United States v. 519803.53164 USDT and 1135.508 XMR

CourtDistrict Court, D. Nevada
DecidedSeptember 2, 2025
Docket2:25-cv-00534
StatusUnknown

This text of United States v. 519803.53164 USDT and 1135.508 XMR (United States v. 519803.53164 USDT and 1135.508 XMR) is published on Counsel Stack Legal Research, covering District Court, D. Nevada primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
United States v. 519803.53164 USDT and 1135.508 XMR, (D. Nev. 2025).

Opinion

1 2

5 UNITED STATES DISTRICT COURT 6 DISTRICT OF NEVADA

7 United States of America, 2:25-CV-534-JCM-BNW

8 Plaintiff, Default Judgment of Forfeiture and Final Judgment of Forfeiture 9 v.

10 519803.53164 USDT and 1135.508 XMR that are associated with transaction hashes 11 0x1ac48e72bb2fd83ad60a0f3f0cea5036e3bd cfe593a4a9be53c12c44a6197421, 12 0xbc0e435002aba822c6355e4f7571fe9b0d82 2e17e448c7262b2c9114ec325228, and 13 0x3e989f0de45e39c89e86032acc59e33c5161 d492dde3c7b09ea19408ba74c931 sent to 14 Gate.io USDT address 0x6BC5C2661D75f0Ced80754D3C7bD651 15 f1d60f736 and held in the name of Avalanche Bridge, 16 Defendant. 17 18 I. FACTS 19 On August 18, 2023, a company (Victim A) located in Las Vegas, Nevada, was the 20 victim of a cyber-attack. 21 The unknown subjects gained unauthorized access into Victim A’s network and 22 stole sensitive company data. 23 The unknown subjects demanded Victim A to pay the unknown subjects in bitcoin 24 (BTC)1 and threatened that the data would be publicly released if Victim A did not comply. 25 The unknown subjects initially demanded $30 million USD worth of BTC be paid 26 by Victim A or the sensitive data would be publicly released. 27

28 1 A glossary of cryptocurrency-related terms is provided in Exhibit 1 to the Complaint, ECF 1 Victim A negotiated the extortion payment down to approximately $15 million 2 USD. The unknown subjects promised to delete the stolen data after they received the 3 payment. 4 Victim A paid the extortion payment in two separate purchases of BTC. Through 5 subsequent analysis (using a commercially available crypto-tracing tool), law enforcement 6 traced the BTC transactions sent from Victim A to a point known in crypto currency 7 transactions as a bridge, in this case extortion payment wallets Avalanche Bridge. The 8 property was traced based on the “Illegal Proceeds In, First Out” (or last-in, first-out) 9 accounting principle, which assumes that the last or most recent incoming assets are the 10 first expended or sent out. See United States v. Banco Cafetero Panama, 797 F.2d 1154, 1160 11 (2d Cir. 1986) (government can establish prima facie case for forfeiture by relying on the 12 “last-in, last-out” approach or the “last-in, first-out” approach.)2 13 A detailed summary flowchart attached as Exhibit 2 to the Complaint3 describes the 14 transfer of the illegal proceeds from the extorted payments made by Victim A to the 15 unknown subjects. 16 When the illegal proceeds were transferred from the extorted payments made by 17 Victim A to the unknown subjects, BTC fees, in the form of a minute portion of the BTC, 18 may have been paid in small amounts as each transaction progressed.4 19 Victim A paid the unknown subjects through two separate transactions. On 20 September 11, 2023, Victim A sent the first payment in the amount of approximately 297 21 2 Also known as the “‘drugs-in, first-out’ rule. As the name suggests, this rule posits that 22 when withdrawals are made, tainted money leaves the account first.” United Sates v. Dillion, No. 1:16-cr-00037-BLW, 2022 WL 2105974, *4 (D. Ida. Jun. 10, 2022) (citing Banco, 797 23 F.2d at 1158 3 Complaint, ECF No. 1, p. 19. 24 4 Bitcoin (BTC) fees are the costs that users pay to have their transactions processed by miners on the Bitcoin network. These fees incentivize miners to include transactions in the 25 blocks they create. The amount of the fee can vary based on several factors, including network congestion and the transaction size. Network congestion occurs when the Bitcoin 26 network is congested (i.e., there are more transactions waiting to be processed than available space in the blocks), fees increase because users compete to have their transactions 27 confirmed quickly. Transaction size fees are calculated based on the size of the transaction in bytes, rather than the amount of Bitcoin being transferred. Larger transactions (in terms 28 of data size) will require higher fees. See also 1 BTC to BTC address bc1qmrcc0dtdn3c785phrncf5wtz98q9qy8ndpd5ev (Extortion Wallet 2 1). 3 On October 11, 2023, Victim A paid the second payment in the amount of 4 approximately 277 BTC. As instructed to do so by the unknown subjects, Victim A sent the 5 second payment to BTC address bc1q5ft3et8h0qp4ppk6hjjhfxmmy32egzgvrgtwsn 6 (Extortion Wallet 2). 7 Prior to these transfers, Extortion Wallet 1 and Extortion Wallet 2 did not have a 8 balance, nor did either wallet receive any additional payments. Therefore, there was no co- 9 mingling of any previous cryptocurrencies. Upon information and belief, Extortion Wallet 10 1 and Extortion Wallet 2 appeared to have been opened only for the purpose of receiving 11 these two payments. 12 On September 12, 2023, the unknown subjects who had access/ownership of 13 Extortion Wallet 1 sent approximately 125 BTC (of the initially deposited 297 BTC) from 14 Extortion Wallet 1 to bc1qy43glppnqfrey5yt97xv7fyrcn0a04npfwtef5 (Transfer Wallet 1). 15 Prior to this transfer, Transfer Wallet 1 did not have a balance, nor did it receive any 16 additional payments. Therefore, there was no co-mingling of any previous 17 cryptocurrencies. Upon information and belief, Transfer Wallet 1 appeared to have been 18 opened only for the purpose of receiving the transfer of Victim A’s first payment. 19 On January 19, 2024, the unknown subjects who had access/ownership of 20 Extortion Wallet 2 and Transfer Wallet 1 combined the BTC in Extortion Wallet 2 and 21 Transfer Wallet 1 into the BTC address bc1qpy24cr5lukg33cpt3mx9xx3368mu4x2znnswt4 22 (Combined Wallet 1): approximately 125 BTC was sent from Transfer Wallet 1 and 23 approximately 277 BTC was sent from Extortion Wallet 2. Prior to this transfer, Combined 24 Wallet 1 did not have a balance, nor did it receive any additional payments. Therefore, 25 there was no co-mingling of any previous cryptocurrencies. Upon information and belief, 26 Combined Wallet 1 appeared to have been opened only for the purpose of receiving the 27 transfer of Victim A’s first and second payments. 28 / / / 1 The unknown subjects who had access/ownership of Combined Wallet 1 then 2 transferred all the cryptocurrencies in Combined Wallet 1 to the Avalanche Bridge BTC 3 address bc1q2f0tczgrukdxjrhhadpft2fehzpcrwrz549u90 (Avalanche Wallet 1) via two 4 separate transactions by the unknown subjects. 5 On January 19, 2024, at 07:57 (UTC), Avalanche Wallet 1 received approximately 6 125 BTC from Combined Wallet 1. 7 On the same day, at 22:36 (UTC), Avalanche Wallet 1 received approximately 277 8 BTC from Combined Wallet 1. 9 As a result of these transactions, Avalanche Wallet 1 received a total amount of 10 approximately 402 BTC. 11 On January 19, 2024, the FBI contacted Ava Labs, Inc., and requested it to 12 voluntarily freeze the 402.41203181 BTC sent to Avalanche Wallet 1. 13 Ava Labs, Inc., agreed to voluntarily freeze the 277.56327614 BTC transferred from 14 Extortion Wallet 2 to Avalanche Wallet 1 (which went to Combined Wallet 1 before 15 Avalanche Wallet 1), until service of a civil forfeiture seizure warrant. However, Ava Labs, 16 Inc., was not able to voluntarily freeze the 125 BTC transferred from Extortion Wallet 1 to 17 Avalanche Wallet 1 (which went to Combined Wallet 1 before Avalanche Wallet 1) 18 because the 125 BTC had already been transferred from Avalanche Wallet 1. 19 On January 19, 2024, an unknown actor transferred the 125 BTC from Extortion 20 Wallet 1 that was now in Avalanche Wallet 1 through the Avalanche Bridge to the wallet 21 0x97937B9CF687379322E54A8DA35d5D2b243857E6 (BTCB Wallet). The approximate 22 125 BTC was valued at $5,152,669.48 USD. Prior to this transfer, the BTCB Wallet did not 23 have a balance.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
United States v. 519803.53164 USDT and 1135.508 XMR, Counsel Stack Legal Research, https://law.counselstack.com/opinion/united-states-v-51980353164-usdt-and-1135508-xmr-nvd-2025.