Diamond Hands

True Spies, Episode 220 - Diamond Hands

NARRATOR: This is True Spies, the podcast that takes you deep inside the greatest secret missions of all time. Week by week, you’ll hear the true stories behind the operations that have shaped the world we live in. You’ll meet the people who live life undercover. What do they know? What are their skills? And what would you do in their position? I’m Sophia Di Martino, and this is True Spies from SPYSCAPE Studios.

TYLER HATCHER: And we find this little computer chip that's in the bottom of a popcorn tin being hidden in a clothes hamper in the bathroom. We pull that out, scan it, and figure out what's going on. There's 50,000, a little over 50,000 Bitcoin on that particular piece of equipment. 

NARRATOR: Diamond Hands, Gainesville, Georgia. November 21, 2021. A young man is under arrest - flanked by federal agents. Behind him, their colleagues are tearing his home apart. He has something they want.

TYLER HATCHER: We go in. We're looking through the house, trying to figure out what meets the terms of our warrant.

NARRATOR: They’re there to seize the profits of an audacious act of fraud. The sum in question is immense. But they won’t find it in a deadlocked vault, or stuffed inside a mattress. They’re looking for something much smaller: a computer chip. And the agents need to move fast.

TYLER HATCHER: There's always that possibility in the hours leading up to a search warrant that by a flick of a computer's keystroke, that stuff's gone. 

NARRATOR: As the armed men scour the house, they leave no stone unturned. No hiding place is too innocuous. No nook or cranny too unlikely.

TYLER HATCHER: So we were looking for a number of things, of course, evidence of the crime. Looking for anything that would point us in the direction of, number one, the existence of those Bitcoin. 

NARRATOR: This is the story of a 21st-century heist and the investigators who used digital intelligence-gathering to bring the perpetrator to justice. And this is one of the True Spies who cracked the case.

TYLER HATCHER: My name is Tyler Hatcher. I'm the Special Agent in charge of IRS Criminal Investigation here in the Los Angeles field office.

NARRATOR: Let’s talk about crypto. Cryptocurrency, to be exact. Digital ‘coins’ that can be bought and sold for cash. The ‘currency’ aspect of cryptocurrencies is easy enough to grasp. Users purchase the coins, and their ownership of the asset is recorded on something called a ‘blockchain’.

TYLER HATCHER: A blockchain is essentially kind of another word for a distributed ledger technology, meaning it's essentially a record keeper. 

NARRATOR: You can visualize a blockchain as a massive spreadsheet. Most cryptocurrencies have their own dedicated ledger and there are thousands of cryptocurrencies out there. But when most people think of digital money, they’re thinking of one in particular - bitcoin. Bitcoin’s value isn’t set by governments or financial institutions. Its blockchain ledger is hosted on a decentralized series of ‘nodes’ all over the world and its value comes from its scarcity - that, and the market’s confidence in the technology’s future. That confidence saw the price of a bitcoin soar from pennies in 2009 to an all-time high of $69,000 per coin in November 2021. So - that’s the currency. But this is True Spies. Let’s talk about cryptography because that’s what makes the blockchain - and bitcoin - work.

TYLER HATCHER: The blockchain is typically a peer-to-peer system of keeping track of stuff. So when you and I… if we go buy something or trade something or transact something or store something, there's unique letters or numbers or symbols to be able to keep track of those things, but more importantly, identify who owns them or who controls them. 

NARRATOR: The blockchain serves as a public record of bitcoin transactions. Which is why Tyler keeps a close eye on it. IRS Criminal Investigation is the only US federal law enforcement agency that can investigate tax crimes. And no, we’re not talking about late filing.

TYLER HATCHER: It gives us a good launching point into every financial federal crime that the US has jurisdiction over. So that gives us expertise in organized crime, drug trafficking, international crimes, financial crimes of every sort, but more particularly into cyber and crypto. 

NARRATOR: And the IRS-CI, as Tyler’s agency is known, isn’t limited to American soil. Money makes the world go round, so they have to go around the world.

TYLER HATCHER: I spent a couple of years overseas for an IRS criminal investigation. We have 12 or, well 13 now, foreign offices where we work very closely with our foreign counterparts.

NARRATOR: At its outset, encrypted currency that could be exchanged for hard cash was an exciting prospect for tech-savvy criminals the world over. 

TYLER HATCHER: Back when I started 20 years ago, it was still easy to conduct essentially anonymous transactions using cash. The criminal element was always looking for ways to not only conduct transactions anonymously but do it timely. It was rather cumbersome to take several hundred thousand or millions of dollars and transport it from one location to another.

NARRATOR: But the mechanics of bitcoin weren’t always fully understood by its shadier users.

TYLER HATCHER: Crooks thought that it was anonymous and obviously that they could execute transactions in a matter of seconds rather than days or weeks or months. 

NARRATOR: But the thing about a currency that relies on a public blockchain ledger to track transactions is, well, it’s public, isn’t it? Which means that people like Tyler and his team at IRS Criminal Investigation, can see when funds move from one place to another. And with a bit of dedicated investigative work - and some specialized software - they can eke out nuggets of identifying data from those movements. An IP address, for example - is the digital signature that all your devices use to identify themselves online. That’s bad news for criminals hoping to keep their transactions private. Criminals like Ross Ulbricht - aka, the Dread Pirate Roberts, the founder of Silk Road.

TYLER HATCHER: Essentially, what the Silk Road was, it was an illicit marketplace. It was most notoriously known for sales of narcotics but you could certainly jump on there and buy stolen identities and stolen bank accounts and you could hire hitmen. I mean, it literally had every illicit good or service that you could think of was available for sale there.

NARRATOR: The Silk Road was hosted on what’s known colloquially as ‘the Dark Net’ - the Internet below the Internet you’ve used to find this podcast. It’s only accessible using specialized, highly encrypted browsers which, if used correctly, can offer the user near-total anonymity. Ross Ulbricht’s marketplace was the most successful darknet bazaar of its kind. Its users paid in bitcoin.

TYLER HATCHER: It had I think, a million-plus users or registered users on the platform.

NARRATOR: But in 2013, Ulbricht was arrested and the Silk Road was no more.

TYLER HATCHER: So, of course, we were involved in the original Silk Road takedown. It was us that identified Ross Ulbricht as the Dread Pirate Roberts and were able to tie that up and help with that takedown. But as you can imagine, in this kind of investigation, we executed search warrants and seizure warrants. And we were able to essentially seize the entirety of the Silk Road servers.

NARRATOR: At heart, Tyler and his team are accountants - gun-toting accountants, sure, but accountants all the same.

TYLER HATCHER: And as we went back and did our jobs as IRS investigation specialists, we wanted to know: where did all that money go? We know millions of bitcoins transacted through Silk Road. We know somewhere around 600,000 bitcoins were attributable to profit to Mr. Ulbricht or those who worked for Silk Road at that time.

NARRATOR: As we heard in the last episode of True Spies, Ulbricht was sentenced to life in prison. He was also ordered to pay back $183m - the total amount that the US government believed that Silk Road had generated in sales. But the Dread Pirate Roberts didn’t have that kind of money to hand. So, the IRS-CI needed to find out where all that crypto had wound up. 

TYLER HATCHER: Our job at the end of the day is not only to make sure that these criminals are caught and prosecuted and serve prison time as appropriate. But to make sure that they don't make off with any of their ill-gotten gains.

NARRATOR: The IRS are very good at what they do. During the original Silk Road investigation, they methodically traced the Silk Road’s records on the blockchain.

TYLER HATCHER: As we were going through and looking at that, we noticed a big chunk of bitcoin basically just missing.

NARRATOR: 50,000 bitcoin, to be exact.

TYLER HATCHER: Now, at the time I think Bitcoin was roughly $200 per coin. So we're talking about $1,000,000.

NARRATOR: A lot of money, sure, but nothing an experienced fraud investigator wouldn’t have seen before. For crypto investors, astronomical profits were still a fantasy - albeit one that was swiftly coming within reach.

TYLER HATCHER: We knew, because of some of our tools in the blockchain, and we kind of knew where it was to an extent, or at least that it existed. And we knew the value and we knew that it wasn't sitting in any of the Silk Road wallets or anything like that. 

NARRATOR: At the time, it was considered that Ross Ulbricht might have moved the funds to a separate crypto wallet - that’s software or hardware designed to store bitcoin. But as the law came crashing down on the Silk Road mogul, it became clear that the Dread Pirate had no access to the funds. Someone else had gotten hold of them. But the identity of the new owner of the 50,000 bitcoins was a mystery. And they were just sitting there. 

TYLER HATCHER: Crypto, and in this case, bitcoin, is completely worthless until you can convert it into something you can spend. And those are the things that we're watching. We're watching exchangers and any time transactions happen because those are when entries on the blockchain happen and we can identify some of that transactional data that'll help us trace that. 

NARRATOR: Without any transactions taking place, no new information was recorded in the blockchain, and there were no new opportunities for the investigators to investigate.

TYLER HATCHER: So we ultimately just sat on it for a decade. 

NARRATOR: In the world of cryptocurrencies, the 2010s were boom years, and early adopters suddenly found themselves sitting on piles of virtual money by the end of the decade. One of those people was James Zhong.

TYLER HATCHER: So we don't really know a lot about him. I mean, we know that he was fairly young.

NARRATOR: In 2012, James Zhong was in his early 20s. He had taken a prescient interest in bitcoin. An interest so strong that he was prepared to act outside of the law to get more of it.

TYLER HATCHER: But we didn't even know it was him we were looking for at that time.

NARRATOR: Zhong, as you’ve probably deduced by now, was the mysterious owner of the 50,000 bitcoin that so frustratingly eluded Tyler and the IRS. And no, he had nothing to do with the running of Silk Road. He’d acquired his fortune by targeting the criminals themselves.

TYLER HATCHER: Yeah, it's actually a pretty ingenious ‘scheme’, we'll call it. And I don't know how he came up with it. 

NARRATOR: How do you steal 50,000 bitcoin from the biggest darknet market on the planet? Well, it comes down to a simple truth: cryptocurrency, unlike cash or gold, is no more real than numbers on a screen. It exists in an almost entirely digital ecosystem. And if it’s digital, you can hack it.

TYLER HATCHER: He was a registered user, if you will, of Silk Road. 

NARRATOR: Back then, if you wanted to use Silk Road, you had to deposit bitcoin on the platform itself before you could use it to purchase anything. And we do mean anything. 

TYLER HATCHER: And he came up with a system whereby he had a pretty sophisticated computer system in his house, and he was able to open up several registered accounts under Silk Road. And we think that he originally funded those with between 200 and 2,000 Bitcoin at the time. 

NARRATOR: So Zhong had several Silk Road accounts, and each of them was loaded with a nominal amount of bitcoin. That money was now ‘real’ within the Silk Road systems.

TYLER HATCHER: But as soon as the bitcoin hit Silk Road, he would immediately transact hundreds of transactions.

NARRATOR: Using his sophisticated network of home computers, Zhong then withdrew the same bitcoins several times - so quickly that the Silk Road’s servers didn’t have time to register that the money was already gone before sending it again.

TYLER HATCHER: And so he essentially was able to withdraw bitcoin that he didn't actually have there.

NARRATOR: Ingenious, no? But at the time, Tyler and his colleagues at the IRS-CI weren’t able to deliver their personal congratulations to Zhong. They had no idea who he was.

TYLER HATCHER: It's unique in the sense that most of the time, at least with financial crimes, we know who the target is. We know who's conducted some of the transactions or we have a lead. And we usually know who we need to look at. This case was not that. It was actually kind of a fascinating case and certainly a lesson for us and really some patience by Mr. Zhong. 

NARRATOR: Patience is right. Zhong resisted the urge to sell off his ill-gotten crypto for immediate profit, instead choosing to weather a series of ups and downs in Bitcoin’s value. In the crypto community, that speaks to a mindset known as ‘diamond hands’ - holding on at all costs. And it paid off. By 2021, Zhong’s bitcoin was worth serious money. In the spring of 2019, his home in Athens, Georgia, was robbed. The thief, Zhong reported to the police, had made off with a briefcase containing $400,000 in cash and a USB thumb drive containing ‘personal information’. According to local police, the amount of stolen cash raised a red flag at the IRS. But without the thumb drive - which may or may not have contained information relating to his bitcoin holdings - there was nothing to suggest Zhong’s connection to the missing crypto. The break-in had no effect on Tyler’s investigation. Zhong resumed his life of quiet obscurity and his remaining assets continued to grow in value.

TYLER HATCHER: As we sat on it, we actually had a break in the case where a portion of the bitcoin was automatically made into bitcoin cash.

NARRATOR: Bitcoin cash is a kind of spinoff of the original Bitcoin cryptocurrency. It was developed by a faction of users who wanted a digital coin that was more suited to real-world transactions, as opposed to being a store of value, like a stock. When Bitcoin Cash launched, all users of traditional bitcoin received an equivalent amount of the new currency. Which meant that James Zhong now had 50,000 units of Bitcoin Cash worth much less than the original article, but not worth nothing. But Zhong didn’t want to spend his fortune yet. He was Mister Diamond Hands, after all. So he converted his Bitcoin Cash back into regular bitcoin. His faith in the asset was unshakeable.

TYLER HATCHER: And so, he did that conversion, and ultimately through a few international transactions that would bring it back into a usable format for him, we lucked out. 

NARRATOR: If the IRS were watching the missing 50,000 bitcoin on the blockchain. They were watching its Bitcoin Cash equivalent, too. Watching and waiting. Playing the long game.

TYLER HATCHER: He actually made a mistake. He used his own unmasked unhidden IP address to move or to transact something.

NARRATOR: People who trade in bitcoin - particularly early adopters - are likely to be security-conscious. For example, they’ll use software like VPNs - Virtual Proxy Networks - to hide their devices’ IP addresses online. Usually, James Zhong was no exception. He’d been so careful. But when the IRS-CI is on your case, one tiny slip-up can mean the end of the road. But for Tyler and his team, it’s not just a case of tracking the IP and showing up at the perp’s front door. There’s a process. If the IRS wants to spy on you, it needs a legally justifiable reason.

TYLER HATCHER: But, in this case, where we knew that every single bitcoin that was transacted through the Silk Road is essentially proceeds of money laundering. That gives us the ability to start to look at transactions. And so if you trace that through, we knew what the bitcoin was. We knew where they were on the blockchain, we knew where the transactions were. Then we see an IP address pop up that was involved in a transaction [of] illegal bitcoin. Then we can get a subpoena to find out who actually owns that IP address. And at that point, that's when we start putting positive identities on people. We start identifying real bank accounts. And certainly, when we're talking about tax crimes or money laundering crimes as we see transactions go out, it may take a couple of days of us doing surveillance or issuing subpoenas or whatnot. But we're going to find out who it is that we need to be focusing on fairly quickly. 

NARRATOR: What can an IRS-CI Special Agent learn from physical surveillance? Well, for a start, it identifies the suspect - putting a face to a name. Secondly, it can help to build up a profile. If he’s young and computer savvy, he might just be your guy. If he’s 82 and thinks a Mac is a kind of raincoat, then you might want to go back to the drawing board. In this case, James Zhong’s face fit. The IRS could move in.

TYLER HATCHER: And once that happens, a court will allow us to, in this case, execute a search warrant looking for evidence or assets or anything that we have been able to articulate to the judge that it exists in that location, that it's a value to our investigation, and that in this case, it was fruits of a crime.

NARRATOR: Which brings us back to that day in late November 2021. The day James Zhong’s world came crashing down.

TYLER HATCHER: We are gun-toting special agents, meaning we, for the most part, affect all of our own arrests and search warrants, the seizure warrants, and anything that we kind of think about US Federal Law Enforcement doing. And so, this particular search warrant of Mr. Zhang's residence was a culmination of all this work that we've talked about.

NARRATOR: The agents place a shell-shocked Zhong under arrest. Part of him must have known that this was coming down the track. He goes quietly.

TYLER HATCHER: Whether we handcuff them or not, kind of depends on the danger that they pose to our team as we go in. But what was interesting in this case is, is really what we found.

NARRATOR: The agents are looking for physical evidence of Zhong’s ill-gotten fortune. This amount of digital currency wouldn’t be kept on a device that connects to the Internet - too vulnerable to hacks. They’re looking for something real and something small. Easy to conceal.

TYLER HATCHER: We're looking through the house, trying to figure out what meets the terms of our warrant. 

NARRATOR: They move through the house from room to room, upending, emptying, prodding, and peering at the contents of Zhong’s life. Until… Bingo.

TYLER HATCHER: And we find this little computer chip that's in the bottom of a popcorn tin being hidden in a clothes hamper in the bathroom.

NARRATOR: On the spot, the IRS team produces the necessary equipment to investigate the chip.

TYLER HATCHER: We pull that out, scan it, figure out what's going on. There's 50,000 - a little over 50,000 - bitcoin on that particular piece of equipment. 

NARRATOR: The missing bitcoin at last. Almost a decade of watching, waiting, and tracking had finally borne fruit. But wait. There’s more. 

TYLER HATCHER: We continue our search looking around. We find a floor safe. 

NARRATOR: Zhong had been a busy boy. The IRS agents get to work cracking the safe open. When they do, they’re pleasantly surprised by what they find.

TYLER HATCHER: We get it open. There's a little over 660,000 in cash in US currency. In the safe, there are 25 Casascius coins, which up to this point, I had never heard of, but they're actual physical bitcoin. And those 25 coins were worth about 174 Bitcoins. 

NARRATOR: At the time, that modest haul alone was worth around $10.5m - and that really was just the tip of the iceberg.

TYLER HATCHER: And ultimately the value of the Bitcoin on that date when we seized it at the house was 3.35 billion.

NARRATOR: It’s an astonishing sum. But remember…

TYLER HATCHER: Crypto, and in this case, bitcoin, is completely worthless until you can convert it into something you can spend. 

NARRATOR: $3.3 billion on the back of a microchip and 25 physical coins that no bank in the world would accept. Liquidating that kind of money is no easy feat - not if you don’t want to be asked some awkward questions by the likes of Tyler Hatcher.

TYLER HATCHER: To Mr. Zhang's credit, from the day we kicked in that door and did that search warrant and took possession of the majority of what was there, he's been pretty cooperative - given us the tokens and the passcodes to virtually everything we've asked for. I think that a lot of these folks who stole bitcoins either liquidated it right away because they had a business to run. Or they sat on it. And I think Mr. Zhong is one of those folks who was just intimidated or scared to liquidate all that. I think we can all imagine it's probably going to raise a fairly large flag if you have little money and then the next day you have a lot and how you facilitate that through the transactions to get that money out or start buying assets. That's going to raise some eyebrows. ‍There's absolutely room for it to be a great force for good. But obviously, there will be those who have illicit purposes for it and will use it for that. But there's absolutely a future in crypto. And I think if we look at the legitimate reasons for it and what legitimate companies are trying to do with it, more focus on the technology side than the actual assets of value side, there's an absolute market for it. Especially when we look at third world countries or countries that have volatile financial systems this kind of technology can really be a great help with them.

NARRATOR: I’m Sophia Di Martino. Join us next time for another secret liaison with True Spies.‍