Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 1 of 24

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA, :

:
v. : Criminal No. 21-cr-433 (BAH)
:
GARY JAMES HARMON, :
:
Defendant. :

GOVERNMENT’S MEMORANDUM
IN SUPPORT OF PRETRIAL DETENTION

The United States, by and through its attorney, the United States Attorney for the District

of Columbia, hereby submits this Memorandum in Support of Pretrial Detention pursuant to 18

U.S.C. § 3142(f)(2)(A) and (B). In support whereof, the government states as follows:

FACTUAL BACKGROUND

This case arises out of the prosecution of the defendant’s brother, Larry Dean Harmon, for

operating the illicit Darknet bitcoin money laundering and money transmitting service called

Helix. See United States v. Larry Dean Harmon, No. 19-cr-395 (BAH). As alleged in the

Indictment in this case, Helix enabled customers, for a fee, to send bitcoins to designated recipients

in a manner which was designed to conceal and obfuscate the source or owner of the bitcoins.

This type of service is commonly referred to as a bitcoin “mixer” or “tumbler.” Prior to Larry

Harmon’s arrest, federal investigators using blockchain analysis identified 16 Bitcoin wallets (the

“SUBJECT WALLETS”) containing approximately 4,877 BTC traced to Helix. This sum

represented criminal proceeds that Larry Harmon accumulated through his operation of Helix. At

the time of Larry Harmon’s arrest, federal agents acting pursuant to a search warrant seized a

cryptocurrency storage device belonging to Larry Harmon that was later discovered to contain the

SUBJECT WALLETS. The defendant, Gary James Harmon, has been indicted for remotely
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 2 of 24

accessing and absconding with approximately 712.6 BTC from the SUBJECT WALLETS,

representing property that was seized pursuant to a lawful warrant and subject to criminal forfeiture

in the pending proceeding against Larry Harmon.

A. Indictment and Arrest of Larry Harmon and Recovery of TREZOR ONE

Cryptocurrency Storage Device

On December 3, 2019, a federal grand jury in the District of Columbia returned a sealed

indictment against Larry Harmon on counts of Conspiracy To Launder Monetary Instruments, in

violation of 18 U.S.C. § 1956(h); Operating an Unlicensed Money Transmitting Business, in

violation of 18 U.S.C. § 1960(a); and Money Transmission Without a License, in violation of D.C.

Code § 26-1023(c). The Indictment contained a Forfeiture Allegation, which provided notice that

the government will seek the forfeiture of “any property, real or personal, involved in the offense,

and any property traceable thereto,” referring to Counts One and Two of the Indictment, charging

Conspiracy To Launder Monetary Instruments and Operating an Unlicensed Money Transmitting

Business.

On February 6, 2020, federal agents arrested Larry Harmon in Akron, Ohio and executed

search warrants issued in the Northern District of Ohio at three properties owned or leased by

Larry Harmon, including suites on the second and third floors of a three-story office building at

57/59 Market Street in Akron, Ohio. Agents located Larry Harmon on the second floor of the

Market Street building. In the same location, agents recovered a Trezor-brand cryptocurrency

storage device (“TREZOR ONE”) that was magnetically attached underneath a table located a

short distance from where Larry Harmon was seated at the time of his arrest.

2
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 3 of 24

Figure 1: TREZOR ONE

Federal agents executing the search warrants also discovered the defendant, Gary Harmon,

was residing in an apartment directly across from the suite where Larry Harmon was found. Gary

Harmon told agents that he was Larry Harmon’s brother and worked for Larry Harmon’s company,

Coin Ninja. Gary Harmon told agents that he was not familiar with Helix.

Further on February 6, 2020, Belizean authorities, acting on a Mutual Legal Assistance

Treaty request, searched a condominium leased by Larry Harmon in San Pedro, Belize. On

February 10, 2020, federal agents executed a search warrant issued in the Northern District of

California for an apartment leased by Larry Harmon in California. The searches in Ohio,

California, and Belize recovered multiple cryptocurrency storage devices.

Cryptocurrency wallets stored on a Trezor device, such as TREZOR ONE, can be accessed

in at least two ways. First, if the user has physical access to the device, the user can plug the

device into a computer and access it by entering a passcode on the device. Second, if the user is

unable to physically access the device, the user can recreate wallets stored on the device by using

recovery seed words. Recovery seed words are a unique sequence of 12 to 24 words securely

3
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 4 of 24

generated in the Trezor device when it is set up. If a user is later unable to access the device, the

user can still access the cryptocurrency wallets stored on the device by entering the seed words in

the correct sequence into another Trezor device or similar application, which will recreate the data

constituting the same cryptocurrency wallets stored on the original device.

TREZOR ONE had an additional security feature enabled, which allows a user to create

unlimited “hidden wallets” within a Trezor device. Each hidden wallet is protected by its own

additional passphrase. Without the correct passphrase, such hidden wallets are not visible on the

device and cannot be accessed.

Immediately following Larry Harmon’s arrest, law enforcement was unable to recover any

cryptocurrency from TREZOR ONE. TREZOR ONE actually held the 16 SUBJECT

WALLETS containing proceeds and fees Larry Harmon generated through the operation of Helix,

but the wallets were concealed within hidden wallets and were not visible to law enforcement.

Federal agents subsequently transported TREZOR ONE to a secure evidence locker in

Washington, D.C.

B. Gary Harmon Attends Detention Hearings for Larry Harmon

On February 11, 2020, Larry Harmon appeared for a detention and identity hearing before

Magistrate Judge Kathleen B. Burke in the U.S. District Court for the Northern District of Ohio.

The defendant, Gary Harmon, was present in the gallery of the courtroom. During the hearing,

IRS-CI Special Agent Jeremiah Haynie testified that agents had recovered a spreadsheet from a

search of Larry Harmon’s Google Drive account, last edited October 18, 2018, purporting to show

an accounting by Larry Harmon of bitcoin and other assets valued at $56,939,610. 2/11/20 Tr.

at 35-39, attached as Ex. A (excerpts). Some of the bitcoin was identified as being located on

4
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 5 of 24

“Trezor” devices. Id. at 36. Special Agent Haynie explained that bitcoin stored on a Trezor

device can be recovered remotely by means of seed keys. Id. at 37-38. Special Agent Haynie

further testified that, while executing the search warrant for the Market Street premises, he had

found and seized a concealed Trezor device (i.e., TREZOR ONE). Id. at 39-40. When asked

by the government attorney, “Are there in fact tens of millions of dollars that have not yet been

seized in this investigation,” Special Agent Haynie confirmed, “Yes.” Id. at 73. In argument,

defense counsel informed the Court that Larry Harmon had the ability to “unlock those devices.”

Id. at 86. Government counsel confirmed that the government was unable to access to Larry

Harmon’s cryptocurrency stored on devices such as TREZOR ONE. Id. at 84 (noting

“substantial resources that he potentially has at his fingertips that the government does not have

access to now”); see also id. at 86 (“But certainly to the extent he wishes to provide the passwords

and the PINs and the information that would allow us to access that bitcoin, we would happily

accept that offer.”).

On March 13, 2020, Larry Harmon appeared for a detention appeal hearing before this

Court. The defendant, Gary Harmon, was present in the gallery of the courtroom. There was

extensive argument during the detention hearing about Trezor devices, seed recovery phrases, and

hidden wallets. See 3/13/20 Tr. at 17-19, 22-23, attached as Ex. B (excerpts). Counsel for the

government stated: “These are illegal proceeds from Helix, and we have not been able to secure

those assets. Until we can secure them and transfer them to a government wallet, those are

available for [Larry Harmon] or his family members to transfer them . . . .” Id. at 19. At the

conclusion of the hearing, Larry Harmon was ordered released pending trial, subject to conditions

of release including restrictions on cryptocurrency transactions.

5
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 6 of 24

C. Gary Harmon Transfers Helix Proceeds from the Hidden Wallets Stored on
TREZOR ONE

IRS-CI monitored the 16 SUBJECT WALLETS containing approximately 4,877 BTC

traceable to Helix for any indication funds were being moved. Between February 6, 2020 and

April 18, 2020, there was no such movement of funds. However, beginning on or about April

19, 2020 and continuing through on or about April 24, 2020, IRS-CI observed a series of eight

bitcoin transactions from the 16 SUBJECT WALLETS into new bitcoin wallets previously

unknown to law enforcement. In total, the transfers totaled approximately 712.6003 BTC, with

an approximate value of $5,397,083.98 as of April 25, 2020 from the SUBJECT WALLETS into

eight new wallets (the “NEW WALLETS”). The transactions are summarized in the following

table:

6
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 7 of 24

Approximate
U.S. dollar
Transfer value as of
Timestamp Originating Wallet Destination Wallet BTC Sent 4/25/20

SUBJECT WALLET 1 NEW WALLET 1

4/21/20
365Ha89bm4ujCxJyGax8yg bc1q8xljz94cckeusrsvj9hc23z4 109.1979479 $827,042.33
20:41
GYpkH9FfcYTc 8vprne5asyda9q

SUBJECT WALLET 2 NEW WALLET 2

4/21/20
34Yjw2Tb8fHM97LgB3enVc bc1qm2s3fawp9cykf7cml2an4 99.99989744 $757,378.22
16:26
ajixH6U9Qpxi 895nm8vurmf8cz4fe

SUBJECT WALLET 3 NEW WALLET 3

4/21/20
33CP1cYEjFTCVjRDYEw1wZ bc1quw0cj5sz7twgjr2k5hk3m 229.9998355 $1,741,970.45
16:26
Pzer688BE4BT 5jfvsy30xl0qts479

SUBJECT WALLET 4 NEW WALLET 4

4/21/20
3F7cdqtZMdriwBwwCB74W bc1qt4asc4wj6khhsm3xs5us5 54.83112457 $415,279.42
13:03
iKit3bkirihRb 4jqvwlwxmd7f6wzax

SUBJECT WALLET 5 NEW WALLET 5

4/21/20
35fhvnAC37K55WuCTxFXk7 bc1q7apq75zv6r7hvcqrpm56 55.88845252 $423,287.40
19:22
zfTJge75G1dD nke54le7uhf87ytsvh

SUBJECT WALLET 6 NEW WALLET 6

4/20/20
3HuevX13pPgnUrtqU3UaJx bc1q485k94wyqttylekcge8hw 158.6830152 $1,201,831.83
12:44
1AMBph5xH86w uy2fa94mq5r7jk62y

SUBJECT WALLET 7 NEW WALLET 7

4/19/20
3PLUJ9YJ6p3RrhmvmMQV bc1q5lf2jwjfkajxtwtfxj0zqy3n 2.999981 $22,721.23
14:42
wyS38VxeRQ81Nq 5jrm20w5gsp4k2

SUBJECT WALLET 8 NEW WALLET 8

4/24/20
37NxUHKKbmoZsQDEw5yyJ bc1qee72uxqgj5yrywfmtcmm 0.99990861 $7,573.10
19:26
xktNLGdzjDV1J yfkk4zku67ep6krfe3

TOTAL: 712.6003 $5,397,083.98

On April 26, 2020, government attorneys filed a motion for an emergency status hearing

in Larry Harmon’s criminal case, alerting the Court to the cryptocurrency transactions involving

7
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 8 of 24

the 16 SUBJECT WALLETS. Notably, the transactions stopped after the government’s filing—

suggesting that the responsible party was aware of developments in Larry Harmon’s criminal case.

On April 28, 2020, following a hearing, this Court issued an Order requiring Larry Harmon

to provide the government with access to any and all cryptocurrency within Larry Harmon’s

possession, including “by disclosing seed recovery keys, access to hidden wallets, and other keys

needed to transfer cryptocurrency.” See 19-cr-395, ECF No. 26. The Court further required

that such cryptocurrency be turned over to the custody of the U.S. Marshals Service during the

pendency of the criminal proceeding. On April 29, 2020, Larry Harmon complied with the

Court’s order and, through his attorney, provided the government with recovery seed phrases and

passphrases for his cryptocurrency wallets.

Further on April 29, 2020, federal agents used the credentials provided by Larry Harmon

to access hidden wallets within TREZOR ONE. Federal agents confirmed that TREZOR ONE

contained all 16 SUBJECT WALLETS. Federal agents successfully recovered approximately

4,168.98163 BTC from wallets stored on TREZOR ONE, which BTC was then transferred to the

U.S. Marshals Service. Federal agents were also able to view transaction history for TREZOR

ONE and confirm that eight of the SUBJECT WALLETS had been emptied out as a result of the

defendant’s transactions.

8
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 9 of 24

Figure 2: TREZOR ONE Transaction Histories

According to non-content electronic records obtained by Court order pursuant to 18 U.S.C.

§ 2703(d), the defendant’s personal Google account received four emails from the email address

no-reply@trezor.io between April 19, 2020 and April 26, 2020, bracketing the time period during

which the illicit bitcoin movements took place. This is consistent with Gary Harmon using

Trezor’s web interface to recreate a Trezor wallet using only seed words and a passphrase.

Notably, the defendant did not receive any other messages from Trezor.io addresses before or after

April 2020.

D. The Defendant Falsely Denies Removing the Missing Bitcoin, Admits to Destroying
Evidence

On July 15, 2020, federal agents from FBI and IRS-CI conducted a voluntary interview of

the defendant in Akron, Ohio. Agents advised the defendant that he was suspected of transferring

approximately 712 BTC owned by Larry Harmon that were subject to forfeiture in the pending

criminal case against Larry Harmon. The defendant denied moving the bitcoin, stating: “if I took

it, why wouldn’t I take it all?”

The defendant stated that he obtained a USB thumb drive from Larry Harmon containing

passwords for accounts and servers used at the company Coin Ninja. The defendant stated that

9
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 10 of 24

he found several partial sets of seed words on the USB drive. When agents asked about the

whereabouts of the USB drive, the defendant stated that he flushed the USB drive down the toilet

at his gym.

E. The Defendant Launders the Bitcoin Through Online Mixers, Engages in Lavish
Spending Spree

Prior to the illicit removal of the 712.6 BTC from TREZOR ONE, the defendant was on

unemployment and lived a modest lifestyle. Bank records show that the defendant was earning

approximately $45,000 per year as a Coin Ninja employee prior to Larry Harmon’s arrest in

February 2020. The defendant received his last paycheck of approximately $1,769.51 on or about

January 31, 2020. Beginning on or about April 13, 2020, the defendant began receiving

unemployment payments from the Ohio Department of Jobs and Family Services (ODJFS).

Between April 13, 2020 and November 18, 2020, the defendant received a total of $23,436 in

unemployment compensation from ODJFS. He also received economic stimulus payments from

the U.S. Department of the Treasury totaling $2,400 in April 2020 and December 2020. He had

no other known legitimate income or employment during this time period.

Beginning on or about August 18, 2020, federal agents monitoring the public blockchain

began observing numerous small transfers of bitcoin out of the eight NEW WALLETS and into

two different bitcoin mixers, Wasabi Wallet and ChipMixer.com. 1 Between on or about August

1
WasabiWallet.io is an open-source, non-custodial privacy-focused bitcoin wallet that creates trustless CoinJoin
transactions over the Tor network. CoinJoin is a mechanism by which multiple participants combine their coins into
one large transaction with multiple inputs and multiple outputs. An observer cannot determine which output belongs
to which input, and neither can the participants themselves. This makes it difficult for outside parties to trace where
a particular coin originated from and where it was sent to.

Chipmixer.com is a bitcoin tumbling service operating on both the Clearnet and the Tor network. ChipMixer mixes
funds of its user together (similar to how Helix functioned) and returns them to users in an effort to confuse blockchain
analysts or blockchain tracking software.

10
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 11 of 24

18, 2020 through on or about March 30, 2021, at least 518.98 BTC was sent to these mixers from

the NEW WALLETS.

Corresponding to these efforts to launder the 712.6 BTC through online mixer services, the

defendant’s financial situation began a dramatic transformation. Bank records show that the

defendant began making thousands of dollars in unexplained cash deposits into his bank account

in late 2020 and early 2021. The unexplained cash deposits above are consistent with the

defendant engaging in peer-to-peer sales involving the missing 712.6 BTC. 2 On January 12,

2021, the defendant deposited a $52,000 check with the notation “Crypto” in the memo line, further

supporting the conclusion that he was selling bitcoin in exchange for U.S. dollars. The defendant

used the proceeds of the “Crypto” check to purchase a 2018 Audi S5 luxury automobile.

Figure 3: Check Deposit for “Crypto”

2
Several witnesses interviewed by federal law enforcement about Larry Harmon’s activities prior his arrest identified
the defendant as someone who had assisted Larry Harmon in selling bitcoin for cash in peer-to-peer transactions.
The defendant’s involvement in these earlier peer-to-peer transactions shows that he would know how to go about
arranging similar peer-to-peer transactions to liquidate the illicitly obtained 712.6 BTC.

11
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 12 of 24

Records obtained from the cryptocurrency exchange Bittrex showed that the defendant

opened an account on January 30, 2021, using a ProtonMail email address. 3 Between February

5, 2021 and February 8, 2021, the defendant deposited 26.55 BTC into his account, valued at

approximately $983,000 at the time of the transactions. On February 12, 2021, the defendant

used the majority of his BTC deposits to purchase 16,079,260.6675007 in Dogecoin, an alternative

cryptocurrency.

Records obtained from the cryptocurrency finance company BlockFi show that the

defendant deposited approximately 67.62681465 BTC into a new BlockFi account on or about

March 25, 2021, valued at more than $3.5 million at the time of the transaction. The defendant

used his ProtonMail address to register the BlockFi account. Approximately 65.95 BTC was

used as “loan collateral” for a loan to the defendant in the amount of $1,200,000. The defendant

used a portion of the $1,200,000 loan proceeds to purchase a luxury condominium unit in

Cleveland, Ohio.

BlockFi flagged the defendant’s March 25, 2021 bitcoin deposit for “close exposure to a

Darknet Market and Ransomware.” BlockFi’s analytics linked the March 25, 2021 transaction

to the mixer ChipMixer.com. BlockFi flagged another bitcoin deposit by the defendant on or

about April 2, 2021 for “close exposure to a Mixing Service.”

3
ProtonMail is an end-to-end encrypted email service based in Switzerland. ProtonMail markets itself as a
“privacy” service and advertises that it does not collect any personal information or user IP logs. See
https://protonmail.com/.

12
Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 13 of 24

Figure 4: BlockFi Records

13
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 14 of 24

Preliminary examination of the defendant’s cellular phone, recovered pursuant to a search

warrant, show that he spent bitcoin extravagantly at nightclubs, and that he used TapJets, a private

charter jet company that accepts bitcoin as payment.

Figure 5: Images from Defendant’s Phone

14
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 15 of 24

F. Arrest of Gary Harmon and Recovery of Multiple Trezor Devices and Seed Keys

On June 28, 2021, a federal grand jury in the District of Columbia returned a sealed

indictment against the defendant, Gary Harmon, on eight counts of Money Laundering, in violation

of 18 U.S.C. § 1956(a)(1)(B)(i); Obstruction of an Official Proceeding, in violation of 18 U.S.C.

§ 1512(c)(2); and Removal of Property To Prevent Seizure, in violation of 18 U.S.C. § 2232(a).

On July 28, 2021, federal agents arrested Gary Harmon at his luxury condominium unit in

Cleveland, Ohio, and executed a residential search warrant there. Agents also obtained a search

warrant on July 29, 2021, for the Market Street apartment in Akron, Ohio that Gary Harmon

formerly occupied and continued to use on occasion. Among other things, agents recovered two

Trezor-brand cryptocurrency storage devices and approximately 50 sets of seed words—including

seed words handwritten on scraps of paper and contained in files on the defendant’s phone and

other devices. Agents suspect that the Trezor devices have hidden wallets enabled (as with

TREZOR ONE). Agents used some of the seed words to successfully reconstitute and seize

bitcoin wallets containing bitcoin valued at approximately $6,007.78. The whereabouts of the

vast majority of the missing 712.6 BTC remains unknown. Forensic examination of the

defendant’s Trezors, phone, and other electronic devices is ongoing.

15
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 16 of 24

APPLICABLE LAW

Under the Bail Reform Act, the Court “shall order” the defendant to be detained if it

determines after a hearing that no condition or combination of conditions “will reasonably assure

the appearance of the person as required and the safety of any other person and the community.”

18 U.S.C. § 3142(e).

A finding of either danger to the community or risk of flight is sufficient for detention.

See United States v. Ferranti, 66 F.3d 540, 543-44 (2d Cir. 1995). “A threat of future

dangerousness may be based on the risk that no conditions will reasonably prevent the defendant

from obstructing justice.” United States v. DeGrave, 2021 WL 1940536, at *8 (D.D.C. May 14,

2021) (internal quotations omitted). The government must prove danger to the community by

clear and convincing evidence. 18 U.S.C. § 3142(f)(2). If the basis for detention is risk of flight,

the government must prove that the defendant presents a risk of flight only by a preponderance of

the evidence. United States v. Vortis, 785 F.2d 327, 328-29 (D.C. Cir. 1986); United States v.

Xulam, 84 F.3d 441, 442 (D.C. Cir. 1996). The government may present evidence by way of

proffer, United States v. Smith, 79 F.3d 1208, 1209-10 (D.C. Cir. 1996), and “[t]he rules

concerning admissibility of evidence in criminal trials do not apply” at a detention hearing, 18

U.S.C. § 3142(f).

In considering whether there are conditions of release which will reasonably assure the

safety of any other person and the community, and the appearance of the defendant as required,

the Court should consider and weigh the following factors: (1) the nature and circumstances of the

offense; (2) the weight of the evidence against the defendant; (3) the defendant’s history and

characteristics; and (4) the nature and seriousness of the danger to any person or the community

16
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 17 of 24

that would be posed by the defendant’s release. 18 U.S.C. § 3142(g). As set forth more fully

below, these factors weigh in favor of detaining the defendant.

ARGUMENT

Each of the § 3142(g) factors weighs in favor of detention. The defendant’s offenses

involved willful obstruction of his brother’s criminal proceeding and technologically sophisticated

criminal conduct. The defendant is facing a Guidelines range of up to 19 years of imprisonment.

The evidence against the defendant is circumstantial but strong. The defendant has no job and

no community ties, but he has the ability to remotely access tens of millions of dollars’ worth of

bitcoin that remains unaccounted for. And the defendant’s conduct raises serious concerns about

prospective destruction of evidence or witness tampering. In short, the defendant’s pretrial

detention is necessary to ensure both the safety of the community and that the defendant does not

flee to evade prosecution.

A. The Nature and Circumstances of the Offense

As alleged in the Indictment, the defendant committed serious offenses involving the

removal of more than 712.6 BTC that had been lawfully seized pursuant to a search warrant and

was subject to forfeiture in Larry Harmon’s criminal case. The defendant did so knowing that

the property represented his brother’s illegal proceeds from operating the bitcoin money

laundering service Helix, and knowing that the property had been seized and was part of the

criminal proceeding against his brother. Indeed, the defendant executed the transactions after he

personally attended court hearings in his brother’s case and heard testimony and argument about

the unsecured bitcoin. The defendant surreptitiously removed the 712.6 BTC stored on TREZOR

ONE, lied to federal law enforcement agents about it, and laundered the purloined BTC through

17
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 18 of 24

Tor-based mixing services before embarking on a lavish spending spree with his brother’s illegal

profits. The brazenness of the defendant’s scheme weighs in favor of detention.

The defendant is a sophisticated cyber criminal who has exhibited a high level of

operational security. The security features enabled on TREZOR ONE represented the cutting

edge of cryptocurrency security technology. The defendant’s ability to remotely reconstitute the

SUBJECT WALLETS, transfer the Helix-derived bitcoin into new, unhosted wallets, and then

gradually launder the bitcoin through two bitcoin mixing services reflects a significant degree of

technological sophistication. His subsequent precautions included laundering the illicit bitcoin

through two Tor-based mixing services (similar to Helix), reflecting a working knowledge of Tor

hidden services. He began using an encrypted ProtonMail email service. And he engaged in

additional laundering of the illicit bitcoin proceeds—such as exchanging bitcoin for Dogecoin (a

virtual currency laundering technique known as “chain-hopping”) or using his bitcoin as collateral

for a cash loan to purchase luxury real estate (severing any direct link between the illegal bitcoin

and the funds used to purchase the luxury asset).

The defendant’s crimes expose him to heavy punishment. The defendant faces up to 20

years in prison on the money laundering counts as well as the obstruction count, see 18 U.S.C.

§ 1956(a)(1); 18 U.S.C. § 1512(c); and 5 years in prison for removal of property to prevent seizure,

see 18 U.S.C. § 2232(a). The government estimates his Sentencing Guidelines offense level for

the money laundering counts alone will be 36, resulting in an advisory sentencing range of 188

18
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 19 of 24

months to 235 months of imprisonment. 4 In addition, the money laundering counts expose the

defendant to “a fine of not more than $500,000 or twice the value of property involved in the

transaction, whichever is greater,” 18 U.S.C. § 1956(a)(1)—meaning that the defendant could be

fined up to twice the value of the $5.3 million in BTC he illegally obtained, or more than $10

million. He is also liable for forfeiture of the 712.6 BTC and a forfeiture money judgment of at

least the entire value of the $5.3 million in property “involved in” the money laundering offenses,

and for the same amount representing the proceeds of the obstruction offense. 5 See 18 U.S.C.

§ 982(a)(1); 18 U.S.C. § 981(a)(1)(C); 28 U.S.C. § 2461(c). The realistic prospect of 19 years in

prison and millions of dollars in financial penalties provides a strong incentive to flee.

B. The Weight of the Evidence Against the Defendant

The government’s case against the defendant is circumstantial but strong. This is an

indicted case in which the grand jury found probable cause to believe the defendant is guilty of the

charged offenses. See, e.g., United States v. Johnson, 212 F. Supp. 3d 126, 129 (D.D.C. 2016)

(noting indictment is “not dispositive” but still relevant). The defendant’s presence at the two

4
Assuming a violation amount of $5.3 million and the defendant’s knowledge that any portion of the laundered
property represented the proceeds of, or was intended to promote, Darknet drug trafficking activity, the government
estimates the defendant’s offense level as follows:

U.S.S.G. § 2S1.1(a)(2) Base offense level 8

U.S.S.G. § 2B1.1(b)(1)(J) More than $3,500,000 +18
U.S.S.G. § 2S1.1(b)(1)(i) Knew funds were proceeds of
or intended to promote drug offenses +6
U.S.S.G. § 2S1.1(b)(1)(B) Conviction for § 1956 +2
U.S.S.G. § 2S1.1(b)(3) Sophisticated laundering +2
Total offense level: 36

Assuming criminal history category I, the total Guidelines range for offense level 36 is 188-235 months of
imprisonment.
5
The value of the illicitly obtained 712.6 BTC has since ballooned to more than $34 million, based on current market
prices. See https://coinmarketcap.com (last accessed Aug. 24, 2021) (showing BTC at $48,059.73). All of this
bitcoin, and any and all property traceable to it, would be subject to forfeiture regardless of current market value.

19
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 20 of 24

detention hearings was witnessed by several law enforcement agents; it shows the defendant was

aware that the bitcoin stored on TREZOR ONE was lawfully seized pursuant to search warrant,

that the funds represented illegal proceeds from Helix, and that the funds were claimed by the

government in the criminal prosecution of the defendant’s brother. Evidence of the defendant

accessing TREZOR ONE to obtain the 712.6 bitcoin includes objective email records showing

automated messages from Trezor.io addresses corresponding to the laundering transactions, as

well as the defendant’s admissions to law enforcement agents that he obtained partial seed words

from his brother (and destroyed the evidence afterwards). Objective blockchain evidence shows

that most of the 712.6 BTC was laundered through Tor-based mixing services. Following that

laundering activity, financial records show that the defendant experienced a rags-to-riches

transformation fueled by a sudden infusion of unexplained bitcoin wealth—including bitcoin

traceable back to the same Tor-based mixing services used to launder the missing 712.6 BTC.

The defendant developed a new interest in encryption and operational security. And the search

warrants executed in this case recovered two Trezor devices and approximately 50 sets of seed

words—attesting to the defendant’s investment in cryptocurrency storage and security following

his illicit acquisition.

The defendant may well argue that he did not understand that the 712.6 BTC was subject

to forfeiture in the pending criminal case. But that is irrelevant to the money laundering counts—

the most serious offenses charged in the Indictment—which only require the defendant’s

knowledge that the property involved in the transactions represented the proceeds of “some form

of unlawful activity,” 18 U.S.C. § 1956(a)(1). That element is satisfied by the defendant’s

knowledge that the property represented his brother’s illegal proceeds from the bitcoin money

20
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 21 of 24

laundering service Helix. In any event, the defendant was clearly aware, from his attendance at

the detention hearings, that the government had lawfully seized the bitcoin stored on TREZOR

ONE pursuant to a search warrant. He was also aware that by removing the bitcoin stored on

TREZOR ONE, he was impairing the government’s claim over the funds and corruptly removing

the funds from the Court’s reach in the criminal proceeding. His false statements to agents in

July 2020 denying his involvement in the transfer, and the extreme lengths to which he went to

conceal his connection to the funds, is further evidence of his consciousness of guilt.

The government’s case against the defendant is strong, and the government anticipates that

further forensic examination of the devices recovered through the search warrants in this case will

yield additional evidence of the defendant’s guilt. The weight of the evidence supports pretrial

detention.

C. The Defendant’s History and Characteristics

The defendant’s access to tens of millions of dollars in cryptocurrency weighs heavily in

favor of detention. Notwithstanding the defendant’s recent spending spree, the majority of the

missing 712.6 BTC remains unaccounted for. That sum was worth approximately $5.3 million

at the time of the bitcoin was first removed from TREZOR ONE, and it is currently worth more

than $34 million. The defendant has demonstrated the ability to remotely access and launder

bitcoin from anywhere in the world with an Internet connection. Evidence recovered from the

defendant’s cellular phone shows that he was a user or TapJets, a private charter jet company that

accepts bitcoin as payment. With tens of millions of dollars in cryptocurrency at his fingertips

and a working knowledge of the Darknet—where false identification documents are readily

21
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 22 of 24

available for purchase—the defendant could finance his flight from prosecution for the rest of his

life.

The defendant also lacks any substantial ties to the community. He has no job, he was on

unemployment for months, and before that he worked as a modest wage-earner in his older

brother’s company. According to accounts from acquaintances in Ohio, the defendant’s

relationship with his family has suffered since the illicit bitcoin movements and the repercussions

on his brother’s criminal case. Although the defendant’s lavish spending may have won him

friends and admirers in recent months, these are not the kinds of community ties that are likely to

discourage his flight from prosecution.

D. Nature and Seriousness of the Danger of Future Obstruction

Finally, the defendant poses a danger of future obstruction. Courts in this district and

elsewhere have recognized that the risk of future obstructive conduct may justify pretrial detention.

See, e.g., DeGrave, 2021 WL 1940536, at *8 (collecting cases); United States v. Robertson, 608

F. Supp. 2d 89 (D.D.C. 2009); United States v. Gamble, 2019 WL 6877755 (D.D.C. Dec. 17,

2019). In Gamble, the defendant was charged with a variety of obstruction offenses under 18

U.S.C. § 1512 and 18 U.S.C. § 1591 for attempting to destroy evidence in a child sex trafficking

trial involving his associate. 2019 WL 6877755, at *1-2. Judge Collar-Kotelly found that the

risk of obstruction—in combination with other factors—weighed in favor of detention:

While Mr. Gamble does not have an extensive history of obstruction of justice, the
weight of the evidence presented by the Government supports that he has recently
and in a related proceeding obstructed justice by attempting to, for instance, hide
or conceal relevant evidence, which in turn presents a serious danger that he may
do so again in his own case.

22
 Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 23 of 24

Id. at *6. Here, the defendant’s indicted conduct involves obstruction of the criminal prosecution

of his brother and related criminal forfeiture proceeding, as well as removal of property that had

been lawfully seized pursuant to a search warrant. Even the defendant’s fantastical version of

events belies his lack of concern for obstructive conduct; in an attempt to exonerate himself, the

defendant told agents that he destroyed evidence by flushing the USB drive he received from his

brother down the toilet at his gym. The defendant’s brazen actions demonstrate lack of respect

for the Court’s authority and any release conditions it may impose. See DeGrave, 2021 WL

1940536, at *16 (“Mr. DeGrave’s demonstrated a lack of respect for the courts and the rule of

law . . . raises further concern that he would not comply with any release conditions that this Court

might impose.”). This factor weighs in favor of detention.

CONCLUSION

For the foregoing reasons, the government respectfully submits that clear and convincing

evidence establishes that there are no conditions or combination of conditions that will reasonably

assure the safety of the community from future acts of obstruction of justice. The government

also submits that a preponderance of the evidence establishes that the defendant is a serious risk

of flight and no conditions or combination of conditions will assure his appearance in Court.

Accordingly, the government respectfully requests that the Court grant the government’s motion

to detain the defendant pending trial in this case.

23
Case 1:21-cr-00433-BAH Document 10 Filed 08/24/21 Page 24 of 24

Respectfully submitted,
CHANNING D. PHILLIPS
ACTING UNITED STATES ATTORNEY
D.C. Bar No. 415793

BY: /s/ Christopher B. Brown

Christopher B. Brown, D.C. Bar No. 1008763
Assistant United States Attorney
U.S. Attorney’s Office for the District of Columbia
555 4th Street, N.W.
Washington, D.C. 20530
(202) 252-7153
Christopher.Brown6@usdoj.gov

/s/ C. Alden Pelker

C. Alden Pelker, Maryland Bar
Trial Attorney, U.S. Department of Justice
1301 New York Ave., N.W., Suite 600
Washington, D.C. 20005
(202) 616-5007
Catherine.Pelker@usdoj.gov

24