Dooqmm-hmmi a 0 UI -FIETC-E CANTON BUSINESS CORPORATION ALEXANDER VINNIK 23 BRIAN J STRETCH CAEN 163973 In United States Attorney Q6 I 5 BARBARA J VALLIERE DCBN 439353 42314 4 4 Chief Criminal Division fog '36 WIL FRENTZEN LABN 24421 11 5 Assistant United States Attorney 450 Golden Gate Avenue Box 36055 San Francisco California 94102-3495 Telephone 415 436-6959 Fagin 415 436-7234 SE ng Attorneys for the United States - UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION UNITED STATES OF AMERICA CASE NO CR 15-00227 SI UNITED MOTION TO SEAL SUPERSEDING ARREST WARRANTS ORDER Plaintiif UNDER SEAL Defendants I MOTION TO SEAL H 191 I t I-I-I ON cameo Ch U1 It's The United States hereby moves the Court for an order sealing this Motion and Order Arrest Warrants and the Superseding Indictment The government believes that if the defendants are made aware of these documents before they are arrested that they may make shorts to avoid being arrested Respectftu Submitted BRIAN T STRETCH United States Attorney WEELAM FRENTZEN Assistant United States Attorney Date January 12 2017 0mm Based upon the foregoing request the Court hereby ORDERS that this Motion and Order Arrest Warrants and the superseding Indictrnent shall he led and kept under sea by the clerk of the Court until nther order of the Court The Court hereby ntherlORDERS that any representative of the lUnited States Attorney s O ce or the Internal Revenue Service shall be allowed to obtain a copy of the Superseding Indictment without further order of the Corn-L SALLIE KIM UNITED STATES MAGISTRATE JUDGE Dated Ianuary 2017 MOTION To SEAL - Hm'teh tateo Eiottizt Emu FOR THE 5 7 NORTHERN DISTRICT OF 50 VENUE SAN FRANCISCO 7 It I 3 El 'ffgr s - 8 4 3 Wig UNITED STATES OF AMERICA SEALED V- BY comm comm ag W 202 fo BTO-E AIKIA CANTON BUSINESS CORPORATION and ALEXANDER VINNIK SUPERSEDING INDICTMENT 1E U S C 1960 - Operation of an Unlicensed Money Service Business 13 U S C 195601 - Conspiracy to Commit Money Laundering 13 U S C - Money Laundering 13 U S C 1957 - Unlawful Monetary Transactions and 1B U S C - Criminal Forfeiture A true hill Foreman F '7 2i lied In open court the day of a 10 7 no BAILWARRANT '7 Clark - - CESS Fur Bail A0 95 DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U S DISTRICT COURT BY CI COMPLAINT INFORMATION INDICTMENT Name mama mum and Judgmaggwate Location SUPERSEDING NORTHERN DISTRICT OF CALIFORNIA I SAN FRANCISCO DIVISION CHARGED it U S E 1960 - Operation of an Unlicensed Money Service L Business 13 U S C 195I5Ihi - Conspiracy to Commit Money Laundering Laundering Minor r DEFENDANT - u s 13 uses I957 - Unlawful Monetary Tran sections and MINE reuse sealant-Criminal Forfeiture meamr og WA CANTON BU51NBS CORWON I DISTRICT COURT NUMBER Please see attachment - - CR 16 00227 SI 42 6 44 7 Estes was 2 Gauss-g GRDE r a 9 DEFEND PROCEEDING rs NOTIN cusroov @005 Has not been arrested endin outmmeoead n Name of Complalntant Agency or Person a 'l'rtle If any 1 If detained glue dampen pg 4 I 9 Intemai Revenue Service summons was served on above charges person is awaiting trial in another Federal or State Court 2 s a Fugiuve give name of court 3 Is on Ball or Release from show District this personrprooeeding ls transferred from another district per oircle one 2D 21 or 40 Show-District - IS IN CUSTODY 4 On this charge this is a represeoutlon of charges previously dismissed 5 On another conviction whio rr were dismissed on motion SHOW Federal State or DOCKET NO 3 To HEY DEFENSE 6 Awaiting trial on other charges If answer to 6 Is Yes show name of institution this prosecution relates to - pending ease involving this same Hes detainer Yes defendant MAGISTRATE been led CASE NO led prior prooeedings or appearanoeis DATE OF before U S Magistrate regarding this ARREST defendant were records mar Agency at Wanant were not Name and Of ce of Person DATE TRANSFERRED Monthr'Dain ear FumiShing information on this form BRIAN STRETCH TD U S CUSTODY U S Attomey Other U S Agency 4 Name of Assistant U S This report amends A0 25 previously submitted AttorneyI if assigned WILLIAM FHENTZEN I ADDITIONAL INFORMATION OR COMMENTS PROCESS SUMMONS ND WARRANT Bail Amount If Summons complete following and Mmeppra an on comp no new summons or mgnmem Inmal Appearance warrant needed since Magistrate has scheduled arraignment Defendant Address Datefl'irne Before Judge Comments ATTACHMENT TO PENALTY SHEET AIKIA CANTON BUSINESS CORPORATION COUNT ONE 18 U 1960 - Operation of an Unlicensed Money Service Business 5 years imprisonment COUNT TWO 13 U S C 1956 11 Conspiracy to Commit Money r Laundering Not more than 20 years imprisonment not more than $500 000 ne or twice the value of the property involved in the transaction whichever is greater not more than 3 years of supervised release and a $100 special assessment COUNTS THREE THROUGH Money Laundering Not more than 20 years imprisonment not more than $500 000 ne or twice the value of the property involved in the transaction whichever is greater not more than 3 years of supervised release and a $100 Special assessment COUNTS TWENTY THROUGH TWENTY-ONE 13 U S C 1957 Engaging in Unlawful Monetary Transactions Not more than 10 years imprisonment not more than $500 000 ne or twice the value of the property involved in the transaction whichever is greater not more than 3 years of supervised release and a $100 special assessment FORFEITURB ALLEGATION 13 use 932 a 1 Criminal Forfeiture 18 U S C 1956 a 1 A i and - I no 2's Rev one I DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U S DISTRICT COURT COMPLAINT INFORMATION Name or District Court andior Location OFFENSE CHARGED I supenseoine NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DIVISION 13 List is 1950 - Operation ofan Unlicensed Money Service Pails Business 13 U S C 1956th- Conspiracy to Corn Money Laundering Laundering Ci Mimi DEFENDANT -u s Ia use 5 1951- Unlawful Monetary Transactions and Misd - is use 5- ssztaitn-cnminai Forfeiture manor ALEXANDER WNW i 2534 I 5 DISTRICT COURT NUMBER ttfq grir Pleaseseeattachment afgo' 19 6 5 ca 15-00227 Si @494DEFENDANT thrg rh PROCEEDING IS NOTIN cusroov Has not been an ested outcome this rooeedin Name of Complaintant Agency or Person Title if any 1 If not detained gm datepzny pg summons was served on above charges internal Revenue Service person Is awaiting trial in another Federal or State Court 2 is a Fugitive give name of court 3 is on Bail or Release item show District this personiproceedlng is lransfened from another district per circle one 20 21 or 40 Show District IS iN 4 On this charge this is a reprosecution of charges previously dismissed which were dismissed on motion Federal State at DDCKEF NO URN SE 6 j Awaiting trial on other charges U EFEN If answer to B is Yes show name of institution SHOW 5 On another oomnciton this prosecution relates to a I pending case involving this same Hes detainer Yes aim defendant MAGISTRATE been led No led CASE NO prior proceedings or appearance- s DATE OF monmay ear 3 before us Magistrate regarding this defendant were remde under if Arresting Agency were not Eire and Cities of Person DATE TRANSFERRED Montidnayi t ear Furnishing Infom'iation on this form BRIAN J STRETCH TO U 5 CUSTODY U S Attorney 3 Other U S Agency Name of Assistant US This report amends A0 25 previously submitted -Attomey if assigned WILLIAM FRENTZEN ADDITIONAL INFORMATION OR COMMENTS i PROCESS SUMMONS NO WARRANT BaitAmount If Summons complete following Arraignment lnmal A aarance more defendant previousbr apprehendndon oompfat nt no new summons or pp warrant needed since Magistrate hes sdreduisd arraignment Defendant Address Datei l ime Before Judge Comments ATTACMNT TD PENALTY SHEET ALEXANDER VINNTK COUNT ONE 18 U S C $1960 Operation of an Unlicensed Money Service Business 5 years impri sdnment COUNT TWO 13 U S C 195691 Conspiracy to Commit Money Laundering Not more than 20 years imprisonment not more than $500 000 ne or twice the value of the property involved in the transaction whichever is greater not more than 3 years of supervised release and a $100 special assessment COUNTS THREE THROUGH NINETEEN Money Laundering I Not more than 20 years imprisonment not more than $500 000 ne or twice the value of the property involved in the transaction whichever is greater not more than 3 years of supervised release and a $100 special assessment COUNTS TWENTY THROUGH TWENTY-ONE 18 U S C 1957 Engaging in Unlawful Monetary Transactions Not more than 10 years imprisonment not more than $500 000 ne or twice the-value of the property involved in the transaction whichever is greater not more than 3 years of supervised release and a $100 special assessment 13 U S C 982 a 1 Criminal Forfeiture 13 Use 1956 a 1 A i and - t I 1 BRIAN J STRETCH CABN 163973 at United States Attomey - 6 19 - 4 4 SEALED 7 BY COURT GHDEH '3 UNITED STATES DISTRICT COURT 9 NORTHERN DISTRICT OF CALIFORNIA 10 SAN FRANCIS C0 DIVISION 11 1 UNITED STATES OF AMERICA UNDER SEAL 12 Plain ' CASE NO- 01116-00227 SI 13 v m 13 U S C 1960 Operation ofan Unlicensed Money Service Business 18 U S C 14 ETC-E CANTON BUSINESS 195601 ConsPiracy to Commit Money CORPORATION Lalmdering 13 U S C 1956 a 1 Money 15 Laundering 18 U S C 1957 Unlawful Monetaty 'and- Transac ons 18 ESE 982 a 1 Criminal 16 Forfeiture VINNIK 17 SAN FRANCECO VENUE i DefendantsThe Grand Jury charges 21 - MRODUCTORY ALLEGATIONS 22 - At all times relevant to this Indictment 23 - l Since at least approximately 2011 through and including the present both dates being approximate and inclusive the defendant operated as one of the world s largest and most widely I 26 used digital currencp exchanges Since its inception processed several billion dollars worth of 27 monetary exchanges was an exchange for cybercriminals worldwide and one of the principal 23 entities used to launder and liquidate criminal proceeds orn digital currencies including Bitcoin to at 1 currencies 1 including US dollars Euros and Rubles At all relevant times the defendant ALEXANDER VINNIK together with individuals known and milmown directed and supervised e s operations and nances I 2 was an internatiooal money-laundering scheme that by virtue of its business model catered to criminals and to cyberen'minals in particular Through efforts emerged as one of the principal means by which cvber criminals around the world laundered the proceeds of their illicit activity facilitated crimes including computer hacking and ransomware fraud identity theft tax re md fraud schemes public corruption and traf cking 3 laclted basic anti-money laundering controls and policies and as such was attractive to those who desired to conceal criminal proceeds it made it more dif cult for law enforcement to trace and attribute funds 4- Since its founding received criminal proceeds of numerous computer intrusions and hacking incidents ransomware scams identity theft schemes corrupt public of cials and narcotics distribution rings Among other things accounts received substantial proceeds from the hack of the now-de mct Mt Gox digital currency exchange and also received a substantial portion of the criminal proceeds from one of the largest ransomware schemes 5 As described further below the defendants and their co-conspirators including thoSe know and unknown to the Grand Jury intentionally created structured and-operated as a criminal business venture one designed to help criminals launder their proceeds and one they themselves used to launder criminal proceeds The defendants thus attracted and maintained a customer I base that was heavily reliant on criminals 6 Despite doing substantial business in the United States was not registered as a Fiat currency is simply a currency established by government regulation or law e g US Dollars Burns Japanese Yen British Pounds Russian Rubles Chinese RMB etc 2 1 money sendces business with the United States Department of the Treasury s Financial Crimes 2 it Enforcement Network as federal law requires Its described rrther below had no meaningful anti-money laundering processes in place and lacked an e 'ectiye anti money laundering program as federal law also requires 7 This was in contrast to other registered digital currency exchanges that through their anti-money laundering programs stroye to avoid having their platforms used for criminal activity Most of those exchanges described their operations down to listing the names photos and backgrounds of their management the location of their businesses and their regulatory compliance policies 10 8 relied on the use of shell'companies and a iliate entities that were similarly 11 unregistered with FinCliCN and lacked basic anti-money laundering and Know Your Customer 12 13 14 policies These entities catered to an online and worldwide customer base and electronically iuuled at currency in and out of own website stated it was located in Bulgaria yet 15 simultaneously stated it was subject to the laws of Cyprus Meanwhile managing shell 15 company ON BUSINESS CORPORATION was based in the Seychelles but af liated with a 17 Russian phone number and its web domains were registered to shell companies in countries including 18- Singapore the British Virgin Islands France and New Zealand 19 BACKGROUND 20 I 9 Bitcoin is a form of decentralized convertible digital currency that existed through the 21 use of an online decentralized ledger system 2 Bitcoin is just one of many forms of digital currency 22 There are many others including litecoin others worldcoin and dogecoin However bitcoin has the 23 largest market capitalization of any present form of decentralized digital currency 24 10 While bitcoin mainly exists as an Internet-based form of currency it is possible to print 25 out the necessary information and exchange bitcoin via physical medium The currency is not issued 26 - 2 I 2 Since Bitcoin is both a currency and a protocol capitalization differs Accepted practice is to 23 I use Bitcoin singular with an uppercase letter B to label the protocol software and community and i bitcoin with a lowercase letter b to label units of the currency That practice is adopted here 3 any government bank or company but rather is generated and controlled through computer soitware operating via a decentralized network To acquire bitcoin a typical user will purchase them from a Bitcoin seller or exchanger- It is also possible to mine bitcoin by verifying other users transactiOns Bitcoin is just one form of digital currency and there are a signi cant number of other varieties of digital currency I l Bitcoin exchangers typically accept payments of at currency currency which derives its value 'om goverrnnent regulation or law or other convertible digital currencies When a user wishes to purchase bitcoin from an exchanger the user will typically send payment in the form of at currency often via bank wire or ACH or other convertible digital currency to an exchanger for the corresponding quantity of bitcoin based on a fluctuating exchange rate The exchanger often for a commission will then typically attempt to-broker the purchase with another user of the exchange that is trying to sell bitcoin or in some instances will act as the seller itself If the exchanger can place a buyer with a seller then the transaction can be completed 1 address The bitcoin address is somewhat analogous to a bank account number and is comprised of a When a user acquires bitcoin ownership of the bitcoin is transferred to the user's bitcoin case-sensitive string of letters and numbers amounting to a of 26 to 35 characters The user can then conduct transactions with other Bitcoin users by transferring bitcoin to their bitcoin addresses via the Internet 13- Little to no personally identi able information about the payer or payee is transmitted in a bitcoin transaction itself Bitcoin transactions occur using a public key and a private key A public key is used to receive bitcoin and a private key is used to allow withdrawals from a bitcoin address- Only the bitcoin address of the receiving party and the sender's private key are needed to complete the transaction These two keys by themselves rarely re ect any identifying information 14 All bitcoin transactions are recorded on what is known as the blockchain This is essentially a distributed public ledger that keeps track of all bitcoin transactions incoming and outgoing and updates approximately six times per hour The blockchain records every bitcoin address that has ever received a bitcoin and maintains records of every transaction for each bitcoin address 15 Digital currencies including bitcoin have many known legitimate uses However much 4 HH like cash bitcoin can be used to facilitate illicit transactions and to launder criminal proceeds given the ease with which bitcoin can he used to move funds with high levels of anonymity As is demonstrated herein however in some circumstances bitcoin payments may be effectively traced by analyzing the blockchain OVERVIEW 16 was feunded in or about 2011 In the years it operated has served approximately 7 0 000 users worldwide including numerous customers in the United States and customers in the Northern District of California BTC-e-touts itself as a platform for individuals nits-rested in buying and selling bitcoin using an assortment of world currencies in other words a digital currency exchange 17 Through the work of VINNIK and others known and unknown to the Grand Jury became one of the ways by which cybercriminals around the world transferred laundered and stored the criminal proceeds of their illegal activities US dollars and Russian rubles were the most equently exchanged at currencies on the platform while Bitcoin and litecoin were the most widely exchanged digital currencies '13 Because such a signi cant portion of business was derived from suspected criminal activity and given its global reach the scope of the defendants unlaw il conduct was massive A During the relevant timeframe from 20 to December 30 2016 bitcoin addresses associated with BTC- had received over 9 4 million bitcoin Bitcoin s rapidly uctuating exchange rate makes it dif cult to determine the U S Dollar value of this quantity of bitcoin over time However using today s bitcoin exchange rate the total value of bitcoin received by over the course of its operation would be valued at over $9 billion In 2016 alone received over 1 8 million bitcoin valued at over $1 7 billion at today s errchange rate 3 in 3 This is calculated using the December 30 2016 bitcoin trading value of approximately $9652 per bitcoin Since August 2011 the Bitcoin market price has uctuated om a low of roughly $2 to a high 5 19 Notably the above gures only include bitcoin exchanged on the platform and do not even include the deposits and withdrawals made in other digital currencies such as litecoin nor do these gures take into account well over a billion dollars worth of what is known as code- code enabled a user to send andon receive at currencies and digital currencies to other users 20 I maintained its servers in the United States The servers were one of the primary ways in which and the defendants effectuated their operations also used many third- party companies including companies within the Northern District of California to effectuate their operations and enable them to function 21 At its inception was one of a number of digital currency exchanges It was engaged in the same line of business as other online digital currency exchanges in existence at the time including Liberty Reserve Liberty Reserve was a Costa Rica-based centralized digital currency service that laundered approximately $6 billion in criminal proceeds It was shuttered in 2013 when its founder and six other individuals were charged with conspiracy to commit money laundering and with operating an unlicensed money transmitting business Liberty Reserve s website was seized by the U3 governrnent 1 22 There was an overlap between many Liberty Reserve users and users itself was a user of Liberty Reserve 23 Another digital currency exchange in operation between 2011 and 2014 was the MTGOX Exchange Gox that was originally founded in San Francisco but ultimately based in Tokyo Japan In 2014 Mt- Gox collapsed having been the target of a series of major intrusions that resulted in thefts totaling several hundred million dollars worth of bitcoin In 2014 Mt Gox led for bankruptcy in of approximately $1200 per bitcoin and has varied dramatically over time 6 1 2 3 4 Japan 24 After the collapse of Liberty Reserve and with the intrusions and accompanying issues that Mt Gox experienced rapidly grew The volume of transactions it performed and its number of users expanded lling the vacuum left by entities like Liberty Reserve and Mt Gox 29- ENTITIES AND INDIVIDUALS CANTON BUSINESS CORPORATION was a shell eOrpOration used as a front for BTC-els Operations Like CANTON was not registered with Financial and other records demonstrate that CANTON was synonymous with VINNIK a Russian national was a primary bene cial owner of nancial accounts Although listed business address was in the Seychelles it operated using a Russian telephone number 30 - VENNIK also operated and controlled multiple accounts including a account known as the le le account- The account was tied directly to administrator accounts Numerous withdrawals from administrator accounts went directly to bank accounts tied to VINNIK 31 Another such administrator account associated with VINNIK was the Vamnedam 5 account The Wamnedarn account was directly linked to the administrative nancial Operational and support accounts accounts to which only those involved in the operations of the enterprise would have had access Proceeds from Well-1610121111 hacks and thefts from bitcoin exchanges II and users around the world mded the Vamnedarn account Out of the Vaninedarn acoount large payments were made to accounts associated with VINNIK and others known and unknown to the Grand Jury including a Russian national hereafter referred to as unindicted X who is alleged to have access to the Varnnedarn account I ETC-E FUNCTION 32 -To use one created an account by accessing the website A user did not need to provide even the most basic identifying information such as name date of birth address or other identi ers All that reouired was a usemame password and an email address Unlike legitimate payment processors or digital currency exchangers did not require its users to validate their identity information by providing official identification documents given that did not require an identity at all 5 Vainnedam means will not give it to you in Russian 3 33 Thus a user could create a account with nothing morelithan a username and email in address which often bore no relationship to the identity of the actual user Accounts were therefore easily opened anonymously including by customers in the United States within the Northern District of California- 34 At all times relevant to this Indictment had no anti-money laundering andfor Know-Your -Customer KYO processes and policies in place As discussed above collected I virtually no customer data at all Nor did or its shell companies ever register with or perform these functions on behalf 35 A user could fund a account in numerous different ways One way involved funding the account with at currency that would be converted into digital currency such as bitcoiu With at currency a_ user could initiate a wire transfer from a nancial institution made directly for the bene t of to an account at another nancial institution which was routed to a bank account maintained by one of shell or af liated companies 36 Another way involved funding a account a user s existing digital currency A user with existing digital currency such as bitcoin could fund a account directly via bitcoin deposits BTC-e'users could also purchase code that could be sent and exchanged amongst users code enabled a user to send and or receive at currencies and digital currencies to other users This served as another conduit for money laundering as it allowed customers to withdraw funds from their account and transfer them to other users anonymously 37 business model obscured and anonymiaed transactions and source of funds For example a user could not fund an account by directly transferring money to itself but rather had to wire fluids to one of shells or af liate entities Nor could users withdraw funds 'orn their accounts directly such as through an ATM withdrawal Instead users were required to make any deposits or withdrawals through the use of third-party exchangers thus enabling to avoid collecting any information about its users through banking transactions or other activity that would leave a centralized nancial paper trail 38 Once a user funded an account with the user could then do any number of things conduct transactions with other users exchange digital currency into at currency or simply use to store digital currency deposits much like a bank 39 Like other digital currency exchanges charged transaction fees for their services charged a percentage fee every time a user transferred funds held in to another user through the system In addition charged a percentage fee every tithe a user used to exchange digital currency held in a account into at currency 6 40 In addition to the fees charged users were charged additional fees hy- each taking a percentage of the funds exchanged These added fees were associated with getting money in and out of the platform through these funding mechanisms mechanisms that obfuscated the true sender of the currency I 41 Those engaged in criminal activity using gravitated to because of the site s lack of anti-money laundering and processes in place that could have them reported to the government Criminals who used to launder funds were also willing to go to the extra trouble of wiring money offshore to entities that operated through shell companies 10 p-r hoch'tLH-bsmw 42 made a series of self serving public statements designed at least in part to de ect the attention of law enforcement and regulators For example despite advertising on their website that require our clients to verify identity by providing sic scanned copy of ID and scanned copy of utility bill or a bank statement which should not be older then sic 6 month Copy should be in good resolution and colored this process was not in fact followed As discussed no customer identi cation whatsoever was required to set up accounts including accounts set up by customers in the Northern District of California 43 Lilcewise the website advertised that don t accept any more international wire transfers from'US Citizens or om US Bank This too was false Through its elaborate funding mechanisms did in fact knowingly accept wire transfers from banks in the US and made by U S citiZens CRIMINAL DESIGN 44 As described above system was designed so that criminals could accomplish nancial transactions with anonymity and thereby avoid apprehension by law enforcement or seizure of funds was in fact thus used extensively for illegal purposes and particularly since the collapse of entities like Mt Gox and Liberty Reserve it functioned as the exchange of choice to convert digital currency like bitcoin to fiat currency for the criminal world especially by those who committed their crimes online 45 The defendants were aware that functioned as a money laundering enterprise Messages on its own forum openly and explicitly re ected some of the criminal activity in which the users on the platform were engaged and how they used to launder funds 46 users established accounts under monikers suggestive of criminality including monikers such as CocaineCowboys blackhathackers dzkillerhacker and hacker4hire 47 This is not surprising because criminals used to launder criminal proceeds and 11 transfer funds among criminal associates In particular it was used by hacking and computer intrusion rings operating around the world to distribute criminal proceeds of their endeaVors It was also used by rings of identity thieves corrupt public of cials narcotics distribution networks and other criminals 48 'In fact some of the largest known purveyors of ransomware used as a means of storing distributing and laundering their criminal proceeds Ransomware is a criminal scheme in which cybercriminals orchestrate the unwanted malicious download of software on an unsuspecting victim computer It works as follows once a victim is infected with the malicious software often by clicking on a fraudulent email the ransomware will multiple les types on victim machines and tr hold those les for ransom requiring the victim to pay the administrators of the ransomware scheme in order to have their les Victims that pay the ransom are able to their les by using a stand-alone program provided by the ransomware administrators after the ransom payment has been made The method of implemented by the ransomware if properly executed renders it impossible for victims to their les in any other way The most prevalent payment method accepted by current purveyors of ransomware is Ibitcoin 49 One such ransomware scheme was distributed by methods including fraudulent and phishing emails - was one of the most infamous varieties of ransomware and has infected a vast number of computers across the world During the timeframe relevant to this I Indictment the purveyors of deposited and laundered many hundreds of thousands of dollars worth of ransom payments into '1 50 So too did a pair 'of corrupt US federal agents Carl Mark Force and Shaun Bridges use to launder their criminal proceeds Their experience with the criminal underworld taught them that using as opposed to a registered exchange with anti-money laundering policies would maximize their chances of being able to conceal criminal proceeds Each therefore sent several hundred thOuSand dollars in criminal proceeds derived from crimes ranging from the of government property 12 1 to extortion to the platform for laundering 51 also served as the receptacle and transmitter of criminal funds item a series of I well-publicized computer intrusions and resulting thefts including the well-publicized thefts from the Japan-based Mt Gox exchange As discussed below a sizable portion of the stolen Mt Gox funds were deposited into accounts controlled owned and operated by and by defendant 1k and others loiown and 11ch to the Grand Jury 52 The Mt Gox exchange 'was the subject of a series of computer intrusions and resulting thefts between approximately September 2011 and May 2014 in violation of Title 18 United States MD 10 Code Section1030 a 4 Several hundred millions dollars worth of bitcoin was stolen including from 11 numerous customers in the U S and within the Northern District of California After the thefts some 12 approximately 530 000 of the bitcoin worth hundreds of millions of dollars stolen from Mt Gox was 13 4 deposited into wallets at three dj erent digital currency exchanges ii Trade Hill another 15 exchange based in San Francisco and back into Mt Gox into a different Mt Gox wallet 15 53 Of this 530 000 bitcoin 7 300 000 of it was sent directly to three separate 17 it accounts Varnnedam Gnubit and Petr TheSe accounts were all linked to each other 18 54 Meanwhile blockchain analysis reveals that the stolen Mt Gox funds that went to Trade 19 20 Hill and back into the other Mt Gox account were controlled by a user who also controlled a account called At all times relevant to this Indictment defendant VINNIK exercised control 21 22 over the account 23 55 The Varnnedar n Gimbit Petr and accounts were each directly linked-to a 24 variety of different administrative accounts accounts for which only administrators 25 andfor operators would have had access The Vamnedam account was similarly a 26 27 28 Mt Gox suffered 7 The amount of bitcoin stolen from Mt Gox accounted for just under half of the total thefts that 13 meme 4 10 ll 12 56 VINNIK along with others known and unknown controlled and operated the I Vamnedarn account Between approximately August 2013 and November 2015 C0- CONSPIRATOR it and identi es linked to VINNIK and to sine received direct payments from the Varnnedam account to their own personal digital currency accounts at another digital currency Cyprus and Latvia tied to VINNIK and other identities associated with VINNIK and STATUTORY ALLEGATIONS COUNT ONE 18 U S C 1960 Operation of an Unlicensed Money Transmitting Business 57 The factual allegations in paragraphs 1 through 60 are re alleged and incorporated herein as ifset forth in full 53 Title 18 United States Code Section 1960 makes it a crinre to operate an unlicensed 13 money transmitting business The term money transmitting includes transferring funds on behalf public by any and all means including but not limited to transfers within this country or to locations abroad by wire check draft facsimile or ecurier This statute makes it a'violation to conduct a money transmitting business if the business is not registered as a money transmitting business with the Secretary of the Treasury as required by a separate statute Title 31 United States Code Section 5330 and federal regulations pur5uant to that statute- 59 The regulations Speci cally apply to foreign-based money transmitting businesses doing substantial business in the United States Sir C F R 1022 3 60 From in or about 2011 up to and including in or about May 2016 both dates being approximate and inclusive in the Northern District of California and elsewhere the defendants aflda CANTON BUSINESS CORPORATION and ALEXANDER VINNIK I and others known and unloiown to the Grand Jury lorowingly conducted controlled managed supervised directed and owned all and part of a money transmitting business affecting interstate and foreign commerce i e which failed to comply with the money transmitting business il 14 exchange Bitstamp These bitcoin were then exchanged into at crnrency and sent to bank accounts in I tit-Fwa 28' registratiOn requirements set forth in Title 31 United States Code Section 5330 and the regulations prescribed pursuant to that statute including 31 C F R Sections 5 and 1022 3 800110 and ii otherwise involved the transpo ation and transmission of funds lmown to the defendants to have heen'den'ved from a criminal offense and intended to be used to promote and support unlaw ll activity All in violation of Title 18 United States Code Sections 1960 Se 2- COUNT TWO 18 USC 195 6 h Conspiracy to Commit Money Laundering 61 The factual allegations in paragraphsl through 60 are re-alleged and incorpiorated herein as if set forth in ill I 62 From in or about July 2011 through in or about January 2017 both dates being approximate and inclusive within the Northern District of Galifornia and elsewhere the defendants a lda CANTON BUSINESS CORPORATION and ALEXANDER VINNIK and others known and unknown to the Grand Jury willfully and knowingly did combine conspire confederate and agree together and with each other to knowingly conduct and attempt to conduct nancial transactions affecting interstate'comruerce and foreign commerce which transactions involved the proceeds of speci ed unlawful activity that is Operation of an unregistered money transmitting lbusiness in violation of Titie'18 United States Code Sections 1960 computer hacking and intrusions in violation of Title 18 United States Code Section 1030 identity theft in violation of Title 18 United States Code Section 1028 interstate transportation of stolen property in violation of Title 18 United States Code Section 2314 the of government proceeds and extortion in violation of Title 18 United States Code Sections 641 and 1951 and narcotics traf cking in violation of Title 21 United States Code Section 841 with the intent to promote the carrying on of the Speci ed unlawful activity and that while conducting and attempting to conduct such nancial transactions knew that the property involved in the- nancial transactions represented the proceeds of some form of unlawful activity in violation of Title 18 United States Code Section All in violation of Title 18 United States Code Section 1956 h 15 madameCOUNTS THREE THROUGH NINETEEN 13 U S C 1956 a 1 A i and Money Laundering On or about the dates described below in the Northern District of California and elsewhere the defendant aided and abetted by others known and unlmown to the Grand Jury did knowingly conduct and attempt to conduct the listed nancial tranSactions affecting interstate and foreign commerce which involved the ALEXANDER VINNIK I proceeds of a specified unlawful activity that is accessing a computer in furtherance of fraud in violation of Title 18 United States Code Section 103 and with the intent to proniote whole and in part to conceal and disguise the nature location source ownership and proceeds of said the carrying on of sad Speci ed unlawful actlvity and knowmg that the transaction was designed 1n speci ed unlawful activity and that while conducting and attempting to conduct such nancial transaction knew that the property involved in the nancial transaction represented the proceeds of some form of unlawful activity- COUNT DATE AMOUNT AMIOUNT TRANSACTION ETC USP THREE 0110312012 90 BTC $557 00 Transfer into Tradehill FOUR 0112312012 83 BTC $522 07 Transfer of BTC into Tradehill FIVE 0112312012 61 ETC $3 83 69 Transfer into Tradehill SIX 0111243012 91 BTC $573 30 Transfer of BTC into Tradehill SEVEN 01 2412012 90 BTC $567 00 Transfer into Tradehill EIGHT 0112412012 99 ETC $623 70 Transfer into Tradehill NINE 0112412012 533 BTC $3 357 90 Transfer into Tradehill TEN 0112412012 1900 BTC $11 970 00 Transfer of BTC into Tradehill ELEVEN 0119412012 579 BTC $3 647 70 Transfer into Tradehill TWELVE 01f24I2012 2 BTC $12 60 Transfer of BTC into Tradehill THIRTEEN 01112712012 - 1000 BTC $5 290 00 Transfer of BTC into Tradchill FOURTEEN 011 271'2012 1500 BTC $7 935 00 TIaDSfer into Tradehill FIFTEEN 0200119012 1000 BTC $5 820 00 Transfer into Tradehill I SIXTEEN 0211012012 1000 BTC $5 820 00 Transfer of BTC into Tradehill SEVENTEEN 021 05112012 3000 BTC $17 040 00 Transfer into Tradehill EIGHTEEN 0210512012 500 ETC $2 340 00 Transfer of BTC into Tradeh l NWETEEN 0211212012 2000 BT $11 200 00 Transfer of BIG into Tradehill Allin violation of Title 18 United States Code Sections 1956 a 1 15t i and 2 16 p-a COUNTS TWENTY THROUGH TWENTY-ONE 18 1957 Engaging in Unlawful Monetary Transactions On or about the dates described below in the Northern Dishict of Califomia and elsewhere the defendant ALEXANDER aided and abetted by others known and unknown to the Grand Jury did knowingly engage and attempt to engage in the listed monetary transnations by through or to a nancial institution affecting interstate and foreign commerce in criminally derived property of a value greater than $10 000 that is the transactions listed below such property having been derived 'om-a speci ed unlaw ll activity that is accessing a computer in flu'therance of fraud in violation of Title 18 United States Code Section 1030 a 4 and COUNT oars AMOUNT AMOUNT TRANSACTION BIC USD TWENTY 021052012 3000 are $17 040 00 Transfer rm macaw TWENTY-ONE 03122012 2000 are $11 200 00 Transfer into Tradehill All in violation of Title 18 United States Code Sections 1957 and 2 FORFEITURE AQLEGATION 13 U so Criminal Forfeiture 63 All of the allegations contained in this Indictment are re-alleged and by this reference fully incorporated herein for the purpose of alleging forfeiture pursuant to the provisions of Title 18 United States Code Section 932 a l 64 Upon a conviction for any of the offenses alleged in this Indictment the defendants afkfa CANTON BUSINESS CORPORATION and ALEXANDER VINNIK shall forfeit to the United States pursuant to 13 U S C i982 a 1 any property real or personal involved in those o 'enscs or any property traceable to such offenses including but not limited to a forfeiture money judgment NO 00 4 Ch U1 LIJ HHb-II I-I II ull lp ll tl l If any of the aforementioned property as a result of any act or omission of the defendants 3 cannot be located upon the exercise of due diligence b has been transferred or sold to or deposited with a third person 0 has been placed beyond the jurisdiction of the Court d has been substantially diminished in value or c has been commingled with other property that cannot be divided without dif culty I any and all interest the defendant has in other property shall be vested in the United States and - Allin violation of Title 13 United States Code Section 982 a 1 and Rule 32 2 of the Federal Rules of Criminal Procedure DATED A TRUE BILL 7 l1 OREPERSON BRIAN J STRETCH United States Attorney BARBARA J VALLIERE Chief Criminal Division Approved as to form WILLIAM FRENTZEN HAUN Assistant U S Attorneys lira re INDICTMENT I 13 forfeited to the United States pursuant to 21 U S C 853 1 as incorporated by 18 U S C E e9- - A 59 95-3 UNITED STATES DISTRICT COURT 0 3 NORTHERN DISTRICT 0E CALIFORNIA CRIMJNAL COVER SHEET 111m Efeerz've November I 2016 this Criminal Comer Sheet must be completed dong with the Defendant Infemza oh Form for each new crmzinal caste CASE NAME Canton Business Corpqra on CASE NUMBER USA V and Alexander lenik CR 16-00227 SI Is This case Under Real I Yes No Total Number of efmhants I 8 or more Does this case involve ONLY charges Yes No I under 8 U S C 1325 1326 Venue Per Grim LR 18-1 SF OAK SJ Is this a potential high-cost case Yes hTo Yes v Is this a RICO Act gang-case Yes Na William Frentzen - Dates nbmitted 01m on -Comments RESET FORM - SAVE PDF Form WERE-COVER Rev ORIGINAL FILED UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY 3 1 LEDA DUNN WETTRE IN THE MATTER OF THE SEARCH OF Mag No_ 17-8123 INFORMATION ASSOCIATED WITH SERVERS CONTAINING RELATED CONTENT STORED AT THE PREMISES CONTROLLED BY EQUINIX SEALING ORDER Leda Dunn Wettre This matter having been brought before the Court upon application of William E Fitzpatrick Acting United States Attorney for the District of New Jersey Jason S Gould Assistant United States Attorney appearing for an order sealing the search warrant issued on this date and the application and attached Affidavit in support of that warrant and for good cause shown IT IS on this let Day of July 2017 ORDERED that the search warrant the application and affidavit in support of the search warrant and all related documents except for one copy of the search warrant and inventory to be served at the time the search is executed be and hereby are sealed until further Order of this Court Damn Hon Leda Dunn Wettre United States Magistrate Judge                     National Security Archive    Suite 701  Gelman Library  The George Washington University    2130 H Street  NW  Washington  D C  20037    Phone  202 994‐7000  Fax  202 994‐7005  nsarchiv@gwu edu