Prosecutors Trace $13.4M in Bitcoins From the Silk Road to Ulbricht’s Laptop

If anyone still believes that bitcoin is magically anonymous internet money, the US government just offered what may be the clearest demonstration yet that it’s not. A former federal agent has shown in a courtroom that he traced hundreds of thousands of bitcoins from the Silk Road anonymous marketplace for drugs directly to the personal computer of Ross Ulbricht, the 30-year-old accused of running that contraband bazaar.

In Ulbricht’s trial Thursday, former FBI special agent Ilhwan Yum described how he traced 3,760 bitcoin transactions over 12 months ending in late August 2013 from servers seized in the Silk Road investigation to Ross Ulbricht’s Samsung 700z laptop, which the FBI seized at the time of his arrest in October of that year. In all, he followed more than 700,000 bitcoins along the public ledger of bitcoin transactions, known as the blockchain, from the marketplace to what seemed to be Ulbricht’s personal wallets. Based on exchange rates at the time of each transaction, Yum calculated that the transferred coins were worth a total of $13.4 million.

“You mean direct, one-to-one transfers?” prosecutor Timothy Howard asked Yum.

“Yes, direct, one-to-one transfers,” Yum responded.

Yum’s testimony represents another damning line of evidence connecting Ulbricht to the Silk Road, on top of a journal detailing the Silk Road’s creation found on his laptop and testimony from a college friend who said that Ulbricht confessed creating the site to him. Ulbricht’s defense has argued that despite initially founding the Silk Road, the 30-year-old Texan quickly gave it up to the site’s real owners, who later lured him back just before his arrest to serve as the “perfect fall guy.” But Yum’s analysis showed that Ulbricht was receiving bitcoin transfers from Silk Road servers in data centers near Philadelphia and Reykjavik, Iceland long after his defense has argued he turned over control of the site.

More broadly, Yum’s testimony confirms what most savvy bitcoin users already know: that the cryptocurrency is by no means untraceable or anonymous by default. Although using bitcoins doesn’t necessarily require revealing any identifying information, all bitcoin transactions are traced on the blockchain, the same widely distributed list of transactions designed to make counterfeiting bitcoins impossible. If someone can identify a user’s bitcoin addresses—in Ulbricht’s case, by seizing the laptop he was actively using at the moment of his arrest—then they can often be used to trace his or her transactions.

In fact, Berkeley computer science researcher Nicholas Weaver had already shown that he was able to follow more than 29,000 bitcoins from the Silk Road to Ulbricht’s laptop based only on publicly available information. The prosecution, with access to Ulbricht’s hard drive, had far more success. Nearly 500,000 bitcoins of the 700,253 bitcoins were transferred from September to November 2012, explaining their relatively low total exchange rate.1

Remarkably, that total trail of drug-tainted coins represents more than four times as many bitcoins from Silk Road Ulbricht’s laptop than have yet been found and seized in the Silk Road investigation. It’s still not clear from Yum’s testimony where the rest of them ended up.

The Silk Road advertised that it protected users by “tumbling” coins, mixing them up between users to prevent anyone’s transactions from being identified. But Yum’s testimony makes it clear that withdrawals from the site could still be tied to users, particularly after the FBI possessed the Silk Road’s servers. Bitcoin anonymity tools like Bitcoin Fog or Dark Wallet could further obscure bitcoins’ digital trail, but it doesn’t seem that Ulbricht himself used those protections, instead transferring the coins directly to his own wallet. Based on earlier testimony from FBI agents, Ulbricht likely believed his hard drive’s encryption would prevent anyone from tying his bitcoin addresses to his real-world identity.

In its cross-examination of Yum, Ulbricht’s defense attorney Dratel called into question whether Yum had done his analysis single-handedly or relied on a coworker at FTI consulting, the government contractor that now employs him. When Yum admitted that he had done only about 40 hours of work on the analysis and that 60 hours had been performed by a cryptologist named Matthew Edman, Dratel moved to have Yum’s testimony struck from the record as “hearsay,” or testimony that’s not based on firsthand evidence. But the trial’s judge Katherine Forrest denied the motion, ruling that Yum was sufficiently involved in the analysis.2

At another point, Dratel asked Yum whether Ulbricht might have simply used the Silk Road as a bitcoin wallet, an alternative explanation for his withdrawals from the site.

“Yes, it could be done,” Yum admitted, in a skeptical tone. “I wouldn’t maintain my bitcoins that way.”

1Correction 1/29/2015 6pm: An earlier version of this story identified Nicholas Weaver as a Berkeley professor, rather than a researcher.

2Updated 1/29/2015 6pm with the defense’s cross examination and motion to strike Yum’s testimony from the record.

http://www.wired.com/2015/01/prosecu...richts-laptop/