United States v. Sterlingov: D.C. Circuit Affirms Bitcoin Fog Convictions, Upholds Chainalysis Evidence
The D.C. Circuit has affirmed the conviction and 150-month sentence of Roman Sterlingov, the man a jury found operated the bitcoin mixer Bitcoin Fog. The court rejected every argument he raised. Several of those rulings will shape how federal prosecutors investigate and try cryptocurrency money laundering cases, and how defense counsel challenge them.
United States v. Sterlingov, No. 24-3161 (D.C. Cir. Sept. 25, 2026). Opinion by Judge Wilkins, joined by Judges Millett and Pillard.
Affirmed convictions for money laundering conspiracy under 18 U.S.C. § 1956(h), sting money laundering under § 1956(a)(3), operating an unlicensed money transmitting business under 18 U.S.C. § 1960, and unlicensed money transmission under D.C. Code § 26-1023(c). Affirmed a 150-month sentence.
Overview: A Mixer Prosecution Decided Under a Changed Enforcement Policy
Bitcoin Fog ran from 2011 until April 2021. Prosecutors said it processed about $400 million in bitcoin, much of it tied to darknet drug markets. The investigation, indictment, and 2024 trial all took place under the prior administration's approach to digital asset enforcement. When the jury returned its verdict, DOJ announced that any cryptocurrency service reaching the United States must follow U.S. law, wherever it operates.
The policy landscape has since shifted. On April 7, 2025, Deputy Attorney General Todd Blanche issued a memorandum titled Ending Regulation by Prosecution. It directs prosecutors to stop targeting mixing and tumbling services "for the acts of their end users or unwitting violations of regulations." The memo preserves cases involving narcotics, terrorism, human trafficking, organized crime, hacking, and cartel and gang financing. In March 2026, Treasury told Congress in its GENIUS Act report on illicit finance that lawful users may rely on mixers to protect financial privacy on public blockchains.
The policy change narrowed mixer prosecutions. It did not end them. Bitcoin Fog is the type of case the memo's exceptions preserve: a custodial service that, on the trial evidence, processed darknet narcotics proceeds. In New York, prosecutors continue to pursue Tornado Cash developer Roman Storm. A jury convicted Storm in August 2025 of conspiring to operate an unlicensed money transmitting business and deadlocked on money laundering and sanctions counts. His retrial on those counts is set for April 2027, and his motion for acquittal remained pending as of late August 2026.
Sterlingov now supplies appellate authority on the evidence these prosecutions depend on. The opinion addresses venue built on undercover transactions, the admissibility of Chainalysis Reactor, defense access to proprietary source code, willful blindness inferred from platform design, and the sentencing value of commingled funds.
Background: Bitcoin Fog and the Government's Evidence
Bitcoin Fog pooled deposits from many users and paid withdrawals from the same pool. That breaks the visible link between a deposit and a later withdrawal on the blockchain. The service launched in 2011 under the alias "Akemashite Omedetou." The government alleged that the alias belonged to Sterlingov.
The government tied Sterlingov to the platform through an IP address overlap analysis, his 2011 online interest in other mixers, and 2012 posts recommending the darknet market Silk Road. It tied the platform to crime through blockchain clustering. Using Chainalysis Reactor, government experts attributed more than 900,000 bitcoin addresses to Bitcoin Fog and traced transfers to and from darknet markets including Silk Road, AlphaBay, and Agora.
Platform design also featured prominently. Bitcoin Fog deleted its records weekly. It randomized fees to frustrate withdrawal tracing. Its administrator promised the service would never cooperate with authorities.
Sterlingov was arrested at Los Angeles International Airport in April 2021. It was his second trip to the United States. Bitcoin Fog stopped operating two days later. A jury convicted him on all four counts in March 2024.
The jury also returned forfeiture verdicts on about 1,354 bitcoin held in a Bitcoin Fog wallet and on $349,625 and other cryptocurrency held in Sterlingov's Kraken accounts, according to the U.S. Attorney's Office for the District of Columbia. Each money laundering count carries a 20-year statutory maximum. Each licensing count carries five years.
Key Holdings
Venue: An Undercover Withdrawal in Washington Supported Every Count
Venue was the centerpiece of the appeal. Sterlingov never operated in the District of Columbia. The government built venue there through a federal special agent working from his D.C. office.
In 2019, the agent opened a Bitcoin Fog account, deposited about $250 in bitcoin, and withdrew it. In November 2019, he funded the account from a darknet market account. He then told the platform's administrators through its chat function that he was cleaning proceeds from ecstasy sales. No one replied. He withdrew the funds anyway.
The court held that venue was proper for all four counts. The government's burden was a preponderance of the evidence, and the court viewed the evidence in the government's favor.
Sting money laundering. The money laundering statute, 18 U.S.C. § 1956(i), places venue in any district where a financial transaction is conducted and treats a transfer of funds as a single, continuing transaction. The agent received the funds in D.C. That was enough. Sterlingov argued that no evidence showed the administrators read the agent's message. The court held that the argument went to guilt, not venue. It also held that the jury could infer that Sterlingov or a co-conspirator read the message because he administered the platform and the chat function worked.
Conspiracy. Section 1956(i)(2) permits venue wherever an act in furtherance of the conspiracy occurred. Transferring bitcoin to and from the agent in D.C. qualified. The court held that the involvement of a government agent in triggering the transaction did not defeat venue, citing United States v. Sitzmann, 893 F.3d 811 (D.C. Cir. 2018).
Unlicensed money transmission. Neither 18 U.S.C. § 1960 nor the D.C. statute has its own venue provision. The court asked where the conduct constituting the offense occurred. Sterlingov conceded that serving D.C. customers would suffice. The sting showed Bitcoin Fog received funds from and sent funds to a person in the District. D.C. law required a license. Bitcoin Fog had none. Under Johnston v. United States, 351 U.S. 215 (1956), the place where a legally required act must be performed fixes the situs of a failure-to-act offense.
Venue entrapment. Sterlingov argued that a single unanswered message and a small transaction let prosecutors manufacture venue anywhere. The court did not decide whether manufactured venue is a valid doctrine. It held the theory failed on these facts. Bitcoin Fog served users worldwide without regard to location. The agent did not lure it to the District.
For operators of global platforms, the practical reach of this holding is broad. One undercover transaction from a chosen district can anchor venue for laundering, conspiracy, and licensing counts together.
Statute of Limitations: Continuing Offenses and Unknown Co-Conspirators
Most of the darknet markets the government featured at trial shut down before 2017. Sterlingov argued that the government therefore proved no criminal conduct within the limitations periods.
The court disagreed. The November 2019 sting fell within the limitations periods for the substantive laundering and licensing counts. The conspiracy count presented a closer question. It was first charged on July 18, 2022. The last identified transaction between Bitcoin Fog and a named darknet market, AlphaBay, occurred on July 5, 2017. That was 13 days outside the window.
The court held that the jury could infer the conspiracy continued with unknown co-conspirators. Bitcoin Fog kept operating and kept earning money until Sterlingov's arrest in 2021. The 2019 sting added support. Conspiracy is a continuing offense. The limitations period begins only when it ends.
Chainalysis Reactor Survived Rule 702 Without Peer Review or a Known Error Rate
This is the ruling practitioners will cite most. Two government experts relied on Chainalysis Reactor, a proprietary tool that groups bitcoin addresses into clusters controlled by a single entity. Reactor uses three heuristics. The co-spend heuristic assumes that addresses used together as inputs to one transaction share an owner. The behavioral heuristic applies a proprietary algorithm to transaction patterns, including change address analysis. Intelligence-based clustering adds off-chain data from leaks, court records, and data partnerships.
Both experts conceded that Reactor had not been peer reviewed. Neither knew its error rate. Sterlingov argued that those concessions defeated admissibility under Federal Rule of Evidence 702 and Daubert.
The court held otherwise. The Daubert factors are not a checklist, and Kumho Tire gives trial courts broad latitude in assessing reliability. The court identified four other indicators of reliability:
Anecdotal accuracy in controlled settings. Each expert testified that, across many reviews, neither could recall a Reactor attribution later shown wrong when checked against subpoena returns and other legal process. The court distinguished Eleventh Circuit cases rejecting anecdotal evidence. Those cases involved anecdotes offered to rebut controlled population studies.
General acceptance. Law enforcement and private-sector investigators use Reactor widely. Sterlingov argued that market acceptance is not scientific acceptance. The court rejected the distinction, relying on United States v. Morgan, 45 F.4th 192 (D.C. Cir. 2022).
External corroboration. A government contractor had confirmed that Reactor correctly clustered and attributed 99.9 percent of a large set of addresses in a different case.
A case-specific test. One expert searched the Bitcoin Fog cluster for the five addresses used in the undercover transactions. Reactor had attributed four of them to Bitcoin Fog. Sterlingov called that a 20 percent error rate. The court adopted the district court's view that Reactor is deliberately conservative and underinclusive, which is no reason to doubt the attributions it does make.
The last point deserves attention. A missed address is a false negative. It understates the volume attributed to a platform. A false positive attributes someone else's address to the defendant. The two errors carry different consequences for a defendant. The opinion credits the tool's conservatism. Its reasoning does not address false positive risk directly, because the record did not quantify it.
The opinion also does not separately analyze the December 2023 amendment to Rule 702, which requires the proponent to show each admissibility requirement is more likely than not satisfied. Future challenges may press that standard more directly.
The IP Overlap Analysis Was Admissible Despite Being a First-Time Method
A former FBI task force officer compared login records for accounts tied to Sterlingov and to Bitcoin Fog. She identified shared IP addresses, narrowed the data to connections closest in time, and concluded that the same user likely accessed both sets of accounts. On cross-examination, she admitted it was her first time using that specific method and that it had not been peer reviewed.
The court held the testimony admissible. She explained her filters and time windows. She had experience analyzing IP login patterns. Her method rested on accepted experience in her field. The defense cross-examined her at length. In a footnote, the court declined to decide whether her conclusion that the same user "likely" accessed both sets of accounts was itself unsupported opinion. Sterlingov had not raised that argument.
No Right to Reactor's Source Code on This Record
Sterlingov sought Reactor's source code. The district court asked him to explain why it was material. He never did. The court instead ordered Chainalysis to disclose Reactor's heuristics and underlying assumptions to defense counsel and qualified experts under a protective order. Under Federal Rule of Criminal Procedure 16(d)(1), it barred Sterlingov from reviewing that material himself. The court reasoned that the disclosures could serve as a roadmap for evading blockchain tracing, and Sterlingov was accused of running a service built for that purpose. The court later denied his motion for leave to issue a subpoena for the code under Federal Rule of Criminal Procedure 17(c).
On appeal, Sterlingov raised the Confrontation Clause and due process. Both claims failed.
Confrontation Clause. Reviewing for plain error, the court found no reason to depart from the Sixth, Ninth, and Eleventh Circuits. Those courts hold that machine-generated outputs are not testimonial statements. Sterlingov argued that Reactor embeds human judgments about heuristics and off-chain data. The court answered that, even if so, any confrontation right would run against the programmers. It would not require production of source code.
Due process. Sterlingov did not challenge the Rule 17(c) ruling in his opening brief. That forfeited the issue. Treated as an independent claim, it still failed. He never explained why the code itself mattered, and his counsel already had the heuristics.
The protective order. The court upheld the restriction on Sterlingov's personal access. The indictment and surrounding circumstances supplied good cause, notwithstanding the presumption of innocence. A footnote records that defense experts said they would not review the Reactor disclosures under any protective order.
The source code ruling rests on the defense's failure to make a materiality showing. It does not hold that source code is never discoverable. A request tied to a specific attribution, a specific heuristic, and a specific defense theory stands on different footing.
Willful Blindness Inferred From Platform Design
The district court instructed the jury that it could find knowledge if Sterlingov deliberately closed his eyes to what would otherwise have been obvious. The instruction tracked the Supreme Court's standard in Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (2011): a subjective belief that a fact is highly probable, plus deliberate action to avoid learning it. Jurors were told that negligence, recklessness, carelessness, or foolishness would not suffice.
The D.C. Circuit has cautioned that the instruction belongs only in rare circumstances. The parties agreed it is proper when a defendant claims a lack of guilty knowledge and the evidence supports an inference of deliberate ignorance.
Sterlingov argued that his defense was identity. He claimed he never ran Bitcoin Fog at all. The court found that he also contested knowledge by arguing that no one proved he saw the agent's drug-proceeds message. That satisfied the first condition.
The second condition rested on design. Bitcoin Fog deleted records weekly. It had no account verification. It asked users nothing. The court held that a jury could infer those features were chosen so the operator would not learn what users were doing.
Features marketed as privacy protections became evidence of intent. That reasoning will follow any custodial service that avoids collecting customer information. It also reaches beyond mixers. Knowledge is usually the contested element in crypto laundering trials, particularly for defendants who moved funds without controlling the upstream scheme.
Welcome to Video Evidence and Constructive Amendment
The government introduced a spreadsheet showing that Bitcoin Fog users sent funds to Welcome to Video, a darknet site that sold child sexual abuse material. The court held that admission did not violate Rule 403. The evidence showed the kind of activity the platform facilitated. The government may choose how to prove its case and is not limited to one piece of evidence per fact. The titles of the videos were redacted. Sterlingov never requested a limiting instruction.
He also argued that the evidence constructively amended the conspiracy count, which alleged conspiracy with darknet drug vendors. Reviewing for plain error, the court disagreed. The jury instructions required a finding of intent to carry out the specified unlawful activity of dealing in a controlled substance.
Cooperating Witnesses
The government called Ilya Lichtenstein and Larry Harmon. Each had pleaded guilty to unrelated money laundering conspiracy charges. Neither knew Sterlingov. Each testified to using Bitcoin Fog to launder funds. The court held the objections forfeited for lack of developed argument. On the merits, the testimony was relevant, the risk of prejudice was limited, and it qualified as lay testimony about the witnesses' own conduct.
Sentencing: The Defendant Bears the Burden to Separate Commingled Funds
The laundering guideline, U.S.S.G. § 2S1.1(a)(2), ties the offense level to the value of the laundered funds. Application Note 3(B) addresses commingled funds. Only criminally derived funds count, but only if the defendant supplies enough information to determine that amount without unduly complicating sentencing. Otherwise, the full commingled amount counts.
About $78 million in Bitcoin Fog activity was attributed to known darknet markets. The government argued that the full throughput of roughly $400 million was laundered funds. The district court agreed. The opinion describes the government's figure as producing a 28-level increase and the defense figure a 22-level increase.
The D.C. Circuit affirmed. Sterlingov offered no information about the remaining funds. The court did not decide whether assigning that burden to the defendant is constitutional or consistent with the statute. He never raised those objections.
For a mixer, commingling is the product. Under this ruling, the defense may need its own tracing analysis to show which funds were legitimate. Without it, the entire volume can drive the guideline range.
Questions the Court Left Open
The opinion resolved many issues on forfeiture or plain error. Several significant questions remain for future cases.
What the Decision Means for Blockchain Tracing Cases
Sterlingov confirms that the government's case against a mixer operator rests on three pillars: attribution of the operator to the platform, attribution of illicit funds to the platform, and proof of knowledge. The first two depend on forensic analysis that courts will now admit without peer review or a known error rate, provided the proponent explains the method and shows other indicators of reliability. The third can rest on design choices. The same framework will govern challenges to other government-contracted analytics platforms, such as TRM Labs, though each tool's admissibility will turn on its own record.
The defense arguments that failed in Sterlingov failed largely for procedural reasons. The source code request lacked a materiality showing. The Rule 17(c) ruling went unchallenged. The sentencing burden went unrebutted. The narrower venue and expert arguments were never made. Those gaps shaped the opinion as much as the court's reasoning did.
The FinCEN 2019 guidance treats anonymizing service providers as money transmitters. It treats providers of anonymizing software differently. Sterlingov involved a custodial service. How courts apply these holdings to non-custodial protocols remains unsettled, and the Storm retrial will test some of those questions.
Blockchain analytics shows where funds moved. It does not show who controlled the keys or what the operator knew. Sterlingov confirms that courts will admit the analytics. The contest now centers on the inferences drawn from them.
Frequently Asked Questions
Is Chainalysis Reactor evidence admissible in federal court?
In the D.C. Circuit, yes, on the record presented in United States v. Sterlingov. On September 25, 2026, the court held that the district court did not abuse its discretion in admitting expert testimony based on Chainalysis Reactor, a proprietary tool that clusters bitcoin addresses and attributes them to entities. Both government experts conceded that Reactor had not been peer reviewed and that they did not know its error rate.
The court held that the Daubert factors are not a mandatory checklist under Federal Rule of Evidence 702. It relied on other indicators of reliability: testimony that the experts could not recall a Reactor attribution later proven wrong through legal process, the tool's wide use by law enforcement and industry, a government contractor's finding of 99.9 percent accuracy in another case, and a test in which Reactor correctly placed four of five undercover-transaction addresses in the Bitcoin Fog cluster.
The ruling is not a blanket approval. Admissibility still turns on the record in each case, including which heuristics drove a particular attribution and whether the proponent can explain how the tool reached it.
Does a criminal defendant have a right to the source code of blockchain analytics software?
Not automatically. In Sterlingov, the district court required the defense to explain why Reactor's source code was material before it would order production. The defense never did. The court instead ordered Chainalysis to disclose Reactor's heuristics and underlying assumptions to defense counsel and qualified experts under a protective order. It barred the defendant from reviewing that material personally under Federal Rule of Criminal Procedure 16(d)(1).
The D.C. Circuit affirmed. It held that the defendant forfeited any challenge to the denial of his Rule 17(c) subpoena by omitting it from his opening brief. It also held that any independent due process claim failed because he never showed how the source code itself would materially aid his defense, particularly when his counsel already had the heuristics. The decision leaves room for a source code request supported by a specific showing of materiality.
Does the Confrontation Clause apply to machine-generated blockchain attributions?
The D.C. Circuit declined to apply it to Reactor's outputs. Reviewing for plain error, the court found no reason to depart from the Sixth, Ninth, and Eleventh Circuits, which have held that machine-generated outputs are not testimonial statements under Crawford v. Washington.
The defendant argued that Reactor's attributions reflect human judgments about how to encode heuristics and weigh off-chain intelligence. The court answered that, even if true, any confrontation right would run against Reactor's programmers. It would not require Chainalysis to produce source code. The court did not decide whether a defendant could compel testimony from the engineers who designed a tool's heuristics. Separate opinions in Bullcoming v. New Mexico and Smith v. Arizona show the Supreme Court has not resolved how the Clause applies to machine-generated evidence.
Can an undercover transaction establish venue in a crypto money laundering case?
Sterlingov holds that it can. A federal special agent working from his office in Washington deposited bitcoin into Bitcoin Fog, told the platform through its chat function that the funds came from ecstasy sales, and withdrew the funds.
The D.C. Circuit held that the withdrawal in the District supported venue for the sting money laundering count under 18 U.S.C. § 1956(i). It supported venue for the conspiracy count because the transfer was an act in furtherance. It supported venue for the unlicensed money transmitting counts because Bitcoin Fog served a customer in the District without the license D.C. law required.
The court rejected a venue entrapment theory because Bitcoin Fog operated worldwide and was not lured to the District. It did not decide whether a government agent's conduct alone can establish venue for a conspiracy count, because the defendant did not raise that argument.
Is operating a cryptocurrency mixer a federal crime?
Operating a mixer can support several federal charges, depending on how the service works and what the operator knew. FinCEN's 2019 guidance treats a person who accepts value from customers and transmits it in a way designed to conceal its source as a money transmitter. Running that business without required state licensing or federal registration can violate 18 U.S.C. § 1960. Knowingly conducting transactions involving criminal proceeds, or funds represented to be criminal proceeds, can violate 18 U.S.C. § 1956. Section 1960 carries up to five years in prison. Section 1956 carries up to 20 years.
FinCEN's guidance treats providers of anonymizing software differently from operators of anonymizing services. Current DOJ policy, set out in the April 7, 2025 Blanche memorandum, directs prosecutors not to target mixing services for the acts of their end users or for unwitting regulatory violations, subject to exceptions for narcotics, terrorism, hacking, and other priority crimes. The Tornado Cash prosecution of Roman Storm is testing how these statutes apply to non-custodial software.
How is the value of laundered funds calculated for a crypto mixer at sentencing?
Under U.S. Sentencing Guidelines § 2S1.1(a)(2), the offense level rises with the value of the laundered funds. Application Note 3(B) governs commingling. When legitimate and criminal funds are mixed, only the criminal funds count, but only if the defendant provides enough information to determine that amount without unduly complicating sentencing. Otherwise, the total commingled amount counts.
In Sterlingov, about $78 million in Bitcoin Fog activity was attributed to known darknet markets, but the government argued that the full throughput of roughly $400 million was laundered funds. The district court agreed. The D.C. Circuit affirmed because the defendant offered no evidence about the remaining funds. The court did not decide whether placing that burden on the defendant is constitutional or consistent with the statute, because he did not raise those objections.
When can a jury receive a willful blindness instruction in a crypto case?
Under Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754 (2011), willful blindness requires proof that the defendant subjectively believed there was a high probability that a fact existed and took deliberate actions to avoid learning it. Recklessness and negligence are not enough. The D.C. Circuit has said a willful blindness instruction belongs only in rare circumstances. In Sterlingov, the parties agreed it is proper when the defendant claims a lack of guilty knowledge and the evidence supports an inference of deliberate ignorance.
The court found both conditions met. The defense argued the government never proved Sterlingov read the undercover agent's message about drug proceeds. The platform's design supported an inference of deliberate ignorance: it deleted records weekly, required no account verification, and asked users no questions. The ruling shows how features presented as privacy protections can become evidence of a defendant's state of mind.
How do Armstrong & Bradylyons defend cryptocurrency fraud and money laundering cases?
Armstrong & Bradylyons PLLC is a Washington, D.C. firm whose attorneys spent more than 25 combined years as federal prosecutors at DOJ's Fraud Section and the U.S. Attorney's Office for the Eastern District of Virginia. At DOJ, they tried 25 federal jury trials. Scott Armstrong served nearly a decade at DOJ, including as an Assistant Chief in the Fraud Section's Market Integrity and Major Fraud Unit, where he supervised cryptocurrency fraud investigations. He was lead trial counsel in the first cryptocurrency market manipulation case charged under Title 15, a multi-week trial involving more than $300 million in spoof and wash trades, voluminous exchange data, and blockchain tracing evidence. Drew Bradylyons served as Chief of EDVA's Financial Crimes and Public Corruption Unit, where he supervised grand jury investigations and parallel criminal and civil matters involving the SEC and CFTC. Both charged and tried money laundering counts as prosecutors, including cases built on willful blindness theories.
The firm's cryptocurrency fraud and money laundering defense practice addresses the issues Sterlingov decided: blockchain attribution and tracing methodology, expert challenges under Rule 702, discovery of analytics tools, knowledge and willful blindness, venue, forfeiture, and proceeds calculations at sentencing. The firm has defended a foreign national charged with wire fraud conspiracy and money laundering conspiracy in an alleged $260 million social engineering cryptocurrency theft.
Crypto Money Laundering Investigations and Prosecutions
As a former Assistant Chief in DOJ's Fraud Section, Scott Armstrong tried 16 federal jury trials, including the first cryptocurrency market manipulation case charged under Title 15. As former Chief of EDVA's Financial Crimes and Public Corruption Unit, Drew Bradylyons supervised grand jury investigations and parallel criminal and civil enforcement matters involving the SEC and CFTC. Together, the firm's attorneys have tried 25 federal jury trials. Armstrong & Bradylyons PLLC defends individuals and companies in federal cryptocurrency fraud, money laundering, and unlicensed money transmitting investigations nationwide.
