Defense Raises Possibility of a Mistrial Over Allegedly Misleading ‘Victim’ Witness Testimony in Roman Storm Trial

NEW YORK — Lawyers for Tornado Cash developer Roman Storm told a judge on Monday that they are considering filing a motion for mistrial following new revelations that the government may have inaccurately traced the proceeds of a pig butchering scam to the privacy tool.

The scam victim, a Taiwan-born Georgia woman named Hanfeng Ling, testified on the first day of Storm’s trial that she lost approximately $250,000 to a wrong-number Whatsapp scam. After the scam, Ling and her husband hired a so-called “crypto recovery service” called Payback, which traced a portion of her funds to Tornado Cash and suggested that she email them to ask for help. When Ling emailed Tornado Cash’s general email address, she received no response — which the prosecution attempted to paint as evidence of Storm’s disinterest in hack and scam victims’ plight.

However, over the weekend, blockchain sleuth and MyCrypto founder Taylor Monahan (aka @tayvano_X) posted a thread on X explaining that Ling’s funds did not, in fact, travel through Tornado Cash. Monahan explained that she found Ling’s crypto transactions in an unrelated 2023 case involving NTU Capital, the scam company that Ling transferred her crypto to. In investigating the flow of Ling’s funds, Monahan said that none of Ling’s money went to Tornado Cash, but explained how an inexperienced tracer — such as Payback (which she called “bumbling f******idiots”) — could be thrown off track due to the use of instaswappers while tracing. In addition to her X thread, Monahan produced a tracing report containing the precise details of Ling’s transactions.

Several other blockchain sleuths, including well-known pseudonymous investigator ZachXBT, have since confirmed Monahan’s analysis. Payback did not respond to CoinDesk’s request for comment by press time.

“Idk how you mess up the tracing that bad as a firm to where you couldn’t properly follow instant exchange deposits 1 hop from a theft address and then follow subsequent txns down the wrong path to Tornado…” ZachXBT wrote on X on Monday. “”It’s unfortunate these predatory firms come up as the first search results on Google when victims look for help.”

David Patton, a lawyer for Storm and a partner at Hecker Fink LLP, told District Judge Katherine Polk Failla that the defense team attempted to trace Ling’s funds over the weekend and were unable to find a connection between her money and Tornado Cash. Patton told the court that he “would assume’ that the government would have confirmed that Ling’s funds flowed through Tornado Cash ahead of trial, and expected that the government’s relevant expert witness — Federal Bureau of Investigation (FBI) Agent Joel DeCapua, a supervisory special agent in the FBI’s Cyber Unit — would have testified as to the link between Ling and Tornado Cash. Earlier in the day, however, DeCapua admitted he was not asked by prosecutors to investigate the link between Ling’s funds and Tornado Cash and was thus unable to testify to it.

Lead prosecutor Nathan “Thane” Rehn pushed back against the allegations, telling the judge that another government witness — an Internal Revenue Service (IRS) agent — would be able to testify to the connection between Ling’s funds and Tornado Cash, saying that it was “very straightforward” and “a few short hops” between Ling’s money and the privacy software.

Failla told the court that, with no blockchain tracing expertise herself, she couldn’t be sure whether Ling’s transactions could actually be traced back to Tornado Cash.

“I simply don’t know,” she said.

FBI on the stand

The bulk of Monday’s witness testimony came from FBI Agent Joel DeCapua, who gave the jury an overview of 16 major crypto hacks — including the hacks of Kucoin in 2020, BitMart in 2021 and the Ronin Network in 2022 — that saw outflows to Tornado Cash.

Upon cross examination, Patton asked DeCapua if he was aware that NTU Capital — the scam front that victimized Ling — ran over $100 million in crypto scams. DeCapua replied that he was not. Patton asked DeCapua if he had traced other big-name crypto hacks, such as the $320 million hack of Wormhole in 2022.

“Never even heard of that one,” DeCapua said.

DeCapua also professed having no knowledge of in-person crimes involving crypto such as kidnappings or so-called “wrench attacks,” which have seen a dramatic uptick this year across Europe and the U.S.

“Hypothetically that could happen,” DeCapua said when asked whether such risks were possible.

When asked whether it was true that both regular people and criminals used virtual private networks (VPNs) DeCapua said that, while it was true that lots of ordinary people used VPNs on their work computers, “it would be very strange” for normal people to use VPNs outside of work.

“I don’t think a regular person would use a VPN in their everyday communications,” DeCapua said.