Application and Affidavit

Case 3:22-mj-71553-AGT Document 1 Filed 11/30/22 Page 1 of 89
AO 108 (Rev. 06/09) Application for a Warrant to Seize Property Subject to Forfeiture
FILED
UNITED STATES DISTRICT COURT Nov 30 2022
for the
Mark B. Busby
Northern District
__________ DistrictofofCalifornia
__________ CLERK, U.S. DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN FRANCISCO
In the Matter of the Seizure of )
(Briefly describe the property to be seized) )
) Case No.3:22-mj-71553 AGT
)
)
APPLICATION FOR A WARRANT

TO SEIZE PROPERTY SUBJECT TO FORFEITURE
I, a federal law enforcement officer or attorney for the government, request a seizure warrant and state under
penalty of perjury that I have reason to believe that the following property in the District of
is subject to forfeiture to the United States of America under U.S.C.§
(describe the property):
The application is based on these facts:
Continued on the attached sheet.

/s/ Alfonso Speed
Applicant’s signature
Printed name and title
30th
Nov .
11/30/2022
Date:
Judge’s signature
City and state:

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A SEIZURE WARRANT
I, Alfonso Speed, a Special Agent with the United States Secret Service, being duly sworn,
depose and state as follows:
INTRODUCTION AND PURPOSE OF AFFIDAVIT
1. I am a Special Agent with the Department of Homeland Security, United States
Secret Service (“USSS”), and have been so employed since May 2019. The USSS is the primary
investigative agency charged with safeguarding the payment and financial systems of the United
States. I am currently assigned to the San Francisco Field Office as a member of the Digital
Asset Technology Alliance (“DATA”). I attended and completed the twelve-week Criminal
Investigator Training Program at the Federal Law Enforcement Training Center located in
Glynco, Georgia, and an eighteen-week USSS Special Agent Training Course at the James J.
Rowley Training Center located in Beltsville, Maryland. These programs included
comprehensive, formalized instruction in, among other things: fraud investigations, counterfeit
identification and detection, familiarization with United States fraud and counterfeit laws,
financial investigations and money laundering, identification and seizure of assets, physical and
electronic surveillance, and undercover operations. I also received specific instruction in the
investigation of electronic crime, including but not limited to network intrusions, point of sale
terminal compromises, bank fraud, and wire fraud. As part of this instruction, I received training
related to identifying the techniques and methods employed by the groups and organizations
involved in these types of crimes.
2. Since my graduation from the Federal Law Enforcement Training Center and
USSS Special Agent training, I have conducted preliminary and follow-up investigations on
various crimes, including network intrusions, crimes against persons, death investigations,
1
financial fraud, sexual assault, drug possession, drug sales, cryptocurrency money laundering,
prescription forgery, cellular phone fraud, check fraud, petty theft, grand theft, burglary, robbery,
auto theft, computer crime, and Internet crime. These investigations involve preparing reports;
collecting and preserving evidence; arresting suspects; and interviewing suspects, witnesses, and
victims. I have had numerous conversations with other officers and agents regarding related
crimes. I have also had conversations with suspects, who have committed many of these crimes,
about their motives and method of operations. As a result of my training and experience, I have
developed an understanding of the motives and methods of operation of subjects involved in
these related crimes. I have also created and assisted in the service of arrest and search warrants
associated with these types of crimes. I have attended several classes at conferences
teaching/discussing the following topics: mobile wireless investigations and cryptocurrency
(Bitcoin, etc.).
3. The facts in this affidavit come from my personal observations and knowledge,
my training and experience, and information obtained from other agents and witnesses. This
affidavit is intended to show merely that there is sufficient probable cause for the requested
warrant and does not set forth all of my knowledge about this matter. All dates are on or about
the date specified. All amounts are approximate.
4. This affidavit is submitted in support of an application for the issuance of a
seizure warrant for the funds located in four cryptocurrency wallet addresses, to wit:
a. All Tether (“USDT”) held in a wallet address identified by
0x6c3ce666a5b030e82d08881216d4aac582604f3f, herein referred to as
“USDT Token Group A”;
2
b. All USDT held in a wallet address identified by
0xb7a62b9729034fecfcab7ee4256a4ba983eecf7b, herein referred to as
“USDT Token Group B”;
c. All USDT held in a wallet address identified by
0x50c85e5587d5611cf5cdfba23640bc18b3571665, herein referred to as
“USDT Token Group C”; and
d. All USDT held in a wallet address identified by
0xe0fe2b4c9f7d58a05b4a16b71ef8afb42557aef2, herein referred to as “USDT
Token Group D”.
(collectively, “the Subject USDT Tokens”).
5. Based on my training and experience and the facts as set forth in this affidavit,
there is probable cause to believe that unknown subjects have violated Title 18, United States
Code, Section 1343 (Wire Fraud) and laundered the proceeds of that activity in violation of Title
18, United States Code, 1956(a)(1)(B)(i) (Money Laundering). There is also probable cause to
believe that the Subject USDT tokens contain the proceeds of the wire fraud scheme described
below. Accordingly, those proceeds, totaling 80,000 USDT from USDT Token Group A; 55,086
USDT from USDT Token Group B; 32,000 USDT from USDT Token Group C; and 133,438
USDT from USDT Token Group D are subject to seizure and forfeiture pursuant to Title 18,
United States Code, Section 981(a)(1)(C), and Title 28, United States Code, Section 2461(c).
Moreover, as indicated herein, there is probable cause to believe that the four Subject Addresses
are connected to over ninety reports of criminal activity independent of the scam described in
detail below. Accordingly, there is further probable cause to seize the remaining balances of the
3
Subject USDT tokens as funds involved in money laundering transactions, pursuant to Title 18,
United States Code, Sections 981(a)(1)(A) and 982(a)(1).
6. I accordingly request that the Court authorize the attached warrant for seizure of
the assets described herein.
APPLICABLE AUTHORITY
CRIMINAL STATUTES
7. Title 18, United States Code, Section 1343, makes it a crime to knowingly
execute, or attempt to execute, a scheme or artifice to (1) obtain money or property by means of
false or fraudulent pretenses, representations, or promises; (2) that are material; (3) with the
intent to defraud; and (4) where the defendant used, or caused to be used, a wire communication
to carry out or attempt to carry out an essential part of the scheme.
8. Title 18, United States Code, Section 1956(a)(1)(B)(i) makes it a crime to conduct
or attempt to conduct a financial transaction involving the proceeds of specified unlawful activity
knowing that the transaction is designed, in whole or in part, to conceal or disguise the nature,
location, source, ownership, or control of those proceeds. Wire fraud activity conducted in
violation of Title 18, United States Code, Section 1343 is a specified unlawful activity pursuant
to Title 18, United States Code, Section 1956(c)(7), per its cross reference to Title 18, United
States Code, Section 1961(1).
SEIZURE AND FORFEITURE STATUES
9. Wire fraud forfeiture: Title 18, United States Code, Section 981(a)(1)(C)
provides that “[a]ny property, real or personal, which constitutes or is derived from proceeds
traceable” to the violation of an enumerated statute constituting a specified unlawful activity “is
subject to forfeiture to the United States.” Specified unlawful activities are detailed therein, as
well as at Title 18, United States Code, Sections 1956(c)(7) and 1961(1), which enumerates Title
4
18, United States Code, Section 1343 as a specified unlawful activity. This section provides both
civil forfeiture authority and criminal forfeiture authority by virtue of Title 28, United States
Code, Section 2461(c).
10. Money laundering forfeiture: Title 18, United States Code, Section
981(a)(1)(A) provides for the civil forfeiture of any property, real or personal, that is involved in
a transaction or attempted transaction in violation Title 18, United States Code, Sections 1956,
1957, or 1960. Title 18, United States Code, Section 982(a)(1) provides for the criminal
forfeiture of any property, real or personal, that is involved in a transaction or attempted
transaction in violation Title 18, United States Code, Sections 1956, 1957, or 1960.
11. Seizure warrant authority: Title 18, United States Code, Sections 981(b)(2) and
(3) provide that seizures executed for purposes of civil forfeiture shall be made pursuant to a
warrant issued in the same manner as provided for a criminal search warrant under the Federal
Rules of Criminal Procedure. Moreover, seizure warrants may be issued in any district in which
a forfeiture action may be filed and may be executed in any district in which the property is
found. Federal Rule of Criminal Procedure 41 governs the issuance of criminal search and
seizure warrants.
12. Title 28, United States Code, Section 2461(c) provides that the procedures
(including seizure warrants) in Title 21, United States Code, Section 853 control criminal
forfeiture. Section 853(f) of the same title provides that the government may request a warrant
for the seizure of property for forfeiture in the same manner as it may seek a search warrant.
Title 18, United States Code, Section 982(b)(1) also provides that seizures for criminal forfeiture
shall be made pursuant to a warrant issued in the same manner as provided for a criminal search
warrant under the Federal Rules of Criminal Procedure, and cross-references Title 21, United
5
States Code, Section 853. This warrant seeks seizure authority under both the criminal and civil
forfeiture statutes.
13. Title 21, United States Code Section 853(f) provides that a court may issue a
criminal seizure warrant when it “determines that there is probable cause to believe that the
property to be seized would, in the event of conviction, be subject to forfeiture and that a[]
[protective] order under [21 U.S.C. § 853(e)] may not be sufficient to assure the availability of
the property for forfeiture.” As set forth further below, there is a substantial risk that the assets in
the Subject USDT tokens will be withdrawn, moved, dissipated, or otherwise become
unavailable for forfeiture unless immediate steps are taken to secure them. I therefore submit that
a protective order under 21 U.S.C. § 853(e) would not be sufficient to assure that the assets in the
Subject USDT tokens will remain available for forfeiture.
14. One of the chief goals of forfeiture is to remove the profit from crime by
separating the criminal from his or her dishonest gains, and to divest criminal actors from the
apparatus allowing them to engage in criminal activity. See United States v. Newman, 659 F.3d
1235, 1242 (9th Cir. 2011); United States v. Casey, 444 F.3d 1071, 1073 (9th Cir. 2006). To that
end, in cases involving a money laundering offense, the forfeiture statutes connected to money
laundering offenses permit the government to forfeit property “involved in” money laundering.
Such property includes “untainted property” commingled with “tainted” property, when that
untainted property is used to facilitate the laundering offense, such as by obscuring the nature,
source, location, or control of any criminally derived property. See Title 18, United States Code,
Sections 981(a)(1)(A), 982(a)(1); see also United States v. Kivanc, 714 F.3d 782, 794-95 (4th
Cir. 2013); United States v. Huber, 404 F.3d 1047, 1056-1058 (8th Cir. 2005).
6
15. Based on my training, experience, and the information contained in this affidavit,
there is probable cause to believe that funds in the Subject USDT tokens are subject to both civil
and criminal forfeiture as proceeds traceable to a wire fraud scheme, pursuant to Title 18, United
States Code, Section 981(a)(1)(C) and Title 28, United States Code, Section 2461(c). The
balances of the Subject USDT tokens are subject to both civil and criminal forfeiture as property
involved in money laundering, pursuant to Title 18, United States Code, Sections 981(a)(1)(A)
and 982(a)(1). The balances of the virtual currencies in the Subject USDT tokens are therefore
subject to civil and criminal seizure.
BACKGROUND ON CRYPTOCURRENCY AND VIRTUAL CURRENCY

EXCHANGES
16. Virtual currencies are digital tokens of value circulated over the Internet as
substitutes for traditional fiat currency. Virtual currencies are not issued by any government or
bank like traditional fiat currencies such as the U.S. dollar but are generated and controlled
through computer software. Bitcoin is currently the most well-known virtual currency in use.
17. Virtual currency addresses are the particular virtual locations to which such
currencies are sent and received. A virtual currency address is analogous to a bank account
number and is represented as a string of alphanumeric characters.
18. Each virtual currency address is controlled through the use of a unique
corresponding private key, a cryptographic equivalent of a password needed to access the
address. Only the holder of an address’s private key can authorize a transfer of virtual currency
from that address to another address.
19. A virtual currency wallet is a software application that interfaces with the virtual
currency’s specific blockchain and generates and stores a user’s addresses and private keys. A
7
virtual currency wallet also allows users to send and receive virtual currencies. Multiple
addresses can be stored in a wallet.
20. Many virtual currencies publicly record all of their transactions on what is known
as a “blockchain.” The blockchain is essentially a distributed public ledger, run by a
decentralized network, containing an immutable and historical record of every transaction
utilizing that blockchain’s technology. The blockchain can be updated multiple times per hour
and records every virtual currency address that ever received that virtual currency. It also
maintains records of every transaction and all the known balances for each virtual currency
address. There are different blockchains for different types of virtual currencies.
21. Tether, widely known as “USDT,” is a blockchain-based cryptocurrency whose
tokens in circulation are backed by an equivalent amount of U.S. dollars, making it what is
known as a “stablecoin.” USDT is issued by Tether Ltd., a company headquartered in Hong
Kong. Tether is connected to Bitfinex, a cryptocurrency exchange registered in the British Virgin
Islands.
22. USDT is hosted on the Ethereum and Bitcoin blockchains, among others.
Ethereum (“ETH”) is a cryptocurrency that is open source, public, has a blockchain, and is
distributed on a platform that uses “smart contract” technology. The public ledger is the digital
trail of the Ethereum blockchain, which allows anyone to track the movement of ETH.
23. Smart contracts allow developers to create markets, store registries of debts, and
move funds in accordance with the instructions provided in the contract’s code, without any type
of middleman or counterparty controlling a desired or politically motivated outcome, all while
using the Ethereum blockchain protocol to maintain transparency. Smart contract technology is
one of Ethereum’s distinguishing characteristics and an important tool for companies or
8
individuals executing trades on the Ethereum blockchain. When engaged, smart contracts
automatically execute according to the terms of the contract written into lines of code. A
transaction contemplated by a smart contract occurs on the Ethereum blockchain and is both
trackable and irreversible.
24. Like other virtual currencies, USDT is sent to and received from USDT
“addresses.” A USDT address is somewhat analogous to a bank account number, and is
represented as a 26-to 35-character-long case-sensitive string of letters and numbers. Users can
operate multiple USDT addresses at any given time, with the possibility of using a unique USDT
address for every transaction.
25. Although the identity of a USDT address owner is generally anonymous (unless
the owner opts to make the information publicly available), analysis of the blockchain can often
be used to identify the owner of a particular USDT address. The analysis can also, in some
instances, reveal additional addresses controlled by the same individual or entity.
26. Unlike bitcoin, one of the most popular cryptocurrencies in use today, USDT is
“centralized”, meaning that it is issued and controlled by a governing body. Most other
cryptocurrencies are “decentralized” and have no such governing body.
FACTS SUPPORTING PROBABLE CAUSE
27. This investigation was initiated from a fraud report received by the USSS San
Francisco Field Office from “AF”, a 62-year-old resident of San Ramon, California. On or about
May 2022, AF fell victim to a burgeoning fraud scheme known as “Pig Butchering”, which
resulted in a total loss of over $1.3 million to AF. Pig Butchering is a type of romance scam, or
confidence scam, that convinces victims to invest in non-existent cryptocurrency trading
platforms. Romance scams target persons looking for romantic partners or friendships on dating
9
websites and other social media platforms. The scammers may create profiles using fictitious or
fake names, locations, images, and personas, allowing the scammers to cultivate relationships
with prospective romance scam victims. Romance scams aim to use the fictitious relationship to
obtain money or induce victims to conduct financial transaction on behalf of the scammers. In
this case and as explained in further detail below, efforts to defraud AF were evident early on,
when within five hours of their initial contact on WhatsApp, an individual who had matched with
AF on a dating website the same day stated, in an inorganic way to explain a five-minute delay
in her response, “Sorry, I was just analyzing the cryptocurrency blockchain market with my
teacher”, as explained in further detail below.
28. Based on this information, along with all the evidence gathered to date in this
investigation and my training and experience, I submit that there is probable cause to believe that
the Subject USDT tokens are subject to seizure and forfeiture.
A. Wire Fraud Scheme
29. On or about May 29, 2022, AF connected with an individual identifying
themselves as Li SISI (“SISI”) on an online dating platform called Zoosk. SISI claimed to be a
beauty company owner living in Southern China. Shortly after their initial contact on Zoosk,
SISI sent AF a message on WhatsApp, an encrypted messaging service headquartered in Menlo
Park, CA, via phone number +852-6252-7077. AF and SISI discussed personal information, such
as their respective marital statuses and children. Their relationship eventually became personal in
nature, with AF professing their love for SISI less than 24 hours after their initial WhatsApp
message. Based on my training and experience, I know that perpetrators of romance scams are
highly effective in gaining an individual’s trust and affection in a short amount of time using
manipulative tactics and language.
10
30. During their first WhatsApp conversation, SISI began discussing cryptocurrency
futures trading, often unprovoked and unrelated to the topic of their conversation, such as the
following:
[5/29/22, 7:51:28 PM] Sisi Li: �Your tone of voice is very similar to that of my
mother!
[5/29/22, 7:52:17 PM] [AF]: Oh really. Very interesting. In what way?
[5/29/22, 7:53:09 PM] Sisi Li: What you just said is very similar.
[5/29/22, 7:58:31 PM] [AF]: Is it because of her experience, wisdom or just
being an oracle or how she is or knows a lot of these types of expressions?
[5/29/22, 8:03:08 PM] Sisi Li: Yes, because of the Oracle hahaha.
[5/29/22, 8:03:26 PM] Sisi Li: Sorry, I was just analyzing the cryptocurrency
blockchain market with my teacher.
[5/29/22, 8:04:05 PM] Sisi Li: This is the current price chart of Bitcoin. I wonder
if you can understand it haha.�
[5/29/22, 9:34:22 PM] [AF]: Also whenever you have a few mins, let me know. I
wanted to share something with you on what you said about your mom earlier
that made me thinking about it while I was driving.
[5/29/22, 9:36:41 PM] Sisi Li: No. Ha ha. I have been trading futures bitcoin for
more than four years. Every time I trade, I follow the instructions of my teacher.
He and his team can control risks, minimize risks and maximize profits.
31. Continuing on May 29, 2022, SISI introduced AF to a company called BC Group
Technology Co. Ltd, alleging that her “teacher” was one of the top analysts in Asia and worked
as a Chief Financial Officer:
[5/29/22, 9:42:25 PM] Sisi Li: My teacher has his own professional analysis team and 16
years' experience. He has rich experience in investment and capital markets. He is one of
the top ten foreign exchange analysts in Asia. He has worked in a number of leading
Hong Kong listed technology companies, investment banks and big four accounting
firms. Now he is the chief financial officer of bc Group Technology Co., Ltd.
11
32. SISI directed AF to a website, https://bc.group, and alleged her “teacher” was
Davin Wu, who could be found on the BC Group website as its Chief Financial Officer. BC
Group appears to be a legitimate Hong Kong-based company in the digital assets industry, and
search engine results return information that tends to legitimize the firm and their business. The
BC Group website appears to have been in existence since 2016.
33. On or about June 8, 2022, SISI began introducing AF to Davin Wu, who she
referred to as “David”.
[6/8/22, 8:30:26 AM] Sisi Li: When I talked with my teacher yesterday afternoon, I
mentioned you to my teacher. I asked my teacher for guidance, but my teacher didn't
agree at first, because he was very busy. He had many clients, including the president of
Hongkong and Shanghai Banking Corporation and Chase Bank of America, Minister Liu
of Alibaba Finance Department, and many bosses of listed companies.
[6/8/22, 8:30:59 AM] Sisi Li: But after a series of conversations, I finally told my teacher
that you were my boyfriend and he agreed to guide you
34. SISI then provided AF a WhatsApp number for “David,” to wit, +852-9847-8964.
Based on my training, experience, and research, I know that a single Pig Butchering scheme is
often facilitated by multiple individuals with different roles and responsibilities. In a recent
investigative report, ProPublica identified a network of human trafficking victims placed into
call centers and forced to conduct Pig Butchering scams, stating “pig butchering scams have
been fueled by human trafficking. Workers from around Asia are tricked into going to
Cambodia, Laos, or Myanmar for seemingly well-paid jobs that instead trap them inside scam
sweatshops run by Chinese criminal syndicates. Those who resist directives to engage in online
12
fraud face beatings, food deprivation or worse.” 1 The individual or individuals portraying
themselves as SISI are likely low level call center employees, and in some cases have been
known to be victims of human trafficking and forced labor. The handoff to “David” is likely
strategic and meant to elevate a victim from the initial recruitment phase to the next phase, where
they will be guided through investments and ultimately lose their funds as detailed below.
35. Continuing on June 8, 2022, AF messaged ‘David’ with the following:
[6/8/22, 8:40:57 AM] [AF]: Hi David, This is [AF]. Sisi’s boyfriend in the US.
36. “David” replied with several messages conveying his experience and expertise in
the cryptocurrency trading industry, such as:
[6/8/22, 8:55:31 AM] Davin/David Wu: [AF], nice to meet you. You can call me David. I
come from Hong Kong, and I am a foreign exchange analyst
[6/8/22, 8:55:59 AM] Davin/David Wu: I have 20 years of analytical experience in this
field and currently focus on the bitcoin market
37. “David” ultimately directed AF to download Metatrader5, also known as MT5,
which is a smartphone application that allows investors to perform analysis and trading in
foreign exchange, stocks, futures, and cryptocurrency. MT5 is not itself an investment company,
but rather a user interface for countless investment firms. MT5 allows investment firms that
would otherwise not have a smartphone application to link their service with MT5 and allow
investors to view their investment activity on an established smartphone application. It also
1
See PROPUBLICA, “What’s a Pig Butchering Scam? Here’s How to Avoid Falling Victim to
One.”, available at https://www.propublica.org/article/whats-a-pig-butchering-scam-heres-how-
to-avoid-falling-victim-to-one (last accessed Nov. 29, 2022); see also “Authorities Raid Alleged
Cyberscam Compounds in Cambodia.”, available at https://www.propublica.org/article/pig-
butchering-scams-raided-cambodia-apple-trafficking (last accessed Nov. 29, 2022).
13
intends to allow investors to use one investment platform and smartphone app for more than one
investment firm, eliminating the need to have numerous applications.
38. Shortly following AF and “David’s” initial contact, “David” provided AF
instructions to link “David’s” investment service, portrayed as BC Group, to AF’s MT5 account.
This resulted in the MT5 application displaying information that included account numbers,
cryptocurrency wallet addresses, investment amounts and gains, and deposit/withdrawal
functions. The application would have featured graphics and layouts consistent with most
smartphone trading applications, and its presence on MT5 further provided an air of legitimacy
to the trading platform. In reality, though, there was no connection between the true BC Group
and the investment platform “David” provided to AF. In fact, communications from “David”
revealed the use of an email address utilizing the domain “bcgroup.cc”, not the legitimate
“bc.group” domain that the true BC Group uses.
39. During the course of their conversations, “David” made material
misrepresentations to help persuade AF to contribute large sums of money into what AF believed
was BC Group’s investment products, including the following statement:
[6/17/22, 6:43:25 PM] Davin/David Wu: MT5 this is absolutely safe. We insure every
investment client in MT5, over $10 million each, as I'm sure Tina told you when she
opened the real account
40. On or about June 10, 2022, AF made their initial investment into BCGroup.cc, a
transfer of 28,410.55 USDT from AF’s Crypto.com account to USDT address
0x6d29c2c39b630b8a29407dfc0a7a7ddb3f7748bc (the “BCGroup.cc address”).
41. Following the initial investment, AF was able to view his fictitious “earnings” on
his initial investment on the MT5 app, which amounted to nearly 27 percent in gains against the
investment. Those purported gains, which saw his 28,410.55 USDT investment increase to
14
approximately 36,000 USDT within hours, induced AF to begin making several additional
investments.
42. Between June 10, 2022 and September 1, 2022, AF conducted 27 investment
transactions totaling approximately 1,356,033.20 USDT from their account at Crypto.com. The
27 transfers were all sent to the BCGroup.cc Address, as follows:
Date Sending Address Receiving Address Amount Asset

6/10/2022 Crypto.com BCGroup.cc Address 28,410.55 USDT
6/19/2022 Crypto.com BCGroup.cc Address 963.90 USDT
Total 1,356,033.20 USDT
43. The BCGroup.cc scam detailed in this affidavit is consistent with Pig Butchering.
According to the Global Anti-Scam Organization, a nonprofit aiming to raise awareness and
15
provide tools to combat cybercrime, Pig Butchering originated in China in 2019. As noted above,
the scheme often begins with a scammer sending a victim a seemingly misdialed text, WhatsApp
message, or social media/dating website connection. From there, the scammer establishes a more
personal relationship with the victim using manipulative tactics similar to those used in online
romance scams. Pig Butchering schemes frequently originate in Southeast Asia, including, but
not limited to, Hong Kong, Myanmar, Cambodia, Malaysia, Thailand, and Singapore.
44. The victims in Pig Butchering schemes are referred to as “pigs” by the scammers,
because the scammers will use elaborate romantic storylines to “fatten up” victims into believing
they are in a romantic relationship. Once the victim reaches a certain point of trust, they are
brought into a crypto investment scheme and provided fabricated evidence to bolster the
scheme’s legitimacy and help reduce any skepticism the victim may have concerning the scam.
The fabricated evidence includes fake investment platforms via a website or mobile application
that displays fictious investment gains. In reality, the website or application has limited
functionality and does not provide the user any access to a cryptocurrency wallet. The scammers
may also provide fake transaction photos that create the impression that the suspects are
contributing their own funds to the victim’s initial investment. However, the investment gains
displayed on the investment platform website or mobile application are fabricated. In actuality,
the investment platform does not exist. The scammers will then refer to “butchering” or
“slaughtering” the victims once the victim assets are stolen by the criminals, ultimately causing
the victims financial and emotional ruin.
45. In this particular instance, as noted above, the victim was initially contacted by
SISI and later introduced to “David”, who portrayed himself as an experienced and accomplished
cryptocurrency investment trader. Based on my knowledge and experience conducting
16
cryptocurrency fraud investigations, I know that the criminal organizations often operate in
multiple tiers of responsibility. Most often, the individual that communicates directly with the
victim is on a lower tier of responsibility in the criminal organization, whereas individuals
receiving funds at the end of the scheme are those who profit the most and are typically higher in
the criminal organization’s hierarchy.
46. Based on my knowledge and experience in investigating cyber fraud schemes,
SISI is most likely not the person portrayed to the victim during their WhatsApp conversations,
and may actually be a role played by more than one person. The same photographs that SISI
provided to the victim depicting her appearance have been known to be used by scammers in
other schemes where the scammers go by other names.
B. Laundering the Fraud Proceeds to the Subject USDT tokens
47. For each of AF’s transactions, the victim’s funds were traced on the publicly
available blockchain through a series of transfers between addresses, known as hops, to their
arrival at the Subject USDT tokens. The USSS traced the flow of USDT and identified 103
unique USDT addresses involved in the movement of AF’s funds following their transfer from
17
Crypto.com. In approximately 14 instances, the funds were sent to centralized cryptocurrency
exchanges. The USSS reviewed records for eight exchange accounts 2 in receipt of AF’s funds
and found that they were primarily established by individuals from Southeast Asian countries,
which is consistent with the Pig Butchering scheme. Additional indications of these accounts’
involvement in Pig Butchering schemes, or the laundering of funds from Pig Butchering and
other schemes, were each account’s unique behaviors and characteristics. For instance, all but
one of the cryptocurrency accounts used to funnel USDT from AF’s Crypto.com account to the
Subject USDT tokens were established in 2022. The accounts displayed a history of frequent,
large dollar deposit transactions, followed by a pattern of rapid movement of funds with large
corresponding withdrawals. Despite the short duration of their existence, the accounts processed
an average of approximately $38 million worth of cryptocurrency each, with one account alone
receiving over $180 million worth of cryptocurrency in approximately 13 months.
48. The account activity also displayed instances of “chain-hopping”, where
cryptocurrency is moved from one blockchain to another. This behavior is widely recognized
among cryptocurrency security analysts and law enforcement as a mechanism to “layer” the
proceeds of criminal activity into new cryptocurrency ecosystems, all in an effort to obfuscate
the nature, source, control, and/or ownership of those proceeds. This behavior is particularly
possible when using USDT, which is able to be used and transferred on a number of different
blockchains. In a review of the accounts that received AF’s funds, 100 percent of the funds were
2
The remaining six instances included cryptocurrency exchanges outside the U.S. or unresponsive
to U.S. law enforcement requests for information.
18
received on the Ethereum blockchain, whereas 88% of the corresponding withdrawals were then
sent on the TRON blockchain. 3
49. While the majority of AF’s funds were sent to cryptocurrency exchanges, the
blockchain tracing revealed multiple instances where AF’s funds were still in the process of
being laundered and had not yet reached a cryptocurrency exchange. Those instances are detailed
below. Additionally, during the course of the funds tracing and analysis, the USSS analyzed the
USDT wallet addresses utilized in the various hops between victim transactions to the Subject
USDT tokens and observed an exceedingly apparent pattern where individuals reported falling
victim to Pig Butchering scams, among other scams. In these instances, the USSS located 91
victim complaints on either the Federal Bureau of Investigation’s (“FBI’s”) Internet Crime
Complaint Center, known as IC3 (http://www.ic3.gov), or the Federal Trade Commission’s
(“FTC’s”) Consumer Sentinel database (http://reportfraud.ftc.gov).
50. This investigation is related to a USSS investigation into another Pig Butchering
scheme that was the subject of another seizure warrant authorized by this Court, specifically with
respect to USDT Token Groups B and D. That warrant package is appended hereto as Exhibit A.
C. USDT Token Group A
3
As noted above, USDT is among several cryptocurrencies that can be stored in and moved
through different blockchains. In this particular case, the entirety of the funds at issue are USDT,
but there is probable cause to believe that the USDT at issue was moved among different
blockchains to obscure the nature, source, origin, or control of the funds because, among other
things, there is no apparent legitimate business purpose to the chain-hopping that occurred here.
19
51. As illustrated above, between June 17, 2022 and June 20, 2022, AF transferred
approximately 436,279.03 USDT on the Ethereum blockchain via eight transfers to the
BCGroup.cc Address as part of the BCGroup.cc investment scheme. On June 21, 2022, the
BCGroup.cc Address transferred 85,257 USDT to a USDT address beginning with 0x30f9aaa5.
Continuing on June 21, 2022, address 0x30f9aaa5 transferred 80,000 USDT to an address
beginning with 0x7dfbbc8f, which then transferred 2,499,000 USDT to an address beginning
with 0x17122ed2.
52. On June 28, 2022, address 0x17122ed2 transferred 1,999,000 USDT to USDT
Token Group A. On September 16, 2022, the tracing analysis revealed that USDT Token Group
A had not yet transferred AF’s funds, and instead appeared to be pooling USDT assets. This type
of behavior has been previously observed during the laundering of Pig Butchering funds, and
20
may be due to the complexities surrounding the laundering of such significant amounts of
money. Also, the short time in which Pig Butchering scams have existed may be complicating
money laundering efforts for the criminal organizations, leading to what appears to be dormant
wallet addresses pooling assets.
53. Based on the last in-first out (“LIFO”) accounting principle, which assumes that
the last, or most recent, incoming assets are the first expended or sent out, the undersigned
calculated that approximately 80,000 USDT of the balance in USDT Token Group A could be
traced back to AF’s original transactions. I reached this calculation by tracing AF’s initial
investment of 436,279.03 USDT through four hops that culminated in the transfer to USDT
Token Group A. During the course of the four hops, the amount transferred was at one point
reduced to 80,000 USDT. The amount was reduced because AF’s initial deposit was fractured
and subsequently transferred into several other cryptocurrency addresses (including the other
Subject Addresses described below).
54. Based on my training and experience, I know that criminals will often conduct an
otherwise unnecessary number of transactions in the transfer of funds in an effort to layer ill-
gotten funds to ultimately conceal or disguise the nature, location, source, ownership, or control
of those proceeds when they are ultimately transferred into a cryptocurrency exchange. The
number of hops in this transaction is a strong indication that the movement of funds was
performed in a manner meant to conceal or disguise the nature, location, source, ownership, or
control of the proceeds of a specified unlawful activity, to wit, wire fraud.
55. As illustrated in the chart below (a larger version of which is attached hereto as
Exhibit B), AF’s funds were traced through five hops before arriving at USDT Token Group A.
The USSS performed analyses on each of the hops identified in this movement of funds and
21
repeatedly located reports of additional fraud in transactions involving the addresses through
which AF funds hopped.
56. For example, a USDT address starting with 0x30f9aaa5 was found to have
interacted with addresses where, five hops earlier, a victim reported an unspecified scam to the
Federal Bureau of Investigation’s Internet Crime Complaint Center (“IC3”). The third address in
the flow of funds in this transaction, an address starting with 0x7dfbbc8f, was also found to have
interacted with a series of addresses where, seven hops prior, 13 victims reported having
deposited cryptocurrency into the addresses as the victims of a variety of Pig Butchering scams.
Lastly, the analysis revealed the presence of an additional address, beginning with 0x6e2b0116,
which sent funds directly to USDT Token Group A. The 0x6e2b0116 address was also found to
have interacted with an address where, five and six hops back, 13 victims reported having
deposited cryptocurrency into the addresses as the victims of scams ranging from Pig Butchering
to likely Pig Butchering. 4
4
“References to “likely pig butchering” refer to schemes that, as described by victims, have the
hallmarks of a typical pig butchering scheme, but may not have been specifically labeled that way
or included enough detail for investigators to definitively confirm the nature of the scheme. For
example, some may not have indicated that they initially encountered their scammer via a dating
website or other online platform, something which I know, based on my training and experience,
that victims often are embarrassed to disclose. All of the scams labeled “likely pig butchering”
nevertheless involved the solicitation of fraudulent investments.
22
57. As noted previously, each of the aforementioned complaints was documented
with the FBI through IC3, or through the FTC’s Consumer Sentinel system. The 27 victims
associated with the addresses connected to Subject Account A collectively reported losses of
approximately $2,460,467.89
Date of
Name Report City/State/Country Loss Scam Scam Address
Victim 1 4/17/2022 Germany $12,072.52 Likely Pig Butchering 0x69c9c6873…
Victim 2 1/1/2022 Windermere, FL $8,064.00 Likely Pig Butchering 0x06450b4a1…
Victim 3 1/22/2022 Valdosta, GA $34,590.00 Likely Pig Butchering 0x06450b4a1…
Victim 4 2/4/2022 Riverside, CA $100,258.84 Pig Butchering 0x06450b4a1…
Victim 5 2/20/2022 Austin, TX $6,111.66 Pig Butchering 0x06450b4a1…
Victim 6 2/22/2022 Temecula, CA $50,315.49 Pig Butchering 0x06450b4a1…
Victim 7 2/24/2022 Kent, WA $3,855.44 Pig Butchering 0x06450b4a1…
Victim 8 3/6/2022 San Jose, CA $973,483.48 Pig Butchering 0x06450b4a1…
Victim 9 3/19/2022 San Francisco, CA $281,149.10 Pig Butchering 0x06450b4a1…
Victim 10 4/17/2022 Bellevue, WA $579,558.00 Pig Butchering 0x06450b4a1…
Montgomery
Victim 11 5/17/2022 Village, MD $26,414.37 Likely Pig Butchering 0x06450b4a1…
Victim 12 6/6/2022 Hayward, CA $57,442.07 Pig Butchering 0x06450b4a1…
Victim 13 8/23/2022 Colleyville, TX $15,724.35 Likely Pig Butchering 0x06450b4a1…
Victim 14 9/21/2022 Rosenberg, TX $79,000.00 Pig Butchering 0x06450b4a1…
Victim 15 9/29/2022 Ankeny, IA $7,047.65 Likely Pig Butchering 0x81cc156b6…
Victim 16 4/3/2022 Galloway, OH $30,000.00 Likely Pig Butchering 0x6302b04e7…
Victim 17 11/12/2021 Medford, MA $11,664.16 Likely Pig Butchering 0x6302b04e7…
Victim 18 11/26/2021 Spring, TX $18,722.00 Pig Butchering 0x6302b04e7…
Victim 19 11/26/2021 Dimapur, India $4,064.00 Pig Butchering 0x6302b04e7…
Victim 20 12/9/2021 Minneapolis, MN $9,681.59 Pig Butchering 0x6302b04e7…
Victim 21 12/19/2021 Lewisville, TX $3,285.00 Likely Pig Butchering 0x6302b04e7…
Victim 22 12/23/2021 Duzici, Turkey $6,818.00 Likely Pig Butchering 0x6302b04e7…
Victim 23 1/13/2022 Los Angeles, CA $60,694.00 Likely Pig Butchering 0x6302b04e7…
Victim 24 1/31/2022 Alameda, CA $2,267.66 Likely Pig Butchering 0x6302b04e7…
Severn, ON,
Victim 25 2/5/2022 Canada $1,435.00 Pig Butchering 0x6302b04e7…
Victim 26 3/27/2022 Millbrae, CA $56,990.00 Likely Pig Butchering 0x6302b04e7…
New Taipei City,
Victim 27 9/1/2022 Taiwan $19,759.51 Likely Pig Butchering 0x6302b04e7…
Total $2,460,467.89
23
58. As of October 21, 2022, USDT Token Group A maintains a USDT balance of
3,399,014 USDT.
59. Based on my training and experience, I know that the presence of numerous
victims of similar fraud is a likely indication that the addresses involved, and therefore USDT
Token Group A, are used in the laundering of funds tied to Pig Butchering, among other types of
fraud and that the funds currently on deposit at USDT Token Group A are the proceeds of a
specified unlawful activity, to wit, wire fraud.
D. USDT Token Group B
60. The illustration below demonstrates the movement of funds from AF to USDT
Token Group B:
24
61. As illustrated in the chart above, on August 30, 2022, AF transferred
approximately 204,619.71 USDT on the Ethereum blockchain to the BCGroup.cc address.
Continuing on August 30, 2022, the BCGroup.cc address transferred 100,000 USDT to an
address beginning with 0xcd2b75a4. These funds were then transferred on the same day to an
address starting with 0x36fecee4. Less than an hour later, 58,000 USDT were transferred to an
address starting with 0x1b046a68, then continuing on August 30, 2022, address 0x1b046a68 sent
55,086 USDT to an address starting with 0x2c4287d7.
gotten funds to ultimately disguise their illicit source when transferred into a cryptocurrency
exchange. The number of hops in this transaction, particularly on the same day, is a strong
indication that the movement of funds was performed in a manner meant to conceal the nature,
source, control, and/or ownership of the proceeds of a specified unlawful activity, to wit, wire
fraud.
63. As illustrated below, and attached as Exhibit C, AF’s funds were traced through
seven hops before arriving at USDT Token Group B. The USSS performed analyses on each of
the hops identified in this movement of funds and repeatedly located reports of additional fraud.
64. For example, an address starting with 0x6d29c2c3 was found to have interacted
with addresses where six hop earlier 10 victims reported having deposited cryptocurrency into
the addresses as the victims of Pig Butchering scams. The third address in the flow of funds in
25
this transaction, an address starting with 0x36fecee4, was also found to have interacted with a
series of addresses where, two to five hops prior, two victims reported having deposited
cryptocurrency into the addresses as the victims of a Pig Butchering scam.
65. The fourth and fifth addresses in the flow of funds, which start with 0xb046a68
and 0x2c4287d, respectively, were also found to have interacted with addresses where six to
seven hops back, eight victims having deposited cryptocurrency into the addresses as the victims
of reported Pig Butchering scams. As noted above, these two addresses received funds tied to a
separate USSS Pig Butchering investigation known as “RiotX”, for which a seizure warrant was
previously issued by this Court. See Exhibit A.
66. These 20 victims collectively reported losses of approximately $3,888,280.38.
Date of
Name Report City/State/Country Loss Scam Address
Victim 72 11/25/2021 Cutler Bay, FL $196,746.00 Pig Butchering 0x5092a527…
Likely Pig
Victim 73 12/28/2021 Diyarbakir, Turkey $6,915.00 Butchering 0x5092a527…
Likely Pig
Victim 74 12/28/2021 Izmir, Turkey $1,974.00 Butchering 0x5092a527…
Victim 75 12/29/2021 Istanbul, Turkey $12,458.00 Pig Butchering 0x5092a527…
Victim 76 12/29/2021 Bangkok, Thailand $200,909.10 Pig Butchering 0x5092a527…
Victim 77 12/30/2021 Bristol, UK $112,797.71 Pig Butchering 0x5092a527…
Victim 78 1/2/2022 Izmir, Turkey $100,000.00 Pig Butchering 0x5092a527…
Victim 79 1/3/2022 Buellton, CA $25,816.00 Pig Butchering 0x5092a527…
Victim 80 1/9/2022 Ankara, Turkey $8,586.20 Pig Butchering 0x5092a527…
Victim 81 2/2/2022 Kenosha, WI $47,357.96 Pig Butchering 0x5092a527…
Victim 82 7/17/2022 San Diego, CA $758,700.00 Pig Butchering 0x70226954…
Victim 83 9/29/2022 Ankeny, IA $7,047.65 Pig Butchering 0x81cc156b…
North Attleboro,
Victim 84 4/21/2022 MA $5,272.75 Pig Butchering 0xd889c4e2…
Victim 85 12/13/2021 Clearfield, UT $15,200.00 Pig Butchering 0xd889c4e2…
Victim 86 3/6/2022 Roswell, GA $95,000.00 Pig Butchering 0xd889c4e2…
Victim 87 4/1/2022 Forest Grove, OR $50,000.00 Pig Butchering 0xd889c4e2…
Victim 88 4/6/2022 Princeton, NJ $200,000.00 Pig Butchering 0xd889c4e2…
Victim 89 4/9/2022 Foster City, CA $2,005,000.00 Pig Butchering 0xd889c4e2…
Victim 90 4/13/2022 Waukee, IA $30,500.01 Pig Butchering 0xd889c4e2…
26
Victim 91 3/21/2022 Everett, PA $8,000.00 Pig Butchering 0xd889c4e2…

Total $3,888,280.38
67. As of October 21, 2022, USDT Token Group B maintains a USDT balance of
2,439,232.19 USDT.
E. USDT Token Group C
68. The illustration below demonstrates the movement of funds from the Victims’
accounts to USDT Token Group C:
27
69. As illustrated above, on August 19, 2022, AF transferred approximately
154,561.77 USDT on the Ethereum blockchain to the BCGroup.cc address. Continuing on
August 19, 2022, the BCGroup.cc address transferred 150,602 USDT to an address starting with
0xcd2b75a4. On August 19, 2022, address 0xcd2b75a4 transferred 150,592 USDT to an address
starting with 0x8f2b0f07. Continuing on August 19, 2022, address 0x8f2b0f07 transferred
150,602 USDT to an address starting with 0x94a95ef8.
70. On August 22, 2022, address 0x94a95ef8 transferred 1,234,219.55 USDT to an
address starting with 0x7c6adb67. Later, continuing on August 22, 2022, address 0x7c6adb67
transferred 99,990 USDT to an address starting with 0x7f11db0f. On September 14, 2022,
address 0x7f11db0f transferred 32,000 USDT to an address starting with 0x4245d60c. Finally,
on September 14, 2022, address 0x4245d60c transferred 32,000 USDT to USDT Token Group
C.
71. Based on the LIFO accounting principle, approximately 32,000 USDT of the
balance can be traced back to AF’s original transactions. I made this calculation by tracing AF’s
initial investment of 154,561.77 USDT through seven hops that culminated in the transfer to
USDT Token Group C. During the course of the seven hops, the amount transferred was reduced
to 32,000 USDT as proceeds were left behind in each address used in the aforementioned hops.
28
fraud.
73. As of October 21, 2022, USDT Token Group C maintains a USDT balance of
2,986,494.89 USDT.
Exhibit D), AF’s funds were traced through eight hops before arriving at USDT Token Group C.
repeatedly located reports of additional fraud.
75. For example, an address starting with 0x6d29c2c3, which is one hop from AF’s
initial deposit into Crypto.com, was found to have interacted with addresses where one hop
earlier a victim reported having deposited cryptocurrency into the address as the victim of a Pig
Butchering scam. The second address in the flow of funds in this transaction, an address starting
with 0x7dfbbc8f, was also found to have interacted with a series of addresses where, two hops
prior, another victim reported having deposited cryptocurrency into the address as the victim of a
Pig Butchering scam.
76. The third address in the flow of funds, which starts with 0x8f2b0f07, was also
found to have interacted with an address where, five hops back from transfers to the 0x8f2b0f07
address, six victims reported having deposited cryptocurrency into the address as the victims of
scams including Pig Butchering. Lastly, the fourth address in the flow of funds, which starts with
29
0x94a95ef8, was found to have interacted with an address where five hops back, 12 victims
reported having deposited cryptocurrency into the address as the victim of Pig Butchering scams.
77. Each of the aforementioned complaints was documented with the FBI through
IC3, or through the FTC’s Consumer Sentinel system. These 20 victims collectively reported
losses of approximately $7,135,289.62.
Date of
Victim 28 7/3/2021 Wayne, PA $909,504.00 Pig Butchering 0x58168392…
Victim 29 2/7/2022 Chino, CA $2,683,152.22 Pig Butchering 0xfacae6fa...
Victim 30 11/12/2021 Constanta, Romania $25,330.00 Pig Butchering 0x83be39c1…
Victim 31 11/17/2021 Leominster, MA $101,000.00 Likely Pig Butchering 0x83be39c1…
Victim 32 11/19/2021 Los Angeles, CA $76,468.49 Likely Pig Butchering 0x83be39c1…
Victim 33 11/24/2021 Oak Creek, WI $33,190.78 Likely Pig Butchering 0x83be39c1…
Victim 34 12/2/2021 Fort Lauderdale, FL $43,632.00 Likely Pig Butchering 0x83be39c1…
Victim 35 1/13/2022 Miami, FL $112,085.88 Pig Butchering 0x83be39c1…
Victim 36 12/15/2021 Huntington Beach, CA $389,897.25 Pig Butchering 0xb79b3a83…
Victim 37 12/12/2021 Burlingame, CA $991,273.00 Pig Butchering 0xb79b3a83…
Victim 38 11/28/2021 Las Vegas, NV $438,756.22 Pig Butchering 0xb79b3a83…
Victim 39 11/11/2021 San Francisco, CA $50,167.93 Pig Butchering 0xb79b3a83…
Victim 40 11/27/2021 Occoquan, VA $211,954.59 Pig Butchering 0xb79b3a83…
Victim 41 12/6/2021 Sammamish, WA $160,799.01 Likely Pig Butchering 0xb79b3a83…
Victim 42 12/12/2021 Hacienda Heights, CA $312,125.61 Pig Butchering 0xb79b3a83…
Victim 43 12/29/2021 Hacienda Heights, CA $3,039.47 Pig Butchering 0xb79b3a83…
Victim 44 1/6/2022 Torrance, CA $52,330.00 Pig Butchering 0xb79b3a83…
Victim 45 1/19/2022 Fremont, CA $266,947.00 Pig Butchering 0xb79b3a83…
Victim 46 2/14/2022 Los Angeles, CA $20,047.11 Pig Butchering 0xb79b3a83…
Victim 47 1/20/2022 Bethpage, NY $253,589.06 Pig Butchering 0xb79b3a83…
Total $7,135,289.62
victims of similar fraud is a likely indication that the addresses involved, and therefore USDT
Token Group C, are used in the laundering of funds tied to Pig Butchering, among other types of
fraud and that the funds currently on deposit at USDT Token Group C are the proceeds of a
30
F. USDT Token Group D
accounts to USDT Token Group D:
80. As illustrated above, between June 10, 2022 and June 20, 2022, AF transferred
approximately 464,689.58 USDT to the BCGroup.cc address using the Ethereum blockchain. On
31
June 12, 2022, the BCGroup.cc address transferred 50,000 USDT to an address beginning with
0x30f9aaa5. The BCGroup.cc address also sent 178,664 USDT between June 27, 2022 and June
30, 2022 to an address starting with 0x87ff3c32. On June 12, 2022, address 0x30f9aaa5
transferred 50,000 USDT to an address starting with 0x36fecee4. Between June 27, 2022 and
June 30, 2022, address 0x87ff3c32 transferred 175,464 USDT, also to 0x36fecee4.
81. Between June 13, 2022 and June 30, 2022, address 0x36fecee4 transferred
176,425 USDT to an address starting with 0xee2e6e49. During the same timeframe, address
0xee2e6e49 transferred the 176,425 USDT to an address starting with 0x4b7dea30.
82. Between June 14, 2022 and July 1, 2022, address 0x4b7dea30 transferred 135,025
USDT to an address starting with 0x909aae8f. Notably, these transfers were comprised of 14
separate transactions for an average of 9,645 USDT in what appears to be an attempt to structure
transactions in a manner meant to obfuscate its illicit source.
83. Between June 14, 2022 and July 1, 2022, address 0x909aae8f transferred 396,490
USDT to an address starting with 0x1e7d1676. Finally, in the same timeframe, address
0x1e7d1676 transferred the 396,490 USDT to USDT Token Group D.
84. Based on LIFO accounting principle, approximately 133,438 USDT of the
balance can be traced back to AF’s original transactions. I made this calculation by tracing AF’s
initial investment of 464,689.58 USDT through seven hops that culminated in the transfer to
USDT Token Group D. During the course of the seven hops, the amount transferred was reduced
32
fraud.
86. As of October 21, 2022, USDT Token Group D maintains a balance of
2,899,226.09 USDT.
Exhibit E), AF’s funds were traced through seven hops before arriving at USDT Token Group D.
repeatedly located reports of additional fraud.
88. For example, an address starting with 0x30f9aaa5 was found to have interacted
with addresses where, two hops earlier, a victim reported depositing cryptocurrency into the
addresses as a victim of a Pig Butchering scam. The third address in the flow of funds in this
transaction, an address starting with 0x36fecee4, was also found to have interacted with a series
of addresses where, five hops prior, two victims reported having deposited cryptocurrency into
the addresses as victims of a Pig Butchering scam.
89. The fourth address in the flow of funds, which starts with 0xee2e6e49, was also
found to have interacted with addresses where five hops back, five victims reported having
deposited cryptocurrency into the addresses as the victims of Pig Butchering scams. And lastly,
33
the sixth address in the flow of funds, which starts with 0x909aae8f, was found to have
interacted with address where five hops back where 16 victims reported having deposited
cryptocurrency into the addresses as the victims of Pig Butchering scams.
90. Each of the aforementioned complaints was documented with the FBI through
IC3, or through the FTC’s Consumer Sentinel system. These 24 victims collectively reported
losses of approximately $1,676,062.87.
Date of
Victim 48 5/18/2022 Princeton Junction, NJ $100,000.00 Pig Butchering 0x5d047f63…
Victim 49 7/27/2022 Mequon, WI $700,000.00 Pig Butchering 0xF14B0229…
Victim 50 6/25/2022 Delran, NJ $105,000.00 Pig Butchering 0xF14B0229…
Victim 51 1/28/2022 Lakeland. FL $5,820.16 Pig Butchering 0xc4d2897c…
Victim 52 2/17/2022 South Weber, UT $312,000.00 Pig Butchering 0xc4d2897c…
Victim 53 2/21/2022 Davenport, FL $39,685.12 Pig Butchering 0xc4d2897c…
Victim 54 2/22/2022 Land O Lakes, FL $30,111.40 Pig Butchering 0xc4d2897c…
Victim 55 3/18/2022 Houston, TX $13,490.00 Likely Pig Butchering 0xc4d2897c…
Victim 56 1/10/2022 Stockton, CA $1,034.22 Likely Pig Butchering 0x0ce83eb7…
Victim 57 11/17/2021 Dighton, MA $8,736.90 Likely Pig Butchering 0x0ce83eb7…
Victim 58 11/23/2021 Downingtown, PA $32,000.00 Pig Butchering 0x0ce83eb7…
Victim 59 12/16/2021 Great Neck, NY $1,054.00 Likely Pig Butchering 0x0ce83eb7…
Victim 60 12/23/2021 Sacramento, CA $4,103.25 Pig Butchering 0x0ce83eb7…
Victim 61 12/25/2021 Skellefteå, Sweden $20,000.00 Pig Butchering 0x0ce83eb7…
Victim 62 1/8/2022 Fort Mill, SC $16,595.15 Pig Butchering 0x0ce83eb7…
Victim 63 1/26/2022 Alfred, ME $8,964.31 Pig Butchering 0x0ce83eb7…
Victim 64 1/30/2022 Yucca Valley, CA $491.11 Pig Butchering 0x0ce83eb7…
Victim 65 2/17/2022 Las Vegas, NV $2,374.41 Pig Butchering 0x0ce83eb7…
Victim 66 3/1/2022 Perry Hall, MD $6,987.24 Pig Butchering 0x0ce83eb7…
Victim 67 3/10/2022 Brunswick, MD $3,654.68 Likely Pig Butchering 0x0ce83eb7…
Victim 68 3/12/2022 Muharraq, Bahrain $3,567.00 Likely Pig Butchering 0x0ce83eb7…
Victim 69 3/14/2022 Endicott, NY $231,045.05 Pig Butchering 0x0ce83eb7…
Victim 70 3/29/2022 Pinellas Park, FL $18,096.00 Likely Pig Butchering 0x0ce83eb7…
Victim 71 6/13/2022 Cincinnati, OH $11,252.87 Pig Butchering 0x0ce83eb7…
Total $1,676,062.87
victims of similar fraud is a likely indication that the addresses involved, and therefor Subject
34
Address For example, an address starting with 0x6d29c2c3 was found to have interacted with
addresses where six hop earlier 10 victims reported having deposited cryptocurrency into the
addresses as the victims of Pig Butchering scams. The third address in the flow of funds in this
transaction, an address starting with 0x36fecee4, was also found to have interacted with a series
of addresses where, two to five hops prior, two victims reported having deposited cryptocurrency
into the addresses as the victims of a Pig Butchering scam.
92. The fourth and fifth addresses in the flow of funds, which start with 0xb046a68
and 0x2c4287d, respectively, were also found to have interacted with addresses where six to
seven hops back, eight victims reported having deposited cryptocurrency into the addresses as
the victims of Pig Butchering scams. Notably, these two addresses received funds tied to a
separate USSS investigation known as “RiotX”, for which a seizure warrant was previously
issued by this Court. See Exhibit A. Each of the aforementioned complaints was documented
with the FBI through IC3, or through the Federal Trade Commission’s Consumer Sentinel
system.
victims of similar fraud is a likely indication that the addresses involved, and therefor USDT
Token Group D, are used in the laundering of funds tied to Pig Butchering, among other types of
fraud and that the funds currently on deposit at USDT Token Group D are the proceeds of a
CONCLUSION
94. Based on information derived from the foregoing investigation, there is probable
cause to conclude that the Subject USDT tokens contain the proceeds of a wire fraud scheme
performed in violation of Title 18, United States Code, Section 1343. Those proceeds include
35
80,000 USDT from USDT Token Group A; 55,086 USDT from USDT Token Group B; 32,000
USDT; and 133,438 USDT from USDT Token Group D are subject to seizure and forfeiture
pursuant to Title 18, United States Code, Section 981(a)(1)(C), and Title 28, United States Code,
Section 2461(c). Moreover, in light of over ninety other victim reports connected to the four
Subject Addresses, there is probable cause to believe that the proceeds of other schemes, Pig
Butchering or otherwise, are also present in each of the Subject USDT tokens. Finally, there is
further probable cause to believe that a greater amount of funds constitute property involved in
money laundering transactions, to wit: the entire balance of USDT from Subject Addresses A, B,
C, and D. These funds are accordingly subject to forfeiture and seizure pursuant to Title 18,
United States Code, Sections 981(a)(1)(A) and 982(a)(1). Accordingly, I respectfully request that
a warrant be issued authorizing the seizure of the funds in the Subject USDT tokens with the
goal of returning these funds to the victims impacted by the various scams implicated in this
investigation.
95. I submit that a protective or restraining order issued pursuant to 21 U.S.C.
§ 853(e) would be insufficient to ensure the availability of the funds in the Subject USDT tokens
for forfeiture. Cryptocurrency can be transferred faster than traditional bank funds, and once
transferred, generally cannot be recalled to an original wallet. Moreover, there is a risk that the
funds may be moved to a location where no forfeiture or seizure would be possible, at which
point the funds could be further laundered into a “privacy” (i.e. untraceable) cryptocurrency.
Thus, I submit that a seizure warrant is the only means to reasonably assure the availability of the
funds in the Subject USDT tokens for forfeiture.
96. I declare under penalty of perjury that the foregoing is true and correct to the best
of my knowledge.
36
/s/ Alfonso Speed

__________________________
Alfonso Speed, Special Agent
United States Secret Service
30th
Subscribed and sworn to me via telephone this __________ day of November, 2022
__________________________________
HONORABLE ALEX G. TSE
United States Magistrate Judge
Northern District of California
37
Exhibit A
SEALED BY ORDER OF THE COURT Document 1 Filed 11/30/22 Page 40 of 89
Case 3:22-mj-71553-AGT
FILED
UNITED STATES DISTRICT COURT Jun 14 2022
for the Mark B. Busby
CLERK, U.S. DISTRICT COURT
Northern District
__________ NORTHERN DISTRICT OF CALIFORNIA
SAN FRANCISCO

Application by the United States for a Seizure ) Case No.3:22-mj-70788 LB
Warrant for One Account for Investigation of 18 )
U.S.C. Section 1343, and other offenses )

penalty of perjury that I have reason to believe that the following property in the Northern District of
California is subject to forfeiture to the United States of America under 18 U.S.C.§ 982(a)(1)
981(a)(1)(A) (describe the property):
See attached affidavit of Special Agent Kenneth Rayner
✔
’ Continued on the attached sheet.
Chris Kaltsas /s
Approved as to form: ________________________ Applicant’s signature
AUSA Chris Kaltsas
Kenneth Rayner, USSS Special Agent
13th
"Sworn to before me over the telephone and signed by me pursuant to Fed.R.Crim.P 4.1 and 4(d) on this ____
June
day of ________ , 2022”.
Date: 06/13/2022
Judge’s signature
City and state: San Francisco, CA Laurel Beeler, United States Magistrate Judge
I, Kenneth Rayner, a Special Agent with the United States Secret Service, being duly
sworn, depose and state as follows:
1. I am a Special Agent (“SA”) with the United States Secret Service (“USSS”) and
have been so employed since March 2016. The USSS is the primary investigative agency
charged with safeguarding the payment and financial systems of the United States. I am currently
assigned to the San Francisco Field Office as a member of the Cyber Fraud Task Force. In my
capacity as a Special Agent, I attended and completed the eighteen-week USSS Special Agent
Training Course at the James J. Rowley Training Center located in Beltsville, Maryland. This
program included comprehensive, formalized instruction in, among other things: fraud
investigations, counterfeit identification and detection, familiarization with United States’ fraud
and counterfeit laws, financial investigations and money laundering, identification and seizure of
assets, physical and electronic surveillance, and undercover operations.
2. During my time in federal law enforcement, I have participated in criminal
investigations. This casework has involved investigation into the unlawful takeover of financial
accounts, business email compromise schemes, network intrusions, counterfeit currency
investigations, and protective intelligence investigations.
1
4. This affidavit and the attached warrant are connected with a seizure warrant
application approved by this Court on June 2, 2022, which is attached hereto as Exhibit A. With
respect to the instant matter, I now write in support of an application for the issuance of a seizure
warrant for the funds located in one cryptocurrency account, to wit:
a. Up to 599,999.89 US Dollar Equivalent (“USDE”) in Cardano (“ADA”) held
in a Binance account identified by User ID: 74682844 referred to as “Subject
Account B” here and in Exhibit A.
there is probable cause to believe that Zin Ko OO (“OO”), Wing San TSE (“TSE”), and Shen
Chee KOK (“KOK”) have violated Title 18, United States Code, Section 1343 (Wire Fraud) and
laundered the proceeds of that activity in violation of Title 18, United States Code,
1956(a)(1)(B)(i) (Money Laundering). There is also probable cause to believe that Subject
Account B contains the proceeds of the wire fraud scheme described in Exhibit A and that those
proceeds have been laundered in an attempt to conceal the nature, source, ownership, and/or
control of the proceeds. Accordingly, those proceeds, totaling 599,999.89 USDE in ADA, are
subject to seizure and forfeiture pursuant to Title 18, United States Code, Section 981(a)(1)(C),
and Title 28, United States Code, Section 2461(c); and as funds involved in a money laundering
transaction, pursuant to Title 18, United States Code, Sections 981(a)(1)(A) and 982(a)(1).
up to 599,999.89 USDE in ADA held in Subject Account B.
2
CRIMINAL STATUTES
States code, Section 1961(1).
subject to forfeiture to the United States.” Specified unlawful activities are enumerated therein,
as well as at Title 18, United States Code, Sections 1956(c)(7) and 1961(1), which enumerates
Title 18, United States Code, Section 1343 as a specified unlawful activity. This section provides
both civil forfeiture authority and criminal forfeiture authority (by virtue of Title 28, United
States Code, Section 2461(c)).
3
seizure warrants.
4
Subject Account B will be withdrawn, moved, dissipated, or otherwise become unavailable for
forfeiture unless immediate steps are taken to secure them at the time the requested searches are
executed. I therefore submit that a protective order under 21 U.S.C. § 853(e) would not be
sufficient to assure that the assets in Subject Account B will remain available for forfeiture.
there is probable cause to believe that the assets in Subject Account B are subject to both civil
and criminal forfeiture as property involved in money laundering, all pursuant to Title 18, United
States Code, Sections 981(a)(1)(A), 981(a)(1)(C), and 982(a)(1); and Title 28, United States
Code, Section 2461(c), and therefore subject to civil and criminal seizure.
15. As noted in Exhibit A, this investigation was initiated from a fraud report received
by the USSS San Francisco Field Office from Victim 1, a financial advisor residing in Foster
City, California. On or about January 2, 2022, Victim 1 was introduced to an individual
portraying themselves as Amy WanQiu GU (“GU”), a cryptocurrency trader on an investment
platform called RiotX. GU claimed to have paid an analyst to conduct research on futures
investments and offered Victim 1 an opportunity to join the investment, promising substantial
gains. After investing over $300,000, and recruiting his/her family to invest over $1,500,000,
Victim 1 discovered that RiotX was a scam as it misrepresented investor returns and pilfered
5
investors’ funds. Victim 1 realized that the funds he/she had invested, which came from other
victims, were transferred to GU and their associates as part of a Pig Butchering scheme.
16. According to the Global Anti-Scam Organization, a nonprofit aiming to raise
awareness and provide tools to combat cybercrime, Pig Butchering originated in China in 2019.
The scheme often begins with a scammer sending a victim a seemingly misdialed text or
WhatsApp message. From there, the scammer establishes a more personal relationship with the
victim using manipulative tactics similar to those used in online romance scams.
scheme’s legitimacy and help reduce any skepticism the victim may have in the scam. The
fabricated evidence includes a fake investment platform via a website or mobile application that
displays fictious investment gains. In reality, the website or application has limited functionality
and does not provide the user any access to a cryptocurrency wallet. The scammers may also
provide fake transaction photos that create the impression that the suspects are contributing their
own funds to the victim’s initial investment. However, the investment gains displayed on the
investment platform website or mobile application are fabricated. In actuality, the investment
platform does not exist. The scammers will then refer to “butchering” or “slaughtering” the
victims once the victim assets are stolen by the criminals, ultimately causing the victims
financial and emotional ruin.
18. In this instance, the victim was contacted by GU, who portrayed themselves as an
experienced cryptocurrency investment trader. Based on my knowledge and experience
6
conducting cryptocurrency fraud investigations, I know that the criminal organizations often
operate in multiple tiers of responsibility. Most often, the individual that communicates directly
with the victim is on a lower tier of responsibility in the criminal organization, whereas
individuals receiving funds at the end of the scheme are those who profit the most and are
typically higher in the criminal organization’s hierarchy.
19. Based on my knowledge and experience in investigating cyber fraud schemes, GU
is most likely not the person they are portraying to the victim, and may be played by more than
one person. Photographs that GU provided to the victim depicting their appearance have been
known to be used by scammers in other schemes where the scammers go by other names.
20. Though originating in China, Pig Butchering schemes have been seen more
recently to originate in Southeast Asia, including in Hong Kong, Myanmar, Cambodia, Malaysia,
7
Thailand, and Singapore. This may be the result of China’s ban on cryptocurrency trading and
mining in 2021. In the case of the accounts involved in the fraud detailed in this affidavit, seven
of the ten Binance accounts that received victim funds were accessed from Hong Kong-based IP
addresses. The remaining three were accessed from Myanmar based-IP addresses.
21. The USSS’s investigation determined that the majority of the fraudulent transfers
were sent through a series of USDT wallet addresses before ultimately being deposited into
accounts at Binance. In response to a request for information, Binance provided account records
for ten users whose accounts were directly involved in the receipt of funds linked to the fraud
against the Victims. Based on my training and experience, as well as that of other agents and
witnesses, I know that criminally derived funds are often laundered through several addresses or
accounts before ultimately returning to criminal actors near or at the top of the criminal
organization’s hierarchy. These individuals are rarely the same individuals communicating with
victims, such as GU. The Binance accounts may also represent accounts used to launder the
proceeds of the criminal activity.
22. Among the evidence that these accounts are likely involved in laundering the
proceeds of the aforementioned Pig Butchering scheme are the Binance online access logs,
which list login sessions for each of the Binance accounts that received the Victim’s funds,
including Subject Account B (described in further detail in Exhibit A).
8
23. As illustrated above, four of the ten Binance accounts, including Subject Account
B, featured login activity from the same IP addresses. For many of the login sessions, the IP
addresses were captured accessing the Subject Accounts described in Exhibit A within days of
each other. The fact that these Binance accounts, which purportedly belong to different owners,
were at one point accessed by the same IP addresses and are also involved with the receipt of the
Victim’s funds indicates that the Binance accounts are being used to receive the proceeds of
fraud in connection with the aforementioned Pig Butchering scheme; proceeds of similar or
identical schemes against other victims; and to launder the proceeds of said frauds.
9
B. Laundering the Fraud Proceeds to the Subject Account B
accounts to Subject Account B, described in further detail in Exhibit A:
10
25. As illustrated above, between January 12, 2022 and January 20, 2022, the Victims
transferred approximately 308,269.73 USDT on the Ethereum blockchain to RiotX address 1,
one of the addresses to which victims of the scheme were directed to deposit cryptocurrency.
Between January 14, 2022 and January 20, 2022, RiotX address 1 transferred 308,269.73 USDT
to an address beginning with 0xd889c4. Between January 19, 2022 and January 21, 2022,
address 0xd889c4 transferred 540,000 USDT to an address beginning with 0x09bf08.
Blockchain analysis confirms that this 540,000 USDT contained the original 308,269.73 USDT
stolen directly from the Victims through the Pig Butchering scheme.
26. Continuing on January 21, 2022, address 0x09bf08 transferred 317,460 USDT to
an address beginning with 0x9ca372. On February 21, 2022, address 0x9ca372 transferred
282,511 USDT to an address beginning with 0x55ca00. On February 7, 2022, address 0x55ca00
transferred 590,000 USDT to an address beginning with 0xb40b43. Continuing on February 7,
2022, address 0xb40b43 transferred 590,000 USDT to an address beginning with 0x2d441d. On
February 11, 2022, address 0x2d441d transferred 1,000,000 USDT to an address beginning with
0x68fa6c, which this investigation has determined belongs to Subject Account B. Based on the
LIFO accounting principle (described in Exhibit A), approximately 282,511 USDT of the
balance can be traced back to the victims’ original transactions. I made this calculation by tracing
the Victims’ initial investment of 308,269.72 USDT through seven hops that culminated in the
transfer to Subject Account B at Binance. During the course of the seven hops, the amount
transferred was reduced to 282,511 USDT as proceeds were left behind in each address used in
the aforementioned hops.
11
exchange. The number of hops in this transaction is a strong indication that the movement of
funds was performed in a manner meant to conceal the nature, source, control, and/or ownership
of the proceeds of a specified unlawful activity, to wit, wire fraud.
28. On May 6, 2022, the USSS received information pertaining to Subject Account B,
including the balance of the account. Based on those records, I was able to determine that
Subject Account B had received a 1,000,000 USDT transfer on February 11, 2022 and
maintained a balance of 1,276,435.85 USDT as of May 6, 2022. Subject Account B was
determined to be in the name of Shen Chee KOK, a 34-year-old citizen of Singapore. The
account was established on February 5, 2021 and was found to have received nearly $102 million
dollars between February 23, 2021 and May 5, 2022.
C. Subject Account B
29. On June 3, 2022, a federal seizure warrant was executed against Subject Account
B, seeking to seize up to 1,000,000 USDT as described in Exhibit A. Leading up to this seizure,
the government understood that the USDT balance of Subject Account B was approximately
1,276,435.85 USDT as of May 5, 2022.
30. On June 7, 2022, the USSS was informed by Binance that the USDT balance for
Subject Account B was approximately 303,304.77 USDT, considerably less than the balance
previously believed to be in the account.
31. On June 9, 2022, Binance provided updated records for Subject Account B, which
detailed transaction activity that occurred between the initial records request and the execution of
12
the federal seizure warrant. Based on a review of the recently received records, Subject Account
B conducted the following cryptocurrency trades on Binance, utilizing USDT to purchase ADA:
a. 299,999.94 USDE ADA purchased on May 5, 2022 (excluded from May 6
records); and
b. 299,999.95 USDE ADA purchased on May 8, 2022.
32. The ADA purchases were made utilizing the USDT assets traced to the laundering
of funds associated with the RiotX scheme detailed in this affidavit.
33. As the purchase of ADA is another link in the chain of money laundering
described in Exhibit A, and is property traceable to the proceeds of a specified unlawful activity
described in Exhibit A, there is probable cause to forfeit (and accordingly seize) up to
599,999.89 USDE in ADA, which represents the difference between the USDT that was already
seized by the USSS, and the remaining funds that would make the total value of the previously
authorized seizure equivalent to what was authorized.
34. A restraining order would be insufficient to assure the availability of these funds
for forfeiture because of the difficulty in ensuring that cryptocurrency remains traceable. As
noted supra, cryptocurrency is pseudo-anonymous. Notwithstanding law enforcement’s ability to
trace it, cryptocurrencies may easily be exchanged for one another, and may be converted to
“privacy coins” (such as Monero, ZCash, or GRIN) that are virtually untraceable. Moreover,
because some cryptocurrency companies are no longer headquartered in a physical location,
there are instances in which they may release cryptocurrency notwithstanding the existence of a
restraining order. I accordingly request that the Court issue a warrant authorizing seizure of the
funds in the Subject Accounts.
13
CONCLUSION
cause to conclude that Subject Account B contains the proceeds of a wire fraud scheme
performed in violation of Title 18, United States Code, Section 1343, and funds constituting
property involved in money laundering transactions, to wit: up to 599,999,89 USDE in ADA.
These funds are accordingly subject to forfeiture and seizure pursuant to Title 18, United States
Code, Sections 981(a)(1)(A), 981(a)(1)(C), and 982(a)(1); and Title 28, United States Code,
Section 2461(c). Accordingly, I respectfully request that a warrant be issued authorizing the
seizure of the funds in the Subject Accounts.
of my knowledge.
/s
__________________________
Kenneth Rayner, Special Agent
13th
Subscribed and sworn to me via telephone this __________ day of June, 2022
__________________________________
HONORABLE LAUREL BEELER
14
Exhibit A
SEALED BY ORDER OF THE COURT Document 1 Filed 11/30/22 Page 56 of 89
Case 3:22-mj-71553-AGT FILED
Jun 02 2022
UNITED STATES DISTRICT COURTCLERK, Mark B. Busby

U.S. DISTRICT COURT
for the NORTHERN DISTRICT OF CALIFORNIA
Northern District
__________ SAN FRANCISCO

Application by the United States for a Seizure ) Case No. 3-22-mj-70746 LB
Warrant for Three Accounts for Investigation of 18 )
U.S.C. Section 1343, and other offenses )

penalty of perjury that I have reason to believe that the following property in the Northern District of
California is subject to forfeiture to the United States of America under 18 U.S.C.§ 982(a)(1)
981(a)(1)(A) (describe the property):
✔
’ Continued on the attached sheet.
Chris Kaltsas /s
Approved as to form: ________________________ Applicant’s signature
AUSA Chris Kaltsas
Kenneth Rayner, USSS Special Agent
2nd
"Sworn to before me over the telephone and signed by me pursuant to Fed.R.Crim.P 4.1 and 4(d) on this ____
day of ________
June , 2022”.
Date: 06/02/2022
Judge’s signature
City and state: San Francisco, CA Laurel Beeler, United States Magistrate Judge
I, Kenneth Rayner, a Special Agent with the United States Secret Service, being duly
sworn, depose and state as follows:
1. I am a Special Agent (“SA”) with the United States Secret Service (“USSS”) and
have been so employed since March 2016. The USSS is the primary investigative agency
charged with safeguarding the payment and financial systems of the United States. I am currently
assigned to the San Francisco Field Office as a member of the Cyber Fraud Task Force. In my
capacity as a Special Agent, I attended and completed the eighteen-week USSS Special Agent
Training Course at the James J. Rowley Training Center located in Beltsville, Maryland. This
program included comprehensive, formalized instruction in, among other things: fraud
investigations, counterfeit identification and detection, familiarization with United States’ fraud
and counterfeit laws, financial investigations and money laundering, identification and seizure of
assets, physical and electronic surveillance, and undercover operations.
2. During my time in federal law enforcement, I have participated in criminal
investigations. This casework has involved investigation into the unlawful takeover of financial
accounts, business email compromise schemes, network intrusions, counterfeit currency
investigations, and protective intelligence investigations.
1
4. This affidavit is submitted in support of an application for the issuance of a
seizure warrant for the funds located in three cryptocurrency accounts, to wit:
a. Up to 900,000 Tether (“USDT”) held in a Binance account identified by User
ID: 155847839, herein referred to as “Subject Account A”;
b. Up to 1,000,000 USDT held in a Binance account identified by User ID:
74682844, herein referred to as “Subject Account B”; and
c. Up to 163,127 Binance USD (“BUSD”) held in a Binance account identified
by User ID: 46265438, herein referred to as “Subject Account C”.
(collectively, “the Subject Accounts”).
there is probable cause to believe that Zin Ko OO (“OO”), Wing San TSE (“TSE”), and Shen
Chee KOK (“KOK”) have violated Title 18, United States Code, Section 1343 (Wire Fraud) and
laundered the proceeds of that activity in violation of Title 18, United States Code,
1956(a)(1)(B)(i) (Money Laundering). There is also probable cause to believe that the Subject
Accounts contain the proceeds of the wire fraud scheme described below. Accordingly, those
proceeds, totaling 449,650.55 USDT from Subject Account A; 308,269.73 USDT from Subject
Account B; and 49,145.22 BUSD are subject to seizure and forfeiture pursuant to Title 18,
United States Code, Section 981(a)(1)(C), and Title 28, United States Code, Section 2461(c).
There is further probable cause to seize up to 900,000 USDT from Subject Account A; up to
1,000,000 USDT from Subject Account B; and up to 163,127 BUSD from Subject Account C as
funds involved in a money laundering transaction, pursuant to Title 18, United States Code,
Sections 981(a)(1)(A) and 982(a)(1).
2
the assets described herein.
CRIMINAL STATUTES
States code, Section 1961(1).
subject to forfeiture to the United States.” Specified unlawful activities are enumerated therein,
as well as at Title 18, United States Code, Sections 1956(c)(7) and 1961(1), which enumerates
Title 18, United States Code, Section 1343 as a specified unlawful activity. This section provides
3
both civil forfeiture authority and criminal forfeiture authority (by virtue of Title 28, United
States Code, Section 2461(c)).
seizure warrants.
4
the Subject Account will be withdrawn, moved, dissipated, or otherwise become unavailable for
forfeiture unless immediate steps are taken to secure them at the time the requested searches are
executed. I therefore submit that a protective order under 21 U.S.C. § 853(e) would not be
sufficient to assure that the assets in the Subject Accounts will remain available for forfeiture.
there is probable cause to believe that the Subject Accounts are subject to both civil and criminal
forfeiture as property involved in money laundering, all pursuant to Title 18, United States Code,
Sections 981(a)(1)(A), 981(a)(1)(C), and 982(a)(1); and Title 28, United States Code, Section
2461(c), and therefore subject to civil and criminal seizure.
BACKGROUND ON CRYPTOCURRENCY AND VIRTUAL CURRENCY

EXCHANGES
15. Virtual currencies are digital tokens of value circulated over the Internet as
substitutes for traditional fiat currency. Virtual currencies are not issued by any government or
bank like traditional fiat currencies such as the U.S. dollar but are generated and controlled
through computer software. Bitcoin is currently the most well-known virtual currency in use.
5
16. Virtual currency addresses are the particular virtual locations to which such
currencies are sent and received. A virtual currency address is analogous to a bank account
number and is represented as a string of alphanumeric characters.
17. Each virtual currency address is controlled through the use of a unique
corresponding private key, a cryptographic equivalent of a password needed to access the
address. Only the holder of an address’s private key can authorize a transfer of virtual currency
from that address to another address.
18. A virtual currency wallet is a software application that interfaces with the virtual
currency’s specific blockchain and generates and stores a user’s addresses and private keys. A
virtual currency wallet also allows users to send and receive virtual currencies. Multiple
addresses can be stored in a wallet.
19. Many virtual currencies publicly record all of their transactions on what was a
“blockchain.” The blockchain is essentially a distributed public ledger, run by a decentralized
network, containing an immutable and historical record of every transaction utilizing that
blockchain’s technology. The blockchain can be updated multiple times per hour and record
every virtual currency address that ever received that virtual currency. It also maintains records
of every transaction and all the known balances for each virtual currency address. There are
different blockchains for different types of virtual currencies.
20. USDT is a blockchain-based cryptocurrency whose tokens in circulation are
backed by an equivalent amount of U.S. dollars, making it what is known as a “stablecoin.”
USDT is issued by Tether Ltd., a company headquartered in Hong Kong. Tether is a subsidiary
of Bitfinex, a cryptocurrency exchange registered in the British Virgin Islands.
6
21. USDT is hosted on the Ethereum and Bitcoin blockchains, among others.
Ethereum (“ETH”) is a cryptocurrency that is open source, public, has a blockchain, and is
distributed on a platform that uses “smart contract” technology. The public ledger is the digital
trail of the Ethereum blockchain, which allows anyone to track the movement of ETH.
22. Smart contracts allow developers to create markets, store registries of debts, and
move funds in accordance with the instructions provided without any type of middle-man or
counterparty controlling a desired or politically motivated outcome, all while using the Ethereum
blockchain protocol to maintain transparency. Smart contract technology is one of Ethereum’s
distinguishing characteristics and an important tool for companies or individuals executing trades
on the Ethereum blockchain. When engaged, smart contracts automatically execute according to
the terms of the contract written into lines of code. A transaction contemplated by a smart
contract occurs on the Ethereum blockchain and is both trackable and irreversible.
23. Like other virtual currencies, USDT is sent to and received from USDT
“addresses.” A USDT address is somewhat analogous to a bank account number, and is
represented as a 26-to 35-character-long case-sensitive string of letters and numbers. Users can
operate multiple USDT addresses at any given time, with the possibility of using a unique USDT
address for every transaction.
24. Although the identity of a USDT address owner is generally anonymous (unless
the owner opts to make the information publicly available), analysis of the blockchain can often
be used to identify the owner of a particular USDT address. The analysis can also, in some
instances, reveal additional addresses controlled by the same individual or entity.
25. “BUSD” is another stablecoin. Like Tether, it is backed by an equivalent amount
of U.S. dollars to maintain a 1:1 ration between USD and BUSD. BUSD, also known as Binance
7
USD, is issued by Paxos Trust Company, a company headquartered in New York, NY. BUSD is
the result of a partnership between Paxos Trust Company and Binance.
26. BUSD is hosted on the Ethereum network and its characteristics are very similar
to USDT, including the use of a blockchain.
27. This investigation was initiated from a fraud report received by the USSS San
Francisco Field Office from Victim 1, a financial advisor residing in Foster City, California. On
or about January 2, 2022, Victim 1 was introduced to an individual portraying herself as Amy
WanQiu GU (“GU”), a cryptocurrency trader on an investment platform called RiotX. GU
claimed to have paid an analyst to conduct research on futures investments and offered Victim 1
an opportunity to join the investment, promising substantial gains. After investing over
$300,000, and recruiting his/her family to invest over $1,500,000, Victim 1 discovered that
RiotX was a scam as it misrepresented investor returns and pilfered investors’ funds. Review of
the blockchain and available records indicates that individuals conspiring with GU subsequently
laundered the proceeds of the scheme through over a dozen cryptocurrency addresses. Moreover,
in connection with this investigation, Binance investigators advised USSS agents that the Subject
Accounts displayed behavior indicative of attempts to avoid Binance’s money laundering
detection systems.
28. Based on this information, along with all the evidence gathered to date in this
investigation and my training and experience, I submit that there is probable cause to believe
that the Subject Accounts are subject to seizure and forfeiture.
A. Wire Fraud Scheme
8
29. On or about January 2, 2022, Victim 1 received a message on WhatsApp, a
messaging application, from phone number +95-9782622131 that appeared to be a misrouted
message to a recipient other than Victim 1. Despite being the unintended recipient, Victim 1 and
GU engaged in frequent conversation thereafter. Victim 1 and GU discussed personal
information, such as their respective marital statuses and children. Their relationship eventually
became personal in nature.
30. On or around January 10, 2022, GU spoke to Victim 1 about an investment
platform known as “RiotX.” GU claimed that RiotX offered her substantial returns on investing
in cryptocurrency futures contracts, and encouraged Victim 1 to participate and invest with her
on the platform.
31. The RiotX trading platform could be found at riotx.cc. A review of riotx.cc on
May 9, 2022 revealed a well-constructed webpage with high-quality graphics and artwork
advertising multiple investment options and price tickers, which is consistent with legitimate
investment and trading platforms.
9
32. Notwithstanding the compelling appearance of the RiotX website at first glance,
law enforcement officers attempted to conduct a deeper review of the riotx.cc website. That
review revealed that most icons and links featured on the webpage were inoperable via a desktop
computer. The webpage was essentially a single page without functioning links. The website also
featured several instances of improper terminology and grammatical errors, such as words
lacking proper capitalization or structure. This is a possible indication that the creators are not
native English speakers and/or are based outside the country.
33. A reverse image search performed on open-source systems revealed that the
graphics, artwork, and investment verbiage found on the RiotX website were found on
approximately 24 other websites with identical layouts, but utilizing different names such as
www.coinbasebit[.]com, www.buxzero[.]org, www.coinlistex[.]com and www.coinmog[.]net,
among others. Further investigation revealed that the websites all appear to use the same
template, which was located for sale on a website, ritheme[.]com, which appears to sell website
templates. Nearly all of the identical pages were hosted on San Francisco-based CloudFlare, a
web hosting company. Further analysis of riotx.cc, as well as the other identical pages, revealed
that one of the only functioning links on the website redirects the visitor to a mobile-based
webpage that impersonates the Android and Apple App Store. When visited, the mobile-based
site attempts to change the mobile phone’s configurations to allow the installation of an un-
approved application, which would effectively result in the installation of a fraudulent phone app
to simulate the investments and earnings into the RiotX Platform.
34. On or about January 12, 2022, Victim 1 made his initial investment into RiotX, a
transfer of 2,890.53 USDT from Victim 1’s Crypto.com account to USDT address
0x7872783b1d180cf5554a2d9c0dc437a11dd0af32 (“RiotX address 1”).
10
35. Following the initial investment, Victim 1 was able to view his fictitious
“earnings” on his initial investment on the RiotX app, which amounted to 17.50% in gains
against the investment. Those purported gains, which saw his 2,890.53 USDT investment
quickly increase to 3,396.37 USDT, induced Victim 1 to begin making several additional
investments. On January 14, 2022, Victim 1 transferred 98,201.73 USDT to RiotX address 1.
Victim 1 made another transfer to RiotX address 1 totaling 207,177.47 USDT on January 20,
2022.
36. Beginning on or around January 25, 2022, Victim 1 began offering the RiotX
investment platform to his relatives, including his siblings, mother, and father, among others. In
total, Victim 1 convinced fifteen family members to invest into RiotX, unaware of its fraudulent
nature. Many of these investments were initially withdrawn from 529 plans that were originally
designated as savings accounts for higher education expenses. Each of the victims, listed below,
transfers substantial sums of USDT into RiotX addresses 1 and 2:
a. Victims 1 and 2 jointly invested approximately $392,779.82;
b. Victim 3 invested approximately $4,895.14;
c. Victim 4 invested approximately $5,435.09;
d. Victims 5 and 6 jointly invested approximately $1,044,756.97;
e. Victim 7 invested approximately $376,748.36;
f. Victim 8 invested approximately $24,085.84;
g. Victim 9 invested approximately $56,468.74;
h. Victim 11 invested approximately $12,210.84;
i. Victim 12 invested approximately $5,434.00;
j. Victim 13 invested approximately $73,402.07;
11
k. Victim 14 invested approximately $6,859.20; and
l. Victim 15 invested approximately $2,448.67.
37. On or around February 16, 2022, GU advised Victim 1 that future investments
should be sent to USDT address 0x2565088f7794dbef65c45be808d7a04c64f69450 (“RiotX
address 2”).
38. The scam continued into April 2022, but was uncovered when Victim 1 attempted
to conduct a withdrawal and was told he would have to pay fees in excess of $300,000 to
withdraw the USDT he had invested into RiotX. This prompted Victim 1 to perform research on
RiotX, which lead to Victim 1 discovering numerous reports detailing the RiotX fraud scheme.
39. Between January 12, 2022 and March 25, 2022, Victim 1 and the investors he
recruited (collectively, “the Victims”) conducted 32 investment transactions totaling
$2,005,524.73 from accounts at Crypto.com, Binance, and Coinbase. The 32 transfers were all
sent to address RiotX Addresses 1 and 2, as follows:
Date Sending Address Receiving Address Amount Asset

1/12/2022 Crypto.com RiotX address 1 $2,890.53 USDT
1/20/2022 Coinbase RiotX address 1 $207,177.47 USDT
2/7/2022 Coinbase RiotX address 1 $976.34 USDT
12

3/24/2022 Binance RiotX address 2 $34.03 USDT
3/24/2022 Binance RiotX address 2 $349,987.29 USDT
3/24/2022 Binance RiotX address 2 $26,637.08 USDT
Total $2,005,524.73 USDT
40. The RiotX scam detailed in this affidavit is consistent with an emerging fraud
trend coined “Pig Butchering.” According to the Global Anti-Scam Organization, a nonprofit
aiming to raise awareness and provide tools to combat cybercrime, Pig Butchering originated in
China in 2019. The scheme often begins with a scammer sending a victim a seemingly misdialed
text or WhatsApp message. From there, the scammer establishes a more personal relationship
with the victim using manipulative tactics similar to those used in online romance scams.
scheme’s legitimacy and help reduce any skepticism the victim may have in the scam. The
fabricated evidence includes a fake investment platform via a website or mobile application that
displays fictious investment gains. In reality, the website or application has limited functionality
and does not provide the user any access to a cryptocurrency wallet. The scammers may also
13
provide fake transaction photos that create the impression that the suspects are contributing their
own funds to the victim’s initial investment. However, the investment gains displayed on the
investment platform website or mobile application are fabricated. In actuality, the investment
platform does not exist. The scammers will then refer to “butchering” or “slaughtering” the
victims once the victim assets are stolen by the criminals, ultimately causing the victims
financial and emotional ruin.
42. In this particular instance, the victim was contacted by GU, who portrayed herself
as an experienced cryptocurrency investment trader. Based on my knowledge and experience
conducting cryptocurrency fraud investigations, I know that the criminal organizations often
operate in multiple tiers of responsibility. Most often, the individual that communicates directly
with the victim is on a lower tier of responsibility in the criminal organization, whereas
individuals receiving funds at the end of the scheme are those who profit the most and are
typically higher in the criminal organization’s hierarchy.
43. Based on my knowledge and experience in investigating cyber fraud schemes, GU
is most likely not the person they are portraying to the victim, and may be played by more than
one person. Photographs that GU provided to the victim depicting her appearance have been
known to be used by scammers in other schemes where the scammers go by other names.
14
44. Though originating in China, Pig Butchering schemes have been seen more
recently to originate in Southeast Asia, including in Hong Kong, Myanmar, Cambodia, Malaysia,
Thailand, and Singapore. This may be the result of China’s ban on cryptocurrency trading and
mining in 2021. In the case of the accounts involved in the fraud detailed in this affidavit, seven
of the ten Binance accounts that received victim funds were accessed from Hong Kong-based IP
addresses. The remaining three were accessed from Myanmar based-IP addresses.
45. The USSS’s investigation determined that the majority of the fraudulent transfers
were sent through a series of USDT wallet addresses before ultimately being deposited into
accounts at Binance. In response to a request for information, Binance provided account records
for ten users whose accounts were directly involved in the receipt of funds linked to the fraud
against the Victims. Based on my training and experience, as well as that of other agents and
15
witnesses, I know that criminally derived funds are often laundered through several addresses or
accounts before ultimately returning to criminal actors near or at the top of the criminal
organization’s hierarchy. These individuals are rarely the same individuals communicating with
victims, such as GU. The Binance accounts may also represent accounts used to launder the
proceeds of the criminal activity.
46. Among the evidence that these accounts are likely involved in laundering the
proceeds of the aforementioned Pig Butchering scheme are the Binance online access logs,
which list login sessions for each of the Binance accounts that received the Victim’s funds,
including the Subject Accounts.
47. As illustrated above, four of the ten Binance accounts, including Subject
Accounts B and C, featured login activity from the same IP addresses. For many of the login
sessions, the IP addresses were captured accessing the different Subject Accounts within days of
each other. The fact that these four Binance accounts, which purportedly belong to different
owners, were at one point accessed by the same IP addresses and are also involved with the
16
receipt of the Victim’s funds indicates that the Binance accounts are being used to receive the
proceeds of fraud in connection with the aforementioned Pig Butchering scheme; proceeds of
similar or identical schemes against other victims; and to launder the proceeds of said frauds.
B. Laundering the Fraud Proceeds to the Subject Accounts
accounts to Subject Account A. “USDT” refers to Tether, which is a virtual currency whose
value is tied to the U.S. Dollar at a ratio of approximately 1:1. Each block of text along the
arrows depicted below indicates a deposit into an address, whereas the arrows represent “hops”
between addresses. “Hops” are transfers from one USDT address to another.
17
49. As illustrated above, between March 22, 2022 and March 25, 2022, the Victims
(either on their own or with the assistance of Victim 1) transferred approximately 449,650.55
USDT on the Ethereum blockchain to RiotX address 2. Between March 23, 2022 and March 24,
2022, RiotX address 2 transferred 445,752.31 USDT to a USDT address beginning with
18
0xd889c4. On March 24, 2022, address 0xd889c4 transferred 400,000 USDT to an address
beginning with 0x62fa4c. On March 25, 2022, address 0x62fa4c transferred a cumulative
amount of 418,455 USDT to an address beginning with 0xab8ab2.
50. Continuing on March 25, 2022, address 0xab8ab2 transferred 500,000 USDT to
an address beginning with 0xfc3bf2. Between March 25, 2022 and March 26, 2022, address
0xfc3bf2 transferred a cumulative amount of 900,000 USDT to an address beginning with
0x0099f5, which is Subject Account A at Binance. Based on the last in-first out (“LIFO”)
accounting principle, which assumes that the last, or most recent, incoming assets are the first
expended or sent out, the undersigned calculated that approximately 400,000 USDT of the
balance could be traced back to the victims’ original transactions. I reached this calculation by
tracing the Victim’s initial investment of 449,650.55 USDT through four hops that culminated in
the transfer to Binance. During the course of the four hops, the amount transferred was reduced
to 400,000 USDT. The amount was reduced because, with each hop, a small amount of USDT
was left in each USDT address between the initial, receiving address and the final address to
which the USDT was traceable.
gotten funds to ultimately conceal or disguise the nature, location, source, ownership, or control
of those proceeds when transferred into a cryptocurrency exchange. The number of hops in this
transaction is a strong indication that the movement of funds was performed in a manner meant
to conceal or disguise the nature, location, source, ownership, or control of the proceeds of a
19
52. On May 6, 2022, the USSS received information pertaining to Subject Account A
from Binance, including the account balances. Based on those records, I was able to determine
that Subject Account A had received a total of 900,000 USDT on March 25, 2022 and March 26,
2022, and maintained a balance of 200,053.09 USDT as of May 6, 2022. Subject Account A was
determined to be in the name of Zin Ko OO, a 30 year-old citizen of Myanmar. The account was
established on May 13, 2021 and was found to have received nearly $16 million worth of USDT
between May 13, 2021 and March 30, 2022.
20
accounts to Subject Account B:
21
54. As illustrated above, between January 12, 2022 and January 20, 2022, the Victims
transferred approximately 308,269.73 USDT on the Ethereum blockchain to RiotX address 1.
Between January 14, 2022 and January 20, 2022, RiotX address 1 transferred 308,269.73 USDT
to an address beginning with 0xd889c4. Between January 19, 2022 and January 21, 2022,
address 0xd889c4 transferred 540,000 USDT to an address beginning with 0x09bf08.
Blockchain analysis confirms that this 540,000 USDT contained the original 308,269.73 USDT
stolen directly from the Victims through the Pig Butchering scheme.
55. Continuing on January 21, 2022, address 0x09bf08 transferred 317,460 USDT to
an address beginning with 0x9ca372. On February 21, 2022, address 0x9ca372 transferred
282,511 USDT to an address beginning with 0x55ca00. On February 7, 2022, address 0x55ca00
transferred 590,000 USDT to an address beginning with 0xb40b43. Continuing on February 7,
2022, address 0xb40b43 transferred 590,000 USDT to an address beginning with 0x2d441d. On
February 11, 2022, address 0x2d441d transferred 1,000,000 USDT to an address beginning with
0x68fa6c, which this investigation has determined belongs to Subject Account B at Binance.
Based on LIFO accounting principle, approximately 282,511 USDT of the balance can be traced
back to the victims’ original transactions. I made this calculation by tracing the Victims’ initial
investment of 308,269.72 USDT through seven hops that culminated in the transfer to Subject
Account B at Binance. During the course of the seven hops, the amount transferred was reduced
exchange. The number of hops in this transaction is a strong indication that the movement of
22
funds was performed in a manner meant to conceal the nature, source, control, and/or ownership
of the proceeds of a specified unlawful activity, to wit, wire fraud.
57. On May 6, 2022, the USSS received information pertaining to Subject Account B
from Binance, including the balance of the account. Based on those records, I was able to
determine that Subject Account B had received a 1,000,000 USDT transfer on February 11, 2022
and maintained a balance of 1,276,435.85 USDT as of May 6, 2022. Subject Account B was
determined to be in the name of Shen Chee KOK, a 34-year-old citizen of Singapore. The
account was established on February 5, 2021 and was found to have received nearly $102 million
dollars between February 23, 2021 and May 5, 2022.
accounts to Subject Account C:
23
59. As illustrated above, on March 13, 2022, the Victims transferred approximately
49,145.22 USDT on the Ethereum blockchain to RiotX address 2. On March 14, 2022, RiotX
address 2 transferred 42,286.02 USDT to an address beginning with 0xd889c4. On March 15,
24
2022, address 0xd889c4 transferred 350,000 USDT to an address beginning with 0xcdf1c6.
Blockchain analysis confirms that this 350,000 USDT contained approximately 42,286.02 USDT
of the original 49,145.22 USDT stolen directly from the Victims through the Pig Butchering
scheme. Continuing on March 15, 2022, address 0xcdf1c6 transferred 1,700,000 USDT to an
address beginning with 0x0b2892.
60. On March 16, 2022, address 0x0b2892 transferred 1,000,000 USDT to an address
beginning with 0xbf4acc. On March 28, 2022, address 0xbf4acc transferred 163,217 USDT to an
address beginning with 0xcceb28. Continuing on March 28, 2022, address 0xcceb28 transferred
163,217 USDT to an address beginning with 0x3e55c1. Finally, on March 28, 2022, address
0x3e55c1 transferred 163,127 USDT to an address beginning with 0x70fc0e, which this
investigation has determined belongs to Subject Account C at Binance.
61. On March 28, 2022, following the receipt of the Victims’ funds, the account
utilized Victim’s funds, to purchase BUSD.
62. Based on my training and experience, I know that criminals will often convert
cryptocurrency assets to conceal or disguise the nature, location, source, ownership, or control of
those assets when they constitute the proceeds of specified unlawful activity, in violation of Title
18, United States Code, Section 1956.
63. On May 6, 2022, the USSS received information pertaining to Subject Account C
from Binance, including the account balances. Based on those records, I was able to determine
that Subject Account C had received 163,127 USDT, which included USDT from the victims in
this case, and later purchased BUSD utilizing the same funds. The BUSD purchase was
comprised of additional funds received on the same day, all from a single USDT address. This
address was observed on the blockchain to have received funds in the same “multi-hop” fashion
25
outlined above, and a cursory review of the initial addresses revealed the existence of complaints
on the FBI’s internet crime complaint center (IC3) alleging other pig butchering scams, among
others, relating to addresses that made deposits to Subject Account C. As of May 6, 2022,
Subject Account C maintained a balance of 399,991 BUSD. Subject Account C was determined
to be in the name of Wing San TSE, a 33-year-old resident of Hong Kong. The account was
established on May 26, 2021 and was found to have received nearly $1.6 billion dollars between
June 9, 2021 and April 23, 2022.
C. Analysis of The Subject Accounts
64. During the course of the funds tracing and analysis, the USSS discovered that the
Subject Accounts all appeared to receive funds from the same USDT wallet address utilized by
GU and others near the beginning of the fraud. This address, beginning with 0xd889c4 and
described above beginning at paragraph 49, is herein referred to as the “Level 1” wallet address.
Level 1 wallet addresses are the “second hop” from the placement of illicit or stolen funds on a
blockchain. In contrast, Level 0 wallet addresses are the addresses that receive the initial
transaction sent from the victims directly to the scammers in Pig Butchering scheme.
65. Further analysis of the Level 1 wallet address revealed 753 transactions between
November 28, 2021 to May 24, 2022. Of these transactions, 665 were receiving (or inbound)
transactions, including 21 from Victim 1. The remaining inbound transactions were reviewed and
found to be identical with the Level 0 to Level 1 money movement described above for Victim 1.
84% of the inbound transactions had two hops from the wallets at Crypto.com or Coinbase to the
suspect controlled Level 1 wallet address, indicating a high likelihood that the transfers were
involved in a similar fraud scheme, indicating that the 665 incoming transactions are likely also
linked, or are at least similar to, the RiotX fraud scheme.
26
66. On May 24, 2022, I interviewed six individuals identified as having sent USDT to
the Level 0 wallet addresses, which were then transferred to the Level 1 wallet address. In every
instance, the individuals reported being a victim of the RiotX fraud scheme. Every one of them
were defrauded by the same website, www.riotx.cc, and several reported receiving photos
portraying the same individual as GU, using different aliases.
67. In addition, each victim reported being instructed to establish cryptocurrency
accounts at U.S.-based exchanges Coinbase and Cypto.com. Based on my training and
experience, I know this is a common instruction provided to victims in Pig Butchering scams.
68. The additional victims provided wallet address information identifying where
they sent their funds, otherwise known as the Level 0 wallet address. A financial analyst with the
USSS’s San Francisco Field Office traced these transfers and found that they too were being sent
directly to the Level 1 address, as illustrated below:
69. In addition, an analysis of the 665 incoming transfers to the Level 1 address
revealed that the majority of those transfers, to wit, 84%, originated at Crypto.com and/or
Coinbase. Through interviews with various victims of the RiotX scheme, as well as other Pig
Butchering schemes, I know that suspects actively recommend that victims establish
cryptocurrency accounts specifically at Coinbase and Crypto.com indicating a high likelihood
the remaining transactions are tied to the RiotX scheme.
70. Based on my training and experience, as well as that of other agents and
witnesses, the movement of funds tied to the same fraud scheme, as outlined above, is indicative
27
of attempts to launder illicit funds. In this instance, the Subject Accounts were all used to receive
funds derived from the RiotX scheme with several levels of transactions between the victim and
the Subject Accounts, which appear to lack any ostensible business purpose. Indeed, the sheer
number of hops and magnitude of unnecessary transfers establishes probable cause to believe
that the transfers were meant to obscure the control, ownership, source, and purpose of the funds
involved in said transfers. This is further validated with statements made by Binance
investigators, who advised USSS agents that the Subject Accounts displayed behavior indicative
of attempts to avoid Binance’s money laundering detection systems.
71. A restraining order would be insufficient to assure the availability of these funds
for forfeiture because of the difficulty in ensuring that cryptocurrency remains traceable. As
noted supra, cryptocurrency is pseudo-anonymous. Notwithstanding law enforcement’s ability to
trace it, cryptocurrencies may easily be exchanged for one another, and may be converted to
“privacy coins” (such as Monero, ZCash, or GRIN) that are virtually untraceable. Moreover,
because some cryptocurrency companies are no longer headquartered in a physical location,
there are instances in which they may release cryptocurrency notwithstanding the existence of a
restraining order. I accordingly request that the Court issue a warrant authorizing seizure of the
funds in the Subject Accounts.
CONCLUSION
cause to conclude that the Subject Accounts contain the proceeds of a wire fraud scheme
performed in violation of Title 18, United States Code, Section 1343. Those proceeds include
449,650.55 USDT from Subject Account A; 308,269.73 USDT from Subject Account B; and
49,145.22 BUSD are subject to seizure and forfeiture pursuant to Title 18, United States Code,
28
Section 981(a)(1)(C), and Title 28, United States Code, Section 2461(c). There is further
probable cause to believe that a greater amount of funds constitute property involved in money
laundering transactions, to wit: up to 900,000 USDT from Subject Account A; up to 1,000,000
USDT from Subject Account B; and up to 163,127 BUSD from Subject Account C. These funds
are accordingly subject to forfeiture and seizure pursuant to Title 18, United States Code,
Sections 981(a)(1)(A) and 982(a)(1). Accordingly, I respectfully request that a warrant be issued
authorizing the seizure of the funds in the Subject Accounts.
of my knowledge.
/s
__________________________
Kenneth Rayner, Special Agent
2nd
Subscribed and sworn to me via telephone this __________ day of June, 2022
__________________________________
HONORABLE LAUREL BEELER
29
Exhibit B
Exhibit C
Exhibit D
Exhibit E

Application and Affidavit

Uploaded by

Copyright:

Available Formats

You might also like

Application and Affidavit

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Application and Affidavit

Uploaded by

Copyright:

Available Formats

Case 3:22-mj-71553-AGT Document 1 Filed 11/30/22 Page 1 of 89

APPLICATION FOR A WARRANT

The application is based on these facts:

Continued on the attached sheet.

Printed name and title

City and state:

depose and state as follows:

INTRODUCTION AND PURPOSE OF AFFIDAVIT

1. I am a Special Agent with the Department of Homeland Security, United States

Rowley Training Center located in Beltsville, Maryland. These programs included

involved in these types of crimes.

developed an understanding of the motives and methods of operation of subjects involved in

teaching/discussing the following topics: mobile wireless investigations and cryptocurrency

the date specified. All amounts are approximate.

4. This affidavit is submitted in support of an application for the issuance of a

a. All Tether (“USDT”) held in a wallet address identified by

0x6c3ce666a5b030e82d08881216d4aac582604f3f, herein referred to as

“USDT Token Group A”;

b. All USDT held in a wallet address identified by

0xb7a62b9729034fecfcab7ee4256a4ba983eecf7b, herein referred to as

“USDT Token Group B”;

c. All USDT held in a wallet address identified by

0x50c85e5587d5611cf5cdfba23640bc18b3571665, herein referred to as

“USDT Token Group C”; and

d. All USDT held in a wallet address identified by

0xe0fe2b4c9f7d58a05b4a16b71ef8afb42557aef2, herein referred to as “USDT

Token Group D”.

(collectively, “the Subject USDT Tokens”).

United States Code, Sections 981(a)(1)(A) and 982(a)(1).

the assets described herein.

to carry out or attempt to carry out an essential part of the scheme.

States Code, Section 1961(1).

SEIZURE AND FORFEITURE STATUES

Code, Section 2461(c).

forfeiture of any property, real or personal, that is involved in a transaction or attempted

Subject USDT tokens will remain available for forfeiture.

subject to civil and criminal seizure.

BACKGROUND ON CRYPTOCURRENCY AND VIRTUAL CURRENCY

number and is represented as a string of alphanumeric characters.

corresponding private key, a cryptographic equivalent of a password needed to access the

from that address to another address.

addresses can be stored in a wallet.

as a “blockchain.” The blockchain is essentially a distributed public ledger, run by a

decentralized network, containing an immutable and historical record of every transaction

21. Tether, widely known as “USDT,” is a blockchain-based cryptocurrency whose

known as a “stablecoin.” USDT is issued by Tether Ltd., a company headquartered in Hong

of middleman or counterparty controlling a desired or politically motivated outcome, all while

one of Ethereum’s distinguishing characteristics and an important tool for companies or

trackable and irreversible.

“addresses.” A USDT address is somewhat analogous to a bank account number, and is

address for every transaction.

instances, reveal additional addresses controlled by the same individual or entity.

cryptocurrencies are “decentralized” and have no such governing body.

FACTS SUPPORTING PROBABLE CAUSE

confidence scam, that convinces victims to invest in non-existent cryptocurrency trading

teacher”, as explained in further detail below.

the Subject USDT tokens are subject to seizure and forfeiture.

A. Wire Fraud Scheme

29. On or about May 29, 2022, AF connected with an individual identifying