o0 --BRIAN J. STRETCH (CABN 163973) A, (as United States Attorney r, ,0 . 63%: . )7 Q) BARBARA J. VALLIERE (DCBN 439353) 42; 49,; Chief, Criminal Division (Augie, ?51? . Ul?'ib?dj WIL FRENTZEN (LABN 24421) . . Assistant United States Attorney 450 Golden Gate Avenue, Box 36055 San Francisco, California 94102-3495 Telephone: (415) 436-6959 Page (415) 436?7234 35};ng BY QOUET QHQER Attorneys for?the United States - UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION UNITED STATES OF AMERICA, CASE NO: CR 15-00227 SI . Plaintiff, UNITED MOTION TO SEAL SUPERSEDING INDICTMENT, ARREST v. WARRANTS ORDER . CANTON BUSINESS CORPORATION, UNDER SEAL and ALEXANDER VINNIK. Defendants. I MOTION TO SEAL 1 The United States hereby moves the Court for an order sealing this Motion and Order, Arrest 2 Warrants and the Superseding Indietrnent. The government believes that if the defendants are made aware of these documents before they are arrested, that they may make e??orts to avoid being arrested. Date: January 12, 2017 Respectfully Submitted, BRIAN . STRETCH United Statee Attorney wimM FRENTZEN Assistant United States Attorney hm Based upon the foregoing request, the Court hereby ORDERS that this Motion and Order, Arrest Warrants and the Superseding Indictment shall be ?led and kept under sea] by the clerk of the Court Imtil further order of the Court. The Court hereby ?trther'ORDERS that any representative of the United States Attorney?s O?ice or the Internal Revenue Service, shall be allowed to obtain a copy of the Superseding Indictment without further order of the Court. SALLIE KIM UNITED STATES MAGISTRATE JUDGE Dated: Jantaty?, 2017 matron to SEAL ?Hm'teh Qtatw EBiEtrirt Qtnurt FOR THE ?i NORTHERN DISTRICT OF e. ED VENUE: SAN FRANCISCO 7 3 03:. . Pkg-m. 8 . 15 a. $571.5 ?1330? UNITED STATES OF AMERICA, 04. SEALED V. 3? men's? mega ?ew" 9022;236?; BTC-E, NKIA CANTON BUSINESS CORPORATION and ALEXANDER VINNIK. DEF EN SUPERSEDING INDICTMENT 1B U.S.C. 1960 - Operation of an Unlicensed Money Service Business; 13 U.S.C. 1956011- Conspiracy to Commit Money Laundering; 18 U.S.G. 1956(a](1) - Money Laundering; 13 U.S.C. 195? - Unlawful Monetary Transactions: and 1a U.S.C. 982(a}(1) - Criminal Forfertune A true hill. 5? - leereman F. . . '7 :51 lied 1n open cqurt this i day of . . ?uent/Ir; . 7 Clerk 9v rm a Bail. A0 25! (Rev. 6175} BY: CI COMPLAINT INFORMATION INDICTMENT SUPERSEDING DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN US. DISTRICT COURT Name of District Court. andi'or Judgeitilagislrate Location NORTHERN DISTRICT OF CALIFORNIA this personiprowedlng Is transferred from another district 93" (Girdle one) 2D. 21. or 40. Show District this is a repmseoution of charges previously dismissed which were dismissed on motion SHOW 01". U.S. ATTORNEY DEFENSE this prosecution relates to a pending ease involving this same defendant prior proceedings or appearancets) before us. Magistrate regarding this defendant were recorded under DOCKET NO. MAGISTRATE CASE NO. OFFENSE CHARGED SAN FRANCISCO DIVISION USE. 1960- Operation of an Unlicensed Money Service Business; 18 U.S.C. 5 Width} - Conspiracy to Commit Money Laundering; 13 uses Laundering; MW v? DEFENDANT - u.s ra l957 - Unlawful Monetary Tran sections; and Misde- 1ausr: Forfeiture meanor ETC-E. WA CANTON BUSINBS CORWON I . onir DISTRICT COURT NUMBER PENALTY: Please see attachment. - $160022? 5 do 0 44; EALEB were 2 COURT GODS 9 or .e . DEFEND PROCEEDING IS NOT IN CUSTODY o?qfof Has not been arrested. endin outoom rocaed?n . Name of?omplalntant Agency, or Person (a Title, if any) 1) if not detained give datepany pg? 4 I 9 Internal Revenue Service summons was served on above charges . person is awaiting trial in another Federal or State Coon, 2} Is a Fugitive give name of court 3) Is on Ball or Release from (show District) IS IN CUSTODY 4) On this charge 5) On another conviction Federal State 6) Awaiting trial on other charges If answer to (6) is ?Yes". show name of Institution Has detainer I: Yes '2:ng been ?led? CI ND glad DATE OF MonthiDainear ARREST IfAn?esting Agency at Warrant were not DATE TRANSFERRED Monthroaerear Name and Of?ce of Person FurniShing Information on this form BRIAN J. STRETCH glue. Attorney OlherU.S.Agancy Name of Assistant U.S. Attomay [If assigned} WILLIAM FHENTZEN PROCESS: El summons 1] no It Summons. complete following: Arraignment initial Appearance Defendant Address: Comments: ADDITIONAL INFORMATION OR COMMENTS TO U3. CUSTODY CI This report amends no 257 previoust submitted Bail Amount: Where defendant previously apprehended on compiaint, no new summons or warrant needed. since Magistrate has scheduled arraignment Datefi'i'rne: Before Judge: ATTACHMENT TO PENALTY SHEET CANTON BUSINESS CORPORATION COUNT ONE: (13 use. ?1950 - Operation nfan Unlicensed Money Service Business) 5 years imprisonment COUNT TWO: (18 U.S.C. 1956(h) Conspiracy to Commit Money Laundering) Not more than 20 years imprisonment; not more than $500,000 ?ne or twice the value of the property involved in the transaction, whichever is greater; not more than 3 years of supervised release; and a $100 special assessment COUNTS THREE THROUGH NINETEEN: (13 U.S.C. 1956(a)(1)(A)(i) and - Money Laundering) Not more than 20 year's imprisonment; not more than $500,000 ?ne or twice the value of the property involved in the transaction, whichever is greater; not more than 3 years of supervised release; and a $100 special assessment COUNTS TWENTY THROUGH TWENTY-ONE: (13 U.S.C. 1957 Engaging in Unlawful Monetary Transactions) Not more than 10 years imprisonment; not more than $500,000 ?ne or twiee the value of the property involved in the transaction, whichever is greater; not more than 3 years of supervised release; and a $100 special assessment. FORFEITURE (18 U.S.C. 932(a)(1) Criminal Forfeiture) Ace-.7 (Rev. B?tt] I DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U.S. DISTRICT COURT er: El COMPLAINT INFORMATION INDIGTMENT IZI SUPERSEDING OFFENSE CHARGED rs uses WED?Operation ofan Unlicensed Money Service Petty Business: 13 tl.S.C. 5 1955th - Conspiracy to Commit Money Lamdenng; re use resistant} -Monev Laundering; Minor 18 USE. 5 195?- Unlawlirl Monetary Transactionsssttaim - Criminal Forfeiture minor El Felony Please see attachment PROCEEDING Name of Complaintant Agency. or Person (5. Title. if any) lntemal Revenue Service person is awaiting trial in another Federal or State Court. give name of court - this personi'proceeding is transferred from another district per (circle one) so. 21, or 49. Show District this is a reprosecution of charges previously dismissed which were dismissed on motion SHOW of: coma ND. U.S.A1TORNEY El DEFENSE this prosecution relates to a pending case invohring this same Name of District Court. andior Location NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION DEFENDANT - u.s . ALEXANDER counr NUMBER CR 16-00227 SI DEFENDANT IS NOTIN CUSTODY Has not been chested. pending outcome this proceemng. 1) If not detained give date any prior summons was served on above charges 2) is a Fugitive 3) is on Bail or Release item [show District) IS IN CUSTODY 4) On this charge 5) On anotl'ier conviction . Federal State 6) Awaiting trial on other charges if answer to is-"Yas". show name of institution If ?Yes" give date ?led Monlthayf?t?ear Has detainer Yes been ?led? No DATE OF ARREST if Arresting agency tit Warrant Were not DATE TRANSFERRED Montht?Dayf't? ear TO U.S. CUSTODY defendant MAGISTRATE . CASE NO. prior proceedings or appearance-(s) before U.S. Magistrate regarding this . defendant were recorded under Name and Cities of Person Fumlshing Information on this form BRIAN J. STRETCH El U.5. Niamey Ott-ler LLS. Agency . Name of Assistant U.S. -Attomev [if assigned} WILLIAM FRENIZEN PROCESS: DSUMMONS NO WARRANT If Summons. complete following: Arraignment Initial Appearance Defendant Address: ADDITIONAL OR COMMENTS Bail Amount Wheredoi?ondant previoushr apprehendadon complaint. no new morons or warrant needed since Magistrate has schedufsd arraignment Datemma: This report amends A0 25? previoust submitted Before Judge: ATTACHMENT TO PENALTY SHEET ALEXANDER VINNIK COUNT ONE: (18 U.S.C. ?1960 Opera?on of an Unlicensed Money Service Business) 5 years imprisenment COUNT TWO: (18 U.S.C. 195601) Conspiracy to Commit Money Laundering) Not more than 20 years imprisonment; not mere than $500,000 ?ne or twice the value of the property involved in the transaction, whichever is greater; not more than 3 years of supervised release; and a $100 special assessment COUNTS THREE THROUGH NMETEEN: (13 U. S. C. 1956(a)(1)(A)(i) and - - Money Laundering) Not morethan 20 years imprisonment; not more than $500,000 ?ne or twice the value of the property involved in the transaction, whichever is greater; not more than 3 years of supervised release; and a 3100 special assessment COUNTS TWENTY THROUGH TWENTY-ONE: (18 U. C. 1957? ?Engaging' 1n Unlaw?il Monetary Transactions) Not more than 10 years imprisonment; not more than $500,000 ?ne or twice the value of the property involved in the transaction, whichever is greater; not more than 3 years of supervised release; and a $100 special assessment. soars ALLEGATION: (13 use. 982(a)(l) ?C1iminal Forfeiture) 2'3 24 -25 26 At all times releVant to this Indictnent: 1. Since at least nonconnicteN 2011 through and including the present, both dates being it?: 1. 1 BRIAN STRETCH (CABN 163973) ?35! [3 United States Attorney ?1.56SEALED 7 BY COURT O?m I 8 UNITED STATES DISTRICT COURT 9 . NORTHERN DISTRICT OF CALIFORNIA 10 SAN FRANCISCO DIVISION 11 UNITED STATES OF M16291, UNDER SEAL . 12. Plain??', CASE NO. CR 16-00227 SI - 13 v. . VIOLATIONS: 13 113.0. 1960 Operation Ofan Unlicensed Money Service Business; 18 .14 ETC-E, AIKJA CANTON BUSINESS 195601) ConsPicncy tO Commit Money CORPORATION, Lalmdeling; 18 s. (1. 1956(a)(1) Money 15 andenng; 18 U. s. (3. 1957? Unlawful Monetary k'and- Tiansac?ons; 18 U. s. c. ?ciiminn1 - 15 I Forfeitlre AIEXANDER . 1'7 SAN FRANCISCO VENUE . Defendanle. - - .13 1 19 SUPERSEDING INDIC ENT 20 - The Grand Jury charges: 21 - MRODUCTORY ALLEGATIONS 22 . approximate and inclusive, 'the defendant Opegated as one Of the world?s largest and most widely used digital cmrency Since ite inception, processed nevercl billion dollars worth of 27 monetary exchanges. was an exchange for cyberc?minals worldwide, and one of the principal . 28 entities used to launder and liquidate criminal proceeds from digital eun'eneies, including Bitooin, to ?at 1 ND 00 U1 ?Fl . MNMM including US. dollars, Euros, and Rubles. At all relevant times, the defendant ALEXANDER VINNIK, together with individuals known and unlmown, directed and supervised BTC- e's operations and ?nances. I 2. was an international money~laundering scheme that, by virtue of its business model, catered to criminals and to cybercriminals in particular. Through efforts, emerged as one of the principal means by which cyber criminals around the world laundered the proceeds of their illicit activity. facilitated crimes, including computer hacking and ransomware, fraud, identity theft, tax refund fraud schemes, public corruption, and drug traf?cking. 3. laclred basic anti-money laundering controls and policies and, as such, was attractive to those who desired to conceal criminal proceeds as it made it more di?icult for law enforcement to trace and attribute funds. 4- Since its founding, received criminal proceeds of numerous computer intrusions ?l and hacking incidents, ransomware scams, identity theft schemes, corrupt public of?cials, and narcotics distribution rings. Among other things, accounts received substantial proceeds from the hack of the now-defunct Mt. Gox digital currency exchange and also received a substantial portion of the criminal proceeds from one of the largest ransomware schemes, 5. As described further below, the defendants and their co?couspirators, including those known and unknown to the Grand Jury, intentionally created, structured, and?operated as a criminal business venture, one designed to help criminals launder their proceeds and one: they themselves used to launder criminal proceeds. The defendants thus attracted and maintained a customer base that was heavily reliant on criminals. 6. Despite doing substantial business in the United States, was not registered as a Fiat currency is simply a currency established by government regulation or law, e.g. US. Dollars, Euros, Japanese Yen, British Pounds, Russian Rubles, Chinese RMB, etc. 2 money services business with the United States Department of the Treasury?s Financial Crimes Enforce-cut Network as federal law requires. As described further below, had no meaningful anti-money laundering processes in place and lacked an e?ec?ye anti-money laundering program, as federal law also requires. 7. This was in contrast to other registered digital currency exchanges that, through their anti-money laundering programs, sn-oye to avoid having their platforms used for criminal activity. Most of those exchanges described their operations down to listing the names, photos, and backgrounds of their management, the location of their businesses, and their regulatory compliance policies. 8. relied on the use of shell companies and af?liate entities that were similarly unregistered with and lacked basic anti?money laundering and ?Know Your Customer? policies. These entities catered to an online and worldwide customer base, and electronically ??nuled? ?at currency in and out of own website stated it was located in Bulgaria, yet II simultaneously stated it was subject to the laws of Cyprus. Meanwhile, managing shell company, CANTON BUSINESS CORPORATION, was based in the Seychelles but affiliated with a Russian phone number, and its web domains were registered to shell companies in countries including Singapore, the British Virgin Islands, France, and New Zealand. BACKGROUND 9. Bitcoin is aform of decentralized, convertible digital currency that existed through the use of an online, decentralized ledger system. 2 Bitcoin is just one of many forms of digital currency. There are many others, including litecoin, others, worldcoin, and dogecoin. However, bitcoin has the largest market capitalization of any present form of decentralized digital currency. 10. While bitcoin mainly exists as an Internet?based form of currency, it is possible to ?print out? the necessary information and exchange bitcoin via physical medium. The currency is not issued 2 Since Bitcoin is both a currency and a protocol, capitalization differs. Accepted practice is to I use ?Bitcoin? (singular with an uppercase letter B) to label the protocol, software, and community, and ?bitcoin? (with a lowercase letter b) to label units of the currency. That practice 15 adopted here. 3 1 by any government, bank, or company, but rather is generated and controlled through computer so?ware operating via a decentralized network. To acquire bitcoin, a typical user will purchase them ?-orn a Bitcoin seller or ?exchanger.? It is also possible to ?mine? bitcoin by verifying other users" transactions. Bitcoin is just one form of digital currency, and there are a signi?cant number of other varieties of digital currency. I - 11. Bitcoin exchangers typically accept payments of ?at currency (currency which derives its value ?om government regulation or law), or other convertible digital currencies. When a user wishes 99-44571th to purchase bitcoin from an exchanger, the user will typically send payment in the form of ?at currency, 9 often via bank wire or ACH, or other convertible digital currency to an exchanger, for the corresponding 10 ll quantity ofbitcoin, based on a fluctuating exchange rate. The exchanger, often for a commission, will 11 then typically attempt to-broker the purchase with another user of the exchange that is trying to sell 12 II bitcoin, or, in some instances, will act as the. seller itself. If the exchanger can place a buyer with a 13 seller, then the transaction can be completed. _14 12. When a user acquires bitcoin, ownership of the bitcoin is transferred to the user's bitcoin 15 - address. The bitcoin address is somewhat analogous to a bank account number, and is comprised of a 16 case-sensitive string of letters and numbers amounting to a total of 26 to 35 characters. The user can 1'7 then conduct transactions with other Bitcoin users, by transferring bitcoin to their bitcoin addresses, via 13 the Internet. 19 13. Little to no personally identi?able information about the payer or payee is transmitted in 20 a bitcoin transaction itself. Bitcoin transactions occur using a public key and a private key. A public 21 key is used to receive bitcoin, and a private key is used to allow withdrawals from a bitcoin address- 22 Only the bitcoin address of the receiving party and the sender?s private key are needed to complete the 23 transaction. These two keys by themselves rarely reflect any identifying information. 24 14. All bitcoin transactions are recorded on what is lmown as the blockchain. This is 25 essentially a distributed public ledger that keeps track of all bitcoin transactions, incoming and outgoing, 26 and updates approximately six times per hour. The blockchain records every bitcoin address that has ever received a bitcoin and maintains records of every transaction for each bitcoin address. 23 15. Digital currencies, including bitcoin, have many known legitimate uses. However, much 4 ll like cash, bitcoin can be used to facilitate illicit transactions and to launder criminal proceeds, given the ease with which bitcoin can be used to move funds with high levels of anonymity. As is demonstrated herein, however, in some circuinstances bitcoin payments may be effectively traced by analyzing the blockchain. BTC-E OVERVIEW 16. was founded in or about 2011- In the years it operated, has served approximately 700,000 users worldwide, including numerous customers in the United States and customers in the Northern District of California touts itself as ?a platform for individuals interested in buying and selling bitcoin using an assortment of world currencies;? in other words, a digital currency exchange. 17. Through the work of VTNNIK and others lcnown and unknown to the Grand Jury, became one of the primary ways by which cybercrirninals around the world transferred, laundered, and stored the criminal proceeds of their illegal activities. U.S. dollars and Russian rubles were the most ?'equently exchanged ?at currencies on the platform, while Bitcoin and litecoin were the most widely exchanged digital currencies. '13. Because such a signi?cant portion of business was derived from suspected criminal activity and given its global reach, the scope of the defendants? unlaw?Jl conduct was massive. During the relevant time?'ame from 2011 to December 30, 2015, bitcoin addresses associated with BTC- had received over 9.4 million bitcoin. Bitcoin?s rapidly ?uctuating exchange rate makes it dif?cult to determine the U.S. Dollar value of this quantity ot? bitcoin over time. However, using today?s bitcoin exchange rate, the total value of bitcoin received by over the course of its operation would be valued at over $9 billion. In 2016 alone, received over 1.3 million bitcoin, valued at over $1.7 billion at today?s exchange rate.3 3 This is calculated using the December 30, 2016 bitcoin trading value of approximately $962 per bitcoin. Since August 2011, the Bitcoiu market price has ?uctuated item a low of roughly $2 to a high 5 0-. I 1-4' LII LIJ sir-2M MM maw?n?aGET-?JE 26 27 23 19. Notably, the above ?gures only include bitcoin exchanged on the platform and do not even include the deposits and withdrawals made in other digital currencies, such as litecoin, nor do these ?gures take into account well over a billion dollars? worth of what is known as code.? code enabled a user to send audfor receive list currencies and digital currencies. to other users 20. I maintained its servers in the United States. The servers were one of the primary ways in which and the defendants eft'ectuated their operations. also used many third- party companies, including companies within the Northern District of California, to effectuate their operations and enable them to function. 21. At its inception, was one of a number of digital currency exchanges. It was engaged in the same line of business as other online digital currency exchanges in existence at the time, including Liberty Reserve. Liberty Reserve was a Costa Rica-based centralized digital currency service that laundered approximately $6 billion in criminal proceeds. It was shuttered in 2013 when its founder and six other individuals were charged with conspiracy to commit money laundering and with operating an unlicensed money transmitting business. Liberty Reserve?s website was seized by the US. I government.4 22. There was an overlap between many Liberty Reserve users and users. itselfwas a user of Liberty Reserve. 23. Another digital currency exchange in operation between 2011 and 2014 was the MTGOX Exchange Gox?) that was originally founded in San Francisco, but ultimately based in Tokyo, Japan. In 2014, Mt. Go'x collapsed, having been the target of a series of maj or intrusions that resulted in thefts totaling several hundred million dollars worth of bitcoin. In 2014, Mt. Gox ?led for bankruptcy in of approximately $1200 per bitcoin and has varied dramatically over time. v?I Japan. 24. After the collapse Of Liberty Reserve, and with the intrusions and accompanying issues that Mt. Gox experienced, rapidly grew. The volume of transactions it performed and its number of users expanded, ?lling the vacuum left by entities like Liberty Reserve and Mt. Gex. 29. ENTITIES AND INDIVIDUALS CANTON BUSINESS CORPORATION was a shell crime-ration used as a front for BTC?eis Operations. Like CANTON was not registered with Financial and other records demonstrate that CANTON was synonymous with a Russian national, was a primary bene?cial owner ?nancial accounts. Although CANT listed business address was in the Seychelles, it operated using a Russian telephone number. 30. - VleK also operated and controlled multiple accounts, including a account lorown as the account- The account was tied directly to administrator accounts. Numerous withdrawals ?'om administrator accounts went directly to bank accounts tied to VINNIK. . Another such administrator account associated with VINNIK was the ?Varnnedam? 5 account. The ?Warnnedarn? account was directly linked to the administrative, ?nancial, operational and support accounts, accounts to which only those involved in the operations of the enterprise would have had access. Proceeds from well-brown hacks and the?s from bitcoin exchanges and users around the world ?mded the Vamnedam account. Out of the Vamnedarn account, large payments were made to accounts associated with VINNIK. and others known and unknown to the Grand 'Jury, including a Russian national hereafter referred to as unindicted C0-CONSPIRATOR X, who is alleged to have access to the Vamnedam account. I FUNC 32. -To use one created an account by accessing the website. A user did not need to provide even the most basic identifying information such as name, date of birth, address, or other identi?ers. All that reduired was a usemame, password, and an email address. Unlike legitimate payment processors or digital currency exchangers, did not require its users to validate their identity information by providing of?cial identification documents, given that did not require an identity at all. 5 Vamnedam means will not give it to you? in Russian. 3 33. Thus, a user could create a account with nothing morerlthan a username and email 2 ll address, which often bore no relationship to the identity of the actual user. Accounts were therefore easily opened anonymously, including by customers in the United States within the Northern District of California. 34. At all times relevant to this Indicnnent, had no anti?money laundering andfor ?Know-Your-Customer" (KYC) processes and policies in place. As discussed above, collected virtually no customer data at all. Nor did or its shell companies ever register with or perform these functions on behalf. I 35. A user could fund a account in numerous different ways. One way involved ?mding the account with ?at currency that would be converted into digital currency, such as bitcoin. II With ?at currency, a user could initiate a wire transfer from a ?nancial institution made directly for the bene?t of to an account at another ?nancial institution, which was routed to a bank account maintained by one of shell or a?iliated companies. 36.? Another way involved funding a account udtb. a user?s existing digital currency. A user with existing digital currency, such as bitcoin, could fund a account directly via bitcoin deposits. users could also purchase code? that could be sent and exchanged amongst users. code enabled a user to send and/or receive fiat currencies and digital currencies to other users. This served as another conduit for money laundering as it allowed customers to withdraw ?mds from their account and transfer them to other users anonymously. 37. business model obscured and anonymiaed transactions and source of For example, a user could not fund an account by directly transferring money to itself, but rather had to wire funds to one of shells or affiliate entities. Nor could users withdraw funds from their accounts directly, such as through an ATM withdrawal. Instead, users were required to make any deposits or withdrawals through the use of third-party ?exchangers," thus enabling to avoid collecting any information about its users through banking transactions or other activity that would leave a centralized ?nancial paper trail. 38. Once a user funded an'account with the user could then do any number of things: conduct transactions with other users; exchange digital currency into ?at currency; or simply use to store digital currency deposits, much like a bank. 39. Like other digital currency exchanges, charged transaction fees for their services. charged a percentage fee every time a user transferred funds held in to another user through the system. In addition, charged a percentage fee every tinte a user used to exchange digital currency held in a account into ?at currency)5 40. In- addition to the fees charged, users were charged additional fees by . each taking a percentage of the funds exchanged. These added fees were associated with getting money in and out of the platform through these funding mechanisms, mechanisms that obfuscated the true sender of the currency. 41. Those engaged in criminal activity using gravitated to because of the site?s lack of anti-money laundering and ?Know-"ifour-Customer? processes in place that could have them rcported to the government. Criminals who used to launder funds were also willing to go to the extra trouble of wiring money offshore to entities that operated through shell companies. 10 .l 42. made a series of self-serving public statements, designed at least in part to de?ect the attention of law enforcement and regulators. For example, despite advertising on their website that require our clients to verify identity by providing [sic] scanned copy of ID and scarmed copy of utility bill or a bank statement which should not be older then [sic] 6 month. Copy should be in good resolution and colored,? this process was not in fact followed. -As discussed, no customer identi?cation whatsoever was required to set up accounts, including accounts set up by customers in the Northern District of California. 43. Lilcewise, the website advertised that don?t accept any more international . wire transfers aem?Us Citizens or from US Bank.? This, too, was raise. Through its elaborate funding mechanisms, did in fact knowingly accept Wire transfers from banks in the us. and made by U.S. citizens. CRIMINAL DESIGN 44. As described above, system was designed so that criminals could accomplish ?nancial transactions with anonymity and thereby avoid apprehension by law enforcement or seizure of funds. was in fact thus used extensively for illegal purposes, and, particularly since the collapse - of entities like Mt. Great and Liberty Reserve, it ?mctioned as the exchange of choice to convert digital currency like bitcoin to frat currency for the criminal world, especially by those who committed their crimes online. . 45. The defendants were aware that ?rnctioned as a money laundering enterprise. Messages on its own forum openly and explicitly re?ected some of the criminal activity in which the users on the platform were engaged, and how they used to launder funds. 46. users established accounts Under monikers suggestive of criminality, including monikers such as ?Cocainechboys,? ?blackhathaclters,? ?dzkillerhacker,? and ?hacker4hire.? 4'7. This is not surprising because criminals used to launder criminal proceeds and 11 1 transfer ?mds among criminal associates. In particular, it was used by hacking and computer intrusion rings operating around the world to distribute criminal proceeds of their endeavors. It was also used by rings of identity thieves, corrupt public of?cials, narcotics distribution networks, and other criminals. 48. In fact, some of the largest known purveyors of ransomware used as a means of storing, distributing, and laundering their criminal proceeds. Ransomware is a criminal scheme in which cybercriminals orchestrate the unwanted malicious download of software on an unsuspecting victim computer. It works as followsf once a victim is infected with the malicious software, often by no ND clicking on a fraudulent email, the ransomware will multiple files types on victim machines and 10 hold those ?les for ransom, requiring the victim to pay the administrators of the ransomware scheme in 1 1 12 order to have their ?les Victims that pay the ransom are able to their ?les by using a stand-alone program provided by the ransomware administrators after the ransom payment has been 13 14 made. The method of implemented by the ransomware, if properly executed, renders it impossible for victims to their ?les in any other way. The most prevalent payment 15 15 method accepted by current purveyors of ransomware is bitcoin. 1? 49. One such ransomware scheme, was distributed by methods including 18 fraudulent and phishing emails: was one of the most infamous varieties of ransomware and 19 has infected a vast number of computers across the world. During the timeframe relevant to this 20 Indictment, the purveyors of deposited and laundered many hundreds of thousands of 2] . 22 23 50. So, too, did a pair 'of corrupt US. federal agents, Carl Mark Force and Shaun Bridges, use dollars? worth of ransom payments into 24 to launder their criminal proceeds. Their experience with the criminal underworld taught them 25 that using as opposed to a registered exchange with anti-money laundering policies, would 26 maximize their chances of being able to conceal criminal proceeds. Each therefore sent several hundred 27 . thousand dollars in criminal proceeds derived ?-om crimes ranging from theft of government property 28 . i2 23] lMt. Gox su?'ered. to extortion to, the platform for laundering. 51. also served as the receptacle and transmitter of criminal funds from a series of well-publicized computer intrusions and resulting thefts, including the well-publicized thefts ?'om the Japan-based Mt. Gox exchange. As discussed below, a sizable portion of the stolen Mt. Gox ?mds were deposited into accounts controlled, owned, and operated by and by defendant and - others known and unlmown to the Grand Jury. 52. The Mt. Gox exchange was the subject of a series of computer intrusions and resulting thefts between approximately September 2011 and May 2014, in violation of Title 18, United States Code, Section1030(a)(d). Several hundred millions dollars? worth of bitcoin was stolen, including from numerous customers in the US. and within the Northern District of California. After the thefts, some I approxirnately 50 0,000 of the bitcoin (worth hundreds of millions of dollars) stolen ?om Mt. Gox was i deposited into wallets at three di??erent digital currency exchanges: (ii) Trade Hill, another exchange based in San Francisco; and back into Mt. Gox into a different Mt. Gox wallet. 53. Of this 530,000 bitooin, 7 300,000 of it was sent directly to three separate I accounts: ?Varnnedam,? ?Gnnbit,? and ?Petr.? These accounts were all linked to each other. 54. Meanwhile, blockchain analysis reveals that the stolen Mt. Gox funds that went to Trade Hill and back into the other Mt. Gox accountwere controlled by a user who also controlled at account called At all times relevant to this Indictment, defendant VINNIK. exercised control over the account. I 55: The ?Vamnedar?n,? ?Gnubit,? ?Petr,? and accounts were each directly linked'to a variety of different administrative accounts, accounts for which only administrators andfor operators would have had access. The ?Varnnedam? account was similarly a 5' The amount of bitcoin stolen from Mt. Gox accounted for just under half of the total thefts that 13 56. along with others known and unknown, controlled and operated the ?Vamnedam? account. Between approximately August 2013 and November 2015, CO- CONSPIRATOR and identities linked to VWNIK and to received direct payments from the ?Vamnedam? account to their own personal digital currency accounts at another digital currency exchange, Bitstamp. These bitcoin were then exchanged into ?at currency and sent to bank accounts in I Cyprus and Latvia tied to VINNIK and other identities associated with and STATUTORY ALLEGATIONS COUNT ONE: (18 U.S.C. 1960 Operation of an Unlicensed Money Transmitting Business) 57. The factual allegations in paragraphs 1 through 60 are rte?alleged and incorporated herein as if set forth in full. 58. Title 18, United States Code, Section 1960, makes it a crime to operate an unlicensed money transmitting business. The term money transmitting includes ?transferring ?lnds on behalf of the public by any and all means including but not limited to transfers within this country or to locations abroad by wire, check, draft, facsimile, or courier.? This statute makes it a violation to conduct a I ?money transmitting business? if the business is not registered as a money transmitting business with the Secretary of the Treasury as required by a separate statute, Title United States Code, Section 5330 and federal regulations pursuant to that statute. 59. The regulations Speci?cally apply to foreign-based money transmitting businesses doing substantial business in the United States. S+ee C.F.R. 10101006306), 1022.3 60. From in or about 201], up to and including in or about May 2016, both dates being approximate and inclusive, in the Northern District of California and elsewhere, the defendants, a/lda CANTON BUSINESS CORPORATION, and ALEXANDER VINNIK, I and others known and unlmown to the Grand Jury, knowingly conducted, controlled, managed, supervised, directed, and owned all and part of a money transmitting business affecting interstate and fereign which failed to comply with the money transmitting business 14 neuronal-om mamma-mg?gagrsamzm?z?a registration requirements set forth in Title 31, United States Code, Section 5330, and the regulations prescribed pursuant to that statute, including 31 C.F.R. Sections (5) and 1022.3 30(a)t2); and (ii) otherwise involved the transportation and transmission of funds known to the defendants to have been'derived from a criminal offense and intended to be used to promote and support unlawful activity. All in violation of Title 18, United States Code, Sections 1960 2- COUNT TWO: (18 USC. 1956(h) - Conspiracy to Commit Money Laundering) 61. The factual allegations in paragraphsl through 60 are re-alleged and incorporated herein as if set forth" in full. I 62. From in or about July 2011, through in or about January 2017, both dates being approximate and inclusive, within the Northern District of California, and elsewhere, the defendants; elk/a CANTON BUSINESS CORPORATION, and ALEXANDER VINNIK, and others known and unknown to the Grand Jury, willfully and knowingly did combine, conspire, confederate, and agree together and with each other to knowingly conduct and attempt to conduct ?nancial transactions affecting interstate'commerce and foreign commerce, which nansactiOns involved the proceeds of speci?ed unlawful activity, that is, operation of an unregistered money transmitting 'husiness in violation of Title '1 8, United States Code, Sections 1960: computer hacking and intrusions in violation of Title 18, United States Code, Section 1030; identity the? in violation of Title 18, United States Code, Section 1028; interstate transportation of stolen property in violation of Title 18, United States Code, Section 2314; theft of government proceeds and extortion in violation of Title 18, United States Code, Sections 641 and 195]; and narcotics in violation of Title 21, United States Code, Section 841; with the intent to promote the carrying on of the speci?ed unlawful activity, and that while conducting and attempting to conduct such ?nancial transactions, knew that the property involved in the-?nancial transactions represented the proceeds of some form of unlawful activity, in violation of Tide 18, United States Code, Section All in violation of Title 18, United Stems Code, Section 195601). '15 2 COUNTS THREE THROUGH NINETEEN: (18 U.S.C. and - Money 3 Laundering) 4 On or about the dates described below, in the Northem District of California and elsewhere, the 5 defendant, is ALEXANDER VINNIK, 7 aided and abetted by others, known and to the Grand .1 my, did knowineg conduct and attempt 8 to conduct the listed ?nancial transactions affecting interstate and foreign commerce which involved the 9 proceeds of a speci?ed unlawful activity, that is accessing a computer in of ?end, in 10 violation of Title 18, United States Code, Section 1030(a)(4) and with the intent to proniote 11 the carrying on of said speci?ed unlawful activity, and knowing that the transaction was designed in 12 whole and in part to conceal and disguise the nature, location, source, ownership, and proceeds of said 1'3 speci?ed unlaw?il activity, and that while conducting and attempting to conduct such ?nancial I 14 transaction, knew that the property involved in the ?nancial transaction represented the proceeds of 15 some form of unlaw?ll activity- 16 - COUNT DATE AMOUNT AMOUNT TRANSACTION 17 (ETC) (05D) . ?1 THREE 0112312012 90 ETC $567.00 Transfer of ETC into Tradehil] 13 FOUR 0112312012 83 ETC $522.07 Transfer into Tradeh?l 11 FIVE 0112312012 61 ETC $3 83.69 Transfer of BTC 1000 Tradehill 19 3131 0112412012 91 are $57330 Transfer of arc into Tradehill SEVEN 01112412012 90 BTC $567.00 TIaHSfer into Tradehill 20 EIGHT 0112412012 99 FIG $623.70 Transfer into Tradehill NINE 0112412012 533 ETC $3,357.90 Transfer of ETC into Tradehill 21 TEN 0112412012 1900 are $11,970.00 Transfer into Tradehil] ELEVEN 0112412012 579 BTC $3,647.70 Transfer into Tradehill . 22 TWELVE 0112412012 21311: $12.00 name: into Tradehill THIRTEEN 0112712012 1000 BTC $5,290.00 Transfer (1me into Tradehill FOURTEEN 0 112712012 1500 BTU $7,935.00 TraIISfer of ETC 'mto Tradehill 24 mm 0210112012 1000 ETC $5,820.00 Transfer into Tradehill I 1 SIXTEEN 0210112012 1000 ETC $5,320.00 Transfer of ETC into Tradehill 25 SEVENTEEN 0210512012 3000 BTC $17,040.00 Transfer into Tradehill EIGHTEEN 0210512012 500 ETC $2,340.00 Transfer of BTC into 'I?radehill 26 NWETEEN 0211212012 2000 BTC $11,200.00 'I?ranSfer of BTC into Tradehili violation of Title 18, United States Code, Sections and 2. 28 . 1 6 weev-Jcnmesmuw PU 1?1 COUNTS TWENTY THROUGH TWENTY-ONE: (18 1957 Engaging in Unlawful Monetary Transactions) On or about the dates described below, in the Northern District of California and elsewhere, the defendant, ALEXANDER VINNIK, aided and abetted by others, lcnown and unknown to the Grand Jury, did knowingly engage and attempt to engage in the listed monetary transactions by through or to a ?nancial institution affecting interstate and foreign commerce in criminally derived property of a value greater than $10,000, that is the transactions listed below, such property having been derived item a speci?ed unlawful activity, that is accessing a computer in furtherance of fraud, in violation of Title 13, United States Code, Section 1030(a)(4) and COUNT . oars AMOUNT AMOUNT TRANSACTION - (BIC) (USD) TWENTY 02:05:2012 3000 BTC $17,040.00 Transfer orsrc into Tradehill TWENTY-ONE 02:12.2012 2000 are $11,200.00 Transfer into Tradehill Allin violation of Title 18, United States Code, Sections 1957 and 2. FORFEITURE ALEGATION: (18 U. S.C. 932(a)(1) Criminal Forfeiture) 63. All of the allegations contained in this Indictment are re-alleged and by this reference fully incorporated herein for the purpose of alleging forfeiture pursuant to the provisions of Title 18, United States Code, Section 932(a)(l). 64. Upon a conviction for any of the offenses alleged in this Indictment, the defendants, a?da CANTON BUSINESS CORPORATION, and ALEXANDER VINNIK, shall forfeit to the United States pursuant to 18 U.S.C. ?i982(a)(1) any property, real or personal, involved in those o?'enscs or any property traceable to such offenses including but net limited to a forfeiture money judgment. '1 If any of the aforementioned property, as a result of any act or omission of the defendants 2 ?ii 3. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third person; 4 c. has been placed beyond the jurisdiction ofthe Court; 5 d. has been substantially diminished in value; or 6 e. has been oommingled with other property that cannot be divided without 7 . dif?culty; 8 i. any and all interest the defendant has in other property shall be vested in the United States and 9 forfeited to the United States pursuant to 21 U.S.C. 853 as incorporated by 18 U.S.C. 10, - Ali in violation of Title 18, United States Code, Section 982(a)(1) and Rule 32.2 of the Federal 11 Rules .of Criminal Procedure. 12 DATED: A TRUE BILL 13 1 17 14 15 OREPERSON 16 ?7 BRIAN J. STRETCH 18 United States Attorney 20 BARBARA J. VALLIERE 31 Chief, Criminal Division 22 23 _(Approved as to form: 41% WILLIAM FRENTZEN 24 HAUN 25 Assistant U.S. Attorneys 26 27 28 INDICTMENT I 13 Mg? BE Ea- UNITED STATES DISTRICT COURT cO?w NORTHERN DISTRICT OFCALIF A ORNIA CREVIINAL COVER SHEET Efecfz?ve November I, 2016, this Criminal Cover Sheet must be compieted mdsubmi?ed dong with the Dgfendam Infomza?on Form for each new minimal case. CASE NAME: Canton Business Corpqration CASE NUMBER: USA V. and Vipnik CR 16-00227 SI Is This Case Under sat? . . Yes? No I Total Number of?efmiiantsmore Does this case involve ONLY charges Ya: No I under 8 11.8.6. 1325 1326? Venue (Per Crim. LR. 18-1): SF OAK SJ Is this a potential high-cost case? Yes lilo Ya Is this a RICO Act gang-case? Yes No William Frentzen - DateSnbmitte?h 01:17am? -Comments: . RESET FORM - SAVE PDF Form WORM-COVER (Rev. 111%) ORIGINAL FILED. UNITED STATES DISTRICT COURT .. . DISTRICT OF NEW JERSEY 3 1, LEDA DUNN WETTRE IN THE MATTER OF THE SEARCH OF Mag. No. 17-3123 INFORMATION ASSOCIATED WITH SERVERS CONTAINING RELATED CONTENT STORED AT THE PREMISES CONTROLLED BY EQUINIX SEALING ORDER Leda Dunn Wettre This matter having been brought before the Court upon application of William E. Fitzpatrick, Acting United States Attorney for the District of New Jersey [Jason S. Gould, Assistant United States Attorney, appearing), for an order sealing the search warrant issued on this date and the application and attached Affidavit in support of that warrant, and for good cause shown, IT IS on this let Day ofJuly 2017, ORDERED that the search warrant, the application and affidavit in support of the search warrant, and all related documents, except for one copy of the search warrant and inventory to be served at the time the search is executed, be and hereby are sealed until further Order of this Court. 579.2%. Drown. 70% Hon. Leda Dunn Wettre United States Magistrate Judge