1. People couldn't buy BAT to send at the time (Dec. 2018) of the Tom Scott affair, all the tokens were virtual from our user growth pool, subject to our terms. No user funds. This does not excuse the right-to-publicity infringement that I addressed in another comment replying to you, at https://news.ycombinator.com/item?id=42379166, but that wasn't your false claim here, so stick to your "collects money" canard, please.
2. Again with "secretly modifies referral links" canard. No, not "links", exactly two typed in domain names in the address bar, and no one can keep a secret with a URL attribute you can see in the same address bar, via devtools, and with network monitoring; https://news.ycombinator.com/item?id=42354392. Think through your own argument more, please — no ready-fire-aim.
3. Injecting ads would be noticed by users, but you won't find anyone who ever saw us "replace" or "inject ads into websites". We tested the tech with placeholders on Slashdot in early 2016, but the placeholders were not ads and the test ended. Lack of evidence is enough here under normal rules of reality and discourse, or else this is an "are the ad injectors in the room with us now?" joke.
We'd have been roasted and likely sued if we had done any such "replace" or "inject" thing without publisher opt-in. Again, I urge you to think through your criticisms before replying carelessly.
EDIT: I'd forgotten about the NAA's "cease and desist" letter sent in April 2016, which was not actually a C&D even though its PDF filename called it that, because we never did anything to cease or desist from. See
The NAA (now News Media Alliance) complaint to us, misnamed a Cease & Desist Letter, went away. Later in 2016, this same group tried complaining to the FTC about Brave and Opera, see https://www.lexology.com/library/detail.aspx?g=a802b19a-7ba0.... That complaint also went nowhere.