UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

Civil Action No. 20-606 (TJK)

UNITED STATES OF AMERICA,

Plaintiff,

v.

113 VIRTUAL CURRENCY ACCOUNTS et

al., 

Defendants.

MEMORANDUM OPINION

The United States seeks the forfeiture of 145 virtual currency accounts containing funds 

linked to alleged hacks of virtual currency exchanges by North Korean operatives. It alleges that, 

following those hacks, these accounts were each involved in a conspiracy to engage in three types 

of money laundering—concealment, promotion or international promotion money laundering—or 

are otherwise traceable to such property. For the reasons explained below, the Court will grant the 

United States’ motion for default judgment and order forfeiture of these virtual currency accounts, 

referred to as the Defendant Properties.1

Background 

A. Virtual Currency 

Bitcoin, Ether, and other so-called “cryptocurrencies” are types of virtual currency used in

online transactions. ECF No. 24 (“Sec. Am. Compl.”) ¶ 7. To send and receive funds, customers 

use unique addresses that function like email addresses: one user may have many and may even 

use a different one for each transaction. Id. ¶ 8. A customer must have a password, called a

1

 The United States has dismissed Defendant Property 146 from this action. ECF No. 35. 
2

“private key,” to transfer funds held at an address. Id. ¶ 9. Customers often conduct transactions 

on virtual currency exchanges, which are platforms offering trading between the U.S. dollar, 

foreign currencies, and virtual currencies. Id. ¶ 11. Exchanges also commonly offer virtual 

currency storage services to customers. Id.

Although transactions are recorded on a public ledger called a “blockchain,” the transacting 

parties are usually anonymous because each transaction is labeled with a complex series of 

numbers and letters, rather than individuals’ names or other identifying information. Sec. Am. 

Compl. ¶ 7. Law enforcement can, however, identify the parties through analysis of the 

blockchain. Id. ¶¶ 7, 12. Specifically, investigators create large databases that group transactions 

into “clusters” based on patterns identified in transaction data. Id. ¶ 12. Some individuals hoping

to elude such analysis will conduct “peel chains.” Id. ¶ 15. A peel chain occurs when a large 

quantity of virtual currency stored at one address is transmitted through a succession of other 

addresses. Id. ¶ 13. During each transaction, a small, inconsistent amount of virtual currency is 

“peeled off” into an exchange where the individual ultimately wants the virtual currency deposited. 

Id. The transactions continue until all the funds originally held at the first address are peeled off 

into the target exchange. Id. Sophisticated criminals often use peel chains comprising hundreds 

of transactions to hide the path of funds on the blockchain. Id. ¶ 15.

B. The North Korean Hacks and Money Laundering

In a 2019 report, a panel of experts established by the U.N. Security Council identified a 

series of hacks sponsored by North Korea targeting virtual currency exchanges. Sec. Am. Compl.

¶¶ 16–20. According to the panel, North Korean operatives routinely use large-scale cyberattacks 

to infiltrate accounts hosted by exchanges and other financial institutions. Id. ¶ 17. They then 

force transfers and launder stolen virtual currency through an elaborate series of transactions 

before converting it into fiat currency. Id. ¶ 19. The attacks raise money for North Korea’s 
3

weapons of mass destruction programs, with total proceeds at the time of the report estimated at 

up to $2 billion. Id. ¶ 17.

This case arises out of the United States’ investigation of similar hacks of four virtual 

currency exchanges, allegedly by North Korean operatives. Sec. Am. Compl. ¶¶ 2, 21. According 

to the Second Amended Complaint, in late 2018, U.S. authorities learned that Exchange 1 had been 

hacked and that the perpetrators had stolen almost $250 million in virtual currencies, including 

Bitcoin. Id. ¶ 27. To begin the attack, a person pretending to be a potential customer contacted an 

employee of the exchange. Id. ¶ 28. The employee unknowingly downloaded malware during the 

interaction, thereby providing the hackers with remote access to private keys. Id. ¶¶ 28, 30. Once 

the perpetrators used those keys to steal virtual currency, they covered their tracks by conducting 

hundreds of automated transactions in a peel chain layering process where much of the currency 

passed through, or was deposited into, the Defendant Properties. Id. ¶¶ 31–47. 

Eventually, much of the stolen Bitcoin was deposited into four accounts on two exchanges 

(Defendant Properties 56, 62, 67, and 70). Sec. Am. Compl. ¶ 59. These accounts belonged to 

two individuals, Tian Yinyin and Li Jiadong, who have been indicted for money laundering and 

operating an unlicensed money transmitting business in a separate case before the Court, United 

States v. Tian, 20-cr-52 (TJK).2 Id. ¶ 60. From 2018 to April 2019, Tian and Li engaged in 

$100,812,842.54 in virtual currency transactions, consisting primarily of virtual currency traceable 

to the hack of Exchange 1. Id. ¶ 62. After receiving stolen funds via peel chains from the North 

Korean operatives, Tian and Li further laundered the money by moving it between each other’s 

accounts and exchanging some for prepaid iTunes gift cards, a recognized method of money 

2 In all, Tian and Li owned over two dozen of the Defendant Properties: 55–62, 65–80, 

and 83–84. Sec. Am. Compl. ¶ 100.
4

laundering. Id. ¶¶ 67, 70–71. The two then set up multiple accounts at Chinese banks where they 

ultimately deposited the proceeds. Id. ¶¶ 64, 73.

Around December 2017, Exchange 2 announced that 17% of its total assets had been stolen 

in a hack that the U.N. Security Council’s expert panel attributed to North Korean actors. Sec. 

Am. Compl. ¶ 78–79. Some of Tian’s accounts were also used to launder the proceeds from the 

hack of this exchange, as were other accounts that had been used before to send funds to North 

Korean co-conspirator accounts. Id. ¶¶ 77, 81–82. About two years later, $48.5 million in virtual 

currency was stolen from Exchange 3, a South Korea-based exchange. Id. ¶ 83. Over the next 

several days, that money was transferred through multiple peel chains before being deposited into 

various exchanges. Id. ¶ 84. For instance, a portion of the stolen currency was deposited into 

Defendant Property 82 via several transactions about a week after it was stolen. Id. Some of the 

currency ended up in other Defendant Properties. Id. ¶¶ 86–90. In addition, in summer 2018, 

North Korean operatives stole about $30 million in virtual currency from Exchange 4, another 

South Korean exchange, and funds from this hack were deposited into accounts that controlled 

some of the Defendant Properties. Id. ¶¶ 36, 41.

C. Illegal Money Transmitting Business

As already noted, Tian and Li engaged in many transactions using funds traceable to the 

hack of Exchange 1. Sec. Am. Compl. ¶ 62. To do so, they would convert virtual currency into 

fiat currency for their clients in exchange for a fee. Id. Some of their clients were in the United 

States, and they sometimes used United States financial accounts to provide conversion services. 

Id. ¶ 98. An advertisement described their operation as a professional business and listed hours of 

operation and payment information. Id. ¶ 72. Despite transacting with clients and financial 

accounts based in the United States, Tian and Li never registered their operation with the Financial 
5

Crimes Enforcement Network (FinCEN) as a money transmitting business as required by law. Id.

¶¶ 69, 99.

D. Procedural History

The United States commenced this forfeiture action in early 2020 and, soon after, amended 

the complaint to add 33 more Defendant Properties. See ECF Nos. 1, 3. The United States posted 

notice online and served direct notice on Tian and Li, but received no response. ECF No. 5; ECF 

No. 17 at 27–28. The Clerk of Court entered default judgment against the Defendant Properties, 

ECF No. 16, and the United States moved for default judgment for the first time, ECF No. 17. The 

Court denied the United States’ motion without prejudice, see Minute Order of July 23, 2021, and 

a few months later the United States filed its Second Amended Complaint to clarify certain issues 

identified by the Court. 

The United States re-posted notice of this action on its forfeiture website for thirty days 

and emailed notice of this action and copies of the second amended complaint to known potential 

claimants, including Tian and Li. ECF No. 28; ECF No. 29 at 2. No one filed a claim in response 

to the direct notice or notice by internet publication by the deadlines to do so. ECF No. 29 at 3. 

The United States then identified more potential claimants to certain of the Defendant Properties, 

ECF No. 36, and sent notice of this action and copies of the Second Amended Complaint to 

fourteen more email accounts associated with those potential claimants, ECF No. 37 at 3. Once 

again, the deadline to file a claim passed without any party doing so. Id. Finally, based on the 

United States’ revised affidavit for default, ECF No. 37, the Clerk entered default, ECF No. 39, 

and the United States again moved for default judgment, ECF No. 40.

Legal Standard

District courts have the power to enter default judgment against defendants who fail to

appear and defend the case against them. Keegel v. Key W. & Caribbean Trading Co., 627 F.2d 
6

372, 375 n.5 (D.C. Cir. 1980). Although there is a strong preference for decisions on the merits, 

Whelan v. Abell, 48 F.3d 1247, 1258 (D.C. Cir. 1995), “the diligent party must be protected” when 

an unresponsive party obstructs the adversarial process, Gilmore v. Palestinian Interim Self-Gov’t 

Auth., 843 F.3d 958, 965 (D.C. Cir. 2016).

A plaintiff seeking default judgment must follow a two-step process. First, the plaintiff 

must ask the Clerk of Court to enter default against the unresponsive party. Fed. R. Civ. P. 55(a). 

Upon entry of default by the Clerk, the unresponsive party is considered to have admitted every

“well-pleaded allegation in the complaint.” Boland v. Providence Constr. Corp., 304 F.R.D. 31, 

35 (D.D.C. 2014). After the Clerk enters default, the plaintiff must petition the court to award a

default judgment. Fed. R. Civ. P. 55(b)(2). During the application process, the plaintiff “must 

prove [his] entitlement to the relief requested using detailed affidavits or documentary evidence 

on which the court may rely.” Ventura v. L.A. Howard Constr. Co., 134 F. Supp. 3d 99, 103 

(D.D.C. 2015) (cleaned up). The Supplemental Rules for Admiralty or Maritime Claims and Asset 

Forfeiture Actions govern pleading requirements for civil forfeiture actions and require (1) 

compliance with notice standards and (2) an adequate complaint. Fed. R. Civ. P. Supp. R. G(2),(4).

Analysis

A. Compliance with Notice Standards

Generally, forfeiture actions require that the United States publish notice publicly as well 

as serve notice directly upon “any person who reasonably appears to be a potential claimant.” Fed. 

R. Civ. P. Supp. R. G(4)(a),(b). The United States has done both here.

One way to provide public notice is by publication on an official government forfeiture site

for at least thirty straight days. Fed. R. Civ. P. Supp. R. G(4)(a)(iv)(C). The notice must “describe 

the property with reasonable particularity,” state the deadline to file a claim and to answer, and 

name the government attorney to be served with the claim and answer. Fed. R. Civ. P. Supp. R. 
7 

G(4)(a)(ii). To satisfy these requirements, after filing the Second Amended Complaint, the United 

States posted notice of this action on www.forfeiture.gov for thirty straight days, from December 

10, 2021, to January 8, 2022. ECF No. 28. The notice listed all virtual currency addresses that 

constitute the Defendant Properties, stated that any claimant had sixty days from the date of 

publication to file a verified claim and answer with the Court, and directed claimants to serve any

claim and answer on a designated Assistant United States Attorney. Id. at 2–6. Thus, the United 

States properly published notice of the forfeiture. 

As for direct service, United States “must send notice of the action and a copy of the 

complaint to any person who reasonably appears to be a potential claimant . . . by means 

reasonably calculated to reach the potential claimant.” Fed. R. Civ. P. Supp. R. G(4)(b)(i),(iii)(A). 

That rule requires only “that the government attempt to provide actual notice; it does not require 

that the government demonstrate that it was successful in providing actual notice.” United States 

v. $1,071,251.44 of Funds Associated with Mingzheng Int’l Trading Ltd., 324 F. Supp. 3d 38, 47

(D.D.C. 2018). Service via email is a valid form of service, particularly where the potential 

claimants are “international . . . whose locations are hard to pin down.” United States v. TwentyFour Cryptocurrency Accounts, 473 F. Supp. 3d 1, 6 (D.D.C. 2020). Here, the United States did 

just that. By tracing the path of the stolen funds, the United States identified two potential 

claimants—Tian and Li—and their email addresses. See ECF No. 40-1 at 24; Sec. Am. Compl. 

¶ 100. The United States then emailed notice to them on December 30, 2021, but never received 

a response. ECF No. 37 ¶ 10. And when the United States identified fourteen more potential 

claimants, it emailed notice to them on September 13, 2022, but likewise never received a 

response. Id. ¶¶ 13, 15. Accordingly, the United States accomplished direct notice as well. 
8

B. Adequacy of the Complaint

An adequate complaint must be verified, state the grounds for jurisdiction and venue, 

describe the property “with reasonable particularity,” specify the “statute under which the 

forfeiture action is brought,” and “state sufficiently detailed facts to support a reasonable belief 

that the government will be able to meet its burden of proof at trial.” Fed. R. Civ. P. Supp. R. 

G(2). The Second Amended Complaint meets most of these criteria for reasons needing little 

explanation. 

First, the Second Amended Complaint is verified. See Sec. Am. Compl. at 42.

Second, it states proper grounds for jurisdiction, and any venue challenge has been

forfeited. “This Court has jurisdiction over ‘any action or proceeding for the recovery or 

enforcement of any . . . forfeiture . . . incurred under any Act of Congress,’” including the two 

statutes, § 1956 and § 1960, under which this forfeiture action is brought. Twenty-Four 

Cryptocurrency Accounts, 473 F. Supp. 3d at 6 (quoting 28 U.S.C. § 1355(a)). Section 1956, in 

particular, provides for extraterritorial jurisdiction over money laundering offenses of more than 

$10,000 committed at least “in part” in the United States. 18 U.S.C. § 1956(f); see United States 

v. All Assets Held at Bank Julius Baer & Co., 571 F. Supp. 2d 1, 12 (D.D.C. 2008). Such 

jurisdiction includes conspiracy to commit a money-laundering offense under § 1956(h).

3

 And 

the United States has sufficiently shown that at least some transactions in the alleged conspiracy 

involved U.S.-based exchanges. See, e.g., Sec. Am. Compl. ¶ 67 (Tian held an account, among 

3 Section 1956(f) provides for “extraterritorial jurisdiction over the conduct prohibited by 

this section.” As the Fourth Circuit explained, “a conspiratorial agreement to launder money in 

contravention of § 1956(h) is conduct,” and thus the extraterritoriality provision of section 1956(f) 

applies to a money-laundering conspiracy offense under § 1956(h). United States v. Ojedokun, 16 

F.4th 1091, 1102–05 (4th Cir. 2021); cf. Whitfield v. United States, 543 U.S. 209, 215–18 (2005)

(reasoning that § 1956(h) creates a conspiracy “offense” rather than merely raising the penalty for 

money laundering).
9

the Defendant Properties, at “a U.S.-based exchange, where he sold [Bitcoin] in exchange for 

prepaid Apple iTunes gift cards, a known method of money laundering.”).4 As for venue, 

claimants forfeited any objection by defaulting. Henkin v. Islamic Republic of Iran, Nos. 18-cv1273 (RCL), 19-cv-1184 (RCL), 2021 WL 2914036, at *18 (D.D.C. July 12, 2021).

Third, it describes the property with reasonable particularity, given that it identifies the 145

cryptocurrency account addresses and details the complex series of transactions at issue. See 

United States v. 155 Virtual Currency Assets, No. 20-cv-2228 (RC), 2021 WL 1340971, at *5 

(D.D.C. Apr. 9, 2021) (complaint described property with reasonable particularity because it 

“identif[ied] the specific account and cluster numbers that sent, held, or received bitcoin and . . .

provid[ed] details about the transactions themselves”).

And fourth, it identifies the relevant forfeiture statute as 18 U.S.C. § 981, which subjects

“[a]ny property, real or personal, involved in a transaction or attempted transaction in violation of 

section 1956 . . . or 1960 of this title, or any property traceable to such property” to forfeiture. 18 

U.S.C. § 981(a)(1)(A); see also United States v. Miller, 911 F.3d 229, 232 (4th Cir. 2018) (property 

“forfeitable in its entirety, even if legitimate funds have also been invested in the property”); 

United States v. Huber, 404 F.3d 1047, 1058 (8th Cir. 2005) (both dirty and clean money subject 

to forfeiture). Even for property located outside the United States, the Court has jurisdiction to 

order its forfeiture under § 981. See United States v. All Assets Held in Account Number

XXXXXXXX, 83 F. Supp. 3d 360, 368 (D.D.C. 2015); Julius Baer, 251 F. Supp. 3d 82, 92 (D.D.C. 

2017).

4 Moreover, Tian and Li used funds traceable to the thefts to run a money transmitting 

business. Sec. Am. Compl. ¶ 62. To do so, they would convert virtual currency into fiat currency 

for their clients in exchange for a fee. Id. Some of their clients were in the United States, and they 

sometimes used United States financial accounts to provide conversion services. Id. ¶ 98. 
10

Evaluating the fifth and final element of an adequate complaint—whether it states 

“sufficiently detailed facts to support a reasonable belief that the United States would be able to 

meet its burden of proof at trial”—takes a little more work to unpack. See Fed. R. Civ. P. Supp. 

R. G(2)(f). The United States seeks forfeiture of the Defendant Properties on the theory that they 

were “involved in” a complex conspiracy to engage in three types of money laundering—

concealment, promotion, or international promotion money laundering—or are otherwise 

traceable to such property. See ECF No. 40-1 at 25; 18 U.S.C. § 981(a)(1)(A).

Before running through each type of money laundering at issue, the Court notes that as a 

general matter, “even otherwise untainted money may become ‘involved’ in a money laundering 

offense” for these purposes “where those funds are comingled with illicit proceeds” and “the 

government produces evidence that the legitimate funds were used to conceal the source of illicit 

proceeds.” United States v. Bikundi, 125 F. Supp. 3d 178, 194 (D.D.C. 2015) (citing United States 

v. Braxtonbrown-Smith, 278 F.3d 1348, 1351–55 (D.C. Cir. 2002)). 

1. Concealment Money Laundering

First, the Second Amended Complaint alleges that certain Defendant Properties were 

involved in a conspiracy to commit concealment money laundering in violation of 18 U.S.C. 

§ 1956(a)(1)(B) and (h) or are otherwise traceable to such property. See Sec. Am. Compl. 

¶ 123(b). To meet its burden, the United States has to show that Tian and Li conducted financial 

transactions knowing they were “designed in whole or in part” to, in relevant part, “conceal or 

disguise the nature, the location, the source, the ownership, or the control of the proceeds of 

specified unlawful activity.” 18 U.S.C. § 1956(a)(1)(B)(i). The United States must also show that 

Tian and Li knew that the property involved in those transactions “represent[ed] the proceeds of 

some form of unlawful activity.” 18 U.S.C. § 1956(a)(1). Financial transactions include those 

that “in any way or degree affect[] interstate or foreign commerce . . . involving the movement of 
11

funds by wire or other means” (which include virtual currency) or that involve “the use of a 

financial institution which is engaged in, or the activities of which affect, interstate or foreign 

commerce in any way or degree.” Id. § 1956(c)(4); see United States v. Budovsky, No. 13-cr-368 

(DLC), 2015 WL 5602853, at *13 (S.D.N.Y. Sep. 23, 2015). Financial institutions include, among 

other things, foreign or domestic banks and currency exchanges. 18 U.S.C. § 1956(c)(6); 31 

U.S.C. § 5312(a)(2). 

As described in the Second Amended Complaint, Tian and Li laundered proceeds of the 

thefts by conducting hundreds of automated transactions in a peel chain layering process designed 

“to obfuscate the [virtual currency] trail and decrease scrutiny.” Sec. Am. Compl. ¶¶ 32, 84, 88–

89, 91, 106. The D.C. Circuit “has recognized that such funneling of illegal funds through various 

fictitious business accounts is a hallmark of money laundering,” in particular, “an intent to 

conceal.” United States v. Bikundi, 926 F.3d 761, 784 (D.C. Cir. 2019) (citations and internal 

quotations omitted). Thus, the United States has shown that these transactions—in particular, 

those part of the peel chain layering process—were designed to conceal the source of the proceeds 

from the victim exchanges, and that Tian and Li shared that knowledge and intent.

These same transactions also satisfy the requirement of § 1956(c)(4), noted above, that they 

“in any way or degree” affect interstate or foreign commerce and involve virtual currency, or 

involve the use of banks or currency exchanges which are engaged in or “in any way or degree” 

affect interstate or foreign commerce. Most obviously, much of the funds ended up in foreign 

banks as part of the peel chain layering process. For example, over $30 million of the $250 million 

stolen from Exchange 1 were deposited into nine Chinese bank accounts that Li had linked to a 

particular Defendant Property. Sec. Am. Compl. ¶ 71. More generally, as is self-evident, the 
12

hundreds of transactions Tian and Li engaged in to conceal the origin of the stolen funds affected 

interstate or foreign commerce.

These transactions also involved the proceeds of unlawful activity. More than $250 million 

in virtual currencies was stolen from Exchange 1, and millions more were stolen from the other 

three exchanges. See Sec. Am. Compl. ¶ 27. The Second Amended Complaint sufficiently alleges

that those stolen funds resulted from wire fraud in violation of 18 U.S.C. § 1343, which is a 

specified unlawful activity for purposes of 18 U.S.C. § 1956. See id. ¶ 123(a); 18 U.S.C. 

§§ 1956(c)(7)(A), 1961(1); All Assets Held in Account Number XXXXXXXX, 83 F. Supp. 3d at 379 

(adopting reasoning that “as long as the government alleges specific facts supporting an inference 

that the funds are traceable to wire fraud and mail fraud, it has met its burden at the pleadings 

stage” in a forfeiture action (citation omitted)). And Tian and Li knew the funds were sourced 

illegally: they laundered funds stolen from the victim exchanges by conducting hundreds of 

automated transactions in a peel chain layering process where currency passed through, or was 

deposited into, the virtual currency accounts that make up many of the Defendant Properties. Sec. 

Am. Compl. ¶¶ 31–47. By engaging in that elaborate series of transactions to conceal the origin 

of the funds, they demonstrated sufficient awareness that the origin of those funds was illicit. See 

id. ¶¶ 101–02

In sum, the allegations in the Second Amended Complaint provide a reasonable basis to 

believe the United States could show at trial that Defendant Properties were involved in

concealment money laundering. 

2. Promotion Money Laundering

Next, the Second Amended Complaint alleges that certain Defendant Properties were 

involved in a conspiracy to commit promotion money laundering in violation of 18 U.S.C. 

§ 1956(a)(1)(A) and (h) or are otherwise traceable to such property. See Sec. Am. Compl. 
13

¶ 123(a). Many of the requirements noted above in the context of concealment laundering apply 

here as well. Conspirators must conduct “financial transactions,” as defined above, knowing they 

involved proceeds of some form of unlawful activity. 18 U.S.C. § 1956(a)(1). As the Court 

explained above, that condition is satisfied.5 And to meet its burden as to promotion money 

laundering, in particular, the United States has to show that Tian and Li conducted financial 

transactions “with the intent to promote the carrying on of specified unlawful activity,” which 

includes wire fraud in violation of 18 U.S.C. § 1343 as well as conducting an unlicensed money

transmitting business in violation of 18 U.S.C. § 1960. 18 U.S.C. §§ 1956(a)(1)(A)(i), 

1956(c)(7)(A), 1961(1). The Second Amended Complaint sufficiently alleges that Defendant 

Properties were involved in both these activities.

First, the Second Amended Complaint sufficiently alleges a money-laundering scheme in 

promotion of wire fraud. The promotion offense “is aimed . . . only at transactions which funnel 

ill-gotten gains directly back into the criminal venture.” United States v. Stoddard, 892 F.3d 1203, 

1214 (D.C. Cir. 2018) (citation omitted). That intent—to promote the underlying illegal activity—

can generally be shown by facts showing conspirators “benefited from, or had extensive 

knowledge about, the underlying illegal activity [they] [were] promoting.” Id. at 1214–15. The 

distribution of funds to co-conspirators qualifies as such promotion.6 And here, conspirators 

5 As above, the financial transactions alleged here either affect interstate or foreign 

commerce and involve virtual currency or involve the use of banks or currency exchanges which 

are engaged in or affect interstate or foreign commerce. See 18 U.S.C. § 1956(c)(4). 

6 See United States v. Valasquez, 55 F. Supp. 3d 391, 398 (E.D.N.Y. 2014) (“[T]he Court 

concludes that a reasonable trier of fact could have found beyond a reasonable doubt that defendant 

joined a conspiracy that intended to promote Hobbs Act robberies and marijuana distribution by 

distributing the proceeds of robberies to the coconspirators. Critically, there was sufficient 

evidence that the defendant participated in an ongoing conspiracy to commit multiples Hobbs Act 

robberies.”); United States v. Kelley, 471 F. App’x 840, 845 (11th Cir. 2012) (“The Government 

presented sufficient evidence that the monthly dividend payments were designed to give the 
14

distributed funds to other participants in the conspiracy to, as alleged, “compensate them and 

thereby promote their continued participation in subsequent hacking activities.” Sec. Am. Compl. 

¶ 103. Moreover, proceeds from the thefts were used to pay for infrastructure perpetuating the 

scheme, such as domain registration, site hosting from service providers that focus on client 

anonymity, and virtual private networks. Id. ¶ 48. For instance, North Korean operatives 

registered the domain “celasllc.com,” which purported to offer a virtual currency trading platform 

called Celas Trade Pro. Id. ¶ 49. Forensic analysis revealed that Celas Trade Pro was a malicious 

software code that provided conspirators access to the downloader’s system. Id. Funds from the 

thefts of the victim exchanges were used to pay for the registration of business email services for 

that domain. Id. ¶ 48.7

 Thus, the allegations in the Second Amended Complaint provide a 

reasonable basis to believe that the United States could show at trial that Tian and Li acted with 

the intent to promote wire fraud.

Second, the Second Amended Complaint sufficiently alleges that Tian and Li conducted 

financial transactions with the intent to promote their unlicensed money transmitting business. 

The United States asserts that stolen funds were used in an unlicensed money transmitting business 

principal players in the steroid distribution scheme an incentive to continue their activities despite 

the risks inherent in such activity.”) (citations omitted); United States v. Arthur, 432 F. App’x 414, 

421 (5th Cir. 2011) (“We have little difficulty concluding that Ebhamen’s payments to Fleming 

evince the intent to contribute to the growth, enlargement, or prosperity of the conspiracy. Indeed, 

the payments were the lifeblood of the conspiracy. . . . If the payments stopped, there is little doubt 

Fleming would have ended the relationship with Ebhamen, denying her the opportunity to profit 

further from the conspiracy.”).

7 Security researchers also determined that Celas LLC, the entity that offered Celas Trade 

Pro, shared a server IP address and an encryption key with Fallchill, a known malware associated 

with the North Korean government. Sec. Am. Compl. ¶ 50. The perpetrators who emailed the 

malware to Exchange 1 also conducted a phishing campaign to infect other users with malware, 

targeting thousands of email accounts at exchanges around the world, including ones belonging to 

CEOs of major exchanges. Id. ¶¶ 54–55.
15

that Tian and Li illegally operated without registering with FinCEN, in violation of 18 U.S.C. 

§ 1960. Sec. Am. Compl. ¶¶ 62, 99. An “unlicensed money transmitting business” is a business 

that “transfer[s] funds on behalf of the public by any and all means including but not limited to 

transfers within this country or to locations abroad by wire.” 18 U.S.C. § 1960(b)(1),(2). Courts 

have broadly construed this term to cover businesses transmitting money—including virtual 

currencies—for a fee on behalf of third parties in a commercial or business relationship, rather 

than a personal or familial one, in more than one isolated transaction.8

Tian and Li are alleged to have engaged in $100,812,842.54 worth of virtual currency 

transactions for their clients, including customers and financial accounts located in the United 

States. Sec. Am. Compl. ¶¶ 62, 98. For a fee, they would convert virtual currency to fiat currency 

and transfer it to customers. Id. ¶ 62. An advertisement for their services described the operation 

as a professional business, noting their hours and payment information. Id. ¶ 72. Thus, the 

allegations in the Second Amended Complaint provide a reasonable basis to believe that the United 

States could show at trial that Tian and Li acted with the intent to promote this unlicensed money 

transmitting business. See United States v. 50.44 Bitcoins, No. 15-cv-3692 (ELH), 2016 WL 

3049166, at *2 (D. Md. May 31, 2016) (granting motion for default judgment and ordering 

forfeiture of virtual currency involved in unlicensed money transmitting business).

8 See, e.g., United States v. Velastegui, 199 F.3d 590, 592, 595 n.4 (2d Cir. 1999); United 

States v. $215,587.22 in U.S. Currency Seized from Bank Acct. No. 100606401387436 held in the 

Name of JJ Szlavik Companies, Inc. at Citizens Bank, 306 F. Supp. 3d 213, 218–20 (D.D.C. 2018); 

United States v. E-Gold, Ltd., 550 F. Supp. 2d 82, 88 (D.D.C. 2008) (“funds” not limited to cash 

and may include forms of virtual currency transferred by wire); United States v. Harmon, 474 F. 

Supp. 3d 76, 106 (D.D.C. 2020) (“FinCEN has long considered transfers of funds from one unique 

[virtual currency] account to another . . . to amount to a change of the funds’ location.”).
16 

3. International Promotion Money Laundering 

Finally, the Second Amended Complaint alleges that certain Defendant Properties were 

involved in a conspiracy to commit international promotion money laundering in violation of 18 

U.S.C. § 1956(a)(2)(A) and (h) or are otherwise traceable to such property. See Sec. Am. Compl. 

¶ 123(c). This statute prohibits the movement of funds across the border of the United States “with 

the intent to promote the carrying on of specified unlawful activity.” 18 U.S.C. § 1956(a)(2)(A). 

Again, specified unlawful activities include wire fraud as well as operation of an unlicensed money 

transmitting business. Id. §§ 1956(7)(A), 1961(1). And as above, the term “promote” means to 

make the underlying illegal scheme easier by “funnel[ing] ill-gotten gains directly back into the 

criminal venture.” See Stoddard, 892 F.3d at 1214 (citation omitted).

While operating their unlicensed money transmitting business, Tian and Li are alleged to 

have transacted with individuals within the United States and sometimes used U.S. financial 

institutions—as well as those outside the country—to do so. See Sec. Am. Compl. ¶¶ 69, 98. For 

a fee, they would transfer virtual currency—often derived from the exchange hacks—in exchange 

for fiat currency. Id. ¶ 98. And the Second Amended Complaint alleges that, as above, “such 

transactions were intended to promote the operation of an unlicensed money transmitting business 

and the ongoing wire fraud scheme.” ECF No. 40-1 at 36. Thus, the allegations in the Second

Amended Complaint provide a reasonable basis to believe the United States could show that 

Defendant Properties were involved in international promotion money laundering. See 

Mingzheng, 324 F. Supp. 3d at 40 (awarding default judgment after the government presented facts 

supporting belief that front company laundered funds through U.S. financial system on behalf of 

North Korea); United States v. Piervinanzi, 23 F.3d 670, 680 (2d Cir. 1994) (Section 1956(a)(2)(A) 

“penalizes an overseas transfer with the intent to promote the carrying on of specified unlawful 

activity.” (internal quotation and citation omitted)).
17

4. Conspiracy

As for a conspiracy to engage in any of these forms of money laundering, the United States

needs to show that there was a knowing and voluntary agreement to commit an offense. United 

States v. Alexander, 857 F. App’x 592, 594 (11th Cir. 2021) (quoting United States v. Broughton, 

689 F.3d 1260, 1280 (11th Cir. 2012)); see United States v. Farrell, No. 3-cr-311-1 (RWR), 2005 

WL 1606916, at *4 (D.D.C. July 8, 2005). Such an agreement may be shown by circumstantial 

evidence suggesting “a unity of purpose or a common design and understanding.” American 

Tobacco Co. v. United States, 328 U.S. 781, 810 (1946); see also United States v. All Assets Held 

in Account Number XXXXXXXX, 83 F. Supp. 3d 360, 378 (D.D.C. 2015) (“As for whether the 

complaint alleges a conspiracy to launder money, [t]he government does not need to allege facts 

that demonstrate an explicit agreement; rather [p]roof of a tacit, as opposed to explicit, 

understanding is sufficient to show agreement.” (internal quotation marks and citation omitted)). 

It does not require proof of an overt act. Whitfield v. United States, 543 U.S. 209, 219 (2005).

The Second Amended Complaint alleges a scheme to engage in an intertwined series of 

transactions that would conceal the origin of funds stolen in North Korean hacks. Sec. Am. Compl. 

¶¶ 16–20, 97. As part of this scheme, Tian and Li engaged in recognized money laundering 

practices, such as moving the stolen funds between their own virtual currency accounts and 

exchanging some of the virtual currency for iTunes gift cards. See id. ¶¶ 67, 71, 74–75. They 

repeated the same practices exchange to exchange: the two used common accounts to launder 

stolen funds from the various exchanges, executed transfers across those accounts, and submitted 

similarly falsified identification photos to many of the exchanges. Id. ¶¶ 36, 59–60, 63, 77, 81, 

94. This conduct follows a pattern that North Korean operatives have used to launder funds for 

the sanctioned regime, which cannot otherwise access the U.S. financial system. Id. ¶¶ 16–20. 

Thus, the allegations in the Second Amended Complaint have established a reasonable basis to 
18 

conclude that the United States could show a conspiracy to engage in these forms of money 

laundering, and that Tian and Li were knowing and voluntary participants in the conspiracy. See 

Mingzheng, 324 F. Supp. 3d at 40 (awarding default judgment after the Government presented 

facts supporting belief that front company laundered funds through U.S. financial system on behalf 

of North Korea).

* * * 

The Court has scrutinized the relationship of the Defendant Properties to the offenses 

outlined above and finds that the United States has sufficiently shown that under one or more 

theories each is subject to forfeiture as property “involved in a transaction or attempted transaction 

in violation of section 1956” outlined above or otherwise constitutes “property traceable to such 

property.” 18 U.S.C. § 981(a)(1)(A). Thus, the fifth and final element of an adequate complaint 

is satisfied. The Court finds that Second Amended Complaint “state[s] sufficiently detailed facts 

to support a reasonable belief that the government will be able to meet its burden of proof at trial.” 

Fed. R. Civ. P. Supp. R. G(2). 

Conclusion 

For all the above reasons, the Court will grant the United States’ Motion for Default 

Judgment and order the forfeiture of the Defendant Properties. A separate order will issue.

/s/ Timothy J. Kelly 

TIMOTHY J. KELLY

United States District Judge

Date: March 5, 2024