Diamond Hands | IRS-CI
30:16 Share

This is True Spies, the podcast that takes you deep inside the greatest secret missions of all time. Week by week, you'll hear the true stories behind the operations that have shaped the world we live in. True Spies. You'll meet the people who live life undercover. What do they know? What are their skills?

And what would you do in their position? This is True Spies. We find this little computer chip being hidden in a clothes hamper in the bathroom. We pull that out, scan it, and there's a little over 50,000 Bitcoin on that particular piece of equipment. I'm Sofia DiMartino, and this is True Spies from Spyscape Studios. Diamond Hands.

Gainesville, Georgia, November 21st, 2021. A young man is under arrest, flanked by federal agents. Behind him, their colleagues are tearing his home apart. He has something they want. We go in, we're looking through the house, trying to figure out what meets the terms of our warrant. They're there to seize the profits of an audacious act of fraud.

The sum in question is immense. But they won't find it in a deadlocked vault or stuffed inside a mattress. They're looking for something much smaller: a computer chip. And the agents need to move fast.

There's always that possibility in the hours leading up to a search warrant that by the flick of a computer's keystroke, that stuff's gone. As the armed men scour the house, they leave no stone unturned. No hiding place is too innocuous. No nook or cranny too unlikely. So we were looking for a number of things, of course, evidence of the crime, looking for anything that would point us in the direction of, number one, the existence of those Bitcoin.

This is the story of a 21st century heist and the investigators who used digital intelligence gathering to bring the perpetrator to justice. And this is one of the true spies who cracked the case. My name's Tyler Hatcher. I'm the Special Agent in Charge of IRS Criminal Investigation here in the Los Angeles field office. Let's talk about crypto.

Cryptocurrency, to be exact. Digital coins that can be bought and sold for cash. The currency aspect of cryptocurrencies is easy enough to grasp. Users purchase the coins and their ownership of the asset is recorded on something called a blockchain. A blockchain is essentially kind of another word for a distributed ledger technology, meaning it's essentially a record keeper.

You can visualize a blockchain as a massive spreadsheet. Most cryptocurrencies have their own dedicated ledger. And there are thousands of cryptocurrencies out there. But when most people think of digital money, they're thinking of one in particular: Bitcoin.

Bitcoin's value isn't set by governments or financial institutions. Its blockchain ledger is hosted on a decentralized series of nodes all over the world, and its value comes from its scarcity. That, and the market's confidence in the technology's future.

That confidence saw the price of a Bitcoin soar from pennies in 2009 to an all-time high of $69,000 per coin in November 2021. So that's the currency. But this is True Spies. Let's talk about their cryptography, because that's what makes the blockchain and Bitcoin work.

The blockchain is typically a peer-to-peer system of keeping track of stuff. So when you and I, if we go buy something or trade something or transact something or store something, there's unique letters or numbers or symbols to be able to keep track of those things, but more importantly, identify who owns them or who controls them. The blockchain serves as a public record of Bitcoin transactions, which is why Tyler Hatcher keeps a close eye on it.

IRS criminal investigation is the only U.S. federal law enforcement agency that can investigate tax crimes. And no, we're not talking about late filing. It gives us a good launching point into every financial federal crime that the U.S. has jurisdiction over. So that gives us expertise into organized crime, drug trafficking, international crimes, financial crimes of every sort, but more particularly into cyber and crypto.

And the IRS-CI, as Tyler's agency is known, isn't limited to American soil. Money makes the world go round, so they have to go around the world. I spent a couple of years overseas for IRS criminal investigation. We have 12, or well, 13 now, foreign offices where we work very closely with our foreign counterparts.

At its outset, encrypted currency that could be exchanged for hard cash was an exciting prospect for tech-savvy criminals the world over. Back when I started 20 years ago, it was still easy to conduct essentially anonymous transactions using cash. The criminal element was always looking for ways to not only conduct transactions anonymously, but do it timely. You know, it was rather cumbersome to take several hundred thousand or millions of dollars and transport it from one location to another.

But the mechanics of Bitcoin weren't always fully understood by its shadier users. Crooks thought that it was anonymous and obviously they could execute transactions in a matter of seconds rather than days or weeks or months. But the thing about a currency that relies on a public blockchain ledger to track transactions is, well, it's public, isn't it?

Which means that people like Tyler Hatcher and his team at IRS Criminal Investigation can see when funds move from one place to another. And with a bit of dedicated investigative work and some specialized software, they can eke out nuggets of identifying data from those movements. An IP address, for example. The digital signature that all your devices use to identify themselves online.

That's bad news for criminals hoping to keep their transactions private. Criminals like Ross Ulbricht, aka the Dread Pirate Roberts, the founder of Silk Road.

What the Silk Road was, is it was an illicit marketplace. It was most notoriously known for sales of narcotics, but you could certainly jump on there and buy stolen identities and stolen bank accounts, and you could hire hitmen. I mean, it literally had every illicit good or service that you could think of was available for sale there.

Hello, True Spies listener. This episode is made possible with the support of June's Journey, a riveting little caper of a game which you can play right now on your phone. Since you're listening to this show, it's safe to assume you love a good mystery, some compelling detective work...

and a larger-than-life character or two. You can find all of those things in abundance in June's Journey. In the game, you'll play as June Parker, a plucky amateur detective trying to get to the bottom of her sister's murder. It's all set during the roaring 1920s.

And I absolutely love all the little period details packed into this world. I don't want to give too much away because the real fun of June's journey is seeing where this adventure will take you. But I've just reached a part of the story that's set in Paris.

And I'm so excited to get back to it. Like I said, if you love a salacious little mystery, then give it a go. Discover your inner detective when you download June's Journey for free today on iOS and Android. Hello, listeners. This is Anne Bogle, author, blogger, and creator of the podcast, What Should I Read Next? Since 2016, I've been helping readers bring more joy and delight into their reading lives. Every week, I take all things books and reading with a guest and guide them in discovering their next read.

They share three books they love, one book they don't, and what they've been reading lately. And I recommend three titles they may enjoy reading next. Guests have said our conversations are like therapy, troubleshooting issues that have plagued their reading lives for years, and possibly the rest of their lives as well. And of course, recommending books that meet the moment, whether they are looking for deep introspection to spur or encourage a life change, or a frothy page-turner to help them escape the stresses of work, or a book that they've been reading for years.

school, everything. You'll learn something about yourself as a reader, and you'll definitely walk away confident to choose your next read with a whole list of new books and authors to try. So join us each Tuesday for What Should I Read Next? Subscribe now wherever you're listening to this podcast and visit our website, whatshouldireadnextpodcast.com to find out more. The Silk Road was hosted on what's known colloquially as the Dark Net, the internet below the internet you've used to find this podcast.

It's only accessible using specialized, highly encrypted browsers, which, if used correctly, can offer the user near total anonymity. Ross Ulbricht's Marketplace was the most successful darknet bazaar of its kind. Its users paid in Bitcoin.

It had, I think, a million plus users or registered users on the platform. But in 2013, Ulbricht was arrested and the Silk Road was no more.

So of course we were involved in the original Silk Road takedown. It was us that identified Ross Ulbricht as the Dread Pirate Roberts and were able to kind of tie that up and help with that takedown. But as you can imagine, in these kind of investigations, we executed search warrants and seizure warrants, and we were able to essentially seize the entirety of the Silk Road servers.

At heart, Tyler and his team are accountants. Gun-toting accountants, sure, but accountants all the same. And as we kind of went back and did our jobs as IRS criminal investigation special agents, we want to know where did all that money go? We know millions of bitcoins transacted through Silk Road. We know somewhere around 600,000 bitcoins were attributable to profit to Mr. Ulbrich or those that worked at Silk Road or for Silk Road at that time.

As we heard in the last episode of True Spies, Ulbricht was sentenced to life in prison. He was also ordered to pay back $183 million, the total amount that the US government believed that Silk Road had generated in sales. But the dread pirate Roberts didn't have that kind of money to hand. So the IRSCI needed to find out where all that crypto had wound up.

Our job at the end of the day is not only to make sure that these criminals are caught and prosecuted and serve prison time, but to make sure that they don't make off with any of their ill-gotten gains. The IRS are very good at what they do. During the original Silk Road investigation, they methodically traced the Silk Road's records on the blockchain. As we were going through and kind of looking at that, we noticed a big chunk of Bitcoin basically just missing. 50,000 Bitcoin, to be exact.

Now at the time, you know, I think Bitcoin was roughly $200 per coin. So we're talking about a million dollars. A lot of money, sure. But nothing an experienced fraud investigator wouldn't have seen before.

For crypto investors, truly astronomical profits were still a fantasy, albeit one that was swiftly coming within reach. We knew because of some of our tools and the blockchain where it was to an extent, or at least it existed, and we knew the value and we kind of knew that it wasn't sitting in any of the Silk Road wallets or anything like that. At the time, it was considered that Ross Ulbricht might have moved the funds to a separate crypto wallet.

that's software or hardware designed to store Bitcoin. But as the law came crashing down on the Silk Road mogul, it became clear that the Dread Pirate had no access to the funds. Someone else had gotten hold of them. But the identity of the new owner of the 50,000 Bitcoins was a mystery. And they were just sitting there.

Crypto, and in this case, Bitcoin, is completely worthless until you can convert it into something you can spend. And those are the things that we're watching. We're watching exchangers and anytime transactions happen because those are when entries on the blockchain happen. And we can identify some of that transactional data that will help us trace that.

Without any transactions taking place, no new information was recorded in the blockchain. And there were no new opportunities for the investigators to investigate. So we ultimately just sat on it for a decade. In the world of cryptocurrencies, the 2010s were boom years, and early adopters suddenly found themselves sitting on piles of virtual money by the end of the decade.

One of those people was James Xiong. So we don't really know a lot about him. I mean, we know that he was fairly young. In 2012, James Xiong was in his early 20s. He'd taken a prescient interest in Bitcoin. An interest so strong, in fact, that he was prepared to act outside of the law to get more of it. We didn't even know it was him we were looking for at that time.

Zhang, as you've probably deduced by now, was the mysterious owner of the 50,000 Bitcoin that so frustratingly eluded Tyler and the IRS. And no, he had nothing to do with the running of Silk Road. He'd acquired his fortune by targeting the criminals themselves. It's actually a pretty ingenious scheme, we'll call it. And I don't know how he came up with it.

How do you steal 50,000 Bitcoin from the biggest darknet market on the planet? Well, it comes down to a simple truth: Cryptocurrency, unlike cash or gold, is no more real than numbers on a screen. It exists in an almost entirely digital ecosystem. And if it's digital, you can hack it.

He was a registered user, if you will, of Silk Road. Back then, if you wanted to use Silk Road, you had to deposit Bitcoin on the platform itself before you could use it to purchase anything. And we do mean anything.

And he came up with a system whereby he had a pretty sophisticated computer system at his house. And he was able to open up several registered accounts under Silk Road. And we think that he originally funded those with between 200 and 2000 Bitcoin at the time. So, Zhong had several Silk Road accounts, and each of them was loaded with a nominal amount of Bitcoin.

That money was now real within the Silk Road systems. But as soon as the Bitcoin hit Silk Road, he would immediately transact hundreds of transactions. Using his sophisticated network of home computers, Zhong then withdrew the same Bitcoin several times. So quickly that the Silk Road servers didn't have time to register that the money was already gone before sending it again.

And so he essentially was able to withdraw Bitcoin that he didn't actually have there. Ingenious, no? But at the time, Tyler and his colleagues at the IRS-CI weren't able to deliver their personal congratulations to Zhong. They had no idea who he was.

It's unique in the sense that most of the time, at least with financial crimes, we know who the target is. We know who's conducted some of the transactions or we have a lead and we usually know who we kind of need to look at. This case was not that. It was actually kind of a fascinating case and certainly a lesson for us and really some patience by Mr. Zhang.

Patience is right. Zhang resisted the urge to sell off his ill-gotten crypto for immediate profit, instead choosing to weather a series of ups and downs in Bitcoin's value. In the crypto community, that speaks to a mindset known as "diamond hands" — holding on at all costs. And it paid off. By 2021, Zhang's Bitcoin was worth serious money.

In the spring of 2019, his home in Athens, Georgia, was robbed. The thief, Zhong reported to the police, had made off with a briefcase containing $400,000 in cash and a USB thumb drive containing personal information. According to local police, the amount of stolen cash raised a red flag at the IRS. But without the thumb drive, which may or may not have contained information relating to his Bitcoin holdings,

There was nothing to suggest Xiong's connection to the missing crypto. The break-in had no effect on Tyler's investigation. Xiong resumed his life of quiet obscurity, and his remaining assets continued to grow in value. As we sat on it, we actually had a break in the case where a portion of the Bitcoin was kind of automatically made into Bitcoin Cash.

Bitcoin Cash is a kind of spin-off of the original Bitcoin cryptocurrency. It was developed by a faction of users who wanted a digital coin that was more suited to real-world transactions, as opposed to being a store of value, like a stock. When Bitcoin Cash launched, all users of traditional Bitcoin received an equivalent amount of the new currency.

which meant that James Xiong now had 50,000 units of Bitcoin cash worth much less than the original article, but not worth nothing. But Xiong didn't want to spend his fortune yet. He was Mr. Diamond Hands after all. So he converted his Bitcoin cash back into regular Bitcoin.

His faith in the asset was unshakable. And so he did that conversion and ultimately through a few international transactions that would bring it back into kind of a usable format for him, we lucked out. If the IRS were watching the missing 50,000 Bitcoin on the blockchain, they were watching its Bitcoin cash equivalent too.

Watching and waiting, playing the long game. He actually made a mistake. He used his own unmasked, unhidden IP address to move or to transact something. People who trade in Bitcoin, particularly early adopters, are likely to be security conscious. For example, they'll use software like VPNs, virtual proxy networks, to hide their devices' IP addresses online.

Usually James Jong was no exception. He'd been so careful. But when the IRS CI is on your case, one tiny slip-up can mean the end of the road. But for Tyler and his team, it's not just a case of tracking the IP and showing up at the perp's front door. There's a process. If the IRS wants to spy on you, it needs a legally justifiable reason.

But, you know, in this case where we knew that every single Bitcoin that was transacted through the Silk Road was essentially proceeds of money laundering, that gives us the ability to start to look at transactions. And so if you kind of trace that through, we knew what the Bitcoin were. We knew where they were on the blockchain. We knew where the transactions were.

then we see an IP address pop up that was involved in a transaction of illegal Bitcoin. Then we can get a subpoena to find out who actually owns that IP address. And at that point, that's when we start putting positive identities on people. We start identifying real bank accounts. And certainly when we're talking about tax crimes or money laundering crimes, you know, as we see transactions go out, it may take a couple days of us doing surveillance, issuing subpoenas or whatnot. But we're going to find out who it is that we need to kind of be focusing on fairly quickly.

What can an IRSCI Special Agent learn from physical surveillance? Well, for a start, it identifies the suspect, putting a face to a name. Secondly, it can help to build up a profile. If he's young and computer savvy, he might just be your guy. If he's 82 and thinks a Mac is a kind of raincoat, then you might want to go back to the drawing board.

In this case, James Young's face fit. The IRS could move in. And once that happens, a court will allow us to, in this case, execute a search warrant looking for evidence or assets or anything that we have been able to articulate to the judge that it exists in that location, that it's of value to our investigation, and that in this case, it was fruits of a crime. Which brings us back to that day in late November 2021.

The day James Young's world came crashing down. We are gun-toting special agents, meaning we, for the most part, affect all of our own arrests and search warrants and seizure warrants and anything that we kind of think about U.S. federal law enforcement doing. And so this particular search warrant at Mr. Zhang's residence was a culmination of all this work that we've talked about. The agents place a shell-shocked Zhang under arrest. Part of him must have known that this was coming down the track.

He goes quietly. Whether we handcuff them or not kind of depends on the danger that they pose to our team as we go in. But what was interesting in this case is really what we found. The agents are looking for physical evidence of Zhong's ill-gotten fortune. This amount of digital currency wouldn't be kept on a device that connects to the internet. Too vulnerable to hacks. They're looking for something real and something small, easy to conceal.

We're looking through the house, trying to figure out what meets the terms of our warrant. They move through the house from room to room, appending, emptying, prodding and peering at the contents of Zhong's life. Until, bingo. We find this little computer chip that's in the bottom of a popcorn tin being hidden in a clothes hamper in the bathroom.

On the spot, the IRS team produced the necessary equipment to investigate the chip. We pull that out, scan it, figure out what's going on. There's 50,000, a little over 50,000 Bitcoin on that particular piece of equipment. The missing Bitcoin. At last. Almost a decade of watching, waiting and tracking had finally borne fruit. But wait, there's more.

We continue our search, looking around. We find a floor safe. Zhong had been a busy boy.

The IRS agents get to work cracking the safe open. When they do, they're pleasantly surprised by what they find. We get it open, there's a little over $660,000 in cash, in US currency, in the safe. There's 25 cashiest coins, which I up to this point had never heard of them, but they're actual physical Bitcoin. And those 25 coins were worth about 174 Bitcoins.

At the time, that modest haul alone was worth around $10.5 million. And that really was just the tip of the iceberg. And ultimately, the value of the Bitcoin on that date in which we seized it at the house was $3.35 billion. It's an astonishing sum. But remember... Crypto, and in this case Bitcoin, is completely worthless until you can convert it into something you can spend.

$3.3 billion on the back of a microchip and 25 physical coins that no bank in the world would accept. Liquidating that kind of money is no easy feat, not if you don't want to be asked some awkward questions by the likes of Tyler Hatcher.

To Mr. Zhang's credit, from the day we kicked in that door and did that search warrant and took possession of the majority of what was there, he's been pretty cooperative, you know, giving us the tokens and the passcodes to, you know, virtually everything we've asked for. So I think that a lot of, you know, these folks that stole Bitcoins, they either liquidated it right away because they had a business to run or they sat on it.

And I think Mr. Zhang is one of those folks that was just intimidated or scared to liquidate all that. I mean, I think we can all imagine it's probably going to raise a fairly large flag if you have little money and then the next day you have a lot. And how you facilitate that through the transactions to get that money out or start buying assets, that's going to raise some eyebrows. The funds the IRS seized from Zhang as part of the Silk Road haul

countered towards paying off the multi-million dollar restitutions owed by Ross Ulbricht, its founder. Nonetheless, Ulbricht is still facing life in a cell. Since the time of Zhang's arrest, the value of Bitcoin and the cryptocurrency market as a whole has plummeted. Thousands of people have made and lost fortunes.

So you might be thinking that crypto is more trouble than it's worth. The preserve of criminals and those who are easily parted with their money. But that's not how Tyler Hatcher sees it. He believes that blockchain technology isn't going anywhere soon and that in the right hands, it could change the world for the better.

There's absolutely room for it to be a great force for good, but obviously there'll be, you know, those who have illicit purposes for it and will use it for that. But, you know, there's absolutely a future in crypto. And I think if we look at the legitimate reasons for it and what legitimate companies are trying to do with it, more focused on the technology side than the actual assets of value side, there's an absolute market for it. Especially when we look at third world countries or countries that have

volatile financial systems, this kind of technology can really be a great help with them. I'm Sophia DiMartino. Join us next time for another Secret Liaison with True Spies. Get exclusive subscriber-only content and episodes first and ad-free with SpiceGate Plus on Apple Podcasts.