Second Confessed Criminal Takes the Stand Against Roman Storm
In a day dominated by low-energy evidence, the exploiter of Crema Finance described Tornado Cash’s (small) role in his crime.
One nuance of a jury trial that the movies tend to get wrong is that lawyers aren’t allowed, for most of the trial’s duration, to tell a story. With the exception of opening and closing statements, prosecution and defense teams are restricted to eliciting and presenting evidence and interviewing witnesses, and can’t directly draw larger connections or highlight patterns.
That’s why you end up with days like today, July 22, in the case of U.S. v. Roman Storm: a stream of painfully meticulous witness testimony presenting a jumble of facts whose real implications were, at best, unclear.
Prosecutors had particularly modest goals today, including connecting Storm’s alleged money laundering and sanctions-violation conspiracy to the Southern District of New York, providing “venue” for the current trial. Prosecution witnesses also affirmed that Roman Storm and his Tornado Cash cocreators had control over the “front end” web interface most Tornado Cash users interacted through, and which is a key pillar of the prosecution’s case.
The day’s first witness was Ben Gibbs, cofounder of Eth.Limo, an Ethereum Name Service (ENS) routing service. Gibbs walked prosecutors through the details of ENS, its differences from DNS (Domain Name Service) and the role of a routing service like his. Gibbs also described some other relevant services, such as IPFS (Interplanetary File Service), a decentralized hosting and storage system. This set lead prosecutor Thane Rehn up for the day’s only actual laugh line: “Is it actually interplanetary?”
Gibbs’ main evidentiary role was to establish that Storm and his partners controlled the Tornado.Cash and Tornadocash.eth domains, which hosted elements of the Tornado Cash frontend; and that Storm and co. were able to update them or take them down.
On cross-examination, defense attorney Keri Axel elicited testimony that Gibbs “respected” Tornado Cash and shared its commitment to privacy. This includes the fact that Eth.Limo does not record users’ IP addresses. This may have helped build towards the idea that the software projects and developers on decentralized projects face hazard from the prosecution of Storm.
Criminal Minded
The day’s second witness was Shakeed Ahmed, a former Amazon bug bounty program manager and the confessed exploiter of both Crema Finance and Nirvana Finance circa 2022. Ahmed, who was led into court with his hands held behind his back to mimic handcuffs, is currently serving a 36 month sentence, and hoping for a reduction of that in exchange for his testimony.
Ahmed testified that he used Tornado Cash to anonymize funds for a fee that he used to execute a price-manipulation attack against Crema – but that he did not use the service at all in laundering the roughly $15 million in proceeds from those crimes, or use Tornado Cash in any way in the Nirvana exploit. Perhaps the most important part of Ahmed’s testimony, for the prosecution, is the fact that he used Tornado Cash from his Manhattan apartment, providing another bit of standing for holding the trial in the SDNY.
Ahmed is the second confessed hacker or fraudster to take the stand against Storm, following Andre Marcus Quiddaoen Llacuna, the Machiavellian 20-year-old mastermind behind the Frosties NFT rug-pull.
But defense attorney David Patton, on cross examination, made sure Ahmed clarified that he “never engaged in a conspiracy with them [Tornado Cash creators], an agreement with them to commit crimes.” Patton both sounds and looks strikingly like a taller version of actor Mark Proksch – a.k.a. the energy vampire Colin Robinson of What We Do in the Shadows. Both he and fellow defender Keri Axel have consistently delivered incisive cross-examinations so far.
Using Services, Calling Phones, Paying Bills
The next witness was Austin Dever, a former CIA case manager turned executive at Github. Dever was flown from Seattle to New York at government expense to explain what Github is, and that Tornado Cash used the service. What was left unclear in the testimony was that Github merely stores and manages the text of code, rather than executing it – a possibly relevant distinction in the broader context of freedom of speech issues.
Following Dever was Kurush Dubash, an executive at managed Ethereum service provider Alchemy. Much as with Github, Dubash primarily established that Tornado Cash were customers of the service, reinforcing their role in maintaining and managing the front-end portal.
FBI Agent William Lopez then walked jurors through the record of phone communications between the Tornado Cash team and Thomas Schmidt of Dragonfly Capital, which had invested in the protocol. Lopez tracked Schmidt’s location in New York City via cell towers, and cross-referenced data from Schmidt’s financial records, which detailed his penchant for riding the subway and eating at Dig In and Xi’an Famous Foods.
This testimony was notable for two reasons. First, because the primary intent seemed to be providing yet more evidence for venue in the SDNY, yet the interactions, mostly matters of business strategy, were not connected to the alleged crime. Second, the appearance of Schmidt is notable because in 2018 he passed on a chance to invest in the nascent FTX, based on shady behavior by Sam Bankman-Fried. Schmidt later discussed this experience on the podcast The Chopping Block.
The day wrapped up with testimony from Philip Werlau of the blockchain tracing firm Anchain.ai. Werlau detailed changes that were made to the Tornado Cash front end and smart contracts, though so far without acknowledging that the contract code was locked after 2020.
Based on pre-trial motions, Werlau is also expected to testify that it would have been possible for Storm and the other Tornado Cash creators to implement more customer monitoring and controls, but that testimony will likely come tomorrow morning, when the government continues its questioning of Werlau.
The day closed with a procedural ruling from Judge Katherine Failla - mostly in the defense's favor. In six out of ten highlighted instances, Failla ordered prosecution to include more context in exhibits that, presented in their current edited form, excluded crucial context.
For instance, one government exhibit would have highlighted statements that Tornado Cash/Peppersec was "just like a real company 😊," suggesting irony or double meaning - but which excluded following statements demonstrating that Tornado Cash was, in fact, a real company.
Independent journalism does not finance itself. If you enjoyed this article, please consider making a donation. If you would like to note a correction to this article, please email corrections@therage.co
