim about the 2026 domain revival or about AnonEx. **Where this was asked:** - [plisio.net](https://plisio.net/profiles/xeggex-exchange) #### Or is Nayiem a scapegoat with no XeggeX ties, who helped victims regain access? (Defence claim) **Partly answered** The management chat can't settle this. Its working messages stop in October 2021 [#7571](https://altillyfiles.com/chat#7571). The words "Xeggex", "Dokdo" and "Karl" never appear in it. Nothing in the chat or the other evidence we reviewed shows Nayiem helping Xeggex victims get back into their accounts, so that part of the defence has no support here. The claim that he had "no Xeggex ties" is not accurate. Nayiem publicly announced that his company Dokdo would acquire Xeggex. Wayback Machine snapshots from June to December 2022 (an external source, not part of the chat) describe Xeggex as "a service of Dokdo Global". That is a real link and should be disclosed as an interest. By his own account, Nayiem also did not warn Xeggex users until February 2025, after he says he learned in late 2022 who was behind it. The "scapegoat" point is not established. For Altilly, the chat shows that Nayiem expected to take the blame [#1570](https://altillyfiles.com/chat#1570) and that his business address was already public [#1579](https://altillyfiles.com/chat#1579). It also records his own statement that he never had access to certain servers because Mike did not allow it [#1492](https://altillyfiles.com/chat#1492)–[#1493](https://altillyfiles.com/chat#1493). That statement is his account, not independent proof, and elsewhere in the same discussion he says the team used some hosting daily [#1483](https://altillyfiles.com/chat#1483). Nayiem points to external public records (Companies House filings for Xeggex Software Services Ltd and a 2024 GitHub commit by the account mrmikeo to xeggex/hummingbot) as linking Xeggex to Mike. We have not verified those records against the chat. Even taken at face value, they would not show that Nayiem had no involvement at all. **Nayiem's note:** The author's account: Mike suggested working on Xeggex together and approaching "Karl", and the author announced the Dokdo acquisition. Around November 2022 the author says he learned that Mike was running Xeggex himself and that "Karl" did not exist, and the acquisition was cancelled. He admits he did not warn Xeggex users until February 2025. His reasons were that he expected not to be believed and that he feared for his family. He says that after the business relationship ended in late 2022, his only contact with Mike was about getting money back. He says he has had threats for years because people wrongly linked him to the Xeggex hack. **Where this was asked:** - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/) ### Solar #### Were layer-1 coins such as Solar (SXP), PYRK and SPX created as bait or honeypots for the operators' exchanges and then rug-pulled or abandoned? **Partly answered** The chat answers this only in part. It covers Altilly from 2019 to 2021. It says nothing about Solar (SXP), and SPX never appears in it. In the chat, the PYRK messages below come from an account shown as "Deleted Account". From context we believe this is Mike: Nayiem calls him "Mike" [#1751](https://altillyfiles.com/chat#1751), and Chuck tags @MrMike_O and gets replies from that account [#3947](https://altillyfiles.com/chat#3947), [#7095](https://altillyfiles.com/chat#7095), [#7096](https://altillyfiles.com/chat#7096). For PYRK, the chat shows a closer insider tie than an ordinary listing. Mike wrote that "around 2.8 million of the altilly pyrk is mine" [#1748](https://altillyfiles.com/chat#1748) and that a separate wallet "with 1.2m pyrk of mine … is gone" [#1745](https://altillyfiles.com/chat#1745). He also said "I don't remember anybody other than me having that much on the exchange" [#4807](https://altillyfiles.com/chat#4807). He and another contact seem to have run PYRK wallets and servers directly. Mike "moved some to a new address on pyrk" and heard from users about it [#2479](https://altillyfiles.com/chat#2479). Later he said "i need to go thru the pyrk ones, [the contact] had setup new stuff awhile back … just need to make sure i don't have any pyrk sitting on them" [#6056](https://altillyfiles.com/chat#6056), [#6057](https://altillyfiles.com/chat#6057). He planned "to offload pyrk" with that contact [#2482](https://altillyfiles.com/chat#2482). He then said he would "pull out my 2.8m pyrk from the wallet and leave the remaining user funds," out of 3.9m in total [#3175](https://altillyfiles.com/chat#3175), [#3176](https://altillyfiles.com/chat#3176). When Chuck later asked how much was in the PYRK wallet [#7095](https://altillyfiles.com/chat#7095), Mike replied: "if you have a claim, let me know, i had moved those to community fund wallet awhile back" [#7096](https://altillyfiles.com/chat#7096). PYRK users did go through the refund process [#3947](https://altillyfiles.com/chat#3947), [#4005](https://altillyfiles.com/chat#4005), but the chat records no PYRK payout, and the user funds sat in a wallet Mike controlled and had moved himself [#2479](https://altillyfiles.com/chat#2479), [#7096](https://altillyfiles.com/chat#7096). Nayiem says Mike never completed the PYRK refund. So the Reddit and Kaspa commenters have a point that PYRK was closely tied to the exchange's operators. However, nothing in the chat shows who created PYRK, and nothing shows it was designed as bait or deliberately rugged. The chat says nothing about Solar at all. Disclosure: Solar (SXP) was the author's own project. Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png) says that 1,878,477 SXP was fraudulently swapped between 12 August and 29 November 2022 through unauthorised BEP20->SXP swaps, and that "The identity of the perpetrator is known". It does not name anyone; the author's claim that it was Mike rests on his Discord screenshots. The author says the incident ended their business relationship in late 2022, and that Mike later paid all of it back (by 19 March 2024). The chat does not cover any of this, and the identity and repayment have not been checked independently. **Nayiem's note:** The author's account: Solar (SXP) was the author's own project and was ranked in the top 200 on CoinMarketCap. Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png) says 1,878,477 SXP was fraudulently swapped between 12 August and 29 November 2022 and that the perpetrator's identity was known; it does not name him. That it was Mike comes from the author's Discord screenshots. The author says the incident ended their business relationship in late 2022, and that Mike eventually paid all of it back (by 19 March 2024). The group chat does not cover any of this, and it has not been checked independently. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/_/mbkrq1m/): "layer 1 POW coin and honeypotfor their scam exchange" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ika2yt/_/mbkt089/): "spx, pyrk - those were layer 1 pow coins which were meant to be traded there, and they rug pulled." - [Reddit, r/kaspa](https://old.reddit.com/r/kaspa/comments/11mjzyk/_/jbo7ng1/): "they created PYRK as part of that exchange ... but now they abandoned it." #### Are 'Solar Enterprises' and the 'Solar Blockchain Foundation' registered anywhere, or are they brands used to obscure the Dokdo-XeggeX link? Is the SXP ticker (shared with Swipe) misleading, and why did SXP fall 86% after its XeggeX listing? **Not in the chat** The Altilly management chat can't answer this. The Solar and SXP events are from 2022 onward, and the chat never covers them. The word "solar" appears once, in an unrelated 2021 remark about batteries [#6392](https://altillyfiles.com/chat#6392). The chat never mentions XeggeX, Dokdo, SXP or Swipe. On registration: the critic says "Solar Enterprises" was an unregistered trading brand of Dokdo UAB, a Lithuanian company (registration code 306099775) that has since been liquidated. The critic also says it is not a registered Wyoming entity and that there is no record of a "Solar Blockchain Foundation". We found no registration under either name, but we did not search every registry, so the critic's point stands unrebutted. The UK Companies House record we reviewed lists the author as a director of a different company, Solar Network Finance Ltd (15377536), incorporated 31 Dec 2023. On the Dokdo-XeggeX link, the public record goes beyond a plan to acquire. In archived 2022 snapshots, the XeggeX footer read "A product of Dokdo Global". The XeggeX about page said it was "a service of Dokdo Global, Dokdo, UAB". The Dokdo site listed XeggeX Exchange and Wallet among "Our Products". SXP was listed on XeggeX on 10 April 2022, while the Dokdo acquisition was being arranged; the earliest archived Dokdo branding we cite is from 6 June 2022. Readers should treat that as a real conflict of interest. That record also sits badly with later statements that the author "was never involved" with XeggeX and had "no connection" with its operator. Our evidence doesn't cover the SXP ticker being shared with Swipe or the 86% price drop. We can't confirm or explain either. Readers should check the listing and price data themselves on public market trackers. **Nayiem's note:** The author gives this account: Solar (SXP) was a legitimate project ranked in CoinMarketCap's top 200. Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png) says 1,878,477 SXP was fraudulently swapped between 12 August and 29 November 2022 and that the perpetrator's identity was known, without naming anyone. By the author's account, based on his Discord screenshots, the perpetrator was "Mike", who eventually paid all of it back. The author says that at around the same time they learned Mike was running XeggeX himself. After that they cancelled the Dokdo acquisition of XeggeX and ended the business relationship. This is the author's own claim. The chat doesn't corroborate it, and it doesn't address how the brands were registered, the ticker, or the price fall. **Where this was asked:** - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/): "Dokdo UAB operated under the unregistered brand SOLAR ENTERPRISES, allegedly as a means to obscure its connection to XeggeX." - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/): "No registration was found for the 'Solar Blockchain Foundation'" - [Reddit, r/XeggeX_Victims](https://old.reddit.com/r/XeggeX_Victims/comments/1lx6xie/): "Having the same ticker as Swipe (SXP) could be consired misleading ... (-86%)" #### What happened in the November 2022 Solar incident (1,878,477 SXP in unauthorised swaps)? Why was the known perpetrator not named, why did Nayiem offer silence in exchange for repayment, and was the roughly $400K returned the full amount? **The critic is partly right** The management chat does not cover this. Work discussion in the chat stops in September–October 2021 [#7560](https://altillyfiles.com/chat#7560)–[#7571](https://altillyfiles.com/chat#7571). After that the chat has nothing until February 2025, apart from a few short messages [#7572](https://altillyfiles.com/chat#7572)–[#7575](https://altillyfiles.com/chat#7575), and then comments the author added in September 2026 [#7576](https://altillyfiles.com/chat#7576)–[#7598](https://altillyfiles.com/chat#7598). No message in any period mentions Solar, SXP or the 2022 swaps, so none of what follows can be confirmed from the chat. What the documents show: Solar's [statement of 30 November 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png), titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS", says that on 29 November 2022 "a series of unauthorised swap transactions were detected which took place between 12th August 2022 and 29th November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins", and that "In total, 1,878,477 SXP was fraudulently swapped during this time resulting from a vulnerability detected in the BSC nodes used to provide API data to the swap service." It says this "was not due to a hack or breach of security of the Solar mainnet or Solar Core", that "user funds were never at risk", that no new SXP coins were created, and that "no funds were lost". On naming, it says only: "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." It does not name Mike or anyone else. Mike's identity as the perpetrator comes from the author's Discord screenshots, not from the statement. The author's 2025 PDF (pp.13-16) includes them: - 29 Nov 2022, 22:45, the author: "Why did you do it Mike?" - 30 Nov 2022, 00:17, the author: "We are not going to say anything if you can return the funds in 24hrs." - 30 Nov 2022, 05:43, MikeO: "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." - 3 Dec 2022, MikeO: "I had nothing to do with the altilly hack." The PDF's own text puts the deal plainly: "If you don't pay back what you took or stick to the deal, I will expose everything." The critic is right on several points: - The author did offer silence in exchange for repayment, and that put recovering the money ahead of warning the public, including Xeggex users. - The repayment did not happen in 24 hours. The 2025 PDF had a heading dated March 2024 saying Mike paid back "(Part of)" the funds, and put the amount at about $400K. The author's account now is that Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft: the last of it about 16 months after the incident. - The PDF did not itself say the $400K related to Solar. That link, and the [Solar repayment ledger](https://altillyfiles.com/story#after-altilly), come from the author's own records. - Transaction IDs have been published only for the final five payments (18-19 March 2024, 1,300,000 SXP), which can be checked on the Solar blockchain. The first seven payments (578,477 SXP) have no published IDs, and a transaction alone does not show who sent it. - A screenshot in the same PDF dated 3 December 2022, as we read it, shows Mike asking "should I start removing references to Dokdo on Xeggex?" and the author replying "Yes, please". So the two were still in contact about Xeggex days after the incident. **Nayiem's note:** The author's account: the goal was to get Solar's money back. By the author's account, Mike repaid the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. The final payments can be checked on the Solar blockchain (see the [Solar repayment ledger](https://altillyfiles.com/story#after-altilly)). The money was for the Solar incident, not for Altilly. By the author's reading, the transactions pointed to Mike. The business relationship ended in late 2022, and the author no longer trusted him. After that, the author stayed in contact with Mike only to get money back: first the Solar funds, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck, which Mike never followed up on. The author did not name him publicly because they had no proof that he ran Xeggex, were afraid of him, and did not want Solar, a legitimate top-200 project, linked to him. The author admits this meant Xeggex users were not warned. **Where this was asked:** - [Solar Network statement, 30 Nov 2022](https://altillyfiles.com/evidence/solar-statement-2022-11-30.png): "the identity of the perpetrator is known" - Nayiem's Follow-Up PDF (Feb 2025), pp.15-16 #### Why did Nayiem resign from Solar in November 2025, citing 'reputational issues and past decisions that weren't ours'? **Not in the chat** The published chat and our analysis files can't answer this. The Telegram chat covers the Altilly management group, mostly 2019–2021. It also has a few short replies from February 2025 and a set of annotations Nayiem added in late September 2026 before publishing the chat on this site. None of it discusses Solar. The only message containing the word "solar" is an unrelated 2021 remark about batteries [#6392](https://altillyfiles.com/chat#6392). The quoted wording comes from Nayiem's own resignation statement, published on Solar's blog on 28 November 2025. It says he ran into "barriers shaped by reputational issues and past decisions that weren't ours" while working on the card product, and it mentions "rigid, non-negotiable conditions" in the environment around the project. It doesn't say what those reputational issues or past decisions were, and it names neither Altilly nor any individual. Because these are Nayiem's own words, only he can say what they refer to, and nothing in our sources explains them. We won't guess. The one other Solar event our records document that could be relevant is the November 2022 incident. Solar's notice of 30 November 2022 said 1,878,477 SXP had been fraudulently swapped through unauthorised BEP20->SXP swaps between 12 August and 29 November 2022 and that "the identity of the perpetrator is known", without naming anyone. No evidence here shows whether that incident, the Altilly history or the later threats played any part in the 2025 resignation. Readers should treat any link between them as unconfirmed. **Nayiem's note:** The author's account: the resignation statement is about Solar's own history, not Altilly. SXP began as the token of Swipe, a crypto wallet and Visa debit-card company that Binance acquired in 2020; Solar later inherited that legacy, including a token-swap agreement with Binance and the card product. The "reputational issues and past decisions that weren't ours" refer to that Swipe/Binance-era baggage, which he says limited what Solar's card product could do. The full record is published by the Solar Foundation: its [history](https://nayiemw.github.io/solar-foundation-website/history/), the [Binance token-swap agreement](https://nayiemw.github.io/solar-foundation-website/agreement/) and an [archived copy of the resignation statement](https://nayiemw.github.io/solar-foundation-website/archive/resignation-statement-nayiem-w/). Separately, he says that after the November 2022 SXP incident Mike paid back the full 1,878,477 SXP by 19 March 2024; the final payments are listed with transaction IDs on [My story](https://altillyfiles.com/story#after-altilly). **Where this was asked:** - [blog.solar.org](https://blog.solar.org/resignation-statement-nayiem-w/): "I ran into barriers shaped by reputational issues and past decisions that weren't ours." ### Other #### Is Altilly still operating, and is altilly.net (which appeared in 2023 promising repayment and then shut down) connected to the original team? **Not in the chat** The chat can answer the first part but not the second. It does not show Altilly trading again after the December 2020 incident. In May and June 2021 the team worked on a successor brand, Altfenix. altfenix.com had a demo page, and Altfenix pages were posted on qredit.io [#5771](https://altillyfiles.com/chat#5771), [#5909](https://altillyfiles.com/chat#5909), [#6864](https://altillyfiles.com/chat#6864). In June 2021 they talked about "reopen altilly / but make it Altfenix", with unpaid claims issued as tokens and the old domain possibly redirected [#6608](https://altillyfiles.com/chat#6608)–[#6611](https://altillyfiles.com/chat#6611), [#6657](https://altillyfiles.com/chat#6657)–[#6661](https://altillyfiles.com/chat#6661). In September 2021 the stated plan was still that Altfenix would go live within a few weeks [#7428](https://altillyfiles.com/chat#7428). The chat never shows Altfenix, or any of those claim tokens, running as a live exchange. In September 2026 Nayiem announced a plan to make the group public and read-only [#7579](https://altillyfiles.com/chat#7579). In the end the group itself stays private; the redacted chat is published on this site instead, and the unredacted chat is available to law enforcement on request. Nothing in the chat shows Altilly still operating as an exchange. altilly.net is never mentioned in the chat. What we have comes only from Reddit. In July 2023 a subreddit, r/Altilly_Exchange, carried posts promoting "Altilly.net", with titles such as "Payment received" and "Thanks you altilly for reactivating my account". Most of them came from a single account. In February 2025 one Reddit user suggested the site "might be a replica", since the original was altilly.com. In July 2025 a user posted near-identical comments in several subreddits saying altilly.net had shut down. None of this shows who ran altilly.net. We found no evidence that connects it to the original Altilly team or to anyone from it. We also have no evidence that rules such a connection out. Treat it as unverified. On the altilly.com domain: a first-hand account says it was handed over through Namecheap in December 2022. Our check could not confirm this, so the claim stays unverified. **Nayiem's note:** In the author's own account, refunds mostly stopped around 2022/2023, with only a handful after that. The author says unpaid claims can no longer be reliably verified, because many chains are dead and the database is lost, and makes no promise of repayment. The author does not mention altilly.net in any of the statements we hold. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikb3ia/_/mbl1cvs/): "isn't Altilly Exchange still around? Did they scam and still continue?" - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ik58q6/_/n5e85ja/): "Altilly.net, you didn't just shut down your site, you shut down the hope of thousands." #### Why was the team paying off debts instead of restarting the exchange? Will Altilly ever resume? **Partly answered** The quote came from someone in the main group, and Chuck relayed it without naming the writer [#2999](https://altillyfiles.com/chat#2999)–[#3005](https://altillyfiles.com/chat#3005). The team itself was not sure what the writer meant [#3001](https://altillyfiles.com/chat#3001)–[#3004](https://altillyfiles.com/chat#3004). The "debt" most likely means what Altilly owed its users. About USD 1M was lost, and Nayiem expected the real figure to be higher [#1677](https://altillyfiles.com/chat#1677). The BTC, ETH, DASH and DOGE hot wallets were gone, though the ERC-20 tokens were still there [#4094](https://altillyfiles.com/chat#4094)–[#4096](https://altillyfiles.com/chat#4096). The developer said the database and the config files needed to decrypt it were missing [#1352](https://altillyfiles.com/chat#1352)–[#1353](https://altillyfiles.com/chat#1353). By May 2021 only the source code survived, with "No database" [#5309](https://altillyfiles.com/chat#5309)–[#5310](https://altillyfiles.com/chat#5310). So there were no reliable balances left to restart from. Restarting was discussed. On 5 Jan 2021 Nayiem wrote that people "really want the exchange back. Even though I don't want it." He floated a different model instead: a swap feature inside Qredit Motion where users keep their own keys and the team never holds funds [#2608](https://altillyfiles.com/chat#2608)–[#2611](https://altillyfiles.com/chat#2611). The developer (shown in the export as a deleted account, taken to be Mike) replied that any new version "would have to be a completely walletless system" [#2612](https://altillyfiles.com/chat#2612). By June 2021 the plan was to "reopen altilly, but make it Altfenix" [#6608](https://altillyfiles.com/chat#6608)–[#6610](https://altillyfiles.com/chat#6610). Unpaid claims would be issued as tokens that holders could trade or redeem [#6657](https://altillyfiles.com/chat#6657)–[#6660](https://altillyfiles.com/chat#6660). A plan posted on 10 Sep 2021 gave about 2 weeks of Qredit Motion work first, then "3 to 4 weeks to go live with Altfenix" [#7428](https://altillyfiles.com/chat#7428). The chat never shows it launching. There is no sign that Altilly will resume. The team's own records show the strain. In September 2021 Chuck, who handled refunds, told Mike that pending refunds had to go out "before pushing anything else", because "Weve made alot of promises we are not keeping" and users were "Losing trust" [#7421](https://altillyfiles.com/chat#7421). In the same month a user threatened a lawyer over lost DOGE [#7399](https://altillyfiles.com/chat#7399). **Nayiem's note:** In the author's own account, refunds stopped around 2022/2023, with only a handful after that. He puts the remaining unverifiable claims at around $50,000–60,000, and makes no promise about them. Altilly was never registered as a company. The author says he lost the energy to continue once he came to believe who "Mike" really was. That is his belief, not an established fact. **Where this was asked:** - Chat [#2999](https://altillyfiles.com/chat#2999)–[#3005](https://altillyfiles.com/chat#3005) (forwarded from main group): "Altilly should find a way to recover. But no, they're trying to pay off the debt" - Chat [#6653](https://altillyfiles.com/chat#6653), [#6655](https://altillyfiles.com/chat#6655) (forwarded): "Hello is there any possible exchange will resume again..?" #### Why would an operator rob a profitable exchange? **Partly answered** The chat does not show that Altilly was profitable, but it does not prove the opposite either. In July 2019, 17 months before the loss, Mike said "we are too small to worry about audits yet" and "too small to even start moving to safe storage" [#215](https://altillyfiles.com/chat#215)–[#216](https://altillyfiles.com/chat#216). He expected audits to become relevant "probably 2020" [#219](https://altillyfiles.com/chat#219)–[#220](https://altillyfiles.com/chat#220). When Nayiem asked how much of the 31 lost BTC was the team's own [#1662](https://altillyfiles.com/chat#1662), Mike answered "i think around 0.8 was mine. Can't remember exactly what i had. exchange fees, not much" [#1663](https://altillyfiles.com/chat#1663). That is Mike's own rough estimate, not an accounting record. Days after the loss he said that only the week before he had expected the exchange to start bringing in income "soon finally" [#1901](https://altillyfiles.com/chat#1901)–[#1902](https://altillyfiles.com/chat#1902). We found no mention in the chat of anyone drawing a salary or profit payout from Altilly. That is an absence in this record, not proof that none existed. Against that, the exchange did charge listing fees, which Nayiem helped set [#178](https://altillyfiles.com/chat#178), [#771](https://altillyfiles.com/chat#771), and it had trading volume [#786](https://altillyfiles.com/chat#786). So it had some revenue. Nayiem estimated the loss at "1mln" [#1677](https://altillyfiles.com/chat#1677), and nothing in the chat suggests fee income anywhere near that size. The critic has a fair general point. Whether the exchange was profitable or not does not rule out insider theft. Small fee income next to a large hot wallet makes the question sharper, not weaker. The chat still does not show who took the funds or why. Mike reported an outside attack at the time: the messages at [#1033](https://altillyfiles.com/chat#1033)–[#1034](https://altillyfiles.com/chat#1034) appear under Chuck's name but are forwarded from Mike, sent on 23 Dec. An inside job is not established. **Nayiem's note:** The author's account: Nayiem says he never earned from Altilly and never drew a salary, that all listing and trading fees went to Mike, and that pay was meant to start after he formally acquired the exchange. The chat does not discuss that arrangement. The author believes the loss was an inside job by a developer. The chat does not establish this. **Where this was asked:** - [Reddit, r/pepecoin](https://old.reddit.com/r/pepecoin/comments/1ikt45d/_/mbp3f6w/): "Altilly was also profitable. But the answer is 'greed'."