We study how attempts to regulate cryptocurrencies, or at least to mitigate the harm they do, are misdirected. We started by looking at how one might blacklist stolen bitcoin, and find that two established legal principles – the nemo dat rule and the Clayton's case precedent -- make tracing crime proceeds much simpler than researchers previously thought; they support a first-in first-out rule for taint tracking, which turns out to be much more efficient. However once we published initial results and were approached by theft victims, we discovered a more serious problem. Many bitcoin exchanges do not now give their customers actual bitcoin, but rather do off-chain transactions with other exchange customers or transact on customers' behalf with outsiders. Except where customers withdraw cryptocurrency into self-hosted wallets, the ownership of these assets is unclear. The number of off-blockchain transactions has increased enormously in the last eighteen months; we can't find good figures but the volume is sufficient to raise serious concerns and the practice falls under e-money regulations that are not being enforced. In short, the security, economics and regulatory problems of cryptocurrencies in 2018 turn out to be rather different from those described in the academic literature. The real problem is that we are seeing the emergence of a shadow banking system. Cryptocurrencies do not solve the underlying problems that made bank regulation necessary, and we sadly predict that many of the familiar second-order problems will also reappear. We discuss the implications for regulating cryptocurrencies and smart contracts more generally, and suggest eight things that regulators and central banks might usefully do.