- A judge allowed challenged testimony.
- An IRS special agent said he could not prove that scammers deposited a victim's stolen crypto in Tornado Cash.
Tornado Cash co-founder Roman Storm suffered a setback Wednesday morning after a federal judge allowed an IRS agent to testify that crypto stolen from Hanfeng Lin, a woman living in Georgia, was ultimately deposited in the crypto mixer.
Under cross-examination, IRS Special Agent Stephan George said he could not prove that Lin’s scammer deposited the crypto in Tornado Cash.
He testified that crypto could have changed hands as it moved across a series of digital wallets.
But some of the crypto did eventually make its way into Tornado Cash, the agent said. His testimony contradicted prominent blockchain forensics experts who said none of Lin’s money ever went to the protocol.
Stolen crypto
The fate of Lin’s stolen crypto has taken center stage at Storm’s criminal trial this week.
The Georgia woman was the government’s first witness in its prosecution of Storm.
On July 15, LIN testified that she lost about $250,000 in crypto to a pig butchering scam in 2021.
She attempted to contact Storm in 2022 after a “crypto recovery service” told her some of the stolen crypto was laundered through Tornado Cash.
If her money never went to the protocol, “she has utterly no relevance” to Storm’s alleged crimes, his attorney David Patton said Monday.
That could be grounds for a mistrial, the attorney said. If the judge agreed, Storm’s criminal trial would end, though prosecutors could choose to retry the case with a new jury.
Prosecutors have charged Storm with conspiracy to commit money laundering, operate an unlicensed money-transmitting business, and violate US sanctions. He faces more than 40 years in prison.
His case has become a test for crypto privacy as supporters, and Storm’s lawyers, argue that he should not be held liable for the smart contracts running Tornado Cash.
‘Not qualified’
Prosecutors initially asked George to testify that Storm had made millions selling his Tornado Cash tokens in 2022, when government scrutiny of the protocol intensified.
They said this is proof that the software engineer knew he had committed a crime.
Their plans changed over the weekend. On Friday, crypto security researcher Taylor Monahan said she was unable to find evidence Lin’s crypto ever went to Tornado Cash. ZachXBT, the pseudonymous crypto investigator, has endorsed her analysis.
On Sunday, prosecutors said they would also ask George to corroborate the claim that Lin’s stolen crypto ended up in Tornado Cash.
Defence attorneys attempted to bar the agent from sharing that analysis with jurors.
“Agent George is not qualified to do this sort of tracing and his methodology is unsound and not an accepted methodology for attribution in the field of blockchain tracing,” they wrote in a letter to the court Tuesday.
‘Last in, first out’
But Judge Katherine Polk Failla let the agent testify on the grounds that defence attorneys could prove his supposed incompetence during cross-examination.
The agent used an accounting method known as “last in, first out” to trace the stolen funds, he testified.
Over a series of seven steps, 47,000 of Lin’s USDT tokens were batched with other crypto before being converted to Ether and deposited in Tornado Cash, he said.
During cross-examination, George said he could have reached a different conclusion had he used a different accounting method, such as first in, first out.
He also said his method could not prove who owned the accounts that Lin’s crypto supposedly traveled through.
“This doesn’t prove that the hacker deposited money to Tornado Cash, does it?” Defence attorney Keri Axel asked the agent.
“No, not at all,” he said.
But Axel was unable to complete her cross examination on Wednesday. She told the judge it will likely last another half hour when the trial resumes Thursday morning.
Protocol control
Philip Werlau, a senior investigator at blockchain analytics firm AnChain.AI took up the majority of Wednesday’s testimony.
Werlau testified that aspects of the Tornado Cash protocol could have been changed by Storm and his co-founders.
Specifically, the protocol’s so-called relay system had code that could have been changed to deter money laundering, Werlau said.
While those changes required approval from Tornado Cash token holders, Storm and his co-founders had enough tokens to determine the outcome of any vote, according to Werlau.
Moreover, about 99% of all deposits to Tornado Cash relied on the relay system, according to Werlau.
Those that did not use the system could not benefit from the anonymity Tornado Cash provides, as it would be easy to link crypto deposited directly in the protocol to crypto withdrawn from the protocol, he added.
Tornado Cash founders did take steps to limit money laundering. In 2020, they blocked access to the Tornado Cash website for users from certain countries. In 2022, they blocked access to sanctioned crypto wallets.
But both of those measures were easily circumvented, according to Werlau. Even if sanctioned wallets could not use the website, their owners could still access the protocol and its relay system through the command-line interface on their computers.
“They closed the UI [website] door but they left the CLI door open,” Werlau said.
Prosecutors said they expect to finish their portion of the trial Thursday morning. Defence attorneys said they could end their portion as early as Monday — unless Storm himself testifies, a high-risk, high-reward strategy that failed crypto fraudster Sam Bankman-Fried in his November 2023 trial.
Bankman-Fried withered under cross-examination, appearing evasive and drawing a rebuke from the judge. He was eventually convicted on all seven counts and sentenced to 25 years in prison.
Aleks Gilbert is DL News’ New York-based DeFi Correspondent. Reach out to him with tips at aleks@dlnews.com.
