AO zt42 @ev. lUil) M furestWarrant UurBn H SEAL SrAngS DMTruCT COURT for the Northern District of California United States of America v. DANIL POTEKHIN, a/Ua "cronuswar,'and DMlTRll KARASAVI Dl, alV a Dmitriy Karasavidi ) ) ) ) CaseNo. CR-19-0572-CRB JLr -j. t"l \J ) ) (--\---::: zi-.i Defendant t-ft4 ARREST WARRANT To: Any authorized law enforcement officer :--c b YOU ARE COMMANDED to arrept and bring before (name a United States magistrate judge without unnecessary delay of person to be arrested) DMITRII IGRASAVIDI who is accused of an offense or violation based on the following document filed with the court: tr Indictment d Superseding lndicbnent 0 lnformation E Superseding Information O Complaint E ProbationViolationPetition E SupervisedReleaseViolationPetition UViolationNotice il OrderoftheCourt This offense is briefly described as follows: Defendants are charged with a number of counts associated with a sophisticated phishing campaign targeting users of Poloniex and Binance's virtual currency exchanges, resulting in a loss of at least $15.7 million worth of cryptocunency, and the subequent money laundering of the proceeds of the fraud. ox", vlNlwtp 's City and state "t * r,l^Jl * signature yYuox*1,,/+S'A* SPer" Return This warrant was received on (date) , and the person was arrested on (date) at (city and state) Date: Ar re s ting ofi cer's si gnahtre Printed name and title clM AO ,142 (Rev. 11/11) ArrestWarrant Uurpp SrarBs Drsrnrcr counUNDER SEAL for the Northern Distict of California United States of America v, ) DANIL POTEKHIN, a/]da "cronuswar," and DMlTRll KARASAVI D l, alkl a Dmitriy Karasavidi CaseNo. ) ) ) CR-19-0572-CRB ) ) :\f --4 1.1 i.r ,-.''; i -l Defendant ,, ARREST WARRAIYT To: i' " .---_ I l) -l'i '.): i. -, ..,-j ^.; A:ry authorized law enforcement officer 'i YOU ARE COMMANDED to arrest and bring before a United States magistrate judge withouUiinne*tdr.y delay arrested) DANIL POTEKHIN who is accused of an offense or violation based on the following document filed with the court: (name ofperson to be O Indicfinent C U, Probation Violation Superseding lndictuent Petition D Supervised O Information Release Violation E Superseding Information Petifion il Violafion Notice 0 Complaint D Order of the Court This offense is briefly described as follows: Defendants are charged with a number of counts associated with a sophisticated phishing campaign targeting users of Poloniex and Binance's virtual currency exchanges, resulting in a loss of at least $15.7 million worth of cryptocurrency, and the subequent money laundering of the proceeds of the fraud. Date vlql*w SPERO MAGISTRATE JT'DGE Is suing City and state: f, ofi cer's si gnatw e ch s nante and title Return This warrant was received on @atu) , and the person was arrested on (dote) At (city and state) Date Ar res ting ffi cer's s i gnatur Printed name and title e Wntte[ Stuter TBtgtrtrt {,ourt N.RTHER* u5ro$J15, "or,roRNrA UNDER SEAL VENUE: SAN FRANCISCO I': UNITED STATES OF AMERICA, V. F',EB l-::\ --.., iI I I l 2fi28 ri rrt ! :l;_itl:irlfi lJ.S. i!$Tr''i';'r COURT sufi CLIRi( l I\iCiTiii i.)liiTni0"i i'r eALiFORIllA DANIL POTEKHIN, a/luLlb 11 I.INITED STATES OF AMERICA, ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) t2 Plaintiff t3 14 15 DANIL POTEKHIN, aJW a "cronuswar," and DMITRII KARASAVIDI, alW a Dmitriy 16 Karasavidi 17 Defendants. 18 T9 20 2t SUPERSEDIN 22 23 18 U.S.C. $ 1030(b) - Conspiracy to Commit Computer Fraud and Abuse; 18 U.S.C. $$ 1030(a)(a) and (c)(3)(a) - Unauthorized Access to a Protected Computer to Obtain Value; 18 U.S.C. $ 1349 - Conspiracy to Commit Wire Fraud; 18 U.S.C. $ 1028A(a)(1) - Ag$avated Identity Theft; 18 U.S.C. $ 1956(h) - Money Laundering Conspiracy; 18 U.S.C. $$ 982(a)(2)(B) and 1030(i) and O, and 981(a)(1)(C) and 28 U.S.C. $ 2a61(c) - Forfeiture Allegations SAN FRANCISCO VENUE INDICTMENT Backeround At all times relevant to this lndictment: 27 1. 2. 28 Federation 26 VIOLATIONS: The Grand Jury charges: 24 25 CASE NO DANIL POTEKHIN, alWa "cronuswar," is a resident of the Russian Federation. DMITzuI KARASAVIDI, alWaDmitriy Karasavidi, is a resident of the Russian SI.]PERSEDING INDICTMENT I 2 J 4 5 6 7 8 9 3. Poloniex, LLC ("Poloniex") is a digital curency exchange platform based in Wilmington, Delaware. 4. 5. Bithex is a digital currency exchange platform, based in Seattle, Washington. Binance is a digital currency exchange platform that was originally based in Hong Kong, China, and is currently headquartered in Malta. 6. 7. Bitfinex is a digital crrrency exchange platform based in the British Virgin Islands. Gemini Trust Company LLC ("Gemini") is a digital curency exchange platform based in New York, New Work. 8. Bitcoin ("BTC") is a form of decentralized, convertible digital crurency that exists io through the use of an online, decentralized ledger system, referred to as a "blockchain." While Bitcoin 11 mainly exists as an Internet-based form of currency, it is possible to "print out" the necessary l2 information 13 and exchange Bitcoin via physical medium. The currency is not issued by any govemment, bank, or company, but rather is generated and controlled through computer software operating via a l4 decentralized network. Bitcoin is typically acquired by purchasing it from a Bitcoin seller or 15 "exchanger." It is also possible to "mine" Bitcoin by verifying other users' transactions. Bitcoin is just t6 one form of digital cumency, and there t7 9. a.re many other varieties of digital curency. Bitcoin exchangers typically accept payments in the form of fiat curency (such as 18 dollars, euros, or other currency that derives its value from its support by governments), or other 19 convertible digital currencies. When a user wishes to purchase Bitcoin from an exchanger, the user will 20 typically send payment in the form of fiat currency, often via bank wire or ACH, or other convertible 2t digital currency to an exchanger, for the corresponding quantity of Bitcoin, based on a fluctuating 22 exchange rate. The exchanger, often for a commission, z) pwchase with 24 25 will then typically attempt to broker the another user of the exchange that is trying to sell Bitcoin, or, in some instances, will act as the seller itself. If the exchanger can place a buyer with a seller, then the transaction can be completed. 10. When a user acquires Bitcoin, ownership of the Bitcoin is transfeffed to the user's 26 Bitcoin address. The Bitcoin address is somewhat analogous to a bank account number, and is 27 comprised of a case-sensitive string of letters and numbers amounting to a total of 26to 35 characters. 28 The user can then conduct transactions with other Bitcoin users, by transferring Bitcoin to their Bitcoin SUPERSEDING INDICTMENT 2 Intemet. "Bitcoin address clustering" is a process that attempts to de-anonptze 1 addresses, via the 2 user by identifying all of the addresses that they control. J 1 1. a Little to no personally identifiable information about the payer or payee is transmitted in Bitcoin transaction itself. Bitcoin transactions occur using a public key and a private key. A public 4 a 5 key is used to receive Bitcoin, and a private key is used to allow withdrawals from a Bitcoin address. 6 Only the Bitcoin address of the receiving party and the sender's private key are needed to complete the 7 transaction. These two keys by themselves rarely reflect any identifying information. 12. 8 9 Digital currencies, including Bitcoin, have many known legitimate uses. However, much like cash, Bitcoin can be used to facilitate illicit transactions and to launder criminal proceeds, given the with which Bitcoin can be used to move funds with high levels of anonymity. ln some 10 ease 11 circumstances Bitcoin payments may be traced to accounts at traditional financial institutions using the 12 blockchain. 13 13. t4 is distributed 15 on a platform that uses "smart contract" technology. By definition, smart contracts are computer protocols that automatically enforce a pre-arranged negotiation between individuals t6 conducting 17 Ethereum ("ETH") is a digital crrrency that is open source, public, has a blockchain, and a 14. transaction. These protocols are also sometimes called self-executing contracts. The public ledger is the digital trail of the Ethereum blockchain, which allows anyone to of 18 track the movement of ETH. Smart contracts allow developers to create markets, store registries t9 debts, and move firnds in accordance with the instructions provided without any type of middle-man or 20 counterparty controlling a desired outcome. Smart contract technology is one of Ethereum's main 2t selling points and an important tool for companies or individuals executing trades on the ETH 22 blockchain. The ETH platform allows developers to build and deploy software and decentralized Z) applications using the blockchain protocol. The ETH blockchain protocol allows smart contracts to 24 operate without fraud, censorship, or third-party interference. 25 26 27 28 15. Gnosis is a platform built as a decentralized application on the Ethereum network. GNO is the digital currency token used on the Gnosis platform. 16. NEO, formerly called as AntShares, is China's first open source blockchain platform. GAS is the digital culrency token used to pay the cost of execution on the NEO blockchain. SUPERSEDING INDICTMENT 17. I Poloniex, Binance, and Gemini are exchanges that offer their users the ability to trade 2 digital currencies, such as BTC, ETH, GAS, and GNO via the Internet. Users of these exchanges could J access their accounts 4 store, access, move, or trade digital cturency. Poloniex places transaction limitations on certain 5 accounts. Where such limitations were in place at Poloniex, the tansaction limits could be increased by 6 linking their accounts to other accounts. 18. 7 with their email address and a unique password, and through this account, could The computer servers used by Poloniex, Binance, and Gemini in operating their 8 exchanges and user accounts were used to facilitate interstate and foreign commerce and 9 communication, including by interstate and foreign electronic signals, and constituted "protected 10 computers" as defined in Title 18, United States Code, Section 1030(e)(2)(B). The Conspuacv and Scheme to Defrrud 11 19. 12 13 As part of the conspiracy and scheme to defraud, the defendants used the Internet to launch a sophisticated phishing campaign targeting users of Poloniex, Binance, and Gemini's digital l4 crrrency exchanges. 15 The defendants purchased and deployed multiple websites that appeared to users to be the legitimate Poloniex, Binance, and Gemini digital crrrency exchanges. However, when users t6 would log into these fraudulent t7 of websites, the defendants were able to steal their credentials, in the form an email address, and their password information, enabling the defendants to control their actual 18 Poloniex, Binance, and Gemini accounts, withdraw some or all of their digital currency, and manipulate t9 the market for digital crurency. This resulted in losses of digital currencies valued at approximately $17 20 million for Poloniex, Binance, and Gemini customers, including customers in the Northern District of 2l California. 22 23 24 25 COUNT ONE 20. (18 U.S.C. $ 1030O) - Conspiracy to Commit Computer Fraud and Abuse) Paragraphs 1 through 19 of this Indictment are re-alleged and incorporated as if fulIy set forth here. 2I. Beginning at a time unknown to the Grand Jury, but no later than on or about June 8, 26 2017, and continuing through a date unknown, but at least through on or about April 15, 2018, in the 27 Northern District of California, and elsewhere, the defendants, DANIL POTEKHIN, and DMITzuI KARASAVIDI, 28 STIPERSEDING INDICTMENT 4 1 did knowingly and willfully conspire and agree with each other and with others, to commit computer 2 fraud and abuse, namely, with intent to defraud, accessed a protected computer used in interstate and J a foreign cofirmerce without authorization and exceeding authorized access, and by means of such conduct 4 furthered the below-described fraud and obtained something of value, in violation of 18 U.S.C. 5 $ 1030(aXa). 6 22. 7 accomplish the object and purpose of the conspiracy: a. 8 9 10 Using fraud, deception, and social engineering techniques to gain access to the user identification and passwords of victim users of the Poloniex, Binance, and Gemini exchange platforms; b. 11 t2 ln furtherance of the conspiracy, the defendants used the following manner and means to Using identification of others without lawful authority, and fictitious identities to create fictitious Poloniex, Binance, Gemini, and Bittrex accounts to facilitate the fraud scheme; c. 13 Using information obtained from victim customers of the Poloniex, Binance, and I4 Gemini exchange platforms to access their digital currency addresses and transfer cryptocurrencies 15 owned by the victims without authority; d. t6 Using unauthorized access to victim customer Poloniex accounts to manipulate t7 the digital currency markets and take advantage of the immediate increase in digital crrrency value to 18 their benefit; and e. 19 Using multiple digital currency addresses and clusters to deposit the stolen digital 20 currencies and using a layered process for withdrawal and deposits to conceal the nature, source, 2l location, ownership, or control of the digital currency. 22 23. In furtherance of the conspiracy and to effect its objects, on or about the dates listed 23 below, in the Northern District of California and elsewhere, POTEKHIN, KARASAVIDI and others, 24 committed the following overt acts, among others: Poloniex Theft Attack 25 26 a. Between on or about July 17, 2017, and at least on or about October 29,2017, 27 POTEKHIN created and controlled at least 13 separate fake Poloniex domains to be used in 28 scheme targeting Poloniex and its users. SUPERSEDING INDICTMENT 5 a fraud b. 1 Between on or about July 17 , 2017 , and at least on or about October 29 , 2017 , 2 POTEKHIN induced at least 158 victim customers of the Poloniex exchange platform, including ) Poloniex customers in the Northem District of Catifornia, to access the fake Poloniex domains, causing 4 the victim customers to input their user identification and passwords in order to access their Poloniex 5 account, enabling POTEKHIN and others to obtain the customers' user identification, which is the 6 user's email address, and passwords without authorization. c. 7 Between on or about June 8, 2017 andJuly 17, 2017, POTEKHIN, 8 KARASAVIDI, and others created five fictitious Poloniex accounts. At least three of those accounts 9 were in the names of individuals from the United Kingdom: A.C., N.8., and C.A. To create these three 10 accounts, the defendants fraudulently used the means of identification of A.C., N.B., and C.A. 1t POTEKHIN and others possessed the means of identification of A.C., N.B., and C.A. prior to the l2 creation of these fictitious accounts. KARASAVIDI also had access to one of the other fictitious 13 Poloniex accounts. d. 14 Between at least on or about August 3,2017 and August 23,2017, POTEKHIN, 15 Kr{L{SAVIDI, 16 gain access to the approximately 155 victim customer Poloniex accounts and withdraw digital crrrency and others used user identification and passwords obtained without authorization to t7 without authorization. POTEKHIN, KARASAVIDI, and others also used some of the five fictitious 18 accounts, described above, along with victim user identification and passwords obtained without t9 authorization, to link to the victim user accounts, enabling them to withdraw larger sums of digital 20 currency from victim accounts without authorization. Approximately $700,000 in BTC was withdrawn 2l without 22 authorization from victim user accounts, including digital crurency from T.S. and J.S., who resided in the Northern District of California, and deposited into one BTC cluster. e. 23 Between on or about July 8, 2017 and July 15, 2017, POTEKHIN, 24 KARASAVIDI and others created three fictitious Bittrex accounts to receive BTC from the fraud 25 scheme. KARASAVIDI had access to one of the fictitious Bittrex accounts, registered using the email 26 acconnt 'n*'F***'F*'fi*****659@yahoo.com, which was the same email account used to register one 27 the five fictitious accounts. POTEKHIN had access to the identity of one of these Bittrex accounts. 28 SUPERSEDING INDICTMENT 6 of I Between on or about August 10,2017 and on or about September 79,2017, approximately 435 Bitcoins 2 were sent from the Bitcoin cluster to these three fictitious Bittrex accounts. f. J Between on or about August 13, 2017 and on or about September 27 , 2017 , most 4 of the BTC from the three fictitious Bitkex accounts, including one account also in the name of A.C., 5 was converted to approximately 8,816 ETH and through a sophisticated and layered manner was sent 6 through multiple intermediary accounts, before ultimately being deposited into a Bitfinex account 7 controlled by KARASAVIDI. P ol 8 g. 9 oniex Manipul ati on Att ac k Between on or about July 18, 2017 and on or about August 13,2017, POTEKHIN in 10 and others created nine more fictitious Poloniex accounts, each of which provided a residence 11 I-Ikraine or Russia. Eight of those fictitious accounts purchased 300 GAS at relatively low prices (the t2 "Eight Fictitious Poloniex Accounts"). One of these eight accounts was controlled by POTEKI{IN. 13 One of the eight accounts also purchased t4 used in a manipulation attack targeting three victim Poloniex customer accounts, with a total holdings 15 approximately $5,243,000 worth of digital currency on or about October 29,2017. h. 16 t7 unlawfully 18 GNO. These Eight Fictitious Poloniex Accounts were then of Using the same phishing means set forth above, POTEKHIN and others and without authorization obtained the user identification and passwords for these three victim accounts. On or about October 29,2017, POTEKHIN and others unlawfully and without t9 authorization obtained access to the victim accounts. Using digital crurency in one victim Poloniex 20 account, they placed an order to purchase approximately 8,000 GAS, thereby immediately increasing the 2t market price of GAS from approximately $18 to $2,400. POTEKIIIN and others then converted the 22 artificially inflated GAS in their own fictitious Poloniex accounts into ETH and BTC. Using digital 23 currency in the other two victim Poloniex accounts, POTEKHIN and others purchased GNO. The total 24 digital crrrency contained in the Eight Fictitious Poloniex Accounts on October 30,2017, when 25 Poloniex froze the accounts, was approximately t 5,600 ETH and .16 BTC. Before the Eight Fictitious 26 Poloniex Accounts were frozen, POTEKHIN and others transferred approximately 759 ETH to nine 27 digital currency addresses. Through a sophisticated and layered meurner, the ETH from these nine 28 SI.IPERSEDING INDICTMENT 7 1 digital currency addresses was sent through multiple intermediary accounts, before ultimately being 2 deposited into a Bitfinex account controlled by KARASAVIDI. J Binance Theft Attack i. 4 Between on or about October 16,2017 and October 31,2017, POTEKHIN and 5 others created at least two fictitious Binance accounts using the email accounts of two individuals from 6 the United Kingdom. POTEKHIN and others possessed the email accounts of these individuals prior to 7 the creation of these fictitious accounts. j. 8 9 Between at least on or about at least December lg,2Ol7, until on or about March 2,2018, POTEKHIN, KARASAVIDI, and others induced at least l42victimcustomers of the Binance 10 exchange platform, including at least one Binance customer in the Northern District of California, to 11 access the fake Binance domains, causing the t2 passwords in order to access their Binance account, enabling POTEKHIN and others to obtain the 13 customers' user identification, which is the user's email address, and passwords without authorization. k. t4 victim customers to input their user identification and POTEKHIN, KARASAVIDI, and others used the user identification and 15 passwords obtained without authorization to gain access to approximately 142 victim customer Binance t6 accounts and withdraw digital currency without authorization. Approximately 566 BTC, with a value l7 over $10 million BTC (valued on December 19, 2017), was withdrawn without authorization, including 18 digital curency from one victim in the Northern District of California, and deposited into one BTC t9 cluster, as well as several other intermediary digital currency addresses. BTC from the cluster, as well 20 as 2T Binance accounts described above before ultimately being deposited into a Bitfinex account controlled 22 by I(ARASAVIDI. from several other intermediary digital cwrency addresses, was then deposited into the two fictitious 23 24 of Gemini Theft Attack l. Between on or about October 24, 2Ol7,and November 1, 2OIT,POTEKHIN, 25 KARASAVIDI, and others induced at least 42 victim customers of the Gemini exchange platform, 26 including at least one Gemini customer in the Northern District of Califomia, to access the fake Gemini 27 domains. The victim customers input their user identification and passwords, believing they were 28 accessing their Gemini accounts instead of the fake Gemini domains. In this ma.nner, POTEKHIN and SI.JPERSEDING INDICTMENT 8 1 others obtained the customers' user identification, which was the users' email address, and passwords 2 without authorization. m. a J POTEKHIN, KARASAVIDI, and others used the user identification and 4 passwords obtained without authorization to gain access to victim customer Gemini accounts and 5 withdraw digital curency without authorization. Approximately $1.176 million in United States dollars 6 and digital currencies, was withdrawn without authorization from these accounts, including digital 1 currency from one victim in the Northem District of California. The valuation of the digital currencies 8 was based upon the average value between October 24,2017 and Novemb er 9 stolen digital currency was intermingled with flrnds obtained by the co-conspirators in the Poloniex 10 Market Manipulation Attack. Together, those funds then were moved through several intennediary 11 digital currency addresses before being deposited into t2 Still other digital crrrency that was stolen from the victim Gemini accounts was deposited into 13 Binance account that had also received digital currency from the Binance Theft Attack, before it was t4 ultimately a l,2Ol7 . Some of the Bitfinex account controlled by KARASAVIDI. deposited into a Bitfinex account controlled by a KARASAVIDI. Money Launderingfrom the Poloniex, Binanc:e, and Gemini Attacks 15 n. t6 In total, at least $16,876,000 in digital and fiat currency was reported stolen in the t7 Poloniex, Binance, and Gemini Attacks, which was obtained through the above described fraud scheme 18 by the co-conspirators. These fraud proceeds were then moved through various accounts, in an effort by t9 the co-conspirators to promote the fraud and to conceal and disguise the nature, source, ownership, and 20 control of the funds. Specifically, the digital crlrrency from the Poloniex Manipulation Attack was 2t intermingled with the digital currency from the Poloniex Theft Attack, as well as digital and fiat 22 currencies from the Binance Theft Attack and the Gemini Theft Attack. Through a sophisticated and 23 layered manner, these fraud proceeds were sent through multiple intermediary accounts, before 24 approximately 19,600 ETH was ultimately deposited on March 11, 2018, March 18, 2018, April 9, 2018, 25 and 26 April 15,2018 into a Bitfinex account controlled by All in violation of Title 18, United KARASAVIDI. States Code, Section 1030(b). 27 28 SUPERSEDING INDICTMENT 9 1 TWO: (18 U.S.C. $ 1030(a)(a) - Computer Fraud) 24. Paragraphs 1 through 23 of this Indictment are re-alleged and incorporated as if fully set COLTNT 2 J forth here. 25. 4 5 On or about June 8, 2017, and continuing through a date unknown, but at least through on or about April 15, 2018, within the Northern District of California and elsewhere, the defendants, DANIL POTEKHIN, and DMITzuI KARASAVIDI, 6 7 protected computer used in interstate and foreign 8 knowingly and with intent to defraud accessed 9 corlmerce without authorization and exceeding authorized access, and by means of such conduct a 10 firrthered the intended fraud and obtained something of value, specifically digital curency addresses and 11 passkeys, containing digital crurency later withdrawn without authorization by defendants. A11 12 in violation of 18 U.S.C. Sections 1030(a)(a) and (c)(3XA). 13 t4 COI-INT THREE: 26. 15 16 - Conspiracy to Commit Wire Fraud) Paragraphs 1 through 23 of this lndictnent are re-alleged and incorporated as if fully set forth here. 27. 17 18 (18 U.S.C. $ 1349 2017 , and Beginning at a time unknown to the Grand Jury, but no later than on or about June 8, continuing through a date unknown, but at least through on or about April 1 5, 2018, in the t9 Northern District of California and elsewhere, the defendants , DANIL POTEKHIN, and DMITzuI KARASAVIDI, 20 2t 22 and others, did knowingly conspire to devise and intend to devise a scheme and artifice to defraud as to 23 a 24 pretenses, representations, and promises, and by concealment of material facts, and, for the purpose 25 executing such scheme or artifice and attempting to do so, did transmit, and cause to be transmitted, by 26 means of wire communication in interstate and foreign cofitmerce, certain writings, signs, signals, 27 pictures, and sounds, in violation of Title 18, united States Code, Section 1343. 28 material matter and to obtain money and properfy by means of materially false and fraudulent All in violation of Title 18, United States Code, Section 1349. SUPERSEDING INDICTMENT 10 of 1 FOUR: (18 U.S.C. $ 1028A(a)(1) - Aggravated Identity Theft) 28. Paragraphs 1 through 27 of this lndictment are re-alleged and incorporated as if fulIy set COI-INT 2 J forth here. 29. 4 5 Between on or about June 8, 2017 and August 23,'2017, in the Northern District of California and elsewhere, the defendants, DANIL POTEKIIIN, and DMITRII KARASAVIDI, 6 7 8 during and in relation to the crime of Conspiracy to Commit Computer Fraud and Abuse, in violation of 9 1 8 U.S.C. $ 1030(b); Computer Fraud, in violation of 18 U.S.C. $ 1030(a)(4); and Conspiracy to 10 Commit Wire Fraud, in violation of 18 U.S.C. $ 1349, did knowingly transfer, possess, and use, without 11 lawful authority the means of identification of another person, to wit, the username and password of T.S All in violation of Title l2 18, United States Code, Section 1028A(a)(1). 13 t4 COLTNT FTVE: 30. 15 16 Paragraphs - Aggravated Identity Theft) I through 27 of this Indictment are re-alleged and incorporated as if firlIy set forth here. 31. l7 18 (18 U.S.C. $ 1028A(a)(1) Between on or about June 8, 20ll and August 23,2017, in the Northern District of Califomia and elsewhere, the defendants, DANIL POTEKHIN, and DMITzuI KARASAVIDI, 19 20 2t during and in relation to the crime of Conspiracy to Commit Computer Fraud and Abuse, in violation of 22 18 23 Commit Wire Fraud, in violation of 18 U.S.C. $ 1349, did knowingly transfer, possess, and use, without 24 lawful authority the means of identification of another person, to wit, the usemame and password of J.S. 25 U.S.C. $ 1030(b); Computer Fraud, in violation of 18 U.S.C. $ 1030(a)(4); and Conspiracy to A11 in violation of Title 18, United States Code, Section 1028A(a)(1). 26 27 28 SUPERSEDING iNDICTMENT II 1 2 J 4 5 (18 U.S.C. $ 1956(h) - Money Laundering Conspiracy) StX: 32. Paragraphs 1 through 27 of this Indictment are re-alleged and incorporated as if firlly set COI-INT forth here. 33. From on or about June 8, 2017, through on or about April 15, 2018, in the Northern District of California and elsewhere, the defendants, DANIL POTEKHIN, and DMITzuI KARASAVIDI, 6 7 8 did knowingly combine, conspire, and agree with each other and with other persons known and 9 unknown to the Grand Jury to conduct and attempt to conduct financial transactions affecting interstate 10 and foreign commerce, which transactions involved the proceeds of specified unlawfirl activity, that is, 11 Conspiracy to Commit Computer Fraud and Abuse, in violation of l8 U.S.C. $ 10300); Computer 12 Fraud, in violation of 18 U.S.C. $ 1030(a)(4); and Conspiracy to Commit Wire Fraud, in violation of 18 13 U.S.C. $ 1349; knowing the property involved in the financial transactions represented the proceeds of l4 some form of unlawful activity and knowing the transactions were designed in whole or in part to 15 conceal and disguise the nature, location, source, ownership, and control of the proceeds, in violation of t6 Title 18, United t7 States Code, Section 1956(a)(1)(B)(i). AII in violation of Title 18, United States Code, Section 1956(h). 18 FORT'EITURE 19 (18 U.S.C. $$ 982(a)(2)(B) and 1030(i) and (,)) 20 21 34. The allegations contained in this Indictment are re-alleged and incorporated by reference 22 for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Sections 982(a)(2)(b) and 23 i030(D and (i). 24 25 35. Upon conviction for the offenses set forth in Counts One and Two in violation of Title 18, United States Code, Section 1030, set forth in this Indictment, the defendants, 26 DANIL POTEKHIN, and DMITRII KARASAVIDI, 27 28 SUPERSEDING INDICTMENT 1) 1 shall forfeit to the United States, pursuant to Title 18, United States Code, Sections 982(a)(2)(b) and 2 1030(D and (i), any personal properly used or intended to be used to commit or to facilitate the J commission of said violation or a conspiracy to violate said provision, and any properry, real or 4 personal, which constitutes or is derived from proceeds traceable to the offenses, including, but not 5 limited to: a. 6 15,602 ETH and .016 BTC seized by law enforcement on or about December 14, 2017 (with a value of approximately $12,623,627 in USD on that date); 7 b. 8 238.32 BTC, $6,164,994.23 USD, .99 Bitcoin Cash @CFI),196.13 Bitcoin Gold 9 (BTG), 1199.99 NEO, and 50,000 EOS seized by law enforcement on or about 10 August 23,2019 (with a value of approximately $8,768,000 USD on that date); 11 and c. 12 a money judgment equal to the total amount of proceeds defendant obtained or 13 derived, directly or indirectly, from the violation, or the va.lue of the property used t4 to commit or to facilitate the commission of said violation. 15 36. If any of the property described a. b. c. d. e. t6 T7 18 19 20 above, as a result of any act or omission of the defendant: cannot be located upon exercise of due diligence; has been transferred or sold to, or deposited has been piaced beyond the with, a third parfy; jurisdiction of the court; has been substantially diminished in value; or has been commingled with other properly which cannot be divided without difficulty, 2T 22 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21 , 23 United States Code, Section 853(p), as incorporated by Title 18, United States Code, Section 1030(iX2). 24 25 All pursuant to Title of Criminal Procedure 32.2. 26 27 28 SI.IPERSEDING INDICTMENT 18, United States Code, Sections 982(a)(2)(B) and 1030, and Federal Rule 1 2 WIRE FRAUD FORFEITIIRE 37. ALLEGATION: (18 U.S.C. $ 981(a)(1)(C) and 28 U.S.C. $ 2a61(c)) The allegations contained in this tndictment are re-alleged and incorporated by reference a J for the pu{pose of alleging forfeiture pursuant to Title 18, United States Code, Section 981(a)(1)(C) and 4 Title 28, United States Code, Section 2a6l@). 5 6 38. Upon conviction for the offense set forth in Count Three of this lndictrnent, the defendants, DANIL POTEKHIN, and DMITzuI KARASAVIDI, 7 8 9 shall forfeit to the United States, pursuant to Title 18, United States Code, Section 981(a)(lXC) and 10 Title 28, United States Code, Section 2461(c), all property, real or personal, constituting, or derived 11 from proceeds the defendant obtained directly and indirectly, as the result of those violations; including t2 but not limited to: 13 a. 15,602 ETH and .016 BTC seized by law enforcement on or about December 14, 2017 (with a value of approximately $12,623,627 in USD on that date); T4 b. 15 238.32 BTC, $6,164,994.23 USD, .99 Bitcoin Cash (BCFI),796.13 Bitcoin Gold 16 (BTG), 1199.99 NEO, and 50,000 EOS seized by law enforcement on or about t7 August 23,2019 (with a value of approximately $8,768,000 USD on that date); 18 and c. 19 as a result 20 2t 22 23 24 25 26 27 28 A money judgment equal to the total amount of proceeds the defendant obtained 39. If of the offense. any of the property described above, as a result of any act or omission of the defendant: a. b. c. d. e. cannot be located upon exercise ofdue diligence; has been transferred or sold to, or deposited has beenplaced beyond with, a third party; thejurisdiction ofthe court; has been substantially diminished in value; or has been commingled with other property which cannot be divided without diffrculty, the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 2l SUPERSEDING INDICTMENT , I United States Code, Section 853(p), as incorporated by Title 28, United States Code, Section 2a6l@). AII pursuant to Title 18, United States Code, Section 981(a)(1)(C), Title 28, United States Code, 2 J Section 2461(c), and Federal Rule of Criminal Procedure 32.2. 4 G FORIEITURE 5 40. 6 7 ALLEGA : (18 U.S.C. $ 982(aX1) The allegations contained in this lndictment are re-alleged and incorporated by reference for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Section 982(a)(l). 41. 8 Upon conviction for the offense set forth in Count Six of this lndictment, the defendant, DANIL POTEKHIN, and DMITRII KARASAVIDI, 9 10 l1 shall forfeit to the United States, pursuant to Title 18, United States Code, Section 982(a)(1), all t2 property, real or personal, involved in said violations, or any property 13 traceable to such property, including, but not limited to: a. t4 15,602 ETH and .016 BTC seized by law enforcement on or about December 14, 2017 (wrth a value of approximately $12,623,627 in USD on that date); 15 b. t6 238.32 BTC, $6,164,994.23 USD, .99 Bitcoin Cash (BCH), 196.13 Bitcoin Gold t7 (BTG), 1199.99 NEO, and 50,000 EOS seized by law enforcement on or about 18 August 23,2019 (with a value of approximately $8,768,000 USD on that date); t9 and c. 20 A money judgment equal to the total amount of funds involved in the offense. 2t 22 23 24 il 25 26 27 28 SUPERSEDING INDICTMENT 42. 1 If any of the property described above, as a result of any act or omission of the defendant: a. b. c. d. e. 2 J 4 5 6 l cannot be located upon exercise ofdue diligence; has been transferred or sold to, or deposited has been placed beyond the with, a third party; jurisdiction of the court; has been substantially diminished in value; or has been commingled with other property which cannot be divided without difficulty, 8 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21, 9 United States Code, Section 853Gr), as incorporated by Title 18, United States Code, Section 9820)(1). All 10 11 Criminal P pursuant to Title 18, United States Code, Sections 982(a)(1) and (b)(1) and Federal Rule r ocedur e 32.2. 12 13 A TRUE BILL DATED: l4 t5 L tp T(n-O FOREPERSON t6 t7 DAVID L. ANDERSON United States 18 t9 20 As FREY United S Attorney 2t 22 23 24 25 26 27 28 SUPERSEDING INDICTMENT of UNITED STATES DISTRICT UI*DEH SEAL NORTHERN DTSTRTCT OF CALTFORNTA CRIMINAL COVER SIIEET Fii=Fr-.], FEE tE Z$Z$ fnsfiuctions: Effective November t, 2016, this Criminal Cover Sheet must tr 6,q4fit$!H\M:{"WaO along with the Defendant Information Form, for each nsw criminal case. f,:iiii]'i;l,i:iil ;: Cl;;ilii,;;l:,t Casr Naw: USAv. CasrNur,Brn: DANIL POTEKHIN, &4./! "6oEwe," ed DMITRII KARASAVIDI, e/L* Dmitiy Is This Case Under Seal? Total Number of Defendants: Does this case involve ONLY charges under 8 U.S.C. S 1325 andlor 1326? Venue (Per Crim. L.R 18-1): cR 19-0572-CRB Kllevidi Yes / No I 2-7 Yes No { sF { / oAK Is this a potential high-cost case? Yes No { Is any defendant charged with a death-penalfy-eligible crime? Yes No { Is this a RICO Act gang case? Yes No { Assigned AUSA (Lead Attorney): CYNTHIA FREY, AUSA 8 or more SJ Date submitted: )ll$12020 Comments: Form CAND-CRIM-COVER @ev. I l/16) RESET FORM , SAVE PDF 1 UNDER SEAL DAVID L. ANDERSON (CABN 149604) United States Attorney 2 a J 4 HALLTE HOFFMAN (CABN 210020) Chief, Criminal Division FILED CYNTHTA FREY (DCBN 47s889) Assistant United States Attorney FtB 1 BZ0?0 5 450 Golden Gate Avenue, Box 36055 San Francisco, Californi a 9 4102-3 49 5 Telephone: (41 5) 43 6-7 200 Fax: (415) 436-7234 cynthia. fr ey@usdoj . gov 6 7 ,,,#rff'#gji+l}?ftFem^ 8 Attorneys for United States of America 9 UNITED STATES DISTRICT COURT 10 NORTHERN DISTRICT OF CALIFORNIA 11 SAN FRANCISCO DTVISION t2 13 UNITED STATES OF AMERICA, t4 ) No.: CR-19-0572-CRB ) MOTION TO SEAL SUPERSEDING ) TNDTCTMENT AND [P&OPOSED] ORDER Plaintiff, ) v 15 16 DANIL POTEKHIN, alW a"cronuswar," and DMITRII KARASAVIDI, a/k/ a Dmitriy 17 Karasavidi Defendants. 18 ) (UNDER SEAL) ) ) ) ) ) ) ) 19 The government hereby moves the Court for an order sealing the Superseding Indictnent, this 20 2t motion, and the Court's sealing order until execution of the arrest warrant for defendants DANIL 22 POTEKHIN, alWa "cronuswar," and DMITRII KARASAVIDI, alWa Dmitriy Karasavidi. In order to 23 reduce the chances that the defendants 24 requests that the fact will flee and for reasons of offrcer safety, the United States of 25 26 27 28 il MOTION TO SEAL SLIPERSEDING INDICTMENT AND I'PROPOSEDI ORDER I rl ^ 1 the arrest warant remain under seal until the warrant is executed. The Court's sealing order 2 lifted automatically once the arrest warrant is executed. will be J 4 DATED: February 13,2020 Respectfully submitted, DAVID L. ANDERSON 5 United States Attorney 6 7 FREY Assistant United S 8 9 10 IPROPOSEDI ORDER 1l t2 13 Based upon the motion of the government and for good cause shown, IT IS ORDERED that the Superseding Indictment, this motion, and this sealing order shall be sealed until t4 execution of the arrest wa:rant for 15 defendants KARASAVDI, akla Dmitriy Karasavidi DANIL POTEKHIN, akla "cronuswar," and DMITzuI or until further order of the Court, whichever occurs first. t6 This sealing order shall not prevent the Clerk from providing 17 IIEREBY copies of the aforementioned documents to the United States upon rqquest of an attorney for the United States 18 t9 DATED: ,,fiil*n H Chief United 20 2t 22 Z) 24 25 26 27 28 MOTION TO SEAL SI.IPERSEDING INDICTMENT AND [PROPOSEDI ORDER .,) Magistrate Judge