[possible scam] UniJoin.io

[jessuni]

Original post here:
https://www.altcoinstalks.com/index.php?topic=314441.msg1497686#msg1497686

I will duplicate and supplement it and also answer some questions.

• I've been making a number of mixes on this service for about 1 week or longer
• First of course I checked their public key but then I stopped looking at the key as the whole series of mixes completed successfully and all this happened in one session in the Tor browser
• I didn't see my btc after the last mix
• I updated the order page. The order was deleted (before that it was successfully displayed)
• I tried to find support contacts. The only way to communicate is chat. To contact them regarding mix issue you need to upload a letter of guarantee. My last letter did not pass their verification.
• I started checking all letters. Early letters had the correct key which is listed on their website. The last 3 letters already had a different key. That is 2 mixes with a fake key completed successfully and on the third mix with a fake key I did not see my mixed btc.
• I created test mix. The key for it was already correct. Let me remind you that I did not leave their service during this entire time; all this happened during one browser session.
• I tried contacting support in their chat for general issues that do not require a letter of guarantee.

Clarifications to the original post:

• I edited the mix amount because it's quite large and I think it's easy to track. It's not even 10 or 15 btc. In any case I gave the original address in the support chat. I don't think anyone other than chat support should deal with this address. I also indicated a + sign at the end of the amount. This means that the amount can be any higher than this value.
• I provided them with Letters of Guarantee in the form of a link to the well-known and legitimate service privnote.com because their chat prohibits the use of special characters like # ' " ? etc and also does not allow you to write messages longer than 1000 characters.
• I wrote that I did not demand a refund only after they refused to do anything. I thought it would motivate them to do something to solve the problem. Obviously this was actually a failed attempt. Also this phrase caused a wave of skepticism on the forum so I showed the seriousness of the situation by making a donation to the official forum wallet.

There is always the option of replacing the final Tor node by some attackers but if we follow the principle of Occam's razor then the easiest way to do this is (as the owner of such a service) to simply appropriate the client's money. I think this is the most realistic option if the sum has 6 zeros even if your service has been operating since 2022. Let me also remind you that they do not have an official representative on the forum. The only real way to communicate is chat. This opens up endless ways to cheat.


My original post:

Key points:

• I did not leave the correct URL unijoinxaogdzmk3bonngoxxoaezkmsfdyrtfyximisungh2dnc2azad [.] onion
• A series of successful mixes were carried out
• At some point they changed their public key
• There were 2 successful mixes with a fake public key
• In the third mix with a fake key they simply stole my btc and deleted the orderId
• And again I did not leave the correct URL, all this happened during the same browser session
• After the money was not returned I created a test mix where their key was already correct.

Hello! Is it your actual pgp key?
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA32xvTO+18asPUzbekm6r
6a8oSsu5Wsw9+yoU1XAWYxvZEhXKZ1XpRXF9pRdMzLQJb3RLVtt/3Fok9CBmtwHW
CDRjv9YQ1txpcVMBqQg3xokzRscL/XFfWWLKpvBa8XkBJjzcfIvD+IXo3qtvsFwR
HpwmLP3ARL0AAxqG2iJLdeQNBzmawpOHE00VKHR4QnYGkWKTYimE7IosaKyMbJnZ
pHWlQspkGS8BbKqz6NY5tbUAuwt3fc7CQAGMQ4cZuo1OSjzPAwuB6Q2Np71JmUAJ
+a+r9NvCn/rVGCwyl4f4kV+tIS4bzW9Zw1qyiQFeHMZa59TrweGakAnDBQRsq3xm
HjT5VoLooHIE3lRPbqQg4B6538pOgQYc6axYHN2w7aUWpnej1+Xm6wmPztrIXKbK
lKwj1QfV1nKAcS1piPHF4usr2Z1en8lkFHKngSPDbnHtLTnF8SZXv7M4c1iWCthW
Wa1365nCfdYlqh9QeZyvRj1Sey2K0scMl0YI8JuhiWFw1gJQgRpFDNnv/6M8ZvBq
WCZFfvox8l1ccBUZCyfyxrqKcv6MRR4uyywatS9yWtzZwqZ+d2SH3I9i+eOnsxtn
Ru0IJOKNkJCwqmY2mbDLLnv1bA6tkZrrdx/31zAgmCdig5mELzl59Ye5q7SPzBzJ
9W4JvrOsuVJKZnPO8K9CtCUCAwEAAQ==
-----END PUBLIC KEY-----

Support Agent, 4 days ago
Hello *, Thank you for your contact request. A member of the support team will deal with your request as soon as possible. You should receive an answer within the next 24 hours. Thank you for using our service.

You, 4 days ago
Either I was scammed or you replaced the key

You, 4 days ago
order key *, deposit address *, still didnt receive my btc and the letter of guarantee cannot pass verification

Support Agent, 3 days ago
you can find the key in the footer of the page, it does never change

Support Agent, 3 days ago
unijoinxaogdzmk3bonngoxxoaezkmsfdyrtfyximisungh2dnc2azad [.] onion/en/download-public-key

Support Agent, 3 days ago
unijoin [.] io/en/download-public-key

Support Agent, 3 days ago
The above key is not the same as our official PGP. The PGP does not change and is also in public places stored to ensure that it is always the same.

Support Agent, 3 days ago
If the system does not accept the letter of guarantee then there is something wrong with the PGP or the format of the file.

You, 3 days ago
How could the key be replaced? I am 1000% sure that the site address was correct since I did not leave it after previous successful mixes.

You, 3 days ago
Could you still check if order * was in your system?

You, 3 days ago
I did several mixes. Checked them: ... correct key, success - correct key, success - fake key, success - fake key, success - fake key, not success - and now again correct key. I did not leave your correct site address during all the mixes.

You, 3 days ago
for example succesful order with fake key - *

You, 3 days ago
and successful order with correct key - *

You, 3 days ago
I havent left unijoinxaogdzmk3bonngoxxoaezkmsfdyrtfyximisungh2dnc2azad [.] onion in between

You, 3 days ago
Could your site have been hacked?

Support Agent, 3 days ago
We would really like to check the past orders for you. But we keep order information inside the system only as long as needed. If an order is completed then we will remove all information from the database which were needed to complete the order. Then there is only one way to check the order with the letter itself.

Support Agent, 3 days ago
The PGP key is for all users the same and for all orders the same since it is also uploaded on the project itself. There is no option that someone has changed the order for you since the letter will be required for that.

Support Agent, 3 days ago
Have you maybe used two different coinjoin websites to complete the orders? Does someone has access to your machine? Have you been on a pishing site? Lately there are a lot of unreal fake duplication of UniJoin. But even when customer encounter issues with a phishing site we have never encountered that kind of issue and the servers did not had any maintenance or attack.

You, 3 days ago
No. Always had the correct web address. I repeat that I did not leave your web address, and there were several successful mixes before. Also, there are no infections or access to my machine, otherwise the rest of my funds would be lost. Im not asking you to return the money, but would you like to at least try to understand what happened. In fact, the user created an order on your mixer, the mixers web address was correct, not phishing, your system generated a letter of guarantee, then the money did not arrive to the user, and the user saw that the letter generated by your mixer contained a different key.

You, 3 days ago
privnote [.] com/* - Letter of guarantee with fake key

You, 3 days ago
and more - Letter of Guarantee with fake key and SUCCESSFUL previous mix generated by your mixer - privnote [.] com/*

You, 3 days ago
In the previous successful mix with a fake key, the amount was even greater than in the unsuccessful one. It is very strange

You, 3 days ago
Maybe you have some kind of insider who based on my member code decided to steal this money?

Support Agent, 3 days ago
The way how you describe the process is very strange especially since you had several exchanges done. We also try to protect our self and the access to the funds is limits by people who are responsible for the uptime of the system itself. The member code itself is only used to assign you to a different mixing pool every order. Also we are always trying to verify what the customer says since we had frequent issues about people who sent coins to phishing websites and then contact our support to ask why the order did not pass although it did not took place on our website. We are not allowed to open only links outside of this chat for security reasons therefore I can not open your links to privnote [.] com

Support Agent, 3 days ago
Also you say that you have tested and created an order and that the key is really the correct key of the official page. That makes me wonder in which area the mistake happened and from which side.

Support Agent, 3 days ago
Since this never happened before we would just make sure to have an eye on that, if there is any other customer in the future reporting the same or a similar issue. You really need to make sure that the order is places on the official website / onion and that you download the letter of guarantee. Expert users then even compare the PGP to see if the value is correct or they were imposed. It can also be possible that someone inside the local network has reserved the hostname locally and you never request a domain outside the network.

Support Agent, 3 days ago
Feel free to ask us any questions at any time. In case there is anything I can help you with, just let me know. Also if there is any pending order in the future we could then check it real time if you put the waiting time high enough. It is also recommended to have a high waiting time for mixing orders with greater amounts, since the coins will be mixed in a better way when you leave them for a longer time in the conjoins. In any way if there is a pending order we can check in real time if everything is correct as it should be. But it is always expect when the system is in maintenance.

[jessuni]

Btw if your client claims such a situation and if you yourself are a legitimate service then can you assume that your servers has been hacked and investigate (logs, timestamps etc)? But this is only if you don't get the client’s money yourself 

[icopress]

Especially since I have 2 letters of guarantee that I downloaded over the last week (accordingly, I used UniJoin twice). And all the information, including the key, matches what is indicated on the site.

Moreover, I know for a fact that over the last year UniJoin has spent six figures on advertising, so what you are talking about makes no sense. In any case, I notified UniJoin.

[jessuni]

Especially since I have 2 letters of guarantee that I downloaded over the last week (accordingly, I used UniJoin twice). And all the information, including the key, matches what is indicated on the site.

Moreover, I know for a fact that over the last year UniJoin has spent six figures on advertising, so what you are talking about makes no sense. In any case, I notified UniJoin.

I also have their letters of guarantee with correct key that were received during the same session as the letter with fake key. This proves absolutely nothing. If you have access to the server you can do absolutely anything. You can give the client any letters and addresses by tracking him by mixId.

Is it also possible that their "six-figures" advertising costs did not pay off and they decided to recoup their costs this way?

In any case thank you!

[jessuni]

I checked now. My btc lay untouched at the deposit address for 3 days. The first movements on the deposit address began on February 12, the same time when I finished the chat correspondence and when they thought that I was not going to do anything. Quite a strange coincidence.

[dkbit98]

I checked now. My btc lay untouched at the deposit address for 3 days. The first movements on the deposit address began on February 12, the same time when I finished the chat correspondence and when they thought that I was not going to do anything. Quite a strange coincidence.

What is so strange about that and why would you think unijoin wants to have customers that won't do anything if they don't receive mixed coins back?
Your statement sounds a bit silly to me, and I am sure everyone would complain if they don't receive their coins.
I want to see some proof from both sides, and so far I didn't see anything, no addresses, no screenshots, just some text and pgp key (same for everyone).

[jessuni]

What is so strange about that

It is strange and suspicious that the time of the beginning of the movement of funds coincided with the end of the correspondence in chat

and why would you think unijoin wants to have customers that won't do anything if they don't receive mixed coins back?

It’s obvious if you planned a scam exit imo

Your statement sounds a bit silly to me, and I am sure everyone would complain if they don't receive their coins.

If you set everything up exactly as described in my situation (a series of successful mixes, then substitution of the key and address, then returning the correct key) then the client will not have any evidence, and you can safely ignore any complaints from the client. UniJoin can calmly answer any person that he fell for phishing and that everything is OK on their part and this person simply cannot appeal to this argument.

I want to see some proof from both sides, and so far I didn't see anything, no addresses, no screenshots, just some text and pgp key (same for everyone).

I cannot be sure that you or anyone else who sees the correct addresses and amounts in the public domain is not a bad guy. Why else would I use a mixer? I want to remain anonymous and get the real attention of the mixer owners. I don't want to receive stupid answers in chat because I'm absolutely sure that I didn't fall for phishing. You just have to believe or not believe me. It is your right.

[arabspaceship123]

It’s obvious if you planned a scam exit imo

icopress said they've spent six figures on ads that isn't done by companies planning a scam exit. I've known UniJoin from sig campaigns before I've teleported they aren't scammers. They've always had a good rep.

You just have to believe or not believe me. It is your right.

UniJoin don't operate like they've planned a scam exit so there aren't reasons to stop trusting them.

[jessuni]

icopress said they've spent six figures on ads that isn't done by companies planning a scam exit. I've known UniJoin from sig campaigns before I've teleported they aren't scammers. They've always had a good rep.

This says absolutely nothing and proves nothing. Everyone may face unexpected problems in life due to which they may make bad decisions.

UniJoin don't operate like they've planned a scam exit so there aren't reasons to stop trusting them.

Then how exactly do you think what happened can be explained? Hackers attack? Insider? Replacing the final Tor node?

It's your own business - trust or not trust them. But now you and other users are warned that you can easily lose your money using this service.

[dkbit98]

I don't want to receive stupid answers in chat because I'm absolutely sure that I didn't fall for phishing. You just have to believe or not believe me. It is your right.

You don't have to answer anything and you clearly have enough money to buy stuff, so I could speculate that you are maybe coming from some competition mixer or maybe you are the fed.
I didn't saw a single proof so yeah, I have the full right not to believe in anything I read until I see something.
Cheers.

[Cantsay]

Let me also remind you that they do not have an official representative on the forum. The only real way to communicate is chat. This opens up endless ways to cheat.[/i][/b][/u]

If you think they didn`t create an account here because they want to scam users, then go to bitcointalk and see their account there -- Bitcointalk have a larger member and also more exposure compared to altcointalk yet they were super active and interacted with those in need of their help.

Dude, show us something useful, the wall of texts you keep spreading proves nothing.

[paid2]

You don't have to answer anything and you clearly have enough money to buy stuff, so I could speculate that you are maybe coming from some competition mixer or maybe you are the fed.
I didn't saw a single proof so yeah, I have the full right not to believe in anything I read until I see something.
Cheers.

100%

I bet that we are with someone from another mixing service who is willing to pay to harm Unijoin's reputation.

I used Unijoin multiple times this week again, and I still never had any issue with it. I guess that some amounts I mixed would have attracted some "exit scammers", and I still received my funds as usual.

So OPs wall of text means nothing to me right now.

[Papusha20]

Unijoin I use the mixer regularly but haven't encountered any problems yet. But here mentioned the problem but without proper evidence the problem cannot be confirmed. And attacking without proper information is also not a right decision, I think proper evidence needs to be presented.

[bitmover]

Let me also remind you that they do not have an official representative on the forum. The only real way to communicate is chat. This opens up endless ways to cheat.[/i][/b][/u]

As there isn't a representative in btt as well, this is indeed a problem.

I believe all mixers should create an ANN in this forum, as they were banned in BTT.
Thankfully icopress contacted them, but public discussions are better in most cases imo.

[Don Pedro Dinero]

I used Unijoin multiple times this week again, and I still never had any issue with it. I guess that some amounts I mixed would have attracted some "exit scammers", and I still received my funds as usual.

Unijoin I use the mixer regularly but haven't encountered any problems yet.

I have also used it without any problems so far but someone could argue that we are biased by being paid for wearing the signature so I will try to be as unbiased as possible.

I think it was in the Ann thread that the OP talks about exit scam, but it would not be an exit scam as that means stopping the whole service and disappearing, not keeping a customer's money and keep running the business as if nothing as he says.

In support of the veracity of his version we can see that he is a person who manages quite a lot of money because of his status in the forum. On the other hand, I find it quite strange that a business that can earn a lot of money by doing things right and without cheating anyone, swindles only him for the large amount, and continues the business as if nothing happened.

In principle, and without further evidence, I am going to think that Ockam's razor does not work in this case; there are always exceptions that confirm the rule.