The chronicle: Altilly from the inside, 2019-2021

This chronicle tells the story of Altilly's management chat from beginning to end: how the exchange was run before the incident, what happened in December 2020, and how the team handled the aftermath. To write it, every message in the export was re-read. The drafting was AI-assisted, and every quote and message number was then checked against the chat. Numbers in brackets, such as #1232, link to the message in the chat reader, so you can check each point yourself.

Some ground rules:

• All dates and times are the export's timestamps, which are in UTC-8. In Sweden, where Nayiem lived, it was about nine hours later.
• In the export, Mike's messages appear under "Deleted Account".
• The only people named are Nayiem, Chuck and Mike. Other private people, customers and staff are described by role. Customer data and the attacker's IP address are left out.
• The text tries to stay neutral and includes unflattering facts about everyone, Nayiem included.

Building Altilly (Jul-Dec 2019)

A small team with a long list

The management chat began on 8 July 2019. Chuck created a group called "Holder Core" with Mike and Nayiem #1, and Nayiem corrected the name to "Hodler Core" #4. Chuck asked for a short meeting every two weeks #3. He also posted a list of principles: communication, organisation, efficiency, automation and a marketing plan, which he followed with the question "Do we have a plan?" #15.

The roles were clear from the start. Mike was the only developer. Chuck handled support, listings and business development. Nayiem worked on partnerships, marketing and strategy. Most of the backlog waited on Mike, and his own list was long: KYC and AltillyPass, listing and delisting tools, a new admin area and website updates #51. The KYC work alone meant finishing the AltillyPass purchase flow, integrating the KYC provider and adding an "is user verified" API call #55.

Listings were the first dispute. Chuck proposed a pass/fail review before any listing fee was charged, so that rejected projects would not need refunds, and Mike agreed #28, #47. Mike wanted KYC from every project that applied #60. Chuck warned that developers disliked it and that "we may end up losing many more assets" #62, #63. He also admitted that "90% of the devs i have to speak to, fail the reviews and many for refusing to add team members on website" #70. They agreed to try KYC and to log applicants who dropped out #73.

New submissions reopened on 12 July #125. Complaints came the same day. The fee had moved from a flat XQR amount to $300 in XQR, and this was "not published until we went live with new listings" #175. Nayiem's reply was "Dude is right. But on the other hand.. What the fuck. 100 dollars?" #177. Chuck called the complainers "whining devs" and suggested going back to a fixed XQR amount #183. When Chuck asked Nayiem whether a listing he was working on cost a lot, Nayiem answered "A lot of time" #146, #148. He said he still needed a white paper and a KYC disclaimer for it #143.

What the exchange looked like

The figures that appear in the chat point to a small exchange with little trading. Chuck said the BCH base market was "doing absolutely nothing" #191. In August the sponsored banner showed Qredit (XQR) at 8 satoshis with 0.093 BTC of 24-hour volume #365. Chuck asked for a September volume target of $400k #626. On 11 September he reported a "sudden volume drop" and asked whether a market-making competition had to run all the time "to keep over 100k" #786. Nobody answered that in the chat.

Security planning was minimal from the start. When someone asked about a third-party audit, Mike said "we are too small to worry about audits yet" #215, "heck we are too small to even start moving to safe storage" #216, and put audits at "probably 2020" #220. When Chuck raised privacy coins, whose team holdings reviewers could not verify, Nayiem said: "We can decide later when we get in to trouble" #242.

KYC went through the provider Token of Trust (TOT). On 24 July Nayiem reported that live keys would be activated the next day. He said TOT "was really impressed about the integration. But especially that Mike did find the live keys, none of their customers ever did that" #302. Adoption was slow. Chuck said he was "having to walk almost everyone thru the altillypass" because users with too little balance were sent back to an empty form, and Mike added an error message that same day #360, #363. By the end of August, Chuck's email to TOT gave the numbers: "54 have applied 32 approved". Some users said they had waited weeks with no notice #661.

Improvised revenue

Money came from several small, improvised sources. Chuck warned that 20 approved listings were waiting, "a couple since before we shut down listings long ago" #338. He gave Mochimo, a community-run coin, a discounted listing fee of 0.1 BTC #378. He proposed selling the sponsored banner slot #365, #368. He also traded free market-maker accounts for promotional articles #355. Competitions cost only "$150 in XQR" #583. Chuck wanted to use free competitions to pull in communities he wanted "to steal thier volume from other exchanges" #608.

Some housekeeping was loose. When Chuck asked how to set up one listing, Nayiem told him to list it "without any announcement" #225, #227. For the airdrop, Mike matched 10,383 users and arrived at 5,871,800 XQR after removing invalid referrals #416, #431, #432. When Mike asked about deducting unfound referrals, Nayiem said "You can take it from my account" #417–#420. On 12 August Nayiem asked "Anyone knows what happened with 10k merits?" #450, and no one answered in the chat. His plan for an email campaign to more than 4,000 project developers relied on guessed addresses: "I asked all the websites from the assets listed on coingecko. and replaced www. with info@" #548, #559. Under that plan coins would pay "1500 usd I believe" #563.

The mood in August was good. Mike wrote "This is why you need a team to build something good. one person can't think of everything" #476, and Chuck answered "We have a good core team i think.." #477. On fiat, Mike wanted to "make sure the banking relationship is good before we start taking in millions of dollars in deposits" #524. Nayiem estimated "probably 2 months? But at least this year" #516.

September: few new listings, lower fees

On 4 September Nayiem asked how many new coin applications had arrived in two weeks. Chuck answered "1 maybe 2", then "Maaaaybe 3" #681, #683, and Nayiem replied "oh boy" #684. Nayiem said "We really need to do something about the volume" #692. He moved to free ERC-20 and QAE listings and asked that reviews be kept brief, which lowered the vetting standard #753. When Chuck asked whether 10% was still the listing-agent commission, Nayiem offered to raise it to 25% #782, #783. Chuck also noted that he would soon be working long shifts with much less time for Altilly #631.

In the same period Nayiem redesigned the front end. He told Chuck: "Just don't throw it in the group. not waiting for endless discussions again" #704. When legal text on the site raised the question of jurisdiction, he explained that "Altilly operates out of Sweden" but was "still incorporated in Hongkong, until I have the things sorted here" #759. The one clear growth signal was web traffic. Chuck shared an Alexa chart showing the site's rank improving from about #196k to about #94k over 90 days #779, #780. "So it may not seem or feel like it but we are slowly growing and altilly is becoming known to the world," he wrote #781.

The platform also showed operational strain. On 15 September 38 withdrawals were pending #790. Mike traced the cause to a stuck withdrawal "that actually went out and caused the balance percent to drop below the shutdown threshold", and he restored service #792, #793. When the free-listing special ended, Chuck asked what the new prices would be and got no reply #799. On 3 October Nayiem wrote off a new team member who was "working as lone wolf" and "rude against other team members", and Chuck agreed: "Not a good fit" #801, #806.

Late 2019: deferring KYC

On 15 October, with asset reviews "finally completed", Chuck asked whether projects that refused KYC should be delisted #831. Nayiem said to "leave it for now". His reasoning was "Once Altilly becomes more mature, we can ask the devs to apply for KYC" #833, #834. In December Chuck told the others that support tickets were almost all about pending deposits and withdrawals, so FAQ pages would not help #861. He also mentioned "some tech issues early on today" #860. The year ended with planning. On 29 December the team agreed on a prize table for a March market-maker competition #862, #867, and Chuck listed the pipeline: "3 for Jan, 2 for feb and the MM for March" #869.

In summary, Altilly at the end of 2019 was a small exchange with thin volume. It was run informally by three people and depended on one developer. It had no audit and no cold storage. It earned money from listing fees and competitions, and it kept relaxing its own rules to win listings. The team was still on friendly terms, still joking, and still expected the exchange to grow.

Running the exchange (2020, before the incident)

The management chat for 2020 is thin. The group had been busy almost every day in mid-2019. In 2020 it went quiet for weeks or months at a time, with no messages between mid-May and 20 July or between 29 July and 15 November. The day-to-day running of Altilly probably happened elsewhere: in support tickets, in the wider "Hodler Headquarters" staff group, and in private messages. What this group does record are the decisions the three principals took to each other, and those show what the exchange was like in its last year before the incident. Some messages from this period are missing from the export. For example, Chuck replies on 25 February to a message #886 that is not there #892.

A small exchange with thin trading

The year began with the schedule Chuck had set out on 29 December 2019: listing events in January and February, then a market-maker competition in March. Its prize table shared out a percentage of the prize pool plus a 100k XQR fund for all participants, and Nayiem approved it with "All good" #862–#869.

On 9 January 2020 Chuck asked whether team members in the Hodler Headquarters group should get fee-free trading, and proposed "much nicer" filled-in price charts as the default view #872–#879. His reason for the charts was frank: "These charts remove the low trading look by filling it in." #880. Nayiem agreed to both: "both yes, and yes." #882. So the team knew trading was thin, and chose to change how it looked rather than what it was.

Nothing in this stretch gives volume, revenue or user figures. What there is points the same way. Late in the year Chuck complained that referral sign-ups did nothing for the business: "All it does is inflate the total user number which in my mind is pointless if those users are not trading" #984.

Listings, reviews and the paid vote

New assets were still coming in, partly through a community listing vote. On 26 July Chuck reported that "2 out of the 3 submitted for voting are ok. One is a no way" #939–#940. Mike answered that they "Need to find two more" #941. Chuck then offered to steer a developer with two coins into the vote at ".15 each coin" #942–#944. Mike joked "Guaranteed discount if he does", as long as the developer could wait two weeks #945–#947.

Earlier, on 25 February, Chuck had warned that "All assets need to be properly reviewed especially any being pushed by" a referral promoter "or anyone on BTCT crews". He added that he had been "extrememly nervous" about that person being given admin access #893. The messages do not say who gave that access or what it covered. Nayiem replied the next day: "Yea, now I understand." #896.

The same person came up again on 15 November. Chuck forwarded complaints from others, "Just letting you guys know how others are feeling about his sketchy stuff". They said the promoter kept pushing listings of tokens he had invested in and wanted a cut every time someone claimed from a faucet. "Its almost like he wants to use altilly as his personal income stream," one of them wrote #968–#972. Nayiem said he did not know what to say and asked how Mike felt #973, #981. Mike settled it: "im not doing referral fees on faucets", "not doing any more airdrops either", and Chuck would review any assets the promoter suggested #985–#989.

Checks on listed projects stayed light, following the October 2019 decision to leave KYC until "Altilly becomes more mature" #833–#834. Nothing in 2020 shows that changing.

Fiat plans without a verification process

In the spring, fiat and banking services came up for the first time. On 14 April Chuck wrote: "It sounds like FIAT is coming to Altilly. What route are we taking for verifying users?" #910. Nayiem did not know. He would "have to ask Mike" and was "not sure if we are going to use the kyc features that the other guy made" #911. On 13 May he said banking would be limited to assets that paid listing fees and were fully verified, because "If we list an asset that scams later, we will be fucked." #916–#918. Chuck suggested starting with only the base pairs #921.

In July Chuck asked twice whether card-based address verification could be reviewed by a person before cards went out #922–#923, #949–#950. He warned that people "who may have intentions of money laundering will use a 'front' address", and wanted utility bills or mortgage papers as proof #954–#955. Nayiem agreed that forms could be reviewed. He said they needed "either something automated or need to hire someone", and that he would come back to it "once we get to that part" #951, #956–#959. The chat does not show that happening before December.

Security and custody

The team knew other exchanges were being attacked. On 14 February Chuck passed on, in confidence, that another exchange, Crex, had been hacked #884. On 28 July Nayiem suggested looking into BitGo's custody service for exchanges, and into Chainalysis "For Altilly and especially Qredit Motion" #961–#965. Mike rejected BitGo: "we aren't even close to being at that level yet. Also, this is an American company. We need to be very cautious of working with any american companies for anything." #966. Nayiem answered "Alright" #967. This matches Mike's position from July 2019, when he said the exchange was "too small to even start moving to safe storage" #216. It is also a point Nayiem returns to in his 2026 notes.

The same month Mike mentioned that he had owned the domain of an exchange project he "almost launched" with others, and had let it go "Along with any domain I had on that account" #931–#937.

The team

Operations still rested on three people. Chuck ran support, listings and compliance ideas while also taking outside jobs. Mike held the technical side and made the final calls, and often took hours to answer. Nayiem asked questions, approved plans and mostly deferred to Mike on technical and verification matters #911, #973.

The chat stayed informal and often crude. On 25 February Mike posted a long, violent movie quote and marked it "😂 fun movie line" #889–#891. Staffing was handled loosely. On 21 November Nayiem told the others: "I officially fired [a team member] today", and asked them to "Keep an eye on things". By that evening he had reversed it: "Seems he's not fired yet. We had a long talk yesterday. He's going to give his best." #992–#995.

December 2020: optimism, then the incident

In the last weeks before the incident the mood was forward-looking. On 18 December Chuck brought Mike and Nayiem into a Discord discussion with an outside project that was interested in Altilly, and wondered whether "maybe Motion could handle this?" #999–#1014. The next day he predicted: "Once we are able to host IEOs i think altilly will explode provided we market that correctly", with "Many more options" once Motion was available #1021–#1022.

The incident (23–31 Dec 2020)

An "outage" (23–24 December)

The chat does not record the moment Altilly went down. On 23 December Chuck shared an SEC press release, and the next morning Mike dismissed it #1027, #1029. That was the last ordinary exchange in the chat. A few hours later Nayiem asked Mike for "more details about the hack that happened" and asked whether keeping each asset on its own server would have prevented it #1031, #1032. This is the first time the incident appears in the group. Chuck answered by forwarding two messages Mike had written at 22:11 the evening before. They said the attack may have come "from maybe an insecure recue port at the host level" and that "3 machines" with similar configurations were affected #1033, #1034. Six minutes later Nayiem said he had a "brilliant idea for Altilly" #1035. That evening Mike called the wave of exchange attacks "state sponsored for sure" #1054. Nayiem asked whether the loss was "really under 10k", and Mike replied "might be 15" #1056, #1059.

The public message was agreed in the same few minutes. Mike wrote: "Just tell them that we are still investigating the outage, and we have full control of our systems" #1057. He described wiping the machines as a precaution taken because of a "suspicious outage" #1065. Chuck asked what they should say if users asked about missing assets, since the status page showed them. Mike said he would "fix that soon" #1077–#1079. Chuck's draft post thanked users for their patience "the past 24 hours since the outage occurred" and said services were moving "to a more reliable source" #1084. By early 25 December most assets looked active again on the status page #1093–#1096.

The servers disappear (25 December)

At 14:12 on 25 December Mike reported that someone had "hacked into their systems" and "deleted all the servers". He added: "if not then it's game over" #1103, #1104. The host was Cherry Servers #1106. The backups at Backblaze were gone as well #1108. Cherry's first explanation was that the servers had been "cancelled by the system due to non-payment". Mike answered: "there were no overdue invoices, so thats a lie" #1110, #1111. The team heard that Livecoin, hacked in the same week, used the same host #1113.

Several of the weaknesses came from the team itself. Mike was "still in the process of moving stuff" to a new host, Hetzner, when the servers were deleted #1119, #1121. He thought a change he had made had locked the intruder out, "so i guess they got pissed off and just deleted everything" #1132. Later he admitted that the Backblaze API keys "should have" been upload-only #1271. At one point Nayiem sounded an alarm over more than $500k of XQR volume on CoinMarketCap. The figures turned out to be 572 hours old #1154, #1159.

What to tell users

Nayiem argued for disclosure: "it will backfire if we don't tell the truth" #1163. His draft said a new system user had appeared after reinstalls, meaning the system "was hacked above OS level" #1167. He also wanted to add that "hackers were unable to access funds" #1180. Chuck objected that nobody knew this and that users would expect to be paid. He warned that every word "will be copied repeated and anylized for years" #1190, #1195. Chuck also asked for a plan for handling users before anything was posted, and predicted "100 tickets an hour" #1176, #1178. The chat does not record any such plan being agreed.

The notice, headed "26th of December 2020 – 01:25 CET", said Altilly had lost access to its servers, "including the domain, several wallets and the whole codebase", and that it was not yet known whether funds were lost #1232. It went live at about 17:23 #1233. The claim about the domain does not match the chat, because the team was pointing altilly.com's Cloudflare DNS at a new server at that same time #1206, #1227.

Chuck then told HQ staff not to reply to anyone and removed their admin rights #1243, #1263. Nayiem asked the others, "Don't leave me here" #1253, and told Mike, "It's not your fault" #1256. Chuck wrote "so close" #1262.

How it happened and what was lost (26–27 December)

Overnight Mike reported that the attacker had got in "thru an old email still attached to the account" #1289. He wrote the address, [email protected] #1326, and explained that it dated from the account's setup three years earlier and still had login access without 2FA #1504. Cherry said the deletion request came from that email over a Tor IP #1508. Mike had already identified the attacker's IP as a Tor exit node earlier that day #1450. Mike said that access to the portal would have let an attacker boot machines into rescue mode and add users #1510. He had more than 10 servers there, "maybe 15" #1518. Backblaze said that deleted data could not be recovered. Mike could have used "object lock" but had not known about it #1498, #1501. At 23:45 Cherry confirmed that all server data "was cleaned when they were deleted" #1564.

The losses included:

• User records. The private GitHub repository held "just the code". Without the database and config files nothing could run or be decrypted, and Mike found no backup of the config #1351–#1353.
• Cold wallets. The "safe" wallets sat on a VPS at Cherry, and their backups were gone #1299.
• Ownership records. Mike's worst case was holding wallets on the new host "but we will have no idea what belongs to who" #1308.
• Bitcoin. Mike estimated the loss at "around 31 bitcoins, the rest i have no idea" #1600. He had not written down where the BTC had been sent during the migration #1516.

Chuck said: "Sounds like were fucked all the way around" #1312.

Mike shared goodwallets.txt, a list of wallets on the new host that were believed to be safe #1370. Chuck put the public group into slow mode #1364, #1366. Nayiem, who said he "never had access to those servers. Mike didn't allow me, because I break things" #1492, #1493, helped turn the list into about 87 surviving assets #1408–#1420, #1452–#1458.

The strain showed. Mike said "you spend 3 years trying to build somethign and somebody comes along and it's gone in a day" #1341 and talked about retiring from crypto. Nayiem answered "Not yet" #1332, #1335. Nayiem also wrote "All your fault Mike" #1379 and later "Thank you for ruining my Saturday" #1468, both in the joking tone of the chat. Chuck posted an "Exit Scam?" forum thread #1320 and a support ticket that read "i know where you live" #1563. Nayiem said he was starting a "plan B" to protect his family and his other businesses #1525, #1527. He also said he feared someone could "book an igloo. Sleep one night and then kill me" #1584. He asked Mike to keep Cherry's final answer private "until I have my stuff ready" #1566.

Deciding to repay (27–29 December)

On 27 December Nayiem asked the other two to commit to months of work: "1 million usd can be done. It's not impossible" #1626. Chuck agreed but said he needed to be able to pay his bills #1627. Mike said he was in "if you got an idea thats gonna make a million bucks quickly" and added "i have nowhere to go and nothing else to do" #1630, #1632. Chuck admitted he was "not sure where to money gonna come from" #1657. Mike also said "we weren't really holding alot, compared to other places" #1621. The one withdraw wallet whose address he could remember still held about $13,239 in USDT #1624. XQR was "All lost" #1731–#1733. Mike shared a spreadsheet of the balances that were saved #1719. Nayiem said nothing should be sent to users until returns could be documented #1725. The next day Mike said he was going to send the XNC developer his coins #1814. Nayiem published a status page at altilly.com/assets.html #1825.

The claims process was designed quickly:

• Evidence. Mike proposed collecting contact details and the balances users believed they had held #1972. Chuck suggested limiting claims to deposits made up to 60 days before the breach #1643.
• Minimum claim. Nayiem wanted a $25 minimum so "airdrop users" could not claim #1964, #1966.
• The form. A Google Form went live on 28 December #2029. The Portuguese notice gave the deadline year as 2020 instead of 2021 #2032. The form required a Google login to limit spam #2068.
• Security. Chuck criticised Nayiem for publicly asking users to send zip files #2075.

Chuck was also guarded with the public. He advised Nayiem against publicly promising repayment, saying the plan was best kept "close to chest" #1911–#1917. When users asked where the refund money would come from, he answered "Why does it matter as long as users are refunded" #1923. He warned that "If we tell them too much they will find a way to scam us" #1985. Nayiem relayed a user's demand that the hot wallet and the location of "the stolen 30 BTC" be made public #2112. Chuck said the BTC had been held in "safe storage", with only about 0.3 BTC in the withdrawal wallet at a time #2118, #2119. Mike advised telling users only that the matter was being investigated #2124.

Nayiem said it felt "like someone died 2 days ago" #1899. He recounted a history of repeated debt, which in his own account included a period of "work on darknet", and ended by saying he was now "1mln usd in debt" #1882. Mike said that at most the structure of the users table had been copied into Qredit Motion, with no data #1895.

The last days of the year (30–31 December)

Chuck proposed asking claimants to forward their original deposit emails so faked screenshots could be ruled out #2146. Developers began taking back saved coins so they could pay their own holders. The Beyondcoin team, for example, said it could handle its distribution #2149. Developers were told to allow "at least a week" #2218. A claimant threatened to report Altilly to "all possible authorities in Sweden". Nayiem replied "What an idiot", said the claimant could go to the Swedish embassy, and noted that Altilly was "not incorporated in Sweden" #2156, #2158, #2164. Nayiem also admitted "We didn't have an active list of assets we held on Altilly. I took the most recent list from coingecko" #2210. He noted that "Lawyers are all on holiday" #2183. He asked whether to remove Altilly from Trello because "Its painful to watch" #2243, #2247. On 31 December Mike found 15,132 contact records in the support system, which was the nearest thing left to a user list #2281. Chuck suggested checking large claims against old support tickets, saying it "could end up saving alot of $" #2284, #2286.

Aftermath and claims (Jan-Mar 2021)

A refund process with no database

By the start of January 2021 Altilly had stopped trading and the team's only job was paying people back. Claims came in through a Google Form and by email to a repay@ address. The records behind the process were thin: there was no list of the assets held #2210, and the best user list was the 15,132 support-desk contacts #2281. Claimants' document emails were being bounced by the spam filter #2335.

On 3 January Nayiem changed the refund window. Saved coins would start being repaid in seven days #2439, and the final claim date was set for 9 January #2443. He also planned an ERC-20 "voucher" token for claims that could not be paid #2442. Chuck thought changing the date was "a mistake" and warned that "People will see this as a desperation act" #2444, #2445. He was also managing how things looked. He told users the process "may take months" because there were 80,000 users #2451. When Nayiem posted an image showing only about 1,800 form submissions, Chuck deleted it #2453, #2457, #2460.

That same morning the pressure became personal. Nayiem received anonymous messages with a photo of his property. He then reported that someone had been inside a building there: "fridge is empty... i can see footsteps in the snow" #2366, #2372. Chuck's advice included weapons #2402.

A few facts from the first week showed how weak the setup had been. Mike admitted that of the seven countries on the sanctions list in the policy, "the only one i was actively blocking at cloudflare was iran" #2515. He also raised a hope that the master database had sat on a separate PCIe SSD that "was not wiped" #2491, #2500. The chat never records an answer from the host. On 4 January Nayiem reset the root password on one of the servers. He told Mike it was not because he did not trust him, but because a transaction had not arrived #2569. Mike was already saying that any future exchange would have to be "a completely walletless system" #2612.

Buying back the database

On 6 January a user in the public group called the team "sloppy and amateur" for running servers without backups, and claimed, without evidence, to know who was selling the stolen bitcoin. Chuck removed the user and deleted the messages #2679, #2680, #2683. The next day a new member mentioned Cherry Servers by name, even though the host had never been made public. Nayiem asked, "Who knew about cherry?" #2715. The contact said a friend of his ran an offshore host that held a mirror of Altilly's data #2746. Mike was keen: "i'll pay 10k for the db dump if it matches" and "i dont care if it's destroyed or not, i just wnat a copy" #2749, #2755.

On 8 January Nayiem negotiated with the host operator #2790. He offered $5,000 for the database. The seller showed a 13 GB archive, Altilly.7z, and offered 72 hours of SSH access #2793, #2800. A file listing showed a large altilly.sql #2882, #2883. The team also accepted that the dump could not undo the theft: "btc is already gone, transferred" #2858. Nayiem was open about the strain ("Dealing with these type of people every day is killing me.. mentally" #2845). He also said he would only consider relaunching "If we have a license + insurance" #2873.

Mike sent 0.02457 BTC as a first payment, calling it "a gamble" #2925, #2933. Chuck said, "This feels real and he feels cooperative" #2939. While they waited, the team discussed what to tell the public. Nayiem said, "we can't say that we just bought it from someone" #2968. Mike suggested saying only that they had "recovered an sql dump from the 23rd" #2972.

Within hours both of the seller's accounts had been deleted: "Both accounts gone" #3037. Nayiem wrote, "we get kicked again while we are already on our knees" #3047. Mike then saw what he had missed. The file name, format and timestamp did not match his own dumps, and "this story was a little flaky tbh" #3051, #3053. Nayiem said he was getting two or three such offers a day #3075. On 11 January he concluded that no money would come from the hosting provider #3092.

Developers, disputes and an unverified process

For the rest of January, refunds went through project developers or were paid coin by coin. Some of these handovers went wrong. The Goldcoin developer confirmed he had received the coins #3244. Chuck then found that he had "deleted all our chat history", and he had left the Altilly group #3248, #3255. Beyondcoin's refund channel disappeared as well #3213. Nayiem said he had doubts "after that beyondcoin thing. And after goldcoin wanted to put everything in their own dev fund" #3305. Chuck's verdict was: "Some of these devs talk a good talk but are devious as hell" #3310.

On 18 January Mike said he would "pull out my 2.8m pyrk from the wallet and leave the remaining user funds" #3175. So Mike himself held a large PYRK balance on the exchange, in the same wallet as users' PYRK.

Chuck repeatedly complained about how the work was coordinated: "It hard for me to help when i have limited info" #3298. On 27 January he wrote, "It appears we have temporarily lost Nayiem" #3355. The next day Nayiem launched a spreadsheet-backed status page, and Chuck planned to release updates slowly: "the key here is to continually show progress. I will stretch it out some" #3412. That same morning Chuck mentioned that he was in serious financial difficulty #3430. He called the process so far "a clusterfuck" #3508.

The same day Nayiem explained how claims were checked. "anything between 50-200 usd I don't check at all," he said, because "We will be here for another 10 years if we start checking all txid's" #3564, #3566. His only control was whether the total claimed for each coin matched what was left in that coin's wallet #3558, #3570. Payouts were not recorded in a ledger ("I just mark the addresses with the users") #3575. Chuck pointed to Livecoin, which was documenting its payouts to protect itself against lawsuits #3576.

February: cards, country screening and exceptions

In early February Nayiem gave Chuck and Mike cards on his Revolut Business account #3638, #3644, #3723. He also told Chuck not to use the balance "for BS", because the account was one he used for his own bills #3732. Two days later Nayiem posted a photo of a DHL envelope from Revolut, delivered to his address, with the comment "That was really quick." It was addressed to "PAUL Vernon" #3833. Mike had ordered his card by then, to be sent to Nayiem's address because Revolut did not ship to his country, while Chuck had not yet ordered his and still had no card on 11 February #3638–#3693, #3712, #3836. On 19 February Mike wrote "i got my revolut card today" #3960. Read together, these messages show that the envelope held the card Mike ordered. Nobody in the group commented on the name at the time.

The rules were applied unevenly. On 15 February Nayiem warned Chuck that instantly deleting messages about a class action "might trigger some other suspicious things." Chuck replied that "99% of users are content right now but if they see opportunity to jump on a class action they will" #3929, #3932. On 19 February they agreed that team members did not need to send deposit emails ("i think we can trust the team") #3953, #3956. Ordinary claimants still had to provide them.

Chuck reported that PYRK had 15 refunds declined "due to sanctioned countries" #4005. Nayiem then told Chuck that for "a really pushy person," he should "Do the refund, but not by email and remove all traces" #4029. The countries in question were on the banking partner's 139-country high-risk list, not a sanctions list, though Chuck had the "sense this list covers all sanctions of any type" #4023, #4027, #4028. Nayiem described one case of this kind involving a long-time supporter, who, by the author's account, was paid #4032, #4033. The same day he said "The majority of our users is from Nigeria" #4036, and he confirmed that the BTC and ETH wallets were gone #4094. His attention was already moving to Qredit Motion. He laid out a roadmap before its subscription marketing began #4136, and a Qredit swapper went live on 21 February #4236.

March: holdouts and the host's denial

For the MOON refunds, Nayiem ruled that "bold claims with no tx id or screenshots is just a no go" #4310. Then two claimants who were threatening a class action turned out to have no deposit emails. Chuck noted that paying them "may avoid the suit" but would show the rule was not enforced #4326. He suggested telling one of them that Mike was "vouching for his account personally" #4339. Nayiem held off on those refunds for the moment #4324, #4325, #4328.

On 9 March Cherry Servers sent a formal notice denying liability #4349. Nayiem said it contradicted an earlier email in which the host had taken the blame #4350, #4355. Mike approved publishing both #4356. Later in the month Nayiem posted his own full card details in the chat so the helpdesk and email bills could be paid #4417. He also admitted he had once uploaded purchased email leads to Mailchimp as "altilly users" #4440, #4443.

Morale fell. When Nayiem said everyone was working hard, Chuck asked, "Who is everyone?" #4405, #4406. Mike wrote that programming "used to" be something he loved, "but ever since that hack it's been like a chore" #4476. Nayiem answered: "But first Altilly refunds. Once that is done, you are a free man... Until then, you need to help me make us rich" #4481, #4482.

Refunds, Altfenix and new plans (Apr–Jun 2021)

The refund weekend

In early April the team finally started sending out the "saved" assets, the coins whose wallets had survived the hack. The job was split two ways. Chuck kept a Google Sheet with one tab per coin, holding the amount and the address. Mike sent the coins and put each transaction ID in the sheet, and Chuck then emailed each user #4592–#4607. The first coin, 42coin, went out on the evening of 1 April #4610–#4613. Mike worked through the night, reporting "done" coin by coin. Several wallets had to be upgraded or resynced first, one server could not be reached for hours, and the CryptoNote coins needed custom scripts #4608, #4621, #4628, #4699. By the evening of 2 April about fifty coins had been paid #4613–#4808. Nayiem mostly set priorities: saved assets came first, and "rest of the shit storm will come later" #4583. He added that the leftovers "probably can't even buy a full tank of gasoline" #4743.

The claim checks were weak, and the team knew it. Claims were accepted on deposit-confirmation emails alone. Chuck noted: "Thats the downside to only accepting deposit emails" #4665. Some wallets could not cover their claims, such as Bettler and Dimecoin #4643, #4693. Some claims asked for more than the user had put on the original form. Mike ruled that "we can't just give them credit for every deposit email if they only said they had 90k in their claim" #4828. One Mooncoin claimant was paid 1.5 billion MOON on Mike's word alone. Chuck: "if you are vouching for him we can do that" #4778, #4781, #4800. Mike also noted about PYRK that "I don't remember anybody other than me having that much on the exchange" #4807. By the end of 3 April, 28 assets were still open, and Mike put this down to sync problems and CryptoNote coins #4874, #4875. Chuck mentioned in passing that two users were recruiting for a class action #4853.

In April Chuck went back to work #4831, and on 20 April, when he had to step back for personal reasons, Nayiem told him "We will handle it" #4916, #4922–#4924. TUSC, whose wallet keys Mike still had, was still not distributed by then #4876–#4880, #4905, #4906. On 1 May Chuck said closing the developers' group could be discussed now that most saved assets were refunded. He had first worried it "would appear to devs we were trying to simply disappear" #4966. He asked for an overall update on Motion and on the non-saved plan, and Nayiem promised one for the next day #4971–#4974. The chat does not show that update.

"Drag it out"

In mid-May Nayiem complained that users were only now finding out they had funds on the exchange. Without the database they could not be emailed, and he predicted "this is going to take a few years" #5011–#5012. Chuck replied: "I can drag it out forever if you want. Im pretty good with word play" and "Hang the carrot out front and they will follow". Nayiem answered "Go for it" #5017–#5020. The next day he set out a refund-token plan to be bought back on the new exchange #5201–#5203, but Altfenix never launched. The idea came back later. On 25 May Chuck set out a three-phase refund schedule, with a second round on 1 June and a final round on 1 January 2022. The purpose was partly to spare Mike and partly "to drag it out buying us time" #5955–#5962. On 30 May Nayiem wanted to put refunds on "holiday mode" for two weeks so the team could work on Qredit Motion. Chuck advised against telling users about any pause #6035–#6037.

Altfenix

On 16 May Nayiem floated a new idea in the developers' group, which Chuck copied into this chat. An Estonian crypto licence that was being pursued for Qredit Motion would also allow an exchange. How would people feel about a new one, built "with all the legal licenses and insurances" #5023? Chuck objected: "If you promote this to users of altilly, it is doomed". He said unrefunded users would try to destroy it #5044–#5052. Nayiem answered: "If I get 10% approval from users, that's more than enough" #5059. Within hours he had divided the roles. Mike would do the technical side. Nayiem would take "the business part and the emotional stress". Chuck would be the spokesperson who would "take all the bullets from users" #5091.

Most of the design work came from Mike. There would be no wallet daemons, and coins would be listed only if they could be reached through an API, which he said would save "like 90%" #5083–#5090. A separate "oracle" at a hidden location would hold the keys and check each withdrawal #5158–#5169. Nayiem wanted deposits swept to cold wallets and withdrawals approved by hand a few times a day #5180, #5340–#5344, #5669. He described the scale of the shortfall by saying "we can not mine for 200k usd in a short period of time" #5184. He also proposed an "Altilly refund token" that users with unsaved assets could sell at a discount or hold until the team bought it back #5201–#5203.

On 17 May Nayiem registered Altfenix.com: "Alt= Altilly / Fenix= some bird that rises from ashes" #5235–#5236. He gave the licence as 12,000 euro capital plus a 9,900 euro fee, then described it as "so basically 12.000 euro, from which 2100 euro will be returned", which treats the fee as part of the 12,000 euro rather than on top of it #5239–#5240. Logos, a trademark filing and a demo page followed #5252–#5254, #5771. Mike warned that "This will take many months to build first version" #5276, and that only the V2 source code survived, with "No database" #5308–#5310. He also drafted a fee schedule: 50% for operations, 25% for a "Rainy Day Fund" that would also pay claims from the hack, 10% for referrals and 15% for developer pools #5535. Nayiem defended the 50% operations share "in case we get hacked another time" #5883. Nayiem said: "Originally, Altilly wasnt really that bad" #5266. He also admitted: "I can't pull this twice. Next time will be one way ticket to Russia or China" #5354. Mike mentioned in passing that an attacker had once tried an SQL injection, and that "the guy already had root access at that point" #5821–#5827.

Nayiem soon wanted more than an exchange. He wanted one platform with KYC, fiat, cards and insurance, because a plain exchange would mean "starting from the bottom again, working for pennies" #5558. Money was very short. When Mike said the help desk wanted to charge the card, Nayiem said "I have zero cash, I'm sure they can wait a few days" #5600–#5602. Freshdesk was disabled by 29 May #6029.

Tone toward users

On 19 May Nayiem dismissed the critics: "binance has over 18mln users. We had over 80k users. Those negative users will be forgotten one day" #5857. On 10 June he said: "I like it when Altilly users are saying that they are going to sue me. Like it will give them their money back instantly" #6386–#6387. On 9 June he put off an outside request with "Tell him that I will reply to him after dealing with my burnout" #6325. Chuck, meanwhile, asked Mike not to hand about 100m COLX to a developer who "wants all of it for his team" #5912–#5916. He also warned that "natives are getting restless" over the HONK refunds, which were stuck because a BCH wallet had not worked #6433–#6436. On 15 June Chuck forwarded a post from Nayiem's account mocking investors for backing "a depressed CEO with lousy updates and a big ego and big dreams. Missing deadlines like nothing", and asked "Do we have an imposter?" Nayiem replied "nope :P" #6471–#6473.

Satoexchange and the old code

On 11 June Nayiem announced a "really close partnership" with Satoexchange, which he said did about $250k a day in volume #6398–#6402. He wanted Sato's frontend changed to look like Altilly so Altilly users would move over. He also worried: "I'm definitely fucked if they go out of business under my name" #6415–#6416. On 16 June he found old code and got into a v1 staging server from around September 2019. He called it "reverse engineering Mike's stuff" and added "Im glad Mike never gave me access to the database" #6534, #6557. None of it was real Altilly data: "I will never get back old user data" #6536. A prestaging copy showed "7 assets, 3 users and 15 markets" #6594. Chuck asked what it would do for them unless they reopened Altilly. Nayiem's answer was "reopen altilly… but make it Altfenix", and he ended with "Not everything is lost" #6608–#6610, #6629.

Late June: IOU tokens and cost cuts

On 17 June Mike described the plan for unpaid claims. They would be issued as tokens and traded in markets such as QBTC→BTC, so that "if somebody is willing to settle for 50%", those bids would be paid first #6657. When Mike suggested redirecting the altilly domain, Chuck objected that this would remove the hack notice, and the idea was dropped #6661–#6666. He also warned that the new exchange should not look like "just a way to get assets back". Nayiem replied: "Let me deal with the business side" #6667–#6668. The team began cancelling bare-metal servers, each costing about $100 a month or more #6672, #6681, #6697. Nayiem got the SLP wallet working and gave all its private keys to a HONK project contact, who would pay seven claimants. Chuck questioned the move #6731, #6739, #6745. Only 5.25 billion HONK had been recovered, and "The rest was lost" #6750. Chuck wrote: "I look forward to a time when i can be happy again" #6759. The ticket system stayed offline because Nayiem did not "have the money yet to fix it" #6770.

On 26 June Nayiem moved to token refunds for both saved and unsaved assets. Chuck said: "I purposely strung it out to buy you extra time" #6806–#6811. For valuing lost assets, Nayiem pointed him to CoinGecko's historical prices and told him to use the price that was "the most beneficial for us. So the lowest one" #6838–#6842. Nayiem says altcoin prices were spiking around the hack, and they did not want a one-day spike to set the value. The Altfenix pages went up on qredit.io on 30 June #6864.

Winding down (Jul–Oct 2021)

Refunds that kept slipping

By the summer of 2021 Altilly had not traded for more than six months. What was left of it was a refund operation, and it was running behind its own promises. On 1 July Chuck reminded Mike and Nayiem that July had been "earmarked for the 2nd round of refunds for saved assets." He had been giving users that date "for several months." He added that "we still have assets that have not been paid first round" #6872, #6876. Nayiem told him to say "there are some delays, we will get back to them asap" #6878. On 12 July Chuck asked again. Nayiem said nothing would move "until we have qslp running properly with an interface," which he put at "about 2 weeks or something" #7052, #7053. On 29 July Chuck asked for a round of saved and partially saved refunds and said the final round would be at the end of the year #7139, #7141. Nayiem asked for "a few more days" #7143.

On 9 August Chuck said approved users still had not received their saved assets and asked for "a couple days break from other work" to send them #7180. Nayiem said he "will put my focus on it really soon." He signed off at almost 7 a.m. his time, still without sleep #7181, #7183. On 19 August Chuck repeated that some users had not yet been sent their first round #7344. On 25 August Nayiem shared a Discord message from a user who had been approved in April and still had nothing. Chuck replied that the claim "is approved and ready to send" #7377, #7379.

The team kept talking about new listings even with the platform offline. On 3 July Chuck suggested offering free market-maker accounts to developers hurt by the hack, because giving them one "helps get markets moving" #6886, #6887. On 5 July Nayiem told Chuck to say that the plan was "4-6 assets per month at this stage." He added that he was "a bit tired of folks that want to be on the first row but want to wait until we have the exchange running" #6899, #6900. The next day he raised the corporate tax the team would eventually owe on trading-fee income #6906.

Handing the Wrkz wallet away

On 9 July Nayiem asked whether he could "just send over the wrkz wallet files to the devs" #6909. Chuck said two WrkzCoin refunds had been paid, two were still pending, and every other claim was "invalid or no response" #6910, #6912. He questioned the approach: "Is there a reason were doing this?" and "is this a habit you want to get into?" #6915, #6917. Nayiem said assets that were "difficult to restore or difficult to send + without any valuable market" would "only cost us time and headache," and he named HonkHonk and Wrkz #6921, #6922. Mike agreed that Wrkz was "a pain to send anything other than small amounts." He had sent "a few million" before "giving up" #6925, #6933. One of the pending refunds was for 2B #6927.

Chuck asked, "How did you confirm he is CEO of wrkz?" Nayiem answered, "I didn't actually" #6998, #6999. He then asked the project's community to confirm the recipient and posted a screenshot of that exchange #7005. Chuck objected that the post was "giving too much info" and that telling the community only two refunds were left was not the "best idea right now." He then withdrew the objection ("nm") #7008, #7010, #7011. Next he warned: "That guy is in cambodia which is on sanctioned list." Nayiem replied, "Will send over the wallet now" #7030, #7033. The chat contains no further discussion of the sanctions point. On 11 July Nayiem confirmed that the developer had received the wallet #7037, #7038. In October Mike confirmed that "the dev got the whole thing" #7570, #7571.

Fragile tools and a self-inflicted outage

The infrastructure kept failing. On 11 July Chuck posted an error screenshot from the new development site. Nayiem said Mike had "funked it up again," and Mike replied that "it's not really ready for clicking around yet" #7040, #7041, #7046. On 23 July altilly.com began redirecting to Google #7114. Nayiem first pointed out that only he and Mike had DNS access, and suggested Mike had changed it on purpose #7119. The Cloudflare audit log showed no changes #7120. He then found the cause himself: "I deleted qae.altilly.com" #7123. He reported it "fixed" #7124, but Chuck said they were "already getting called out on it in refund group" #7126. During the same weeks Nayiem described a stress dream about another of his websites and said a WordPress site of his kept "going offline with 500 errors" #7098, #7107. Both show how thinly his time was spread.

On 1 August the Altilly information moved to a Qredit-hosted page. Nayiem announced it as "live now" #7149. Chuck asked for a wording change, noting that "the word 'since' implies a period 'after' the hack" #7151, #7155, and asked for the saved and non-saved asset lists to go back up. Nayiem agreed #7163. Chuck summed up the move: "Pretty much all we did was move the info from altilly to qredit" #7164. The next day Chuck said he had been "playing dumb" with a user because something on the site "needs to be removed," or else "were going to get bombarded by every non saved asset user" #7175, #7176.

The support tools lapsed again and again for lack of payment. On 14 August the ticket account was "suspended again," and Chuck also needed Fastmail restored to get back into Discord #7202, #7206. On 15 August he reminded Nayiem that "freshdesk and fastmail" needed paying #7215. On 18 and 19 August he was still repeating "TIckets/Fastmail" #7305, #7309. He warned that user emails bounced while the help desk was down, "so its important we keep that live until at least the saved assets are completed" #7339, #7340. When the billing problem came back on 20 August, Nayiem confirmed the monthly ticket-system cost as "250 usd" #7363, #7369, #7371.

Chuck also asked whether work had begun on the ALT2020 token on the Qredit blockchain #7208. He proposed handling non-saved-asset refunds in two steps #7209. He also asked that the next phase stay closed "until all other claims have been paid first... Or its going to get real messy" #7221, #7222.

The HNC licensing proposal

On 17 August Nayiem brought a proposal from the HNC team, which he said had gained "12k users in the last 2 weeks." It involved using that team's crypto licence and sharing licence costs #7228, #7229. He said "We already have the funding for the crypto license" #7230; by Nayiem's account this was the roughly 10k Mike had offered in May to fund the licence #5728, #5729. Chuck called it "Alot at risk for a little convenience" #7233. Nayiem answered: "If we fuck up, with their license. They lose their license. and we have another chance" #7236. He also objected to providing the development, paying half the cost of another company's licence and then splitting the profit as well #7250. Chuck said, "That is a CEO call but I think its a bad idea," and later, "I just work here :P" #7246, #7274. Nayiem said, "I need to think about it" #7285, and then pointed to HNC's market ranking #7286, and Chuck replied, without giving evidence in the chat, that "they had like 80% fake trading on altilly" #7287, #7288. Nayiem answered that rank 170 was "not easy to fake", "unless they hold 99% of the coins" #7289, #7290. Mike noted that the system was already "being setup so you can have multiple frontend exchanges" #7293.

Threats and fatigue

On 1 September Nayiem shared a screenshot from someone asking where to serve legal papers #7380, #7381. Chuck guessed it was over KYC and put the chance of legal action at "less than 5%" #7383. Nayiem wrote, "I'm starting to not enjoy this shit anymore," and said things were "starting to become serious" now that he had a family to consider #7384, #7385. He admitted he was behind on private messages at 2 a.m. #7393. The same evening a user threatened legal action over DOGE, although, as Chuck pointed out, "he didnt even claim doge" #7402. Nayiem's response was: "People don't understand that there are no funds. ... Don't waste your time" #7407, #7409. On 6 September Nayiem posted a long accusatory message from the person who had asked where to serve legal papers #7417, #7418, and Chuck replied with a crude remark about him #7420. That evening Chuck wrote to Mike that they had to "hit 'all' the saved assets and get out whatever is pending before pushing anything else. Weve made alot of promises we are not keeping and natives are starting to get very restless" #7421.

September: last plans

In early September Chuck mentioned personal difficulties #7424. He said he was "about 80% finished" with the non-saved asset sheets and the conversion tables, and would then value each asset "as of Dec 24 25 or 26" #7426. On 10 September Nayiem posted "the planning for now," with marketing, refunds and sales to follow in the same document #7428, #7429. The claims turned up gaps in the records. There were 95 claims for a "ROCK" token that no list included #7435, which Nayiem explained had been "basically airdropped" #7438. Chuck asked, "If somebody shows me a deposit slip can i kick you?" #7446. The Blocknet wallet did not hold enough to cover its refunds #7450. TUSD and a second stablecoin were added to the non-saved list from memory #7530, #7532, and Mike called both "minimal" #7534. On 16 September Chuck finished the BTC refund request page: "800+ users for now," out of "over 1600 entries" #7517–#7519.

On 13 September a news story about account takeovers started a discussion about security. Nayiem admitted that at Altilly "we did sometimes a password reset for the user on a different email," adding "Not sure how we checked things" #7473. Chuck pressed for forced 2FA at registration #7474, #7490. Mike replied: "im making 2fa a requirement to deposit, withdraw, or trade" #7491. Two days later a critic attacked Altilly publicly. Nayiem replied to every review #7494, #7498, wrote "This dude is really pissing me off" #7500, and the next day said the critic "has finally shut his mouth" #7509.

The rest is mostly background talk. Mike reported a deal on his house #7535, #7544, #7559. Nayiem reported that Satoexchange, the exchange he had announced as a close partner in June, had "Lost user funds. Dev is missing" #7560, #7561, and Mike added that another exchange had also been hacked #7562. Chuck shared news of a regulatory settlement involving Tether and Bitfinex #7567. The last working exchange in the chat is Mike's 26 October confirmation about the Wrkz wallet #7570, #7571. After that the group goes silent. The schedule posted in September #7428 is never shown being delivered, and the saved-asset refunds are never marked complete.

Looking back (2025–2026 notes)

After 26 October 2021 the group goes quiet for more than three years. The messages after that were not written while events were happening. Almost all of them come from Nayiem, looking back at the old messages. They are summarised here as his later commentary.

February 2025: thanks

The first new messages appear on 8 and 9 February 2025. Nayiem replies to three old messages from Mike with "Thank you Mike 🙂", "Thanks" and "Thanks again" #7572, #7574, #7575. Two of those old messages are videos Mike had shared in May 2021. Chuck's only response is an eyes emoji #7573. The export does not say what prompted the thanks. By Nayiem's account, Mike had already left the group by then; Nayiem was browsing through the old messages and meant the thanks ironically, knowing he would use this material against him. The timing fits: it came around the same day as his first Reddit post about Mike and Xeggex (about 8 February 2025).

September 2026: taking over the channel

On 27 September 2026 Nayiem asks Chuck to give him ownership of the channel #7576. Chuck replies "Done" the next day #7578. On 29 September Nayiem tells the group he intends to make the channel "public and make it read-only". He says he first has to "go through all 7000 messages" because he sees "a lot of customer data, emails etc." #7579. In the end the group itself stays private; the redacted chat is published on this site instead. He also says he needs to check whether the Google Docs of Altilly assets are private, because "They contain customer data too" #7580. His last message is a notice that some messages were deleted "to protect customer data and data of unrelated 3rd parties and other management employees that have been in this group during the early days" #7598. So the published record is partly curated by Nayiem, and he is also the person making the accusations below. Readers should keep both facts in mind.

The allegation against Mike

Most of the 2026 notes are replies attached to messages from 2020 and 2021. Together they argue that the December 2020 hack was not what it looked like at the time.

The main claim is attached to the email from Cherry Servers that Nayiem had posted in March 2021 #4353. In it, the hosting provider said the attacker had got into the account the year before. Nayiem's 2026 note calls it "the first response from Cherry Servers after I reached out to them on behalf of Altilly" and says Mike "used this situation to orchestrate the 'hack'" #7587. He also re-shares Cherry's formal notice denying liability #7586, #4349.

He then adds captions to material Mike posted after the hack:

• Three videos from May 2021, two posted by Mike and one forwarded by Chuck #5106, #5114, #5125, re-captioned as Mike's bathtub, garden and living room/office "5 months after the 'hack'" #7589, #7590, #7591. The chat does not show how the work was paid for.
• Mike's May 2021 message "i think i can probably get that 10k by the end of the week" #5728, which at the time was about paying for the licence #5735, #5745. The 2026 caption says that months later, after renovating his house and building "a massive in-door pool", Mike suddenly "has 10k out of nowhere" #7592.
• Mike's July 2020 remark that he had "almost launched" another exchange and owned its domain #931, #933. Nayiem's note says Mike was running "other exchange ventures without anyone from the team knowing… Already before Altilly" #7593. Mike had, however, mentioned that project to the group himself in 2020.
• A July 2020 thread in which Mike turned down BitGo #964, #966. Nayiem's note says Mike was "disregarding any conversation that involves chainalysis or cold wallets" #7594. At the time Nayiem accepted the decision with "Alright" #967.

Identity and the old email

Nayiem also returns to 26 December 2020. That day Mike posted the old email address that had been used to take over the hosting account, [email protected] #1326, and said the domain's history "probably has my name" #1324, #1326, #1328. In September 2026 Nayiem replies with an image of a historical WHOIS lookup for the correctly spelled version of that domain #7577, plus a Bitcointalk link #7583. In a longer note he writes that he "always knew that Mike never used his real name". He repeats second-hand reasons he says he was given at the time for why Mike kept his real name away from the exchange; they are unverified and not repeated here. He also says his own WHOIS check at the time found nothing because the domain as Mike typed it contained a one-letter typo #7595. Separately, he replies to the 2021 photo of the card envelope #3833 with a short remark #7585.

In another reply Nayiem posts a link to a court record and a link to a Cryptsy settlement website #7581. He does this without explaining it further in the group. That note mentions a private individual and is not repeated here.

Cryptsy and Chuck

On 1 April 2021 Mike had pointed out that the bitcoin stolen in the Cryptsy hack had never moved, adding "we had noticed they hadn't moved years ago" #4525, #4529. Nayiem's 2026 reply picks out the word: "'we' had noticed?" #7596. He then links Chuck's December 2020 remark about losing 9 BTC in 2014 #1399 and writes: "Chuck lost 9 BTC on Cryptsy… While the thief is literally in front of his face" #7597. The note implies that Mike was the Cryptsy thief. Nothing in the chat backs this up.

Nayiem on himself

Some of the notes are directed at Nayiem himself. In the same message about Chuck he writes: "Ironically I feel stupid too for being naive and missing all of the hints. I could have known if I paid more attention to the details." #7597. He also replies to his own March 2021 message in which he had posted his full payment-card details to the group #4417. He says the card "is no longer working" and that he is leaving the message up "because it might look suspicious in this context" #7588. In reply to Chuck's June 2021 stock tip, which predicted a rise from $1.20 to $50 a share #6378, he posts a September 2026 screenshot showing the stock at 0.00 USD #7584.

How to read these notes

The notes were written five years after the events. They come from one participant, and they are allegations. Nobody in the chat answers them. Mike, whose account shows only as "Deleted Account", does not reply. Chuck's only reply is the "Done" handing over ownership #7578. Several facts are worth setting next to the notes:

• The messages from 2020 and 2021 contain no admission by Mike.
• Mike was the person who first pointed to the old hosting email as the way in #1504.
• Mike later said he would make 2FA mandatory on the successor platform #7491.
• During those years Nayiem himself trusted Mike with the servers, and later said he had never had database access #1493, #6557.

The 2026 notes show how Nayiem came to see those years. They do not settle what happened to Altilly's servers.

What the chat does not show

The chat is one group among several, and parts of it are missing. It does not show:

• Who deleted the missing messages, or when. Telegram does not record this (see the note at the top).
• The day-to-day running of the exchange in 2020. That happened in support tickets, the wider staff group and private messages, none of which are in this export.
• Reliable volume, revenue or user figures. Apart from a few 2019 snapshots #365, #786, the chat gives no trading or revenue figures.
• The moment Altilly went down. The incident first appears as a question about "the hack that happened" #1031.
• Where the stolen bitcoin went. Mike's estimate of "around 31 bitcoins" #1600 is the only figure, and the chat contains no tracing of the funds.
• An answer about the separate SSD. Mike's hope that the master database "was not wiped" #2491, #2500 is never answered in the chat.
• A user-handling plan before the public notice, which Chuck asked for #1176, #1178.
• A ledger of refund payouts. Nayiem said he only marked addresses against users #3575.
• The Motion and non-saved-asset update promised for 2 May 2021 #4971–#4974.
• Completion of the saved-asset refunds or of the September 2021 schedule #7428.
• Any reply from Mike or Chuck to the 2026 allegations, or any admission by Mike #7578.
• Who Mike is. The chat contains the Revolut card envelope addressed to "PAUL Vernon", posted while Mike's card was on order #3833, the old hosting email he named himself, [email protected] #1326-#1328, and Nayiem's later notes. That is evidence, but it does not legally establish Mike's identity; see Who was Mike?.
• Whether the 2026 allegations are true. They are one participant's reading, written five years later.