How SDNY Saved Its Opening Witness With A 100 Year Old Accounting Method
In the magic world of LIFO Land, anything is possible.
In Yesterday's proceedings against Tornado Cash developer Roman Storm, IRS Agent Stephan George saved a prosecution's witness whose testimony had come under fierce scrutiny for a lack of attribution to the Tornado Cash service.
Hanfeng "Katie" Lin, the Government's opening witness who fell victim to a pig-butchering scam, had told the jury that a company called Payback told her that her life savings had disappeared into Tornado Cash, as well as into other exchanges, including Binance and Coinbase. An email which Payback asked Lin to send to Tornado Cash detailing how her funds allegedly wound up in Storm's service was consequently entered into evidence.
The only problem: blockchain tracing experts, as well as exchange officials, suggest that Payback was wrong. Coinbase Chief Legal Officer Paul Grewal publicly denounced that Lin's funds were ever sent to Coinbase. On-chain sleuths Taylor Monahan and ZachXBT both retraced Lin's funds, and found no credible connection to Tornado Cash. Similarly, the financial intelligence firm Inca Digital told The Rage that it is "unlikely" that Lin's funds were connected to Storm's service. To add insult to injury, the Payback brand appears to be under current FBI investigation for... recovery fraud.
Using an accounting method known as Last In First Out, or LIFO, Agent George set out to prove that Payback was right, and Lin did indeed have her funds disappear into Tornado Cash. With this, the Government was able to prevent a mistrial by keeping Lin's testimony on the record. But Agent George's methods have come under drastic public scrutiny.
L0la L33tz
An Introduction to the Cookie Jar Method
LIFO is an accounting method commonly used for tax reporting, that gained popularity in the 1920s to optimize business expenses under inflation. The last inventory that goes in is the first inventory to go out, reducing a company's taxable income, as the last inventory purchased would also be the most expensive. At the same time, older inventory purchased at cheaper prices stays on the books.
By applying LIFO to blockchain tracing, the analyst assumes that the last funds that go into a wallet are also the first funds to come out. Or, to put it in the words of Agent George: "If you think about a cookie jar, when you make a batch of cookies and you put it in, the last ones that go in, when you open the lid, they're the first ones to come out when you take a cookie out."
LIFO, according to Agent George, is the method that he finds "most accurate" in virtual currency tracing. "It is the type of method that I use for all my tracing when I do this kind of work," he testified, going on to describe how he followed Lin's funds from a crypto[.]com account to the first depository "address A" all the way to the last depository "address F", from where the funds were swapped for ETH in a decentralized exchange, and ultimately sent into the Tornado Cash service.
Agent George testified that he was not asked to attribute the transactions, meaning to sort them to identities, but rather went by percentages: 100% of Lin's funds, or roughly $150,000, left the crypto[.]com account, were deposited with the scammer's wallet, and shortly after split up into three different depository addresses, with two of the three addresses each receiving $60,000, and the third receiving $29,000. From there, Agent George attributed Lin's funds as a percentage of the total outgoing transactions of each previous depository address. In total, Agent George traced the funds over 6-10 intermediary addresses until reaching Tornado Cash, including across wallets holding Billions of Dollars.
David Z. Morris
The Law of '9 Degrees of Tornado Bacon'
Anyone who has ever used a $10 Bill may already be able to see where the problem with Agent George's LIFO lies. Just as a merchant may receive 10$ for a pack of cigarettes from a criminal can any of the 6-10 addresses have exchanged Lin's funds for other goods or currency. Precisely because Agent George wasn't asked to attribute the proceeds, the funds that went into Tornado Cash downstream of Lin's crypto[.]com wallet may have very well been wholly unrelated.
“This doesn’t prove that the hacker moved [Lin’s] money into Tornado Cash, does it?” Storm's defense asked in cross examination. “No, not at all,” George replied. But George's testimony, and by that the testimony of Lin, would remain on record.
Taylor Monahan jokingly referred to George's analysis as the "law of '9 degrees of Tornado Bacon'", referring to a meme saying that every actor knows Kevin Bacon by six degrees of separation, also known as the Bacon Number. Similarly, the cryptocurrency lawyer and privacy advocate Fatemeh Fannizadeh joked that, after girl math, we have found Government Agent math, a 100% guaranteed scientific method where all roads lead to Tornado Cash.
LIFO has "zero legitimacy in terms of blockchain tracing" writes Laurent Salat, who formerly developed the open source blockchain tracing tool 0xt. "These models are completely unrelated to the reality of Bitcoin or Ethereum protocols [...] They only exist in the brains of people who believe in them."
Another issue with Agent George's tracing appears to be that George wasn't asked to find Lin's funds, but rather with finding any connection to Tornado Cash, leaving other leads unpursued.
They Let an IRS Agent Testify and All We Got Was Dank LIFO Memes
An interesting question would be how many wallets X degrees removed are there that had similar interactions, NYU Stern Adjunct Professor Austin Campbell tells The Rage. Essentially, this is the funny money equivalent of "we found your car within 2 miles of the crime scene" and it turns out the crime scene is in Manhattan and there were 500,000 cars, he says.
Agent George's testimony to Lin's funds was heavily contested by the defense. On the one hand, Storm's counsel was only notified that George would testify to Lin days before he took the stand, and merely received an 11-line spreadsheet of his trace. On the other, the defense made very clear that the prosecution had already put a qualified blockchain tracing expert before the jury who did not investigate Lin's connection to Tornado Cash, and that Agent George, compared to the FBI's Joseph DeCapua, was simply not qualified to speak to the level of complexity such tracing would require.
"Agent George utterly ignores the likelihood of changes in ownership," the defense argued in a motion to exclude his testimony. "LIFO is not used for the purpose of tracing and attributing cryptocurrency across multiple transactions," as the scammer could have made a purchase with the funds and Agent George is then following the seller's fund flow instead.
After today's hearings, it seems that the defense may have had a point claiming that Agent George was not qualified to speak to complex cryptocurrency tracing. In cross-examination, George testified that he didn't know what crypto[.]com was, and that he wasn't comfortable speaking to the difference between ERC-20 tokens and ETH.
But at least we got some dank LIFO memes instead.
David Z. Morris
Independent journalism does not finance itself. If you enjoyed this article, please consider making a donation. If you would like to note a correction to this article, please email corrections@therage.co
