A warrant possibly means that they go out of business, because the servers are physically seized. If you tell me you'd risk that for a stranger who you can tell probably committed a crime, I don't believe you.
Not necessarily. A acquaintance of mine at an ISP always did that when police came knocking for "illegale pirating" allegations. His standard response was: Get a warrant or else I would commit a criminal offence (what he would have done).
Nearly never police came back with a warrant. And in the spare cases they did come back he did provide the data (if it was still available) and never did any equipment get seized.
Your friend is also a saint with cojones the size of cannon balls for doing that too.
In Poland the "take it all" strategy seems to be the default one, at least for private devices. There was once a case related to one Polish movie being shared on torrents that ended in 40 thousand confiscated PCs. The law firm hired by the movie studio gave the prosecution a list of 40 thousand IPs they said were pirating their client's movie. The prosecution gave a blanket warrant and the police got the people data from the ISPs, confiscated the computers and gave the law firm copy of the personal data so they could offer the 'pirates' a few hundred zloty settlements to not press charges.
C.f. frivolous DMCA on YouTube reviews and this case: https://news.ycombinator.com/item?id=14904149
So much for warrants when it comes to allegations of piracy.
Polish link for the 40k PCs case for anyone interested: https://www.dobreprogramy.pl/Juz-40-tys.-polskich-internauto...
That's a very very slippery slope. It is the job of the police to not look into data not related with the case, not yours.
Surrendering the info would be giving the police more power if anything since, they now can come and get data from anyone without a warrant (how do you even know that this account is dealing drugs other that "the police came looking for him"?).
Take a look at the transaction history. If there are transactions with known drug site wallets, give them the data they are asking for. Otherwise, request they get a warrant.
If you are going to cooperate, I think that's the most reasonable way to go about it.
Bitcoin exchanges are seen as dodgy anyway and they don't have a lobby to fight for them, so showing some way of cooperation while keeping everyone's (legal) interests in mind might be a good idea.
Why would the police be interested in destroying a legitimate business just because they want data for 8 users?
They can just as well get the warrant and then get the data the same way they did now.
Lavabit comes to mind. I'm sure there are other examples too.
Probably not because of one user, but when the cases pile up there's a good chance it'll raise questions about the legitimacy of their service.
When you earn your money by running said service, you are likely going to want to avoid that.