S3E2 - Financial Forensics Meets Blockchain with Dorothy Haraminac

Hello and welcome to another episode of Niche to Necessity. Today we have

Dorothy Haraminac. She's an expert in blockchain

forensics and investigations. She's also the founder at

YBR Consulting.

Dorothy specializes in asset tracing, economic damage

calculations, and valuation in complex disputes, including

matrimonial cases. She's testified on Bitcoin and

cryptocurrency tracing, and provides fraud investigations,

compliance analysis, and due diligence for Fintech and

Eminent and mma. With her

deep expertise, Dorothy is here to share her valuable insights for

tax and accounting professionals. Welcome, Dorothy. Thanks for being here. Yeah, thanks for

having me. So normally I sometimes like

to get into people's background, but I think that there's a lot here. So I'd

love to kind of just quickly go over your background and how you got into

the space, but then would love to kind of jump into things. Would you mind

just giving us a little bit of context on. On how you got into crypto?

Sure. I worked in litigation support, which

is basically it's math for attorneys.

Right. When I was a kid, I thought lawyers did their own math. Turns out

they don't. They hire people for that, and that's where I come in. And

so the field itself is called litigation support or financial forensics

or forensic accounting. There's kind of all the. The same thing mixed in there,

valuation mixed in. I was in that field,

and I wanted a little more

time, I guess, to develop a case, you know, so I wanted to find out

who do attorneys hire before they hire a litigation support expert, and it turns

out they hire a private investigator. So I left the firm I was at, went

to a private investigations firm and started doing things like digital

forensics, which you need a license for in. In Texas. You need to be a

PI Started doing that kind of thing. And we started doing education

on some of the emerging technology trends that we were

seeing. And so we started doing education on digital forensics.

We started doing it on cybersecurity, on osint, open source intelligence,

and on cryptocurrency. And it was the cryptocurrency that

really hit something in. In really the matrimonial

arena, because it was this new class of assets that nobody really

knew what to do with, you know, and we started doing education,

and then we started getting hired on different cases and started tracing

assets. That was back in 2016,

I think. 2017. Wow. Early. Very early. Been

doing it a while. Yeah, still feels early, but

that's great stuff. I. You know, I. I think that it's such an

interesting aspect when you know, I'm sure there's a lot

of spouses that have kept this from their

spouses and maybe there's some suspicion around it, but lots of

complexity around it. So let's dive a little bit deeper

into forensic accounting and

specifically on the, on the blockchain. So what is forensic accounting on

chain involve and how does it differ from your traditional

forensic accounting that you'd be looking at in trading? Yeah, yeah,

I'm going to correct your term for the duration. It's. Forensic

accounting is kind of a subset of financial forensics, but

the term, they get used interchangeably. But forensic accounting is kind

of typically more focused on accounting records and

financial statements and discrepancies within those, whereas financial

forensics is much, much broader. And so we can break

that term down a little bit too. You've got the financial side of it,

which is really where you're playing the match game, you know,

like the old kids game where you're like flipping faces and who's matching and

whatever. And so except instead of faces, you've got

really, you've got accounting records, you know, so financial statements

or your QuickBooks file or whatever. You've got bank statements, credit

card statements, investment accounts, all of this, you know, money between accounts and money

movement and the story around that movement. And you're matching

all of those things. You're matching the story, you're matching the records, and then you're

matching that against tax filing. So it really is the match game. Do all of

these things add up and do they add up to what's being the story

that's being told in declarations or in the pleadings and of a court

case? That's kind of the financial side of it. You've also got

the asset tracing side of that, which is where you're

applying a character to the movement of

assets between accounts. So whose money is this? Where

did it go, what happened to it? And kind of where is it now? You

know, the disposition of it and how much is left, you know, that, that kind

of thing, that's the financial side, the forensic side of that is

wrapping all of that analysis up in a cohesive manner and explaining it to

the trier of fact, so explaining it to the judge or the jury,

that's very difficult. When assets are complex, you know, and

they can be complex like holding multiple, multiple portions of a

medical practice or lots of different crypto assets. You know, when assets are

complex, that explanation to the trier of fact becomes much more

difficult. You, you don't want to be the person that

Spends six or seven pages of your report on the history

of cryptocurrency. You know, you wouldn't do that for a traditional asset. You wouldn't

give the judge this history of, of banking or history

of investment brokerage. You know, you wouldn't. So don't do it with crypto

either. That's, that's kind of the forensic side of it, is explaining

it, explaining it and then also ensuring that the

analysis you did was all admissible. You know, that the

things you relied on were reliable and proving to the

court that they were reliable or that the conclusions you drew from them were

reasonable. That, that all is on the forensic side of it.

That's kind of the traditional side. Right. With

crypto, now you've got blockchain forensics, so you're throwing the blockchain on top

of everything. And the blockchain is kind of a misnomer.

You know, there's not one, there's not the blockchain that's out there. There are many

blockchains and tens of thousands of assets all over them. And

they all function differently. They've all got rules

around how things are transferred on the blockchain. And you

know, what, what a transfer is on the XRP ledger is very different

from what a transfer is on the Bitcoin blockchain. And that's

very different from an EVM compatible chain. And so you have to

understand all of the inner workings of the chain that

you're researching. Just like you understand at a deep level how investment

accounts work, how 401k works, how tax returns

work. You know, experts in those fields understand those very,

very deeply. You have to have that understanding for blockchain forensics

as well. Or we'll talk about, you know, how errors happen. And really

they happen when, when you've got a traditional skill set

and you apply it to the blockchain as though it's like a one for one

standard. You know, you have to learn what the new standard is. What do

transactions look like on this new thing? And what does that mean?

You know, that's, that's really one of the big errors I see is

where someone doesn't understand what a transfer to an exchange

looks like on the blockchain. Right. So, yeah,

do you have a question about that? Well, I just, I have a follow up

on that. Like, or, or like something like a, if you're posting

collateral on something like aave, it can look like a transfer

to an exchange for another group of tokens, but

really it's more like a Deposit slip that tracks the interest that you're

accruing. So if, if you know enough to get your in trouble, yourself in trouble,

you could think that that's a transfer or a sale of those assets, when in

reality it's more of like you're posting collateral and then you could borrow against

that collateral. I didn't mean to jump in, but I just, I.

Yeah, I was just doing a call on this recently where it's like if you

don't understand the underlying data and you can't get deep into it, it's hard.

You can, you can misclassify something very easily. Absolutely. So not

only could you misclassify something, but then you can throw some wild accusations out there.

So. Right. So think of that transaction, the AAVE transaction. What

happens is that instead of classifying it as a transfer or a sale, which

in matrimonial litigation, it would still be leaving the estate, right. Transferring or sale,

selling for something. But if it's classified as a withdrawal to

another account. Now what's happened is someone has said that

the, a pooling account is yours and you

own all of those assets. That's absurd. Right? That's like

saying because you sent dollars to your Chase account, you own all

the dollars at Chase. Right? Crazy. And that's, that's really

what's happening. And it stems from that deep misunderstanding

or really just like a very,

very basic understanding of transfers. You're thinking that everything

is a two from and it's not, you know, that's not what it is. And

you have to have that understanding or at least know that you don't know, so

that you can do the basic ones and then you can call someone else in

to help you understand the rest of them. That, that happens a lot where.

And then you, if you're, if you're the crypto spouse and

your expert is saying, well, I can see you have this wallet and it's

actually, you know, an exchange hot wallet.

That's really bad for you because it means one, that you have

failed to disclose a wallet and that wallet is very valuable.

And it's your expert and their understanding that that's driving

that misunderstanding. That's a problem. Because what you

don't want is your expert to be relying on you

for an explanation of a transaction. They need to have that expertise on their own.

Because if you end up with, um, it's called an over reliance

on the client's contention that's already going to make them look

bad. Like I use this example a lot. Like if I was If I was

in a divorce, then if I'm the person getting divorced, it's going to

be very difficult for me to hire an expert to

explain crypto to the court. Right. I know the most about

crypto than most people, you know, except for the people that

built it probably. I'm, I'm pretty knowledgeable and it's going to be

very hard for me because I'm also cheap to pay someone else to do that.

But they, I, I would have to do that. I'm at least smart enough to

recognize that I can't be my own expert

and I can't be the experts basis for an

opinion either. You know, that that also is going to look bad. But yeah, no,

it's super. That misunderstanding, trying to fit

those complex transfers into a, you know, a two from basic

accounting model, that's where a lot of errors and misunderstandings

happen. Yeah. And I'm sure that, you know,

additionally there's a lot of reliance on the part

of certain spouses thinking that they're anonymous. You know, really this is all pseudo

anonymous. And you know, it's actually very easy to track down who is who on

chain, you know, but also the transparency, there's

a paradox there because it's, yes, it's transparent but it's not always easy to

glean what is happening each transaction as we demonstrated in the previous

example. So how do you navigate those aspects in these

types of cases? Yeah, I mean it, the,

the pseudonymous issue really bothers me and, and it's really funny

because you know, people say that and it, it cracks me up because

when you see that in an expert report, you know that that expert

is going to be less reliable than others, mainly

because they've forgot about how I can create

more pseudonyms than there are grains of sand on earth. So effectively

it can be anonymous. What happens is that, and it's similar to a

money laundering investigation. I don't really care about what happens in

between the addresses. I care about the inputs and I care about the

outputs. You know, and so sometimes when, when money

is placed into crypto, that's where you find it.

Right. It's going from your joint bank account to Coinbase. That's not really

great at hiding or concealing anything. And then it's coming

out of, it's going into some other addresses, it's going into another

exchange maybe and then I'll see that deposit into

your bank account. You know, it's very easy to get bank records in

court. You subpoena the if, you know, if you know which entity

has them. Right. It's very easy. It's a little bit harder to subpoena

a crypto exchange because not all of them are based in the U.S. but that's

really, that's really where the analysis comes in, is

finding out where money went, you know, where

dollars went, whether or not those dollars were separate or community, and then

tracing what happened to those separate assets and the community

assets, what happened to the marital estate assets in general

through those addresses. So if they're going into an exchange, you need exchange

records. If they're going into wallets, you need addresses, and then you can

see where they go. But you have to identify what

that where is. And the way you do that is either with

public attribution, with different research, you know, you'd

search up the address, see if it was part of any kind of crypto project

and with paid attribution data. So you have to

also know the rely, the reliability of that attribution

data you're using, because it may be different across different sources. And so I may

say, hey, this is Binance. You may say, no, no, no, it's Gemini. We need

to know the difference. And you need to know the reliability of the attribution you're.

You're using. That's super interesting. I

think, you know, all this stuff brings up a lot of other

issues, and I think that it's, it's, it's really challenging to wrap your brain around

a lot of this stuff if you're newer to the space. So

for those who are, who are kind of newer, what are some common methods

that individuals tend to use to hide crypto assets,

and how can a professional like yourself go about uncovering

them? What are some of the strategies you use for that? So it's,

I do get, I do get kind of painted as this, this finder of assets

a lot. But I, I am hired by the crypto

spouse as well, almost as often as the non crypto spouse, because what

happens is the non crypto spouse may get an expert or may

do their own research and start levying some wild allegations like you own all of

aave, and, and the crypto spouse has to defend against

that, you know, or at least wants to ensure that they're disclosing records properly or

something like that. And hiding is. Hiding

might be the wrong word because it kind of implies intent.

Right at the outset, you were trying to hide this, and that may not be

true. What happens when people find themselves accused

of hiding assets? It kind of happens in two ways. One is a

lack of disclosure. So you failed to disclose the records that you

should have disclosed under your state's rules for financial

disclosure. Crypto's financial, you should disclose it. You know, don't err on the

side of I didn't know I was supposed to disclose it, that's a bad idea.

So you've got a lack of disclosure. And whether or not

that's driven by ignorance or intent

doesn't really matter for tracing. It does matter for, you know, an

award of property division, you know, a disproportionate award. And

it'll matter for a damage claim, but it doesn't matter really from the tracing aspect

of it. You've got this lack of disclosure issue that could get you

get an accusation of concealment levied against you. And then the other way that it

happens is kind of an effort to conceal,

an effort to obfuscate. And the way that you show an

effort to obfuscate is kind of a repeated pattern of

transactions. So in the traditional forensics world,

that pattern might be like, look, you disclosed a year's worth of credit

card transactions, except for June. Why didn't you disclose

June? Give me June. It was very easy to see that June

is missing. You know, everybody knows about how to review those. You

need to have that same skill set for crypto records, right? So that you

can say this is obviously missing. Wallet records are obviously missing. Give me

that. So but with this credit card example, June's obviously missing.

Either you give me the June records or I'll go to the

third party account provider and I'll get those records for June. So then you get

June and you see, oh, you went on this

huge trip with your paramore, with your affair partner. That's

why you didn't disclose June. When you started to see a pattern of

that, a pattern of failure to disclose that when

you do discover those records show something nefarious or show something

that, that is otherwise harmful, when you have that pattern, you start to develop

a sufficient basis to say you engaged in efforts to obfuscate

tracing and you don't want to find yourself in that position. If

your failure to disclose stemmed from ignorance, you know, if it was

intent, then of course you're probably going to land there. But if it was ignorance

to begin with, that's, that's really where the biggest problem is.

As the crypto spouse, you're going to be asked for records

related to your cryptocurrency. And the person asking for those

records is not likely to be me, because I'm not an attorney, it's going to

be your ex's attorney. And how intelligent they

are, how knowledgeable they are about crypto is going to drive how

sensible those questions are. And they may be nonsensical.

Right. They may be. Show me the

account where you have assets that contains this

address and the address listed will actually be a transaction id,

you know, because like, how do you answer that? As the crypto. Yeah,

I don't know what you're asking me for. To a judge who doesn't know any

better, you know, that looks like an address. It looks like you're just concealing.

It looks like, you know, it looks bad. And so you have to make sure

that you're disclosing records and that you're not the

person who's trying to correct the ask. Right. If you're the crypto

spouse and you're saying you don't make any sense, still looks like you're trying to

hide something. Get an objective expert in there to tell them they're not making

any sense. Get a neutral expert in there to say what you're asking for doesn't

make any sense. You know, it's, it's

difficult. I don't even know if I answered your question. I think I was rambling.

No, I, I mean, you know, like, so what are some of the

tools or you know, blockchain explorers or metadata analysis that

you're using to, to, to actually go about this trac.

Oh yeah, like hats of what do I use to find stuff? So we, I

use a combination of things, of skills, of

different tools and technology that you can purchase and transaction

analysis. One of the things we use is,

is blockchain data attribution and

that's usually in the form of chainalysis or elliptic or Clue or something like that.

They market themselves as a tracing tool, but what they really are are

attribution data aggregators. So what they're doing is

attributing an identity or an exchange or something like that to an

address. So now instead of just a string of numbers and letters, I now know

that's finance or that's Coinbase or that's whatever, you know, some

public block explorers will do that. Also the Etherscan

and the Etherscan's derivatives have some attribution that's public,

so that's helpful there. So we'll use public

Explorers. We use some paid blockchain data attribution. I also

use OSINT and OSINT data aggregators. That's the

open source intelligence. People do get a little bit confused by that term.

So open just means can a member of the public get

access to this information? You know, and so if it's available to a member of

the public, then it's, it's open source. That's, that's what that is. And so we

use a variety of tools to do that. Some are like social media

aggregators, that's just from public sources. I don't use anything that

relies on things that are called sock puppet accounts. You know,

the short of that is where if I'm investigating you,

I'll set up a fake social media profile and befriend you and

follow you and that kind of thing. I don't do that, that kind of thing.

There are investigators that do that kind of thing, but they have a specific purpose

and they're probably not trying to present that evidence in court. Right, because doing that

kind of thing can, can make stuff inadmissible, especially if what you're going for is

financial data. So I've listed what, I've listed the

blockchain data aggregators, the public explorers, the

OSINT data aggregators, of course, the financial records

and that kind of thing. So what you look for when you're looking at the

public explorers is really an ability to export

data so that you can get it into your analysis suite and an

ability to view balances or to view different kinds of data.

So some of the one I mentioned before, it doesn't have a great view

of NFT holdings. So I use a different tool to view the

NFTs held in an account. They use other tools to view NFTs that may have

been minted and marketed on different platforms. And so you have this

combination of tools, a suite of analysis. And with

crypto it really starts to look less like an

accounting analysis, less like to from kind of thing and

more like link analysis. So if you, if you are coming out

of military intelligence, you'll, you'll be very familiar with big data

analytics tools, things that are very good at

linking information across a disparate source.

You know, some of the accounting suites and some of the analytics

tools, like fraud analytics tools, and some of those things

rely a little bit too heavily on standardized set of

data. And crypto data can get very non standard very quickly. So what

you want is a link analysis tool, something like Palantir or

IBM's analyst notebook. Those tools are very good at

bringing information together when it's non standard, non standard and

then, you know, allowing links to happen and viewing those in, in a

cohesive kind of manner. That's that's really

it. I also use a lot of Excel and it's. I

don't use macros. That's kind of back to that

standard error happening. You know, people that use macros

for kind of a traditional forensic role that then try to force

crypto into that. That's where a lot of errors can happen and miss a lot

of information that way from complex transactions. But I do use Excel

kind of to create the presentations that are going

to, going to court because it's very simple and, and

because you don't, if you don't use all the complex features of Excel, then you're

limiting kind of how you have to present data. And that can help you

simplify it. Like if you have to use a table and you can't use

some kind of complex chart or, you know, something like that, then you're,

it forces you to simplify this otherwise, you know, complex thing.

And so I use a lot of Excel, use a lot of PowerPoints to try

to like show movement, you know. Yeah, makes sense.

Yeah. And really, if you keep the tools simple,

then it kind of helps, really simplify that, that

what's going on. Because it can be really, really complex, really. If you pull up

an Etherscan transaction in Core and say, see,

it's right here on this public, you know, right here. Right. Yeah. See, it's hard,

you know, it's like, okay, but what's Etherscan? What. You know, like, you gotta go

through a whole thing. But if you can present the data in a more simplistic

form, for someone who's used to seeing it that way, it feels familiar

and it makes those connections easier to make, even if it is a very

challenging topic. That's right. And especially if, like

one good example is if it's a decentralized exchange transaction. Right.

Some of it very complex, the details of that transaction are

scrollable. You know, there's no way that you're going to, you're going to

convince anybody that that says what you think it says. But if I

can put that in a little PowerPoint with little circles and little lines, now

everybody gets it. See, this eth went into a liquidity

pool that then sent some to another liquidity pool and exchanges other

assets. See, it's right. Yeah, it's get

messy. Get messy. Right. One, one thing I wanted to touch on,

on your, you know, you brought up the,

the fact that, you know, you have to just, you have to kind of try

to figure out whether it was ignorance or an attempt to obfuscate

gate you Know, I can speak to, you know, working on crypto

taxes a lot. The vast majority of the

time when a wallet address is missing, it's, it's

an ignorance thing or just like a. They just forgot about it kind of thing.

Like, I don't think I've had a single crypto

tax client where all of the data was provided to me at the

outset. It, you know, it took me uncovering, by doing my

reconciliation process to say, hey, your ballots can't go negative.

You know, where, where are these funds coming from? So

I think that it's interesting to look at that, where it's

like, and to be able to identify patterns where you're

seeing this intent forming. Because,

you know, obviously it's different in a marital case where you're trying

to figure out, you know, who, who gets access to what

assets. But, you know, I think the vast majority of the

time when, when a wallet address is missing, at least in my field, it's because

the person just simply forgot about it. So that's a totally possible outcome

as well, that they just forgot about it or they lost access to it or

whatever. Well, your, your pool of clients is, is

skewed, just like mine is. Right. Yours, yours is skewed where

you're at least limited to people who are trying to report it on their

taxes. Right. And so you have your.

Fair enough. Yeah, mine's limited where they may not

be, you know, they may already be engaging in those attempts. So. So

of course that'll be skewed. But the, you bring up an interesting point with the

reconciliation. So what I see a lot of is

that that skill, the reconciliation skill,

especially in, in crypto, it can

transfer to forensics. Right. So somebody with reconciliation

skills or experience could transfer into forensics, but they have to

unlearn some of those techniques. And one of the big one is

just adding your deposit transaction to make that balance not be

negative. Right. You don't want to just plug it in. Yeah,

plugging it in. And I get a lot of that kind of unlearning, like. No,

no, no, you can't just plug in a deposit. In forensics, you have

to, you have to have a source for that. You have to identify

when the balance. That means transactions are missing or

records. That's what that means. And so you have to be aware of that,

too. That's, that's an interesting, an interesting way to bring that in.

Yeah. So we've talked a little bit about

presenting data to courts and things

like that, and I'm sure there's a myriad of challenges that come along with that.

Can you kind of dive a little bit deeper into what some of those challenges

are when you're presenting blockchain evidence in a court? Yeah.

I mean, first you have to get it right. So you have to know what.

Where the addresses are, what they are. And sometimes you'll get

someone who's intentionally only disclosing

a set of addresses. So they're not disclosing all of their addresses. They're certainly not

disclosing their wallet software in the way that's appropriate.

And so when somebody discloses a set of addresses, you can use

clustering, which is something that the data aggregators use,

but something that some. You can do that.

You can do that technically also, you know, with a little script just

to show that if, if you had this address, then you also have

these four, you know, first for sure. That can, that can happen with Bitcoin.

You can do that with, with some of the others as well. So when that

happens, sometimes the crypto spouse is surprised.

They might come back and be like, you can't know that. There's no way for

you to know that because they're not a forensic expert, you know, so they thought

they were concealing something from their spouse. They may have taken steps to do that

successfully, but they didn't think that through from a forensic perspective because they may not

know how. How to think that through. It's. It's

really critical to come at that from

a point of full disclosure and, like, really disclose what you

have, where you hold it and how you access

it. That's kind of the critical point. And now I think I've completely

rambled and didn't injury. No, no. But I love, I love you bringing

up clustering because this is actually in the new. In, like the crypto news, like,

yesterday there was a. There's a girl

who's. Who's like, became like an overnight celebrity. And she

started. She's like a celebrity now, and she started a meme,

coin and rug, pulled it all. But they were able to identify

that clusters of wallets held 97% of the supply

and then just dumped it all on the unsuspecting. And it's

like, it was like over the course of 20 seconds, they extracted, like, millions of

dollars, and they identified these

clusters of wallets that they knew were team members that held

97% of the supply. And they were able to kind of

like, trace them back to a similar source

in the exact way that you're describing. Yeah, absolutely.

What happens, though? Is it kind of calls into question the reliability of

your aggregator, you know, so, yes, I can use clustering. If I'm

doing it technically, then it's unquestionable. But if you're relying on a

data aggregator to do that, like how are. They doing the clustering and how

does that process work and what was their. Incentive to do it? Right. There was

a much bigger case where that they identified the

culprits behind an exchange hack. Right. I think it was Bitfinex or something. It was

really big. But that company had issued

a financial incentive, a bounty. 10% of what was stolen.

Well, 10% of what was stolen is $400 million. Right.

That's a pretty big incentive if you're the guy adding the

attribution data at the data aggregator to be like, yeah, this is, you know,

Billy and Sue and go, go ahead and get that

attribution data out there. Now you can, you can claim that bounty, right?

Hey, look, I identify, I trace this back to Billy and Sue, right? You've got

to call that into question and make sure that especially if it's a criminal case,

that the, the evidence is being relied upon is actually

reliable and is actually, you know, admissible. It was obtained in an

admissible way. That, that can be tough. And so you

have to know, you, you have to know what clustering

is, how it works and how the tool you're

using does it, because they may not be doing it just from a technical

aspect, they may be doing it from some other methods also. And so you have

to be really careful with that. So what strategies do you implement when you

come across like instances of incomplete data, for example, like you get

into a black box like with, you know, ftx,

something like that, or another, like exchange that shut down,

where that some of that historical transactional data may not be

able to come up with that or things like that. What strategies do you implement

in those cases? Yeah, that. I mean, it happens a lot.

There are quite a few exchanges that turned out to be exit scams

or collapsed, you know, of their own accord. It,

it's really tough. And you, it really depends on the case. So if it's a

matrimonial case, then you have to see whether or not the

assets that went into that exchange were

put into that exchange with the knowledge and consent the spouse, because that matters

in divorce, were they put in that exchange with, if it's a commercial

case, were all the risks identified and did the

decision maker put those, make a reasonable decision when placing assets

there? Know that that's going to depend on what time it was, you know,

during. When did they put them there? Did they put them there after, like

two days after the feud between, the little Twitter feud broke out? Or did it,

was it before? Because if it was after, you're going to have a difficult time,

you know, saying that it was a reasonable thing to do. And so

it, it really depends. Sometimes records are available,

you know, so you've got one of the, the oldest

exchanges, you have, Mount Gox, where those transaction

records were leaked to the public. And so that's something that

you may be able to rely on. They're not necessarily complete. They have some

redacted information. You, you should absolutely not download those

yourself because they, you know, a lot of those downloads have embedded malware. And so

you have to know what you're doing even to get those records. But sometimes they're

leaked and then you have Celsius went down. Celsius had

an incident with the, the way that records were disclosed in

court so that all of the account holders were disclosed. Well, if

you're fast enough, you're able to get that data and rely on,

you'll be able to rely on it and say, I know for sure this person

had an account there because that data was released to the public, it was pulled

back, but that doesn't mean it's not still accessible. So finding

records in that way, you know, can be a route. But first, and that would

be, that would be admissible in court even if they were pulled back.

It, it depends on the court, on the jurisdiction. And

sometimes there's a means to an end argument that gets made

in, in some jurisdictions. And so if that argument's been made in

your state or, you know, in, in the federal court, wherever,

wherever you're presenting it, you may have a precedent to be able to admit those,

you may not. But that, that goes back to your kind of traditional skill set.

You have to know your jurisdiction. You know, what's the valuation standard here?

What's the admissibility standard here? What, what are those, those

things? The admissibility standard really is a big one because you

end up getting like one of the ways you could show somebody had an account

would be they had transactions with it in their

emails, right? Here's all the transaction confirmations you can get that Mount

Gox emailed everybody transaction confirmations. And

as, as a nerd, I tend to save everything, right? I just open a new

email account when one gets big, too big, right? So I still

have those. I still have all my transaction confirmations even if an exchange goes

down, that may also be the case for the person

that you're asking about. If the exchange has gone

down, there's no emails, there's no anything. There may still be

records on the devices they used. And getting access

to the devices somebody used is a very, very difficult thing to

do for good reason. Right. There's not a very strong

argument for someone to say, I want access to your device and everything that's on

it, because there's no way to limit a digital forensic image. But I think you

probably have some more questions about that aspect of it differently. But really,

when it comes down to it, in divorce, if you've got assets

going to ftx, you're not getting records from FTX because it's collapsed and

nobody's buying them out of bankruptcy or whatever, you can't get access to

records, you then have to change your damage model. And that's true in a

commercial case too. So what you're going to look at is what went in

to that exchange. If you've got multiple exchanges, then you're going to look at

what happened at those other exchanges and maybe theorize about what could

have happened with those assets at FTX or what the value could be

today. And then that, that turns into a traditional damage calculation

to, to kind of explore the what if analysis and decide what

needs to be claimed for this, for this asset.

This is all super interesting. I mean, I think it's like super cool to be,

you know, able to apply this, this field

into something that's not traditionally,

you know, seeing this. So, um, can you

maybe share some of, like a real world example? Obviously I'm sure you can't

reveal, you know, private information about people, but like more

generalized examples of uncovering like hidden crypto assets

or, or something that was like, I don't know, like, really interesting to

you that you've seen in the field. No,

so I get, I get asked that question a lot. Like,

because when, when you're disclosed as an expert, you have to

list all the cases that you provided testimony on, you know, and

where, where have you been deposed? Where have you provided trial testimony? What cases were

those? And what happens is that opposing counsel will tend to ask

detailed questions about those cases. What was this case about, what

assets were at issue, you know, and some of those questions I can answer, but

for the most part I don't disclose anything about cases ever.

Right. That work is confidential. The only way you're getting information out of me is

with a, a court order from a Court of competent jurisdiction.

So not the one that your case is at, but the one that handled the

case that you're asking about and, or written

consent from the client, you know, that's, that that information

is locked down. Everything I do is confidential. It's in all of my engagement

letters. And then sometimes cases have, they're under seal, they've

got protective orders, they've got additional layers of protection on top of

that, um, which I absolutely value and respect. You

know, as, as someone involved in cryptocurrency, I'm also,

I feel, required to also be a privacy activist. Right. It seems

like that's, those go hand in hand. But. But yeah, no, I

value the integrity of that data and absolutely don't share anything.

And even when presented with something like a lot of my

cases and some of my reports end up being part of the public court

record, that doesn't mean I can talk about them. Right. You would have to go

find it and present me with the report you found and then say,

you know, tell me about this part of your report and then I could talk

about it. But that burdens on you to find it. Right.

Generally, of course, as somebody who does financial

forensics, I think financial forensics is important. I also think you should hire

an expert early in the case, not late in a case

a lot of times. And when I present to attorneys, I tell them

hiring me early will save you money. And that

is counterintuitive, but it really will, whether you're on

the side of the crypto spouse or the non crypto spouse. Because what happens is

that you end up going down all these roads of misunderstanding

or not very clear definitions or something like that. And we cut that off at

the very beginning. Here is a clear definition for how to go get these

records. You mean to jump on a video call with the opposing client,

the crypto spouse, and just tell them which buttons to push? Let's do

that. If they're willing to do that, that can save a lot of time and

effort in the discovery process and then it's straightforward. Then you don't

have those wild accusations of you, you know, you failed to

disclose and it was intentional. You know, you can't really, you can't make that

leap. And that as the crypto spouse, having me

on your side in your corner early on can also prevent those things.

Because I see a lot of post judgment actions where

the non crypto spouse suddenly decides they want to, you know,

claim this person had multiple millions of dollars in crypto. And, and we're

going to go after it. The problem with doing that is that as the

former crypto spouse, you still have to defend yourself in the post

judgment action. You still have to hire an attorney. You're going to have to probably

hire an expert to defend against these wild accusations. And so you want to make

sure in the divorce itself, before you ever get to post judgment

issues, you control for those post judgment issues. And so you don't want to

be, you don't want to use, like, boilerplate language for a

settlement if you're, if you're settling, you want to make sure that everything is ticked

and tied so that somebody can't come back after you. Because

your, your, your non crypto spouse may be surrounded by sycophants

that are like, oh, yeah, you know, your ex is, is, you know, a

crypto bro or whatever. You know, they're. They've got millions of

dollars. Yeah, right. I know, I know. He told me

that he had multiple millions. Like, okay, wait, when your friends start telling you that

about your ex spouse, that's a red flag, you know, like, not

that your ex spouse actually had multiple millions. It's a red

flag for the friend, you know, like, that person should have told you during the

divorce, not after you've settled, you know, so really have to be careful

with that. Yeah, it, it's really trying and

it's, it's a lot of undue stress and burden on

both parties, you know, to, to have that conflict when you could resolve

it with better language, really. Mm.

So what, how do you, how

do you think that expert testimony shapes

the litigation process when it comes to this? Like how, how, how much, how much

does it shape the outcome and what does

that look like? I guess. Yeah, it really, I mean, it really depends.

So my. I really try to talk

myself out of work a lot. I really encourage

clients to settle whether I'm on the side of the crypto spouse and non crypto

sales, but they have to do that with knowledge. You

know, with knowledge and information. You can't really settle if you don't know what all

there is or what happened to it, you know, or whether somebody there's. I

don't typically get involved in cases that are not contentious. You know, when I

get called, parties don't trust each other. They don't believe a single word out of,

out of the mat. You know, they are very angry. It's contentious.

They're in no way amicable, you know, and so you have to.

And I'm not your advocate. That's kind of the other Confusion. When

somebody's paying another person, you think that they're supposed to do

what you want them to do. That's not how this works. I'm an

objective expert, and so I'm going to find facts and I'm going to

conclude on the basis of those facts. I'm not going to be

like, he absolutely is a criminal as a result of this. Like, I would never

say those words in a report, report or trial or whatever, regardless of,

you know, how badly you want them said. And that that can

really be difficult for someone to realize. There's.

I've not taken on cases because the client

had data that they probably shouldn't have had or wanted

too much kind of input into the expert report.

But that's not how this works. And so we're. I'm done to go find

somebody else. But how it shapes, how it shapes the

conclusion, it really, really depends. You know,

I've been encouraging other people in financial forensics to get into

blockchain forensics because there is a huge,

gaping need for more experts

who are actually qualified to be experts and not just random

people that are presenting themselves as that. You know, that that causes

much more stress and costs on, on both parties,

and it can shape the outcome in that

the trier of fact will walk away, and that's the, the judge or the jury,

whoever, the trier factor will walk away with a better understanding of

this technology. And that's a good thing because in their next case, they'll know

exactly what to look for and can kind of start to see through

some of the, the wool, I guess, you know, from either side.

The. What typically happens is that one party or

the other is trying to make, make the other one, I guess,

run out of money, you know, and so if one party hires an

expert, then the other party hires an expert, and then you're going to end up

with a battle of the experts, which is a really common complaint among

judges. Right. How do you have in, in traditional financial forensics, how do you

have two objective experts come to completely

different, you know, conclusions? The values here, the values here,

you know, they've got this many assets. Got this many assets. How do you have

that if you're both supposed to be objective? And the answer is one

of us isn't, and you have to, as the judge, you have to figure out

who that is. And now with kind of the new, new rules

around how judges should treat experts, before

it was a lot of times judges would use the excuse to

say, oh, I'll just, I'll hear from both experts. And if one is

shown to be not credible, that'll just go to the weight of the testimony. Now

there's new kind of rules around what judges are supposed to do where

they need to make more of an effort to exclude experts

who are not qualified to provide testimony. And that's a

good thing for the industry. It's a bad thing if that's your

expert that just got disqualified. Because disqualification doesn't

happen at the beginning of a case. It happens years later when you're

going to trial know, or it can happen a little bit before that. But after

a couple of years of dragging of a case dragging out, those fees are very

high. You don't get that back. And when your expert's disqualified, you're

just, you're just left with no expert, no testimony. You have to either go

hire a new one or try to present your case on your own. And

so it, it, that can be a big problem. As

far as the shape of the case goes, I haven't seen, haven't seen judges really

willing to do that on the crypto side of things so, so much

because it is such a complex topic and they just don't have the

skills to differentiate between someone who's full of it and someone who's not.

Not yet anyway. That's, that's where your expert comes in.

If you're, if your expert's going to have a hard time explaining something

complex to you, like to the attorney, then you may

need to find a different expert or at least find a supplemental expert that,

that can bridge that gap. Because you don't want somebody who's highly

technical or who has no sense of humor or who can't

relate to the judge or the jury. Those things are

really important there. They may be as

important or more important than the technical side of things. So you've got to have

that technical skill set and then you have to have people skills. That's

a rare combination, I think, but I guess, I mean, as far as shaping

the outcome, it's critical when, with

complex assets for you to have a financial expert,

either a neutral expert that's, that's kind of working paid

by both sides, or each their own expert and a neutral

expert differentiating between them. But it's critical when assets are complex

that, that both sides have their chance to explain

what's going on in a cohesive manner. I think

that's really important. So

you mentioned that there's a, you know, there's a lack of supply of folks serving

this aspect of the industry. What advice would you give

professionals that are new to blockchain forensics and want to jump

into this field? Maybe they're tradition, they do traditional forensics

in this realm, but those folks that are qualified

from that aspect but want to jump into the crypto

blockchain side of things. Yeah, I mean, I'm a big proponent

of the skill set you need for blockchain forensics is a

traditional financial forensic skillset. You need to learn the new

technology and it's exactly analogous to PayPal in,

in the 90s, you know, the late 90s, early 2000s when PayPal came

out, financial forensic experts had to learn

what those records looked like. How do you request them? What does an account setup

transaction look like? You know, the little since in and since out. Yeah,

yeah, right. What does that look like? How do I ask for records? How do

I analyze these records when I get them? It's exactly the same.

And like Bitcoin is not that much younger than PayPal.

You know, it's only 10 years younger. And so to have a deep understanding of

how peer to peer transactions work when they're payment services

and to just miss the boat completely on blockchain is

a problem. People know how to do PayPal, it's relatively straightforward.

So it is helpful that that's the case. But they don't know how to do

anything related to blockchain. You have to learn it and you have to

keep learning it because new blockchains happen, new token standards

happen. Right. You've got to, if you've got, you got

something that's on the Cardano blockchain, you have to go understand

the programming language that Cardano has written in so you can understand those

transactions. And he, he, I mean, he didn't write

the language himself, but he did revive it. Right? It was a dead programming

language. It brought it back, revived it. Now you have to go learn it so

you can understand those transactions. Same is true for the XRP ledger. You need to

understand what the details of that transaction are

and how they work, you know, and what, what's the software that runs on top

of the XRP ledger? If it's one of those like flow through payments,

which is kind of like a really big deal on the XRP ledger. You

need to understand how that works. Where do you go to learn it and how

technologically advanced are you? Right. I happen to have

a minor in computer science, which is not much computer science as far as

the. I learned fortrean and Java very

early Java, but tried to learn C Sharp and then dropped it because it was

such garbage. And so it went back to C and objective C.

Like you need to have Pythons in there. You need to

have at least the ability to read pseudocode,

at least that ability. And if you get some familiarity with

Python that would be great. But you have to have that, you at least

have to have that curiosity to figure

out what this is, you know. And I refer to

that as, as like when I'm hiring somebody new, I kind of ask them how

they interact with a computer. When they were younger, are they a button pusher or

did they like follow the instruction manual? I was a button pusher. I

broke our family computer so many times

where one issue was my, my uncle had to come over to fix our computer

and, and his reaction was

I, I don't even understand how you got

to this. How did you get. This is the deep inner workings

of this stuff. Later when I was in college I learned that that was like

the, the machine code, right? Or the assembly language is an old DOS computer

is relatively easy to get to. But anyway that's the cure, that's the

gene you need to be successful in this. And if

you don't have that, maybe stick to traditional stuff but

you kind of need that traditional financial forensics also. So to go learn blockchain, you've

got the, got the traditional skill set, you've got that curiosity

part in you, right? There's a few really good

places to go start learning the technical side of things. One is a website,

bitsonblocks. And it does a really good job of presenting very

technical information in, in a readable format. And

so it's accessible to someone who's kind of non technical. But my, I mean

you can go do a credential. Credentials are getting better. A few

years ago they were, they were kind of garbage credentials like pay to earn, you

know, just pay for the piece of paper to hang on your wall or whatever.

Now there's a few more out there that are a little bit more rigorous but

they tend to lean towards the, the criminal side of things. And like a money

laundering investigation side of things or risk management. There's,

there's still not a good credential out there for civil financial

forensics. I'm working with a guy to maybe build one

or at least get some more information out there for that. Because it's different than

the criminal side of things. What you're looking for is different how you're

tracing and sometimes evaluation is even different. But really I think

the best thing that somebody could do is go build something

on the blockchain, right? Go, go to the, the build guild

and follow that, that little course. It's, it's a great little course. It'll teach you

everything you need to know about building things on a blockchain. Go

create some NFTs and you know, see what

those look like. Look at the parameters that you can change when you create those

things. That'll give you a really good understanding of one,

how complex transactions can be. But also it'll give you a good

understanding of how to recognize when someone is trying to pull the wool over your

eyes with their explanation. And that, you know, that can come from a traditional

interview skill set and it can come from a deeper knowledge of the

technology that you're discussing. And so it's, there's a. I guess that's kind

of a lot, right? I keep telling. No, I think that's great and I'm glad

you brought up the experiential piece as well because I think that that's, it's so

critical. Critical in crypto tax reconciliation.

I don't think you can be in this field, at least in, on the, on

the reconciliation side of things without having some hands on

experience of actually trading, holding, moving,

accessing these assets. I think what you're talking about is deeper and I

think it's more necessary for your type of field when you really need to understand

the underlying technical aspect of what's happening. For my field, it's less

necessary for folks to build things on chain, but I think at the bare

minimum you have to have used these assets and you don't have to

mortgage your house and go all in on Bitcoin to do that. You

can take $10 and go play around on Optimism or

Polygon or Solana or whatever and you can do 90% of

DeFi activities with that small amount because they have low fees.

So you're playing around with some Dexes, do some swaps on

there, throw some collateral on aave, see

what borrowing against that collateral looks like. Follow the chain of events on

Chain to see what the block explorers tell you about what's happening. And then with

your knowledge of what actually happened because you did it yourself, you can

kind of tie those pieces together. So I always, when

anyone's trying to get into anything related to blockchain, I say get your feet wet.

Doesn't have to be with a lot of money. But I love that you're talking

about building on Chain as well, because I think for what you're talking with

your field. It's more important to understand that technical aspect, which honestly is

beyond me. I don't know anything about solidity other than, you know, it's the

programming language of Ethereum. You know, I don't know anything about, you know, the

programming language of, of Cardano.

That's the name of it. Couldn't think of it earlier. Yeah, so,

but, but I think it's incredibly important and it can't be emphasized enough

that if you want to start operating in this space, you

cannot do so without being. You don't have to be invested, but

at least play around in the space. Well, I mean, I think, I think to

clarify, you absolutely can. You'll just be bad at it, right?

Yeah, yeah, be bad. I mean, that's the other way to learn, right? You

could practice. And that's what, that's what I do at my firm is,

is I have associates that will practice on an

old case. And so they're going to make a lot of mistakes, they're going to

misunderstand a lot, and then we can correct those. Right. And

then, you know, they've got to go through some of the, the training for building

on the blockchain. They've got to look at really complex transactions

and, and parse that out. And it takes a long time

to. Harder. It's harder

for people, I feel like, that are already educated. So people

with a master's degree or two master's degrees are,

Are much more kind of ingrained in their ways. And you've got to kind of

go. Go through this process of unlearning before they can learn. Like my, my

most successful hirees have been people that have a high school

education, which is kind of wild. Other people are starting

to recognize that now that, you know, degrees have decrease. Have been on the

decline for a while, if we're honest. But you

really ultimately need that curiosity. You

know, what does this do? What does this button? What does it look like when

you're engaging in those transactions? What does it look like in the wallet

software that you're using? What's the, you know, contrast that against what somebody can see

publicly, then you'll understand why when you're disclosing something, you can't just

give over a list of addresses. You've got to give the wallet software

details also. And that's, that's really difficult for,

for people to wrap their heads around. A lot of times I hear I don't

have to give you that because all the transactions are public. You

do have to give me that because What I'm limited to is just

the addresses you say you have. You've got to prove that those are all of

your addresses. And then for complex transactions, you, you may not be

able to discern what's going on on the blockchain, but that you've got to have

those, those details from the wallet software or at least

you can discern it from the blockchain, but it's easier for the wallet holder to

provide it. That's also, you know, something that comes up in matrimonial divorce a

lot. Equal access isn't the same. You know, doesn't. Just

because it's public doesn't mean both parties have, have equal access to that, that

data. Well, this has been a super

enlightening conversation. I really appreciate you taking the time. Do you have any final thoughts

or anything you'd like to share about the, the field or anything, anything else you'd

like to say? I think, I think the, the end

note would be don't be afraid of it. You know, for, for somebody in

traditional financial forensics, this is not

insurmountable. You know, it, it will take some work, it

does take some effort, but you can gain enough knowledge that

you can feel comfortable taking on a crypto case and maybe, you know, be an

opposing expert on the case that I'm on or something like they, we absolutely

still need it. And I think it's important for people to, to get out there

and, and try to learn this stuff so that we've got more people that are

qualified to do this kind of work. That's awesome.

And finally, can you direct listeners,

how could they connect with you or if they have a matrimonial case that

they want you to be an expert on, how would they get in touch with

you or find more information about you or your firm? Yeah, I

mean my website has a little contact form on it that's probably the easiest.

I should probably check it more often than I do. But I think my

website is ybr.solutions and use

that contact form. There's also a lot of articles on there. I put together

a lot of templates for people who are engaged in litigation. And so

if you're still in the DIY mode or

it's you, you're the, the non

propertied spouse or you don't have enough money to hire an expert, you can still

give me a call or shoot me an email because those, your attorney might still

be able to use those, those templates even if you're the crypto spouse. Right.

If you're not ready to hire an expert, at least look at those and see

what might be asked of you. And make sure you understand how to disclose it.

Well, thanks again, Dorothy, for. For sharing your expertise and your time with

us. We really appreciate it, and we hope to work on more webinars

and things like that with you in the future. Yeah. Thank you so much for

having me.

Creators and Guests

Taylor Zork
Host
Taylor Zork
Co-founder CryptoCFOs | Host "From Niche to Necessity" Podcast
Brandon
Producer
Brandon "Bova" Santiago
Helping finance pros build and grow their practice in the $5B tax / accounting Web3 space.
Brian Whalen CPA
Producer
Brian Whalen CPA
Here for #TaxTwitter. Cannabis & #CryptoTax for fun, Blaise’s Dad, Veteran of Nuclear Navy, #CPA firm owner, Cannabis Landlord
CryptoCFOs
Producer
CryptoCFOs
Teaching you to navigate the complex and evolving DeFi and crypto landscape to level up your tax or accounting practice.
Dorothy Haraminac
Guest
Dorothy Haraminac
@ the Intersection of Technology and Humanity +|+
S3E2 - Financial Forensics Meets Blockchain with Dorothy Haraminac
Broadcast by