Tornado Cash Day 2: Storm Didn’t Help Recover Hacked Funds, Influenced Protocol Specs, Prosecutors Argue
Wednesday’s witnesses recounted scams and hacks whose perpetrators used Tornado Cash - but never spoke to Roman Storm.
Thurgood Marshall Courthouse, Manhattan – Government prosecutors brought out six witnesses to testify on Wednesday in the criminal trial of Roman Storm, the co-developer of crypto mixing protocol Tornado Cash, who faces money laundering and sanctions violations charges.
Witnesses included scam victim “Katie” Lin; Sky Mavis CTO Viet Anh (Andy) Ho; McDermott Will & Emery law firm partner Joseph Evans; former signer of Tornado Cash community multisig Justin Bram; Frosties NFT rugpuller Andre Llacuna; and FBI forensic accountant Jocelyn Reyes.
Prosecutors focused on how witnesses who suffered from financial exploits didn’t receive any help from Storm and those contributing to Tornado Cash, while defense attorneys stressed the decentralized essence of Tornado Cash where a single actor can’t affect the protocol.
The trial began with prosecutor Thane Rehn continuing the inquiry with the first witness to take the stand, “Katie” Lin, who made five total deposits totaling roughly $250,000 to a sketchy trading platform called NTU Capital between October and November 2021. Lin saw her account balance drop to zero and stated the platform simply disappeared the following February.
Prosecutors spotlighted that Lin’s scammer used Tornado Cash to hide the stolen funds, and that when she reached out, Ling didn’t receive any aid from the Tornado Cash team.
After hiring a firm to investigate where her funds went and learning that around $150,000 of her funds were transferred to Tornado Cash, Lin emailed addresses on the Tornado Cash home page in April 2022 asking for help, writing “Scammers were committing financial crimes right under your nose.” She did not receive a response.
On cross-examination, defense lawyers asked Lin about the remainder of her stolen money, which was traced to centralized exchanges including Kraken, FTX, and Coinbase. According to Lin, none of those funds were ever recovered, either.
David Z. Morris
Catch up on day one of the trial against Roman Storm here
Storm Responds to BitMart Lawyer
The government’s second witness was Joseph B. Evans, a partner at McDermott Will & Emery which represented BitMart as a result of its exploit for roughly $200 million in 2021. Prosecutors concentrated on Tornado Cash's failure to assist BitMart in the asset recovery process.
In December 2021, Evans reached out to Storm as well as Tornado Cash codevelopers Roman Semenov and Alexey Pertsev through email and messaging platform Telegram.
The email demanded Tornado Cash take all possible actions to ensure stolen assets are frozen and returned to BitMart. Evans’ email also asked the Tornado Cash developers for specific information to help identify the hackers who exploited BitMart, including IP addresses, names, addresses, phone numbers, emails, and know-your-customer information.
Storm responded to Evans via email, writing: “Our company does not have any ability to affect any change or take any action with respect to the Tornado Cash protocol – It is a decentralized software protocol that no one entity or actor can control. For that reason, we are unable to assist with respect to any issues relating to the Tornado Cash protocol.”
Prosecutors framed Storm’s response as failure to aid in the recovery of dirty money that was subsequently cleaned using the mixing protocol.
On cross examination, the defense highlighted the decentralized nature of Tornado Cash, and the reality that one single actor can’t affect change or move anyone else’s funds.
The defense included the lack of response from other parties Evans reached out to, including Amazon Web Services, Cloudflare, and Binance. Evans admitted a portion of BitMart’s stolen funds went to decentralized exchange aggregator 1Inch which indicated that they would preserve information, but refused to provide information without a request from law enforcement.
In its redirect, the defense asked Evans whether other parties responded to his inquiry directly. Evans told the jury the only person to respond directly to him was Storm.
Axie Infinity CTO Relives $600+ Million Hack
Sky Mavis CTO Viet Anh (Andy) Ho, who received a subpoena, traveled from Ho Chi Minh City, Vietnam to become the third witness in Storm’s trial. Prosecutors asked Ho about details of the Ronin blockchain and Axie Infinity, owned by Sky Mavis, with questions revolving around how to play the game, what NFTs were, and how cryptocurrencies were embedded within Axie Infinity.
Ho also explained his point-of-view when the network suffered a roughly $600 million exploit in 2022. According to the Sky Mavis CTO, the hack occurred because an attacker approached one of its employees who had credentials to the blockchain’s validators. The exploiter, who pretended to be a recruiter in search of talent for a firm, messaged the employee on LinkedIn.
The hacker requested that the Sky Mavis employee complete an assignment during the interview process, but this was really a deception to trick them into downloading malware. This gave the exploiter access to network validator credentials stored on the employee’s computer. Ho shared during the defense’s cross examination that the Ronin blockchain had nine total validators – four of which were compromised during the 2022 hack.
On cross examination, defense attorney Keri Curtis Axel asked Ho whether he remembered learning in the aftermath that stolen funds flowed through a number of destinations independent of Tornado Cash, such as Chinese crypto exchange Huobi and now-bankrupt exchange FTX.
“I don’t recall,” Ho said to Axel’s questions. Similarly, Ho said he didn’t remember whether the Ronin’s decentralized exchange Katana was frozen. When Axel asked whether any funds were returned, Ho said $6 million was retrieved by the Norwegian police.
But when she asked whether he knew that these $6 million flowed through Tornado Cash, Ho didn’t know.
David Ingram
The Axie Infinity hack was one of the largest in cryptocurrency history
Prosecutors Argue Storm Had Influence Over the Protocol
The next witness was former Tornado Cash multisig signer Justin Bram. Bram was also a content creator who made a YouTube video educating viewers about privacy on the Ethereum blockchain, and how to generate yield on Tornado Cash.
After making the video, Bram would join the Tornado Cash multisig community, earn 100 TORN tokens a month, and join a group chat for the multisig community members over Telegram in May 2021.
Prosecutors brought up screenshot messages between Bram and other community members that implied Storm’s involvement in potential features of the platform and upcoming versions of Tornado Cash.
The defense emphasized that Tornado Cash was non-custodial and decentralized, with Bram caveating that the protocol was decentralized if no one person had a majority of TORN tokens.
Storm’s defense mentioned that Tornado Cash included geoblockers to block IP addresses in particular countries, but the government during its redirect used this to argue that the use of geo-blocking implies the platform could have collected IP address information. Bram went on to agree with prosecutors that the founders of Tornado Cash were responsible for the platform’s frontend website.
Bram stepped down from his role as a multisig signer in November 2021 for a number of reasons, particularly the increasingly intense regulatory climate stemming from exploiters using Tornado Cash to obfuscate their funds. He received a subpoena and was given a non-prosecution agreement in return for his testimony.
NFT Scammer Testifies to Using Tornado Cash
Andre Llacuna was the face of the Frosties NFT scam, which “rugpulled” buyers in 2022. Llacuna pled guilty to wire fraud and conspiracy to commit money laundering. He took the witness stand following Bram, having entered into an agreement to testify truthfully in return for a possible, but not guaranteed or specific, reduction in his own sentence.
Llacune was involved in an NFT collection called “Frosties” in January 2022 where he would lie about the project’s roadmap and rugpull purchasers by taking down the project’s website, discord, and X account.
The NFT collection earned Llacuna over $1 million worth of ether, a portion of which he attempted to anonymize via Tornado Cash, which he and his coconspirators learned about only after conducting their rug-pull. According to screenshots put forward by the government, Llacuna and his then-girlfriend jokingly referred to the use of Tornado Cash as “washy washy”.
Llacuna faces a maximum of 40 years in prison.
Independent journalism does not finance itself. If you enjoyed this article, please consider making a donation. If you would like to note a correction to this article, please email corrections@therage.co
