Shaun Overton, a 40-year-old software developer from Texas, was on a layover at Miami International Airport when he received a text message from a friend: “Give me a call. I’ve got the deal of a lifetime for you.” It was Sep. 9, 2021. Intrigued, Overton called back. His friend then told him: “My customer's project is on fire.” The customer was the government of El Salvador and the project was Chivo Wallet, a state-created bitcoin wallet released two days earlier. The task, he later would discover, was in fact a rescue mission: that of saving an over-confident president’s political pirouette amid a labyrinth of haste, improvisation, and secrecy. Spoiler alert: He failed.
The details of the chaos that soon enveloped the developer come directly from Overton himself, who told his story on Aug. 16, 2022 in a judicial deposition. The document is part of a lawsuit his software company Accruvia filed against Athena Bitcoin, Inc., the main developer of the Chivo Wallet. In December 2021, Overton sued Athena for a breach of contract in the Northern District Court of Texas. In February 2022, Athena counter-sued him in the Northern District of Illinois. Athena’s counter-offensive has been dismissed, but Overton’s case is still pending.
Chivo was the cornerstone of President Nayib Bukele’s crypto project. If bitcoin adoption, the promise of the highly popular millennial leader, were to happen in El Salvador, he argued that this was the way. Bitcoin was supposed to eliminate fees in migrants' remittances, which amount to a fifth of the Salvadoran economy, and give an entryway to financial services for a 6.7-million population where 70 percent have no bank account. Chivo is slang for “cool” in Salvadoran, but when used as a verb (“chivear”), it stands for gambling. It quickly became clear that using Chivo was an uncertain bet.
At its birth, Chivo Wallet was shrouded in darkness. After announcing in June 2021 the adoption of bitcoin as a bridge to the future of international finance, the Bukele administration repurposed an inactive private company formed in 1999 by a public institution, poured a seed capital of $60 million into it and rebranded it as Chivo. Its status as a private company, despite the public ownership and taxpayer money sustaining it, insulated Chivo from any accountability or scrutiny from public information law or other auditing procedures. The government gave no details on how it was built or run. So Salvadorans spent months cobbling together bits and pieces of information. In September 2021, El Faro revealed that the whole bitcoin project was managed by Venezuelan advisors to Bukele, and in April 2022 that the wallet project had cost a minimum of $3 million. Months later, in November 2022, Revista Factum published that the total paid to Athena was $4.7 million.
Athena, in reality, was never the government’s first choice to develop the crypto wallet. At least two other companies declined to take the project in the tight three-month deadline set by the government when it announced the Bitcoin Law. The first was Strike, a crypto-wallet company founded by Jack Mallers, the man who announced the law in June 2021 at a Miami conference. Mallers went from posing teary-eyed on stage with a Salvadoran national team soccer jersey, declaring that he would “fucking die on this fucking hill,” to months later denying his overall connection to the project to Bloomberg. Neither he nor the government clarified why the deal collapsed.
Athena entered the picture later. The small Illinois-based ATM company had to put together a web of companies to accomplish the task by the September deadline. By December, Athena had already lost the contract to New York-based Alphapoint, the company that’s currently running the affair.
The September launch was supposed to be a party. Diario El Salvador, the government newspaper, put “Bitcoin Day” on its cover. Crypto billionaire and former child star Brock Pierce threw an actual beach party in La Libertad attended by YouTuber-slash-boxer Logan Paul. Main plazas all over the country had been filled days before with 200 Athena-made bitcoin ATMs, guarded day and night by police and soldiers.
It was all marvelous until the Chivo app actually launched. As soon as they downloaded it, users publicly complained about multiple glitches like difficulties in registering or failure to process payments. It didn’t take long for President Bukele to enter panic mode in his Twitter feed. At 7 a.m. on September 7, he tweeted they were “disconnecting Chivo Wallet while we augment the capacity of the servers that capture images.” At 9 am, he asked his 4 million followers if they could try and log in and comment on his thread about the problems they were having. At 11 p.m., he posted a screenshot of the app with instructions to correct a malfunction. At 1:52 a.m., in the middle of the night just 26 hours after Chivo went live, he tweeted they were again “disconnecting” the app to adjust it and enhance user experience.
Overton said he signed a contract with El Salvador’s government on September 10, 24 hours after that first call at Miami International Airport — “the most stressful project of my life”, he calls it. His depositions provide a glimpse behind the scene on the chaotic first days of Chivo and of the fallout of the fiasco. Post-launch glitches meant that transactions made from a bank account to a Chivo address were delayed or failed to register. People’s money was “disappearing”. The government was losing money, too.
The Promise of Easy Money
President Bukele had not only promised the public that bitcoin would catapult El Salvador out of financial distress and into a new Asian-Tiger-style future. He also offered a $30 sign-up bonus to every Salvadoran who registered for the Chivo Wallet. But many would soon find out ways to make much more money from a defective app.
“People very quickly learned that if they could show an El Salvador IP address, they could sign up for Chivo Wallet, get $30 completely for free as a gift for registering, and then withdraw that money immediately”, Overton said.
The process for registering included taking a picture of the Salvadoran ID card and hundreds of people denounced that their identification numbers had been used to register accounts in the Chivo Wallet. In December, NGO Cristosal filed a complaint representing 131 persons who had their identities stolen.
Overton said he worked nearly every day with Miguel Sabal, one of the many Venezuelan advisors to Bukele and right-hand man of the leader of the Venezuelan shadow cabinet in El Salvador, Sara Hanna. Reportedly more powerful than the cabinet of ministers, this tight ring of advisors close to the Venezuelan opposition has a hand in every major policy, from the pandemic handling to a now-defunct OAS-led Anti-Corruption commission to bitcoin. Sabal, said Overton, “was coming in(to) my office saying people were taking pictures of the wall, of potted plants when they would take the selfie for their personal identification”.
“We never pinned down the exact amount of fraud, but we estimated that between 10 to 20 percent of all of the registered users were fraudulent,” Overton said before the court.
According to official figures from the Salvadoran government, Chivo reached 4 million users in its first three months; based to the developer’s low-end calculation that 10 percent of the users were fraudulent, at least 400,000 profiles were used to collect a $30 bonus each, totaling $12 million in embezzlement of taxpayer money. “And the vast majority of that money had left the Chivo Wallet ecosystem,” said the developer. “So throughout my time in the project, fighting fraud was overwhelmingly the government's priority and consumed a lot of our time and resources.”
Although the government has pursued some forms of fraud in Chivo, no charges have been brought against anyone for stealing identities to collect Chivo, nor against any government official involved. There’s no official information about the total tally of wrongdoers or lost funds. In fact, there’s not even an official acknowledgment that any of this even happened.
How could it? This is the president who introduced himself to the U. N. General Assembly by taking a selfie and declaring the format of the conference obsolete. He launched an Innovation Secretariat —that had no role in the bitcoin project— and introduced himself to investors with an animation of himself descending from a UFO. His party also conducted its internal elections over the internet in July 2020, with some of the losing candidates alleging generalized fraud after the results were announced.
And still more than one form of fraud happened within Chivo.
Arbitrage, a practice that takes advantage of bitcoin’s highly variable price by buying fractions of bitcoin (nicknamed “sats”) and selling them when the price goes up, was one of them. Another of the many technical failures of Chivo was updating the bitcoin reference price just once per minute, so Chivo users could see the price variations in real-time but trade on Chivo when the frozen reference price was lower than the market one “and make half a percent or one percent on their money”, as Overton described.
“The government was hemorrhaging money,” the developer said, and offered the example of a user who started trading with $2,000 and ended up with $400,000. “Because the Chivo Wallet ecosystem did not offset market risk, that means that all of those guys' profits came from the government of El Salvador,” Overton said.
The result echoes what happened one year earlier, as the pandemic hit El Salvador, with another of Bukele’s subsidies: a $300 pandemic-relief check. The Salvadoran Court of Audits said that $30 million had been handed with unknown criteria.
Overton then described an “all-night marathon session writing code,” during which a developer made a mistake that allowed the exchange of one dollar to one bitcoin, while bitcoin’s price was around $60,000. “Miguel Sabal came into my office and directed me and said: I need this fixed today,” Overton recalls. He says Sabal “frantically” texted another member of the team to ask him what was happening because the amount of bitcoin going through the system was in excess of $10 billion.
On October 18, 2021, Chivo users reported a glitch that momentarily made them “millionaires”, according to their balances in the app. Chivo went offline that day, as Overton described in court: “We had to take the server completely off-line — we killed the entire system, just turned it off, and didn’t get it back on until about 7:30 in the morning”, he said.
Open Door for Money Laundering
Chivo’s problems didn’t end with Athena’s exit. On April 8, 2022, four users started moving funds from their Chivo Wallet to their bank accounts through a glitch that allowed them to send money without the app registering it, according to Revista Factum. This led the Salvadoran Attorney General to charge five people with computer theft and money laundering for the illicit transfer of $840,000.
But the accusations were handled in complete silence by Bukele’s hand-picked attorney general, rare secrecy for a government that heavily publicizes arrests for prosecutions ranging from organized crime to animal cruelty. In the case of Chivo Wallet, it was the government’s own decisions that made it vulnerable, according to Overton. “It was rife with fraud,” he said.
Brian Berknopf, the friend who had called Overton at the Miami Airport, is the managing director of U.S. operations for QA Consultants. The details of the firm’s contract with the Bukele administration, as those for every other company involved in the Chivo project, are not public. Bernknopf told his friend that Chivo code was written in a programming environment called Django and that “the government needs as many talented Django developers as it can possibly get ahold of right now.” The government, says Overton, was “extremely concerned about capability with a country of 6 million people, so they hired QA Consultants with the intent to use them for load testing,” a simulation of the real-life operation of the app.
Chivo Wallet, however, was never tested before release. “Because of stalling from Athena, they were never actually able to run those load tests,” Overton said.
At 9 pm on launch day, Bukele boasted on Twitter that Chivo was the “number 1 finance app” in the Apple App Store in El Salvador. But all the while, his untested app was falling apart.
“Within the first 150 sign-ups on the platform, the vendor for KYC compliance crashed. So the government of El Salvador made [decided] to eliminate the KYC vendor from the process so that the Chivo Wallet registrations could continue,” Overton testified. KYC means “know your client,” describing a series of standards designed to prevent money laundering, fraud, and other forms of crime. In the first chart of Chivo’s operations, the KYC provider was the Uruguayan company “Vu Security.” It was apparently their program that failed.
But Overton said the government “wanted to hit their 50,000-user initial launch point” at any cost. To achieve it, Overton said that they didn’t fix the KYC issue; they just turned it off.
Less than 48 hours after launching Chivo, they turned the know-your-client filter off.
This cannot be understated. Wilson Sandoval, the coordinator of the Salvadoran NGO Anti-Corruption Counseling Center (ALAC) and one of the lawyers who has led the charge in requesting public information about bitcoin implementation, said that the Chivo operators acted against every recommendation in the field.
“KYC allows client identification. By not doing it, money laundering or terrorism financing operations could be conducted in that time span, and we don’t know how long it lasted,” Sandoval said.
According to Sandoval, getting rid of these standards violates Salvadoran and international law. Specifically, he said that it goes against the New Technologies Recommendation of the Financial Action Task Force (FATF), the global anti-money laundering (AML) and counter-terrorist financing (CTF) standard, which states that “countries should ensure that virtual asset service providers are regulated for AML/CFT purposes, and licensed or registered and subject to effective systems for monitoring and ensuring compliance with the relevant measures called for in the FATF Recommendations”.
This is codified in Salvadoran Law. Article 13 of the anti-money laundering bill details eight fields of information about the client and the transaction that companies have to collect and send to the Attorney General for operations larger than $10,000.
Moreover, there are 55 Chivo ATMs in Salvadoran consulates in the United States. Since the registry was unsupervised, Chivo carved out a way to send money from the United States to any wallet user in the world without KYC regulations, for an unspecified amount of time.
Minimal Footprint in Remittances
While the Chivo Wallet has proved its capability for fraud and as a way to conduct unsupervised transactions, it has yet to live up to its main purported use-case: remittances.
Overton said two people gave him the “rationale behind the project”: Eric Gravengaard, Athena CEO and public-facing “father” of Chivo, and Lorenzo Rey, another Venezuelan advisor “functionally the government’s Chief Technology Officer,” though he holds no official post.
The plan, Overton said, is “100 percent focused on remittances and avoiding commissions from Western Union and similar services”. This was one of the Bitcoin Law's main objectives, according to the president and lawmakers. It hasn’t worked.
Crypto wallets received almost $30 million in remittances in September 2021, 4.5 percent of the market share, but it gradually declined and the figure has not exceeded two percent since. In October 2022, it was $10 million, or 1.5 percent.
Despite the meager results, the government was using Chivo as leverage to negotiate the fees of remittance commissions with the money-transfer company Western Union. “Eric told me about a conversation between Sara Hanna and Western Union where Western Union started negotiating on the remittance rates to El Salvador because they were feeling the financial pressure of people using the Chivo Wallet system,” Overton said.
In fact, according to Eric Gravengaard’s deposition in the same case, it was Hanna who told him, in the first week of November 2021, that he was being ousted from the Chivo project and that Overton had offered to take over and fix all the problems. In light of Overton’s allegations, problems might be just starting.
The trajectory of Chivo is not promising for a government that has its mind set on its next technological feat, one that has more implications than millionaire financial transactions. In October 2022, legislators passed a bill aimed to allow three million Salvadorans largely residing in the United States to vote via the internet in the 2024 general elections, just in time for another novelty: Bukele has announced, despite an explicit constitutional ban, that he will run for reelection.
