United States v. 519803.53164 USDT and 1135.508 XMR

District Court, D. Nevada·Decided September 2, 2025·No. 2:25-cv-00534·Unknown

Opinion

UNITED STATES DISTRICT COURT

United States of America, 2:25-CV-534-JCM-BNW

Plaintiff, Default Judgment of Forfeiture and Final Judgment of Forfeiture v.

519803.53164 USDT and 1135.508 XMR that are associated with transaction hashes 0x1ac48e72bb2fd83ad60a0f3f0cea5036e3bd cfe593a4a9be53c12c44a6197421, 0xbc0e435002aba822c6355e4f7571fe9b0d82 2e17e448c7262b2c9114ec325228, and 0x3e989f0de45e39c89e86032acc59e33c5161 d492dde3c7b09ea19408ba74c931 sent to Gate.io USDT address 0x6BC5C2661D75f0Ced80754D3C7bD651 f1d60f736 and held in the name of Avalanche Bridge, Defendant. On August 18, 2023, a company (Victim A) located in Las Vegas, Nevada, was the victim of a cyber-attack. The unknown subjects gained unauthorized access into Victim A’s network and stole sensitive company data. The unknown subjects demanded Victim A to pay the unknown subjects in bitcoin (BTC)1 and threatened that the data would be publicly released if Victim A did not comply. The unknown subjects initially demanded $30 million USD worth of BTC be paid by Victim A or the sensitive data would be publicly released.

1 A glossary of cryptocurrency-related terms is provided in Exhibit 1 to the Complaint, ECF Victim A negotiated the extortion payment down to approximately $15 million USD. The unknown subjects promised to delete the stolen data after they received the payment. Victim A paid the extortion payment in two separate purchases of BTC. Through subsequent analysis (using a commercially available crypto-tracing tool), law enforcement traced the BTC transactions sent from Victim A to a point known in crypto currency transactions as a bridge, in this case extortion payment wallets Avalanche Bridge. The property was traced based on the “Illegal Proceeds In, First Out” (or last-in, first-out) accounting principle, which assumes that the last or most recent incoming assets are the first expended or sent out. See United States v. Banco Cafetero Panama, 797 F.2d 1154, 1160 (2d Cir. 1986) (government can establish prima facie case for forfeiture by relying on the “last-in, last-out” approach or the “last-in, first-out” approach.)2 A detailed summary flowchart attached as Exhibit 2 to the Complaint3 describes the transfer of the illegal proceeds from the extorted payments made by Victim A to the unknown subjects. When the illegal proceeds were transferred from the extorted payments made by Victim A to the unknown subjects, BTC fees, in the form of a minute portion of the BTC, may have been paid in small amounts as each transaction progressed.4 Victim A paid the unknown subjects through two separate transactions. On September 11, 2023, Victim A sent the first payment in the amount of approximately 297 2 Also known as the “‘drugs-in, first-out’ rule. As the name suggests, this rule posits that when withdrawals are made, tainted money leaves the account first.” United Sates v. Dillion, No. 1:16-cr-00037-BLW, 2022 WL 2105974, *4 (D. Ida. Jun. 10, 2022) (citing Banco, 797 F.2d at 1158 3 Complaint, ECF No. 1, p. 19. 4 Bitcoin (BTC) fees are the costs that users pay to have their transactions processed by miners on the Bitcoin network. These fees incentivize miners to include transactions in the blocks they create. The amount of the fee can vary based on several factors, including network congestion and the transaction size. Network congestion occurs when the Bitcoin network is congested (i.e., there are more transactions waiting to be processed than available space in the blocks), fees increase because users compete to have their transactions confirmed quickly. Transaction size fees are calculated based on the size of the transaction in bytes, rather than the amount of Bitcoin being transferred. Larger transactions (in terms of data size) will require higher fees. See also BTC to BTC address bc1qmrcc0dtdn3c785phrncf5wtz98q9qy8ndpd5ev (Extortion Wallet 1). On October 11, 2023, Victim A paid the second payment in the amount of approximately 277 BTC. As instructed to do so by the unknown subjects, Victim A sent the second payment to BTC address bc1q5ft3et8h0qp4ppk6hjjhfxmmy32egzgvrgtwsn (Extortion Wallet 2). Prior to these transfers, Extortion Wallet 1 and Extortion Wallet 2 did not have a balance, nor did either wallet receive any additional payments. Therefore, there was no co- mingling of any previous cryptocurrencies. Upon information and belief, Extortion Wallet 1 and Extortion Wallet 2 appeared to have been opened only for the purpose of receiving these two payments. On September 12, 2023, the unknown subjects who had access/ownership of Extortion Wallet 1 sent approximately 125 BTC (of the initially deposited 297 BTC) from Extortion Wallet 1 to bc1qy43glppnqfrey5yt97xv7fyrcn0a04npfwtef5 (Transfer Wallet 1). Prior to this transfer, Transfer Wallet 1 did not have a balance, nor did it receive any additional payments. Therefore, there was no co-mingling of any previous cryptocurrencies. Upon information and belief, Transfer Wallet 1 appeared to have been opened only for the purpose of receiving the transfer of Victim A’s first payment. On January 19, 2024, the unknown subjects who had access/ownership of Extortion Wallet 2 and Transfer Wallet 1 combined the BTC in Extortion Wallet 2 and Transfer Wallet 1 into the BTC address bc1qpy24cr5lukg33cpt3mx9xx3368mu4x2znnswt4 (Combined Wallet 1): approximately 125 BTC was sent from Transfer Wallet 1 and approximately 277 BTC was sent from Extortion Wallet 2. Prior to this transfer, Combined Wallet 1 did not have a balance, nor did it receive any additional payments. Therefore, there was no co-mingling of any previous cryptocurrencies. Upon information and belief, Combined Wallet 1 appeared to have been opened only for the purpose of receiving the transfer of Victim A’s first and second payments. / / / The unknown subjects who had access/ownership of Combined Wallet 1 then transferred all the cryptocurrencies in Combined Wallet 1 to the Avalanche Bridge BTC address bc1q2f0tczgrukdxjrhhadpft2fehzpcrwrz549u90 (Avalanche Wallet 1) via two separate transactions by the unknown subjects. On January 19, 2024, at 07:57 (UTC), Avalanche Wallet 1 received approximately 125 BTC from Combined Wallet 1. On the same day, at 22:36 (UTC), Avalanche Wallet 1 received approximately 277 BTC from Combined Wallet 1. As a result of these transactions, Avalanche Wallet 1 received a total amount of approximately 402 BTC. On January 19, 2024, the FBI contacted Ava Labs, Inc., and requested it to voluntarily freeze the 402.41203181 BTC sent to Avalanche Wallet 1. Ava Labs, Inc., agreed to voluntarily freeze the 277.56327614 BTC transferred from Extortion Wallet 2 to Avalanche Wallet 1 (which went to Combined Wallet 1 before Avalanche Wallet 1), until service of a civil forfeiture seizure warrant. However, Ava Labs, Inc., was not able to voluntarily freeze the 125 BTC transferred from Extortion Wallet 1 to Avalanche Wallet 1 (which went to Combined Wallet 1 before Avalanche Wallet 1) because the 125 BTC had already been transferred from Avalanche Wallet 1. On January 19, 2024, an unknown actor transferred the 125 BTC from Extortion Wallet 1 that was now in Avalanche Wallet 1 through the Avalanche Bridge to the wallet 0x97937B9CF687379322E54A8DA35d5D2b243857E6 (BTCB Wallet). The approximate 125 BTC was valued at $5,152,669.48 USD. Prior to this transfer, the BTCB Wallet did not have a balance. A more detailed overview is found in Exhibit 3.5 Between January 20, 2024, and January 21, 2024, cryptocurrency totaling in the amount of $3,185,995.35 USD was sent to wallet 0x1934d0D0CbF872Ff11cDb859de D6Dd6c5C7cbC1e (AVAX Wallet 1) from the BTCB Wallet. Prior to this transfer, AVAX Wallet 1 did not have a balance. On January 21, 2024, cryptocurrency totaling in the amount of $2,198,220.27 USD was sent to wallet 0xA3631164d97ec60407DFe79b91b19C8eF83 ADABe (AV

Free access — add to your briefcase to read the full text and ask questions with AI

United States v. 519803.53164 USDT and 1135.508 XMR, (D. Nev. 2025).

United States v. 519803.53164 USDT and 1135.508 XMR (United States v. 519803.53164 USDT and 1135.508 XMR) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related