The air in a New York courtroom thickened this week. Lawyers for Roman Storm, a developer tied to the Tornado Cash privacy tool, hinted at a mistrial. This isn’t a small development. It suggests a fundamental crack in the prosecution’s case, raising questions about the very evidence presented.
- The defense hinted at a mistrial, suggesting a crack in the prosecution’s case. This casts doubt on the evidence presented.
- A blockchain sleuth found that the victim’s funds did not pass through Tornado Cash, contradicting the prosecution’s narrative.
- An FBI agent’s testimony revealed gaps in his knowledge of crypto crimes and digital tools, undermining his credibility.
At the heart of this courtroom drama is a witness, Hanfeng Ling, a Georgia woman who lost about $250,000 in a “pig butchering” scam. She testified on the first day of Storm’s trial. After the scam, Ling and her husband hired a “crypto recovery service” called Payback. This service claimed to trace some of her lost funds to Tornado Cash.
Payback then suggested Ling email Tornado Cash for help. She did, but received no reply. The prosecution used this lack of response to paint a picture of Storm’s indifference to victims. It was a powerful narrative, designed to show a clear link between the scam’s proceeds and Tornado Cash.
The Tracing Tangle
But then, over the weekend, a wrench was thrown into the works. Taylor Monahan, a respected blockchain sleuth and founder of MyCrypto, posted a thread on X. Her findings were clear: Ling’s funds did not, in fact, pass through Tornado Cash. Monahan had found Ling’s transactions in an unrelated 2023 case involving NTU Capital, the scam company Ling had sent her crypto to.
Monahan explained how an inexperienced tracer, like the Payback service, could get confused. The use of “instaswappers” (services that quickly exchange one crypto for another, sometimes obscuring the original path) can throw off a novice. Along with her X thread, Monahan produced a detailed tracing report of Ling’s transactions. Other well-known blockchain investigators, including the pseudonymous ZachXBT, quickly confirmed Monahan’s analysis. Payback, for its part, remained silent when asked for comment.
“Idk how you mess up the tracing that bad as a firm to where you couldn’t properly follow instant exchange deposits 1 hop from a theft address and then follow subsequent txns down the wrong path to Tornado…” ZachXBT wrote on X. “It’s unfortunate these predatory firms come up as the first search results on Google when victims look for help.”
This revelation put the defense in a strong position. David Patton, a lawyer for Storm, told District Judge Katherine Polk Failla that his team had also tried to trace Ling’s funds over the weekend. They found no connection to Tornado Cash. Patton assumed the government would have confirmed this link before the trial began.
He expected the government’s expert witness, FBI Agent Joel DeCapua, to testify about this link. But earlier that day, Agent DeCapua admitted he hadn’t been asked by prosecutors to investigate Ling’s funds. So, he couldn’t testify about any connection to Tornado Cash. This was a significant moment, undermining a key part of the prosecution’s initial narrative.
Lead prosecutor Nathan Rehn pushed back. He told the judge that another government witness, an IRS agent, could testify to the connection. Rehn described the link between Ling’s money and Tornado Cash as “very straightforward” and “a few short hops.” But the judge, Katherine Polk Failla, admitted her own lack of expertise in blockchain tracing. “I simply don’t know,” she said, a candid admission that highlights the technical challenges in these cases.
The FBI on the Stand
Much of Monday’s testimony came from FBI Agent Joel DeCapua. He gave the jury an overview of 16 major crypto hacks, including those of Kucoin in 2020, BitMart in 2021, and the Ronin Network in 2022. He noted that funds from these hacks flowed to Tornado Cash. This part of his testimony seemed designed to establish a pattern of illicit use.
However, cross-examination by Patton revealed some surprising gaps in DeCapua’s knowledge. Patton asked if he knew that NTU Capital, the scam front that victimized Ling, had run over $100 million in crypto scams. DeCapua said he did not. Patton then asked if he had traced other major crypto hacks, like the $320 million Wormhole hack in 2022. DeCapua’s reply was stark. “Never even heard of that one,” he said.
The agent also claimed no knowledge of in-person crypto crimes, such as kidnappings or “wrench attacks” (physical assaults to extract crypto). These types of crimes have seen a dramatic rise in Europe and the U.S. this year. “Hypothetically that could happen,” DeCapua said when asked if such risks were possible. It was a curious response, given the real-world incidents.
Perhaps the most eyebrow-raising exchange involved virtual private networks (VPNs). Patton asked if both ordinary people and criminals used VPNs. DeCapua agreed that many people used VPNs for work. But then he added, “it would be very strange” for normal people to use VPNs outside of work. “I don’t think a regular person would use a VPN in their everyday communications,” he stated. One might wonder if he’s ever tried to stream a geo-restricted show or simply values online privacy. His comments seemed to suggest a disconnect from common digital practices.
This trial, and the recent developments, offer a stark look at the challenges of prosecuting cases in the crypto space. The accuracy of blockchain tracing, the expertise of witnesses, and even basic understanding of digital tools are all under the microscope. As the courtroom drama unfolds, the crypto community watches closely, pondering what these revelations mean for the future of privacy tools and the pursuit of justice in a digital world.
