UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA,

Plaintiff,

v. Civil Action No. 20-606 (TJK) 113 VIRTUAL CURRENCY ACCOUNTS et al.,

Defendants.

MEMORANDUM OPINION

The United States seeks the forfeiture of 145 virtual currency accounts containing funds

linked to alleged hacks of virtual currency exchanges by North Korean operatives. It alleges that,

following those hacks, these accounts were each involved in a conspiracy to engage in three types

of money laundering—concealment, promotion or international promotion money laundering—or

are otherwise traceable to such property. For the reasons explained below, the Court will grant the

United States’ motion for default judgment and order forfeiture of these virtual currency accounts,

referred to as the Defendant Properties. 1

Background

A. Virtual Currency

Bitcoin, Ether, and other so-called “cryptocurrencies” are types of virtual currency used in

online transactions. ECF No. 24 (“Sec. Am. Compl.”) ¶ 7. To send and receive funds, customers

use unique addresses that function like email addresses: one user may have many and may even

use a different one for each transaction. Id. ¶ 8. A customer must have a password, called a

1 The United States has dismissed Defendant Property 146 from this action. ECF No. 35. “private key,” to transfer funds held at an address. Id. ¶ 9. Customers often conduct transactions

on virtual currency exchanges, which are platforms offering trading between the U.S. dollar,

foreign currencies, and virtual currencies. Id. ¶ 11. Exchanges also commonly offer virtual

currency storage services to customers. Id.

Although transactions are recorded on a public ledger called a “blockchain,” the transacting

parties are usually anonymous because each transaction is labeled with a complex series of

numbers and letters, rather than individuals’ names or other identifying information. Sec. Am.

Compl. ¶ 7. Law enforcement can, however, identify the parties through analysis of the

blockchain. Id. ¶¶ 7, 12. Specifically, investigators create large databases that group transactions

into “clusters” based on patterns identified in transaction data. Id. ¶ 12. Some individuals hoping

to elude such analysis will conduct “peel chains.” Id. ¶ 15. A peel chain occurs when a large

quantity of virtual currency stored at one address is transmitted through a succession of other

addresses. Id. ¶ 13. During each transaction, a small, inconsistent amount of virtual currency is

“peeled off” into an exchange where the individual ultimately wants the virtual currency deposited.

Id. The transactions continue until all the funds originally held at the first address are peeled off

into the target exchange. Id. Sophisticated criminals often use peel chains comprising hundreds

of transactions to hide the path of funds on the blockchain. Id. ¶ 15.

B. The North Korean Hacks and Money Laundering

In a 2019 report, a panel of experts established by the U.N. Security Council identified a

series of hacks sponsored by North Korea targeting virtual currency exchanges. Sec. Am. Compl.

¶¶ 16–20. According to the panel, North Korean operatives routinely use large-scale cyberattacks

to infiltrate accounts hosted by exchanges and other financial institutions. Id. ¶ 17. They then

force transfers and launder stolen virtual currency through an elaborate series of transactions

before converting it into fiat currency. Id. ¶ 19. The attacks raise money for North Korea’s

2 weapons of mass destruction programs, with total proceeds at the time of the report estimated at

up to $2 billion. Id. ¶ 17.

This case arises out of the United States’ investigation of similar hacks of four virtual

currency exchanges, allegedly by North Korean operatives. Sec. Am. Compl. ¶¶ 2, 21. According

to the Second Amended Complaint, in late 2018, U.S. authorities learned that Exchange 1 had been

hacked and that the perpetrators had stolen almost $250 million in virtual currencies, including

Bitcoin. Id. ¶ 27. To begin the attack, a person pretending to be a potential customer contacted an

employee of the exchange. Id. ¶ 28. The employee unknowingly downloaded malware during the

interaction, thereby providing the hackers with remote access to private keys. Id. ¶¶ 28, 30. Once

the perpetrators used those keys to steal virtual currency, they covered their tracks by conducting

hundreds of automated transactions in a peel chain layering process where much of the currency

passed through, or was deposited into, the Defendant Properties. Id. ¶¶ 31–47.

Eventually, much of the stolen Bitcoin was deposited into four accounts on two exchanges

(Defendant Properties 56, 62, 67, and 70). Sec. Am. Compl. ¶ 59. These accounts belonged to

two individuals, Tian Yinyin and Li Jiadong, who have been indicted for money laundering and

operating an unlicensed money transmitting business in a separate case before the Court, United

States v. Tian, 20-cr-52 (TJK). 2 Id. ¶ 60. From 2018 to April 2019, Tian and Li engaged in

$100,812,842.54 in virtual currency transactions, consisting primarily of virtual currency traceable

to the hack of Exchange 1. Id. ¶ 62. After receiving stolen funds via peel chains from the North

Korean operatives, Tian and Li further laundered the money by moving it between each other’s

accounts and exchanging some for prepaid iTunes gift cards, a recognized method of money

2 In all, Tian and Li owned over two dozen of the Defendant Properties: 55–62, 65–80, and 83–84. Sec. Am. Compl. ¶ 100.

3 laundering. Id. ¶¶ 67, 70–71. The two then set up multiple accounts at Chinese banks where they

ultimately deposited the proceeds. Id. ¶¶ 64, 73.

Around December 2017, Exchange 2 announced that 17% of its total assets had been stolen

in a hack that the U.N. Security Council’s expert panel attributed to North Korean actors. Sec.

Am. Compl. ¶ 78–79. Some of Tian’s accounts were also used to launder the proceeds from the

hack of this exchange, as were other accounts that had been used before to send funds to North

Korean co-conspirator accounts. Id. ¶¶ 77, 81–82. About two years later, $48.5 million in virtual

currency was stolen from Exchange 3, a South Korea-based exchange. Id. ¶ 83. Over the next

several days, that money was transferred through multiple peel chains before being deposited into

various exchanges. Id. ¶ 84. For instance, a portion of the stolen currency was deposited into

Defendant Property 82 via several transactions about a week after it was stolen. Id. Some of the

currency ended up in other Defendant Properties. Id. ¶¶ 86–90. In addition, in summer 2018,

North Korean operatives stole about $30 million in virtual currency from Exchange 4, another

South Korean exchange, and funds from this hack were deposited into accounts that controlled

some of the Defendant Properties. Id. ¶¶ 36, 41.

C. Illegal Money Transmitting Business

As already noted, Tian and Li engaged in many transactions using funds traceable to the

hack of Exchange 1. Sec. Am. Compl. ¶ 62. To do so, they would convert virtual currency into

fiat currency for their clients in exchange for a fee. Id. Some of their clients were in the United

States, and they sometimes used United States financial accounts to provide conversion services.

Id. ¶ 98. An advertisement described their operation as a professional business and listed hours of

operation and payment information. Id. ¶ 72. Despite transacting with clients and financial

accounts based in the United States, Tian and Li never registered their operation with the Financial

4 Crimes Enforcement Network (FinCEN) as a money transmitting business as required by law. Id.

¶¶ 69, 99.

D. Procedural History

The United States commenced this forfeiture action in early 2020 and, soon after, amended

the complaint to add 33 more Defendant Properties. See ECF Nos. 1, 3. The United States posted

notice online and served direct notice on Tian and Li, but received no response. ECF No. 5; ECF

No. 17 at 27–28. The Clerk of Court entered default judgment against the Defendant Properties,

ECF No. 16, and the United States moved for default judgment for the first time, ECF No. 17. The

Court denied the United States’ motion without prejudice, see Minute Order of July 23, 2021, and

a few months later the United States filed its Second Amended Complaint to clarify certain issues

identified by the Court.

The United States re-posted notice of this action on its forfeiture website for thirty days

and emailed notice of this action and copies of the second amended complaint to known potential

claimants, including Tian and Li. ECF No. 28; ECF No. 29 at 2. No one filed a claim in response

to the direct notice or notice by internet publication by the deadlines to do so. ECF No. 29 at 3.

The United States then identified more potential claimants to certain of the Defendant Properties,

ECF No. 36, and sent notice of this action and copies of the Second Amended Complaint to

fourteen more email accounts associated with those potential claimants, ECF No. 37 at 3. Once

again, the deadline to file a claim passed without any party doing so. Id. Finally, based on the

United States’ revised affidavit for default, ECF No. 37, the Clerk entered default, ECF No. 39,

and the United States again moved for default judgment, ECF No. 40.

Legal Standard

District courts have the power to enter default judgment against defendants who fail to

appear and defend the case against them. Keegel v. Key W. & Caribbean Trading Co.,

, 375 n.5 (D.C. Cir. 1980). Although there is a strong preference for decisions on the merits,

Whelan v. Abell,

(D.C. Cir. 1995), “the diligent party must be protected” when

an unresponsive party obstructs the adversarial process, Gilmore v. Palestinian Interim Self-Gov’t

Auth.,

(D.C. Cir. 2016).

A plaintiff seeking default judgment must follow a two-step process. First, the plaintiff

must ask the Clerk of Court to enter default against the unresponsive party. Fed. R. Civ. P. 55(a).

Upon entry of default by the Clerk, the unresponsive party is considered to have admitted every

“well-pleaded allegation in the complaint.” Boland v. Providence Constr. Corp.,

(D.D.C. 2014). After the Clerk enters default, the plaintiff must petition the court to award a

default judgment. Fed. R. Civ. P. 55(b)(2). During the application process, the plaintiff “must

prove [his] entitlement to the relief requested using detailed affidavits or documentary evidence

on which the court may rely.” Ventura v. L.A. Howard Constr. Co.,

(D.D.C. 2015) (cleaned up). The Supplemental Rules for Admiralty or Maritime Claims and Asset

Forfeiture Actions govern pleading requirements for civil forfeiture actions and require (1)

compliance with notice standards and (2) an adequate complaint. Fed. R. Civ. P. Supp. R. G(2),(4).

Analysis

A. Compliance with Notice Standards

Generally, forfeiture actions require that the United States publish notice publicly as well

as serve notice directly upon “any person who reasonably appears to be a potential claimant.” Fed.

R. Civ. P. Supp. R. G(4)(a),(b). The United States has done both here.

One way to provide public notice is by publication on an official government forfeiture site

for at least thirty straight days. Fed. R. Civ. P. Supp. R. G(4)(a)(iv)(C). The notice must “describe

the property with reasonable particularity,” state the deadline to file a claim and to answer, and

name the government attorney to be served with the claim and answer. Fed. R. Civ. P. Supp. R.

6 G(4)(a)(ii). To satisfy these requirements, after filing the Second Amended Complaint, the United

States posted notice of this action on www.forfeiture.gov for thirty straight days, from December

10, 2021, to January 8, 2022. ECF No. 28. The notice listed all virtual currency addresses that

constitute the Defendant Properties, stated that any claimant had sixty days from the date of

publication to file a verified claim and answer with the Court, and directed claimants to serve any

claim and answer on a designated Assistant United States Attorney.

at 2–6. Thus, the United

States properly published notice of the forfeiture.

As for direct service, United States “must send notice of the action and a copy of the

complaint to any person who reasonably appears to be a potential claimant . . . by means

reasonably calculated to reach the potential claimant.” Fed. R. Civ. P. Supp. R. G(4)(b)(i),(iii)(A).

That rule requires only “that the government attempt to provide actual notice; it does not require

that the government demonstrate that it was successful in providing actual notice.” United States

v. $1,071,251.44 of Funds Associated with Mingzheng Int’l Trading Ltd.,

(D.D.C. 2018). Service via email is a valid form of service, particularly where the potential

claimants are “international . . . whose locations are hard to pin down.” United States v. Twenty-

Four Cryptocurrency Accounts,

, 6 (D.D.C. 2020). Here, the United States did

just that. By tracing the path of the stolen funds, the United States identified two potential

claimants—Tian and Li—and their email addresses. See ECF No. 40-1 at 24; Sec. Am. Compl.

¶ 100. The United States then emailed notice to them on December 30, 2021, but never received

a response. ECF No. 37 ¶ 10. And when the United States identified fourteen more potential

claimants, it emailed notice to them on September 13, 2022, but likewise never received a

response. Id. ¶¶ 13, 15. Accordingly, the United States accomplished direct notice as well.

7 B. Adequacy of the Complaint

An adequate complaint must be verified, state the grounds for jurisdiction and venue,

describe the property “with reasonable particularity,” specify the “statute under which the

forfeiture action is brought,” and “state sufficiently detailed facts to support a reasonable belief

that the government will be able to meet its burden of proof at trial.” Fed. R. Civ. P. Supp. R.

G(2). The Second Amended Complaint meets most of these criteria for reasons needing little

explanation.

First, the Second Amended Complaint is verified. See Sec. Am. Compl. at 42.

Second, it states proper grounds for jurisdiction, and any venue challenge has been

forfeited. “This Court has jurisdiction over ‘any action or proceeding for the recovery or

enforcement of any . . . forfeiture . . . incurred under any Act of Congress,’” including the two

statutes, § 1956 and § 1960, under which this forfeiture action is brought. Twenty-Four

Cryptocurrency Accounts, 473 F. Supp. 3d at 6 (quoting

(a)). Section 1956, in

particular, provides for extraterritorial jurisdiction over money laundering offenses of more than

$10,000 committed at least “in part” in the United States.

(f); see United States

v. All Assets Held at Bank Julius Baer & Co.,

(D.D.C. 2008). Such

jurisdiction includes conspiracy to commit a money-laundering offense under § 1956(h). 3 And

the United States has sufficiently shown that at least some transactions in the alleged conspiracy

involved U.S.-based exchanges. See, e.g., Sec. Am. Compl. ¶ 67 (Tian held an account, among

3 Section 1956(f) provides for “extraterritorial jurisdiction over the conduct prohibited by this section.” As the Fourth Circuit explained, “a conspiratorial agreement to launder money in contravention of § 1956(h) is conduct,” and thus the extraterritoriality provision of section 1956(f) applies to a money-laundering conspiracy offense under § 1956(h). United States v. Ojedokun,

, 1102–05 (4th Cir. 2021); cf. Whitfield v. United States,

, 215–18 (2005) (reasoning that § 1956(h) creates a conspiracy “offense” rather than merely raising the penalty for money laundering).

8 the Defendant Properties, at “a U.S.-based exchange, where he sold [Bitcoin] in exchange for

prepaid Apple iTunes gift cards, a known method of money laundering.”). 4 As for venue,

claimants forfeited any objection by defaulting. Henkin v. Islamic Republic of Iran, Nos. 18-cv-

1273 (RCL), 19-cv-1184 (RCL),

, at *18 (D.D.C. July 12, 2021).

Third, it describes the property with reasonable particularity, given that it identifies the 145

cryptocurrency account addresses and details the complex series of transactions at issue. See

United States v. 155 Virtual Currency Assets, No. 20-cv-2228 (RC),

, at *5

(D.D.C. Apr. 9, 2021) (complaint described property with reasonable particularity because it

“identif[ied] the specific account and cluster numbers that sent, held, or received bitcoin and . . .

provid[ed] details about the transactions themselves”).

And fourth, it identifies the relevant forfeiture statute as

, which subjects

“[a]ny property, real or personal, involved in a transaction or attempted transaction in violation of

section 1956 . . . or 1960 of this title, or any property traceable to such property” to forfeiture.

(a)(1)(A); see also United States v. Miller,

(4th Cir. 2018) (property

“forfeitable in its entirety, even if legitimate funds have also been invested in the property”);

United States v. Huber,

, 1058 (8th Cir. 2005) (both dirty and clean money subject

to forfeiture). Even for property located outside the United States, the Court has jurisdiction to

order its forfeiture under § 981. See United States v. All Assets Held in Account Number

XXXXXXXX,

(D.D.C. 2015); Julius Baer,

(D.D.C.

2017).

4 Moreover, Tian and Li used funds traceable to the thefts to run a money transmitting business. Sec. Am. Compl. ¶ 62. To do so, they would convert virtual currency into fiat currency for their clients in exchange for a fee.

Some of their clients were in the United States, and they sometimes used United States financial accounts to provide conversion services. Id. ¶ 98.

9 Evaluating the fifth and final element of an adequate complaint—whether it states

“sufficiently detailed facts to support a reasonable belief that the United States would be able to

meet its burden of proof at trial”—takes a little more work to unpack. See Fed. R. Civ. P. Supp.

R. G(2)(f). The United States seeks forfeiture of the Defendant Properties on the theory that they

were “involved in” a complex conspiracy to engage in three types of money laundering—

concealment, promotion, or international promotion money laundering—or are otherwise

traceable to such property. See ECF No. 40-1 at 25;

(a)(1)(A).

Before running through each type of money laundering at issue, the Court notes that as a

general matter, “even otherwise untainted money may become ‘involved’ in a money laundering

offense” for these purposes “where those funds are comingled with illicit proceeds” and “the

government produces evidence that the legitimate funds were used to conceal the source of illicit

proceeds.” United States v. Bikundi,

(D.D.C. 2015) (citing United States

v. Braxtonbrown-Smith,

, 1351–55 (D.C. Cir. 2002)).

1. Concealment Money Laundering

First, the Second Amended Complaint alleges that certain Defendant Properties were

involved in a conspiracy to commit concealment money laundering in violation of

(a)(1)(B) and (h) or are otherwise traceable to such property. See Sec. Am. Compl.

¶ 123(b). To meet its burden, the United States has to show that Tian and Li conducted financial

transactions knowing they were “designed in whole or in part” to, in relevant part, “conceal or

disguise the nature, the location, the source, the ownership, or the control of the proceeds of

specified unlawful activity.”

(a)(1)(B)(i). The United States must also show that

Tian and Li knew that the property involved in those transactions “represent[ed] the proceeds of

some form of unlawful activity.”

(a)(1). Financial transactions include those

that “in any way or degree affect[] interstate or foreign commerce . . . involving the movement of

10 funds by wire or other means” (which include virtual currency) or that involve “the use of a

financial institution which is engaged in, or the activities of which affect, interstate or foreign

commerce in any way or degree.”

§ 1956(c)(4); see United States v. Budovsky, No. 13-cr-368

(DLC),

, at *13 (S.D.N.Y. Sep. 23, 2015). Financial institutions include, among

other things, foreign or domestic banks and currency exchanges.

(c)(6);

(a)(2).

As described in the Second Amended Complaint, Tian and Li laundered proceeds of the

thefts by conducting hundreds of automated transactions in a peel chain layering process designed

“to obfuscate the [virtual currency] trail and decrease scrutiny.” Sec. Am. Compl. ¶¶ 32, 84, 88–

89, 91, 106. The D.C. Circuit “has recognized that such funneling of illegal funds through various

fictitious business accounts is a hallmark of money laundering,” in particular, “an intent to

conceal.” United States v. Bikundi,

(D.C. Cir. 2019) (citations and internal

quotations omitted). Thus, the United States has shown that these transactions—in particular,

those part of the peel chain layering process—were designed to conceal the source of the proceeds

from the victim exchanges, and that Tian and Li shared that knowledge and intent.

These same transactions also satisfy the requirement of § 1956(c)(4), noted above, that they

“in any way or degree” affect interstate or foreign commerce and involve virtual currency, or

involve the use of banks or currency exchanges which are engaged in or “in any way or degree”

affect interstate or foreign commerce. Most obviously, much of the funds ended up in foreign

banks as part of the peel chain layering process. For example, over $30 million of the $250 million

stolen from Exchange 1 were deposited into nine Chinese bank accounts that Li had linked to a

particular Defendant Property. Sec. Am. Compl. ¶ 71. More generally, as is self-evident, the

11 hundreds of transactions Tian and Li engaged in to conceal the origin of the stolen funds affected

interstate or foreign commerce.

These transactions also involved the proceeds of unlawful activity. More than $250 million

in virtual currencies was stolen from Exchange 1, and millions more were stolen from the other

three exchanges. See Sec. Am. Compl. ¶ 27. The Second Amended Complaint sufficiently alleges

that those stolen funds resulted from wire fraud in violation of

, which is a

specified unlawful activity for purposes of

. See id. ¶ 123(a);

(c)(7)(A), 1961(1); All Assets Held in Account Number XXXXXXXX,

(adopting reasoning that “as long as the government alleges specific facts supporting an inference

that the funds are traceable to wire fraud and mail fraud, it has met its burden at the pleadings

stage” in a forfeiture action (citation omitted)). And Tian and Li knew the funds were sourced

illegally: they laundered funds stolen from the victim exchanges by conducting hundreds of

automated transactions in a peel chain layering process where currency passed through, or was

deposited into, the virtual currency accounts that make up many of the Defendant Properties. Sec.

Am. Compl. ¶¶ 31–47. By engaging in that elaborate series of transactions to conceal the origin

of the funds, they demonstrated sufficient awareness that the origin of those funds was illicit. See

¶¶ 101–02

In sum, the allegations in the Second Amended Complaint provide a reasonable basis to

believe the United States could show at trial that Defendant Properties were involved in

concealment money laundering.

2. Promotion Money Laundering

Next, the Second Amended Complaint alleges that certain Defendant Properties were

involved in a conspiracy to commit promotion money laundering in violation of

(a)(1)(A) and (h) or are otherwise traceable to such property. See Sec. Am. Compl.

12 ¶ 123(a). Many of the requirements noted above in the context of concealment laundering apply

here as well. Conspirators must conduct “financial transactions,” as defined above, knowing they

involved proceeds of some form of unlawful activity.

(a)(1). As the Court

explained above, that condition is satisfied. 5 And to meet its burden as to promotion money

laundering, in particular, the United States has to show that Tian and Li conducted financial

transactions “with the intent to promote the carrying on of specified unlawful activity,” which

includes wire fraud in violation of

as well as conducting an unlicensed money

transmitting business in violation of

.

(a)(1)(A)(i),

1956(c)(7)(A), 1961(1). The Second Amended Complaint sufficiently alleges that Defendant

Properties were involved in both these activities.

First, the Second Amended Complaint sufficiently alleges a money-laundering scheme in

promotion of wire fraud. The promotion offense “is aimed . . . only at transactions which funnel

ill-gotten gains directly back into the criminal venture.” United States v. Stoddard,

(D.C. Cir. 2018) (citation omitted). That intent—to promote the underlying illegal activity—

can generally be shown by facts showing conspirators “benefited from, or had extensive

knowledge about, the underlying illegal activity [they] [were] promoting.”

at 1214–15. The

distribution of funds to co-conspirators qualifies as such promotion. 6 And here, conspirators

5 As above, the financial transactions alleged here either affect interstate or foreign commerce and involve virtual currency or involve the use of banks or currency exchanges which are engaged in or affect interstate or foreign commerce. See

(c)(4). 6 See United States v. Valasquez,

(E.D.N.Y. 2014) (“[T]he Court concludes that a reasonable trier of fact could have found beyond a reasonable doubt that defendant joined a conspiracy that intended to promote Hobbs Act robberies and marijuana distribution by distributing the proceeds of robberies to the coconspirators. Critically, there was sufficient evidence that the defendant participated in an ongoing conspiracy to commit multiples Hobbs Act robberies.”); United States v. Kelley,

(11th Cir. 2012) (“The Government presented sufficient evidence that the monthly dividend payments were designed to give the

13 distributed funds to other participants in the conspiracy to, as alleged, “compensate them and

thereby promote their continued participation in subsequent hacking activities.” Sec. Am. Compl.

¶ 103. Moreover, proceeds from the thefts were used to pay for infrastructure perpetuating the

scheme, such as domain registration, site hosting from service providers that focus on client

anonymity, and virtual private networks. Id. ¶ 48. For instance, North Korean operatives

registered the domain “celasllc.com,” which purported to offer a virtual currency trading platform

called Celas Trade Pro. Id. ¶ 49. Forensic analysis revealed that Celas Trade Pro was a malicious

software code that provided conspirators access to the downloader’s system. Id. Funds from the

thefts of the victim exchanges were used to pay for the registration of business email services for

that domain. Id. ¶ 48. 7 Thus, the allegations in the Second Amended Complaint provide a

reasonable basis to believe that the United States could show at trial that Tian and Li acted with

the intent to promote wire fraud.

Second, the Second Amended Complaint sufficiently alleges that Tian and Li conducted

financial transactions with the intent to promote their unlicensed money transmitting business.

The United States asserts that stolen funds were used in an unlicensed money transmitting business

principal players in the steroid distribution scheme an incentive to continue their activities despite the risks inherent in such activity.”) (citations omitted); United States v. Arthur,

(5th Cir. 2011) (“We have little difficulty concluding that Ebhamen’s payments to Fleming evince the intent to contribute to the growth, enlargement, or prosperity of the conspiracy. Indeed, the payments were the lifeblood of the conspiracy. . . . If the payments stopped, there is little doubt Fleming would have ended the relationship with Ebhamen, denying her the opportunity to profit further from the conspiracy.”). 7 Security researchers also determined that Celas LLC, the entity that offered Celas Trade Pro, shared a server IP address and an encryption key with Fallchill, a known malware associated with the North Korean government. Sec. Am. Compl. ¶ 50. The perpetrators who emailed the malware to Exchange 1 also conducted a phishing campaign to infect other users with malware, targeting thousands of email accounts at exchanges around the world, including ones belonging to CEOs of major exchanges.

¶¶ 54–55.

14 that Tian and Li illegally operated without registering with FinCEN, in violation of

. Sec. Am. Compl. ¶¶ 62, 99. An “unlicensed money transmitting business” is a business

that “transfer[s] funds on behalf of the public by any and all means including but not limited to

transfers within this country or to locations abroad by wire.”

(b)(1),(2). Courts

have broadly construed this term to cover businesses transmitting money—including virtual

currencies—for a fee on behalf of third parties in a commercial or business relationship, rather

than a personal or familial one, in more than one isolated transaction. 8

Tian and Li are alleged to have engaged in $100,812,842.54 worth of virtual currency

transactions for their clients, including customers and financial accounts located in the United

States. Sec. Am. Compl. ¶¶ 62, 98. For a fee, they would convert virtual currency to fiat currency

and transfer it to customers. Id. ¶ 62. An advertisement for their services described the operation

as a professional business, noting their hours and payment information. Id. ¶ 72. Thus, the

allegations in the Second Amended Complaint provide a reasonable basis to believe that the United

States could show at trial that Tian and Li acted with the intent to promote this unlicensed money

transmitting business. See United States v. 50.44 Bitcoins, No. 15-cv-3692 (ELH),

, at *2 (D. Md. May 31, 2016) (granting motion for default judgment and ordering

forfeiture of virtual currency involved in unlicensed money transmitting business).

8 See, e.g., United States v. Velastegui,

, 595 n.4 (2d Cir. 1999); United States v. $215,587.22 in U.S. Currency Seized from Bank Acct. No. 100606401387436 held in the Name of JJ Szlavik Companies, Inc. at Citizens Bank,

, 218–20 (D.D.C. 2018); United States v. E-Gold, Ltd.,

(D.D.C. 2008) (“funds” not limited to cash and may include forms of virtual currency transferred by wire); United States v. Harmon,

, 106 (D.D.C. 2020) (“FinCEN has long considered transfers of funds from one unique [virtual currency] account to another . . . to amount to a change of the funds’ location.”).

15 3. International Promotion Money Laundering

Finally, the Second Amended Complaint alleges that certain Defendant Properties were

involved in a conspiracy to commit international promotion money laundering in violation of

(a)(2)(A) and (h) or are otherwise traceable to such property. See Sec. Am. Compl.

¶ 123(c). This statute prohibits the movement of funds across the border of the United States “with

the intent to promote the carrying on of specified unlawful activity.”

(a)(2)(A).

Again, specified unlawful activities include wire fraud as well as operation of an unlicensed money

transmitting business.

§§ 1956(7)(A), 1961(1). And as above, the term “promote” means to

make the underlying illegal scheme easier by “funnel[ing] ill-gotten gains directly back into the

criminal venture.” See Stoddard,

(citation omitted).

While operating their unlicensed money transmitting business, Tian and Li are alleged to

have transacted with individuals within the United States and sometimes used U.S. financial

institutions—as well as those outside the country—to do so. See Sec. Am. Compl. ¶¶ 69, 98. For

a fee, they would transfer virtual currency—often derived from the exchange hacks—in exchange

for fiat currency. Id. ¶ 98. And the Second Amended Complaint alleges that, as above, “such

transactions were intended to promote the operation of an unlicensed money transmitting business

and the ongoing wire fraud scheme.” ECF No. 40-1 at 36. Thus, the allegations in the Second

Amended Complaint provide a reasonable basis to believe the United States could show that

Defendant Properties were involved in international promotion money laundering. See

Mingzheng,

(awarding default judgment after the government presented facts

supporting belief that front company laundered funds through U.S. financial system on behalf of

North Korea); United States v. Piervinanzi,

(2d Cir. 1994) (Section 1956(a)(2)(A)

“penalizes an overseas transfer with the intent to promote the carrying on of specified unlawful

activity.” (internal quotation and citation omitted)).

16 4. Conspiracy

As for a conspiracy to engage in any of these forms of money laundering, the United States

needs to show that there was a knowing and voluntary agreement to commit an offense. United

States v. Alexander,

, 594 (11th Cir. 2021) (quoting United States v. Broughton,

(11th Cir. 2012)); see United States v. Farrell, No. 3-cr-311-1 (RWR),

, at *4 (D.D.C. July 8, 2005). Such an agreement may be shown by circumstantial

evidence suggesting “a unity of purpose or a common design and understanding.” American

Tobacco Co. v. United States,

(1946); see also United States v. All Assets Held

in Account Number XXXXXXXX,

(D.D.C. 2015) (“As for whether the

complaint alleges a conspiracy to launder money, [t]he government does not need to allege facts

that demonstrate an explicit agreement; rather [p]roof of a tacit, as opposed to explicit,

understanding is sufficient to show agreement.” (internal quotation marks and citation omitted)).

It does not require proof of an overt act. Whitfield v. United States,

(2005).

The Second Amended Complaint alleges a scheme to engage in an intertwined series of

transactions that would conceal the origin of funds stolen in North Korean hacks. Sec. Am. Compl.

¶¶ 16–20, 97. As part of this scheme, Tian and Li engaged in recognized money laundering

practices, such as moving the stolen funds between their own virtual currency accounts and

exchanging some of the virtual currency for iTunes gift cards. See id. ¶¶ 67, 71, 74–75. They

repeated the same practices exchange to exchange: the two used common accounts to launder

stolen funds from the various exchanges, executed transfers across those accounts, and submitted

similarly falsified identification photos to many of the exchanges. Id. ¶¶ 36, 59–60, 63, 77, 81,

94. This conduct follows a pattern that North Korean operatives have used to launder funds for

the sanctioned regime, which cannot otherwise access the U.S. financial system. Id. ¶¶ 16–20.

Thus, the allegations in the Second Amended Complaint have established a reasonable basis to

17 conclude that the United States could show a conspiracy to engage in these forms of money

laundering, and that Tian and Li were knowing and voluntary participants in the conspiracy. See

Mingzheng,

(awarding default judgment after the Government presented

facts supporting belief that front company laundered funds through U.S. financial system on behalf

of North Korea).

* * *

The Court has scrutinized the relationship of the Defendant Properties to the offenses

outlined above and finds that the United States has sufficiently shown that under one or more

theories each is subject to forfeiture as property “involved in a transaction or attempted transaction

in violation of section 1956” outlined above or otherwise constitutes “property traceable to such

property.”

(a)(1)(A). Thus, the fifth and final element of an adequate complaint

is satisfied. The Court finds that Second Amended Complaint “state[s] sufficiently detailed facts

to support a reasonable belief that the government will be able to meet its burden of proof at trial.”

Fed. R. Civ. P. Supp. R. G(2).

Conclusion

For all the above reasons, the Court will grant the United States’ Motion for Default

Judgment and order the forfeiture of the Defendant Properties. A separate order will issue.

/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge

Date: March 5, 2024

18