S3E2 - Financial Forensics Meets Blockchain with Dorothy Haraminac
Hello and welcome to another episode of Niche to Necessity. Today we have
Dorothy Haraminac. She's an expert in blockchain
forensics and investigations. She's also the founder at
YBR Consulting.
Dorothy specializes in asset tracing, economic damage
calculations, and valuation in complex disputes, including
matrimonial cases. She's testified on Bitcoin and
cryptocurrency tracing, and provides fraud investigations,
compliance analysis, and due diligence for Fintech and
Eminent and mma. With her
deep expertise, Dorothy is here to share her valuable insights for
tax and accounting professionals. Welcome, Dorothy. Thanks for being here. Yeah, thanks for
having me. So normally I sometimes like
to get into people's background, but I think that there's a lot here. So I'd
love to kind of just quickly go over your background and how you got into
the space, but then would love to kind of jump into things. Would you mind
just giving us a little bit of context on. On how you got into crypto?
Sure. I worked in litigation support, which
is basically it's math for attorneys.
Right. When I was a kid, I thought lawyers did their own math. Turns out
they don't. They hire people for that, and that's where I come in. And
so the field itself is called litigation support or financial forensics
or forensic accounting. There's kind of all the. The same thing mixed in there,
valuation mixed in. I was in that field,
and I wanted a little more
time, I guess, to develop a case, you know, so I wanted to find out
who do attorneys hire before they hire a litigation support expert, and it turns
out they hire a private investigator. So I left the firm I was at, went
to a private investigations firm and started doing things like digital
forensics, which you need a license for in. In Texas. You need to be a
PI Started doing that kind of thing. And we started doing education
on some of the emerging technology trends that we were
seeing. And so we started doing education on digital forensics.
We started doing it on cybersecurity, on osint, open source intelligence,
and on cryptocurrency. And it was the cryptocurrency that
really hit something in. In really the matrimonial
arena, because it was this new class of assets that nobody really
knew what to do with, you know, and we started doing education,
and then we started getting hired on different cases and started tracing
assets. That was back in 2016,
I think. 2017. Wow. Early. Very early. Been
doing it a while. Yeah, still feels early, but
that's great stuff. I. You know, I. I think that it's such an
interesting aspect when you know, I'm sure there's a lot
of spouses that have kept this from their
spouses and maybe there's some suspicion around it, but lots of
complexity around it. So let's dive a little bit deeper
into forensic accounting and
specifically on the, on the blockchain. So what is forensic accounting on
chain involve and how does it differ from your traditional
forensic accounting that you'd be looking at in trading? Yeah, yeah,
I'm going to correct your term for the duration. It's. Forensic
accounting is kind of a subset of financial forensics, but
the term, they get used interchangeably. But forensic accounting is kind
of typically more focused on accounting records and
financial statements and discrepancies within those, whereas financial
forensics is much, much broader. And so we can break
that term down a little bit too. You've got the financial side of it,
which is really where you're playing the match game, you know,
like the old kids game where you're like flipping faces and who's matching and
whatever. And so except instead of faces, you've got
really, you've got accounting records, you know, so financial statements
or your QuickBooks file or whatever. You've got bank statements, credit
card statements, investment accounts, all of this, you know, money between accounts and money
movement and the story around that movement. And you're matching
all of those things. You're matching the story, you're matching the records, and then you're
matching that against tax filing. So it really is the match game. Do all of
these things add up and do they add up to what's being the story
that's being told in declarations or in the pleadings and of a court
case? That's kind of the financial side of it. You've also got
the asset tracing side of that, which is where you're
applying a character to the movement of
assets between accounts. So whose money is this? Where
did it go, what happened to it? And kind of where is it now? You
know, the disposition of it and how much is left, you know, that, that kind
of thing, that's the financial side, the forensic side of that is
wrapping all of that analysis up in a cohesive manner and explaining it to
the trier of fact, so explaining it to the judge or the jury,
that's very difficult. When assets are complex, you know, and
they can be complex like holding multiple, multiple portions of a
medical practice or lots of different crypto assets. You know, when assets are
complex, that explanation to the trier of fact becomes much more
difficult. You, you don't want to be the person that
Spends six or seven pages of your report on the history
of cryptocurrency. You know, you wouldn't do that for a traditional asset. You wouldn't
give the judge this history of, of banking or history
of investment brokerage. You know, you wouldn't. So don't do it with crypto
either. That's, that's kind of the forensic side of it, is explaining
it, explaining it and then also ensuring that the
analysis you did was all admissible. You know, that the
things you relied on were reliable and proving to the
court that they were reliable or that the conclusions you drew from them were
reasonable. That, that all is on the forensic side of it.
That's kind of the traditional side. Right. With
crypto, now you've got blockchain forensics, so you're throwing the blockchain on top
of everything. And the blockchain is kind of a misnomer.
You know, there's not one, there's not the blockchain that's out there. There are many
blockchains and tens of thousands of assets all over them. And
they all function differently. They've all got rules
around how things are transferred on the blockchain. And you
know, what, what a transfer is on the XRP ledger is very different
from what a transfer is on the Bitcoin blockchain. And that's
very different from an EVM compatible chain. And so you have to
understand all of the inner workings of the chain that
you're researching. Just like you understand at a deep level how investment
accounts work, how 401k works, how tax returns
work. You know, experts in those fields understand those very,
very deeply. You have to have that understanding for blockchain forensics
as well. Or we'll talk about, you know, how errors happen. And really
they happen when, when you've got a traditional skill set
and you apply it to the blockchain as though it's like a one for one
standard. You know, you have to learn what the new standard is. What do
transactions look like on this new thing? And what does that mean?
You know, that's, that's really one of the big errors I see is
where someone doesn't understand what a transfer to an exchange
looks like on the blockchain. Right. So, yeah,
do you have a question about that? Well, I just, I have a follow up
on that. Like, or, or like something like a, if you're posting
collateral on something like aave, it can look like a transfer
to an exchange for another group of tokens, but
really it's more like a Deposit slip that tracks the interest that you're
accruing. So if, if you know enough to get your in trouble, yourself in trouble,
you could think that that's a transfer or a sale of those assets, when in
reality it's more of like you're posting collateral and then you could borrow against
that collateral. I didn't mean to jump in, but I just, I.
Yeah, I was just doing a call on this recently where it's like if you
don't understand the underlying data and you can't get deep into it, it's hard.
You can, you can misclassify something very easily. Absolutely. So not
only could you misclassify something, but then you can throw some wild accusations out there.
So. Right. So think of that transaction, the AAVE transaction. What
happens is that instead of classifying it as a transfer or a sale, which
in matrimonial litigation, it would still be leaving the estate, right. Transferring or sale,
selling for something. But if it's classified as a withdrawal to
another account. Now what's happened is someone has said that
the, a pooling account is yours and you
own all of those assets. That's absurd. Right? That's like
saying because you sent dollars to your Chase account, you own all
the dollars at Chase. Right? Crazy. And that's, that's really
what's happening. And it stems from that deep misunderstanding
or really just like a very,
very basic understanding of transfers. You're thinking that everything
is a two from and it's not, you know, that's not what it is. And
you have to have that understanding or at least know that you don't know, so
that you can do the basic ones and then you can call someone else in
to help you understand the rest of them. That, that happens a lot where.
And then you, if you're, if you're the crypto spouse and
your expert is saying, well, I can see you have this wallet and it's
actually, you know, an exchange hot wallet.
That's really bad for you because it means one, that you have
failed to disclose a wallet and that wallet is very valuable.
And it's your expert and their understanding that that's driving
that misunderstanding. That's a problem. Because what you
don't want is your expert to be relying on you
for an explanation of a transaction. They need to have that expertise on their own.
Because if you end up with, um, it's called an over reliance
on the client's contention that's already going to make them look
bad. Like I use this example a lot. Like if I was If I was
in a divorce, then if I'm the person getting divorced, it's going to
be very difficult for me to hire an expert to
explain crypto to the court. Right. I know the most about
crypto than most people, you know, except for the people that
built it probably. I'm, I'm pretty knowledgeable and it's going to be
very hard for me because I'm also cheap to pay someone else to do that.
But they, I, I would have to do that. I'm at least smart enough to
recognize that I can't be my own expert
and I can't be the experts basis for an
opinion either. You know, that that also is going to look bad. But yeah, no,
it's super. That misunderstanding, trying to fit
those complex transfers into a, you know, a two from basic
accounting model, that's where a lot of errors and misunderstandings
happen. Yeah. And I'm sure that, you know,
additionally there's a lot of reliance on the part
of certain spouses thinking that they're anonymous. You know, really this is all pseudo
anonymous. And you know, it's actually very easy to track down who is who on
chain, you know, but also the transparency, there's
a paradox there because it's, yes, it's transparent but it's not always easy to
glean what is happening each transaction as we demonstrated in the previous
example. So how do you navigate those aspects in these
types of cases? Yeah, I mean it, the,
the pseudonymous issue really bothers me and, and it's really funny
because you know, people say that and it, it cracks me up because
when you see that in an expert report, you know that that expert
is going to be less reliable than others, mainly
because they've forgot about how I can create
more pseudonyms than there are grains of sand on earth. So effectively
it can be anonymous. What happens is that, and it's similar to a
money laundering investigation. I don't really care about what happens in
between the addresses. I care about the inputs and I care about the
outputs. You know, and so sometimes when, when money
is placed into crypto, that's where you find it.
Right. It's going from your joint bank account to Coinbase. That's not really
great at hiding or concealing anything. And then it's coming
out of, it's going into some other addresses, it's going into another
exchange maybe and then I'll see that deposit into
your bank account. You know, it's very easy to get bank records in
court. You subpoena the if, you know, if you know which entity
has them. Right. It's very easy. It's a little bit harder to subpoena
a crypto exchange because not all of them are based in the U.S. but that's
really, that's really where the analysis comes in, is
finding out where money went, you know, where
dollars went, whether or not those dollars were separate or community, and then
tracing what happened to those separate assets and the community
assets, what happened to the marital estate assets in general
through those addresses. So if they're going into an exchange, you need exchange
records. If they're going into wallets, you need addresses, and then you can
see where they go. But you have to identify what
that where is. And the way you do that is either with
public attribution, with different research, you know, you'd
search up the address, see if it was part of any kind of crypto project
and with paid attribution data. So you have to
also know the rely, the reliability of that attribution
data you're using, because it may be different across different sources. And so I may
say, hey, this is Binance. You may say, no, no, no, it's Gemini. We need
to know the difference. And you need to know the reliability of the attribution you're.
You're using. That's super interesting. I
think, you know, all this stuff brings up a lot of other
issues, and I think that it's, it's, it's really challenging to wrap your brain around
a lot of this stuff if you're newer to the space. So
for those who are, who are kind of newer, what are some common methods
that individuals tend to use to hide crypto assets,
and how can a professional like yourself go about uncovering
them? What are some of the strategies you use for that? So it's,
I do get, I do get kind of painted as this, this finder of assets
a lot. But I, I am hired by the crypto
spouse as well, almost as often as the non crypto spouse, because what
happens is the non crypto spouse may get an expert or may
do their own research and start levying some wild allegations like you own all of
aave, and, and the crypto spouse has to defend against
that, you know, or at least wants to ensure that they're disclosing records properly or
something like that. And hiding is. Hiding
might be the wrong word because it kind of implies intent.
Right at the outset, you were trying to hide this, and that may not be
true. What happens when people find themselves accused
of hiding assets? It kind of happens in two ways. One is a
lack of disclosure. So you failed to disclose the records that you
should have disclosed under your state's rules for financial
disclosure. Crypto's financial, you should disclose it. You know, don't err on the
side of I didn't know I was supposed to disclose it, that's a bad idea.
So you've got a lack of disclosure. And whether or not
that's driven by ignorance or intent
doesn't really matter for tracing. It does matter for, you know, an
award of property division, you know, a disproportionate award. And
it'll matter for a damage claim, but it doesn't matter really from the tracing aspect
of it. You've got this lack of disclosure issue that could get you
get an accusation of concealment levied against you. And then the other way that it
happens is kind of an effort to conceal,
an effort to obfuscate. And the way that you show an
effort to obfuscate is kind of a repeated pattern of
transactions. So in the traditional forensics world,
that pattern might be like, look, you disclosed a year's worth of credit
card transactions, except for June. Why didn't you disclose
June? Give me June. It was very easy to see that June
is missing. You know, everybody knows about how to review those. You
need to have that same skill set for crypto records, right? So that you
can say this is obviously missing. Wallet records are obviously missing. Give me
that. So but with this credit card example, June's obviously missing.
Either you give me the June records or I'll go to the
third party account provider and I'll get those records for June. So then you get
June and you see, oh, you went on this
huge trip with your paramore, with your affair partner. That's
why you didn't disclose June. When you started to see a pattern of
that, a pattern of failure to disclose that when
you do discover those records show something nefarious or show something
that, that is otherwise harmful, when you have that pattern, you start to develop
a sufficient basis to say you engaged in efforts to obfuscate
tracing and you don't want to find yourself in that position. If
your failure to disclose stemmed from ignorance, you know, if it was
intent, then of course you're probably going to land there. But if it was ignorance
to begin with, that's, that's really where the biggest problem is.
As the crypto spouse, you're going to be asked for records
related to your cryptocurrency. And the person asking for those
records is not likely to be me, because I'm not an attorney, it's going to
be your ex's attorney. And how intelligent they
are, how knowledgeable they are about crypto is going to drive how
sensible those questions are. And they may be nonsensical.
Right. They may be. Show me the
account where you have assets that contains this
address and the address listed will actually be a transaction id,
you know, because like, how do you answer that? As the crypto. Yeah,
I don't know what you're asking me for. To a judge who doesn't know any
better, you know, that looks like an address. It looks like you're just concealing.
It looks like, you know, it looks bad. And so you have to make sure
that you're disclosing records and that you're not the
person who's trying to correct the ask. Right. If you're the crypto
spouse and you're saying you don't make any sense, still looks like you're trying to
hide something. Get an objective expert in there to tell them they're not making
any sense. Get a neutral expert in there to say what you're asking for doesn't
make any sense. You know, it's, it's
difficult. I don't even know if I answered your question. I think I was rambling.
No, I, I mean, you know, like, so what are some of the
tools or you know, blockchain explorers or metadata analysis that
you're using to, to, to actually go about this trac.
Oh yeah, like hats of what do I use to find stuff? So we, I
use a combination of things, of skills, of
different tools and technology that you can purchase and transaction
analysis. One of the things we use is,
is blockchain data attribution and
that's usually in the form of chainalysis or elliptic or Clue or something like that.
They market themselves as a tracing tool, but what they really are are
attribution data aggregators. So what they're doing is
attributing an identity or an exchange or something like that to an
address. So now instead of just a string of numbers and letters, I now know
that's finance or that's Coinbase or that's whatever, you know, some
public block explorers will do that. Also the Etherscan
and the Etherscan's derivatives have some attribution that's public,
so that's helpful there. So we'll use public
Explorers. We use some paid blockchain data attribution. I also
use OSINT and OSINT data aggregators. That's the
open source intelligence. People do get a little bit confused by that term.
So open just means can a member of the public get
access to this information? You know, and so if it's available to a member of
the public, then it's, it's open source. That's, that's what that is. And so we
use a variety of tools to do that. Some are like social media
aggregators, that's just from public sources. I don't use anything that
relies on things that are called sock puppet accounts. You know,
the short of that is where if I'm investigating you,
I'll set up a fake social media profile and befriend you and
follow you and that kind of thing. I don't do that, that kind of thing.
There are investigators that do that kind of thing, but they have a specific purpose
and they're probably not trying to present that evidence in court. Right, because doing that
kind of thing can, can make stuff inadmissible, especially if what you're going for is
financial data. So I've listed what, I've listed the
blockchain data aggregators, the public explorers, the
OSINT data aggregators, of course, the financial records
and that kind of thing. So what you look for when you're looking at the
public explorers is really an ability to export
data so that you can get it into your analysis suite and an
ability to view balances or to view different kinds of data.
So some of the one I mentioned before, it doesn't have a great view
of NFT holdings. So I use a different tool to view the
NFTs held in an account. They use other tools to view NFTs that may have
been minted and marketed on different platforms. And so you have this
combination of tools, a suite of analysis. And with
crypto it really starts to look less like an
accounting analysis, less like to from kind of thing and
more like link analysis. So if you, if you are coming out
of military intelligence, you'll, you'll be very familiar with big data
analytics tools, things that are very good at
linking information across a disparate source.
You know, some of the accounting suites and some of the analytics
tools, like fraud analytics tools, and some of those things
rely a little bit too heavily on standardized set of
data. And crypto data can get very non standard very quickly. So what
you want is a link analysis tool, something like Palantir or
IBM's analyst notebook. Those tools are very good at
bringing information together when it's non standard, non standard and
then, you know, allowing links to happen and viewing those in, in a
cohesive kind of manner. That's that's really
it. I also use a lot of Excel and it's. I
don't use macros. That's kind of back to that
standard error happening. You know, people that use macros
for kind of a traditional forensic role that then try to force
crypto into that. That's where a lot of errors can happen and miss a lot
of information that way from complex transactions. But I do use Excel
kind of to create the presentations that are going
to, going to court because it's very simple and, and
because you don't, if you don't use all the complex features of Excel, then you're
limiting kind of how you have to present data. And that can help you
simplify it. Like if you have to use a table and you can't use
some kind of complex chart or, you know, something like that, then you're,
it forces you to simplify this otherwise, you know, complex thing.
And so I use a lot of Excel, use a lot of PowerPoints to try
to like show movement, you know. Yeah, makes sense.
Yeah. And really, if you keep the tools simple,
then it kind of helps, really simplify that, that
what's going on. Because it can be really, really complex, really. If you pull up
an Etherscan transaction in Core and say, see,
it's right here on this public, you know, right here. Right. Yeah. See, it's hard,
you know, it's like, okay, but what's Etherscan? What. You know, like, you gotta go
through a whole thing. But if you can present the data in a more simplistic
form, for someone who's used to seeing it that way, it feels familiar
and it makes those connections easier to make, even if it is a very
challenging topic. That's right. And especially if, like
one good example is if it's a decentralized exchange transaction. Right.
Some of it very complex, the details of that transaction are
scrollable. You know, there's no way that you're going to, you're going to
convince anybody that that says what you think it says. But if I
can put that in a little PowerPoint with little circles and little lines, now
everybody gets it. See, this eth went into a liquidity
pool that then sent some to another liquidity pool and exchanges other
assets. See, it's right. Yeah, it's get
messy. Get messy. Right. One, one thing I wanted to touch on,
on your, you know, you brought up the,
the fact that, you know, you have to just, you have to kind of try
to figure out whether it was ignorance or an attempt to obfuscate
gate you Know, I can speak to, you know, working on crypto
taxes a lot. The vast majority of the
time when a wallet address is missing, it's, it's
an ignorance thing or just like a. They just forgot about it kind of thing.
Like, I don't think I've had a single crypto
tax client where all of the data was provided to me at the
outset. It, you know, it took me uncovering, by doing my
reconciliation process to say, hey, your ballots can't go negative.
You know, where, where are these funds coming from? So
I think that it's interesting to look at that, where it's
like, and to be able to identify patterns where you're
seeing this intent forming. Because,
you know, obviously it's different in a marital case where you're trying
to figure out, you know, who, who gets access to what
assets. But, you know, I think the vast majority of the
time when, when a wallet address is missing, at least in my field, it's because
the person just simply forgot about it. So that's a totally possible outcome
as well, that they just forgot about it or they lost access to it or
whatever. Well, your, your pool of clients is, is
skewed, just like mine is. Right. Yours, yours is skewed where
you're at least limited to people who are trying to report it on their
taxes. Right. And so you have your.
Fair enough. Yeah, mine's limited where they may not
be, you know, they may already be engaging in those attempts. So. So
of course that'll be skewed. But the, you bring up an interesting point with the
reconciliation. So what I see a lot of is
that that skill, the reconciliation skill,
especially in, in crypto, it can
transfer to forensics. Right. So somebody with reconciliation
skills or experience could transfer into forensics, but they have to
unlearn some of those techniques. And one of the big one is
just adding your deposit transaction to make that balance not be
negative. Right. You don't want to just plug it in. Yeah,
plugging it in. And I get a lot of that kind of unlearning, like. No,
no, no, you can't just plug in a deposit. In forensics, you have
to, you have to have a source for that. You have to identify
when the balance. That means transactions are missing or
records. That's what that means. And so you have to be aware of that,
too. That's, that's an interesting, an interesting way to bring that in.
Yeah. So we've talked a little bit about
presenting data to courts and things
like that, and I'm sure there's a myriad of challenges that come along with that.
Can you kind of dive a little bit deeper into what some of those challenges
are when you're presenting blockchain evidence in a court? Yeah.
I mean, first you have to get it right. So you have to know what.
Where the addresses are, what they are. And sometimes you'll get
someone who's intentionally only disclosing
a set of addresses. So they're not disclosing all of their addresses. They're certainly not
disclosing their wallet software in the way that's appropriate.
And so when somebody discloses a set of addresses, you can use
clustering, which is something that the data aggregators use,
but something that some. You can do that.
You can do that technically also, you know, with a little script just
to show that if, if you had this address, then you also have
these four, you know, first for sure. That can, that can happen with Bitcoin.
You can do that with, with some of the others as well. So when that
happens, sometimes the crypto spouse is surprised.
They might come back and be like, you can't know that. There's no way for
you to know that because they're not a forensic expert, you know, so they thought
they were concealing something from their spouse. They may have taken steps to do that
successfully, but they didn't think that through from a forensic perspective because they may not
know how. How to think that through. It's. It's
really critical to come at that from
a point of full disclosure and, like, really disclose what you
have, where you hold it and how you access
it. That's kind of the critical point. And now I think I've completely
rambled and didn't injury. No, no. But I love, I love you bringing
up clustering because this is actually in the new. In, like the crypto news, like,
yesterday there was a. There's a girl
who's. Who's like, became like an overnight celebrity. And she
started. She's like a celebrity now, and she started a meme,
coin and rug, pulled it all. But they were able to identify
that clusters of wallets held 97% of the supply
and then just dumped it all on the unsuspecting. And it's
like, it was like over the course of 20 seconds, they extracted, like, millions of
dollars, and they identified these
clusters of wallets that they knew were team members that held
97% of the supply. And they were able to kind of
like, trace them back to a similar source
in the exact way that you're describing. Yeah, absolutely.
What happens, though? Is it kind of calls into question the reliability of
your aggregator, you know, so, yes, I can use clustering. If I'm
doing it technically, then it's unquestionable. But if you're relying on a
data aggregator to do that, like how are. They doing the clustering and how
does that process work and what was their. Incentive to do it? Right. There was
a much bigger case where that they identified the
culprits behind an exchange hack. Right. I think it was Bitfinex or something. It was
really big. But that company had issued
a financial incentive, a bounty. 10% of what was stolen.
Well, 10% of what was stolen is $400 million. Right.
That's a pretty big incentive if you're the guy adding the
attribution data at the data aggregator to be like, yeah, this is, you know,
Billy and Sue and go, go ahead and get that
attribution data out there. Now you can, you can claim that bounty, right?
Hey, look, I identify, I trace this back to Billy and Sue, right? You've got
to call that into question and make sure that especially if it's a criminal case,
that the, the evidence is being relied upon is actually
reliable and is actually, you know, admissible. It was obtained in an
admissible way. That, that can be tough. And so you
have to know, you, you have to know what clustering
is, how it works and how the tool you're
using does it, because they may not be doing it just from a technical
aspect, they may be doing it from some other methods also. And so you have
to be really careful with that. So what strategies do you implement when you
come across like instances of incomplete data, for example, like you get
into a black box like with, you know, ftx,
something like that, or another, like exchange that shut down,
where that some of that historical transactional data may not be
able to come up with that or things like that. What strategies do you implement
in those cases? Yeah, that. I mean, it happens a lot.
There are quite a few exchanges that turned out to be exit scams
or collapsed, you know, of their own accord. It,
it's really tough. And you, it really depends on the case. So if it's a
matrimonial case, then you have to see whether or not the
assets that went into that exchange were
put into that exchange with the knowledge and consent the spouse, because that matters
in divorce, were they put in that exchange with, if it's a commercial
case, were all the risks identified and did the
decision maker put those, make a reasonable decision when placing assets
there? Know that that's going to depend on what time it was, you know,
during. When did they put them there? Did they put them there after, like
two days after the feud between, the little Twitter feud broke out? Or did it,
was it before? Because if it was after, you're going to have a difficult time,
you know, saying that it was a reasonable thing to do. And so
it, it really depends. Sometimes records are available,
you know, so you've got one of the, the oldest
exchanges, you have, Mount Gox, where those transaction
records were leaked to the public. And so that's something that
you may be able to rely on. They're not necessarily complete. They have some
redacted information. You, you should absolutely not download those
yourself because they, you know, a lot of those downloads have embedded malware. And so
you have to know what you're doing even to get those records. But sometimes they're
leaked and then you have Celsius went down. Celsius had
an incident with the, the way that records were disclosed in
court so that all of the account holders were disclosed. Well, if
you're fast enough, you're able to get that data and rely on,
you'll be able to rely on it and say, I know for sure this person
had an account there because that data was released to the public, it was pulled
back, but that doesn't mean it's not still accessible. So finding
records in that way, you know, can be a route. But first, and that would
be, that would be admissible in court even if they were pulled back.
It, it depends on the court, on the jurisdiction. And
sometimes there's a means to an end argument that gets made
in, in some jurisdictions. And so if that argument's been made in
your state or, you know, in, in the federal court, wherever,
wherever you're presenting it, you may have a precedent to be able to admit those,
you may not. But that, that goes back to your kind of traditional skill set.
You have to know your jurisdiction. You know, what's the valuation standard here?
What's the admissibility standard here? What, what are those, those
things? The admissibility standard really is a big one because you
end up getting like one of the ways you could show somebody had an account
would be they had transactions with it in their
emails, right? Here's all the transaction confirmations you can get that Mount
Gox emailed everybody transaction confirmations. And
as, as a nerd, I tend to save everything, right? I just open a new
email account when one gets big, too big, right? So I still
have those. I still have all my transaction confirmations even if an exchange goes
down, that may also be the case for the person
that you're asking about. If the exchange has gone
down, there's no emails, there's no anything. There may still be
records on the devices they used. And getting access
to the devices somebody used is a very, very difficult thing to
do for good reason. Right. There's not a very strong
argument for someone to say, I want access to your device and everything that's on
it, because there's no way to limit a digital forensic image. But I think you
probably have some more questions about that aspect of it differently. But really,
when it comes down to it, in divorce, if you've got assets
going to ftx, you're not getting records from FTX because it's collapsed and
nobody's buying them out of bankruptcy or whatever, you can't get access to
records, you then have to change your damage model. And that's true in a
commercial case too. So what you're going to look at is what went in
to that exchange. If you've got multiple exchanges, then you're going to look at
what happened at those other exchanges and maybe theorize about what could
have happened with those assets at FTX or what the value could be
today. And then that, that turns into a traditional damage calculation
to, to kind of explore the what if analysis and decide what
needs to be claimed for this, for this asset.
This is all super interesting. I mean, I think it's like super cool to be,
you know, able to apply this, this field
into something that's not traditionally,
you know, seeing this. So, um, can you
maybe share some of, like a real world example? Obviously I'm sure you can't
reveal, you know, private information about people, but like more
generalized examples of uncovering like hidden crypto assets
or, or something that was like, I don't know, like, really interesting to
you that you've seen in the field. No,
so I get, I get asked that question a lot. Like,
because when, when you're disclosed as an expert, you have to
list all the cases that you provided testimony on, you know, and
where, where have you been deposed? Where have you provided trial testimony? What cases were
those? And what happens is that opposing counsel will tend to ask
detailed questions about those cases. What was this case about, what
assets were at issue, you know, and some of those questions I can answer, but
for the most part I don't disclose anything about cases ever.
Right. That work is confidential. The only way you're getting information out of me is
with a, a court order from a Court of competent jurisdiction.
So not the one that your case is at, but the one that handled the
case that you're asking about and, or written
consent from the client, you know, that's, that that information
is locked down. Everything I do is confidential. It's in all of my engagement
letters. And then sometimes cases have, they're under seal, they've
got protective orders, they've got additional layers of protection on top of
that, um, which I absolutely value and respect. You
know, as, as someone involved in cryptocurrency, I'm also,
I feel, required to also be a privacy activist. Right. It seems
like that's, those go hand in hand. But. But yeah, no, I
value the integrity of that data and absolutely don't share anything.
And even when presented with something like a lot of my
cases and some of my reports end up being part of the public court
record, that doesn't mean I can talk about them. Right. You would have to go
find it and present me with the report you found and then say,
you know, tell me about this part of your report and then I could talk
about it. But that burdens on you to find it. Right.
Generally, of course, as somebody who does financial
forensics, I think financial forensics is important. I also think you should hire
an expert early in the case, not late in a case
a lot of times. And when I present to attorneys, I tell them
hiring me early will save you money. And that
is counterintuitive, but it really will, whether you're on
the side of the crypto spouse or the non crypto spouse. Because what happens is
that you end up going down all these roads of misunderstanding
or not very clear definitions or something like that. And we cut that off at
the very beginning. Here is a clear definition for how to go get these
records. You mean to jump on a video call with the opposing client,
the crypto spouse, and just tell them which buttons to push? Let's do
that. If they're willing to do that, that can save a lot of time and
effort in the discovery process and then it's straightforward. Then you don't
have those wild accusations of you, you know, you failed to
disclose and it was intentional. You know, you can't really, you can't make that
leap. And that as the crypto spouse, having me
on your side in your corner early on can also prevent those things.
Because I see a lot of post judgment actions where
the non crypto spouse suddenly decides they want to, you know,
claim this person had multiple millions of dollars in crypto. And, and we're
going to go after it. The problem with doing that is that as the
former crypto spouse, you still have to defend yourself in the post
judgment action. You still have to hire an attorney. You're going to have to probably
hire an expert to defend against these wild accusations. And so you want to make
sure in the divorce itself, before you ever get to post judgment
issues, you control for those post judgment issues. And so you don't want to
be, you don't want to use, like, boilerplate language for a
settlement if you're, if you're settling, you want to make sure that everything is ticked
and tied so that somebody can't come back after you. Because
your, your, your non crypto spouse may be surrounded by sycophants
that are like, oh, yeah, you know, your ex is, is, you know, a
crypto bro or whatever. You know, they're. They've got millions of
dollars. Yeah, right. I know, I know. He told me
that he had multiple millions. Like, okay, wait, when your friends start telling you that
about your ex spouse, that's a red flag, you know, like, not
that your ex spouse actually had multiple millions. It's a red
flag for the friend, you know, like, that person should have told you during the
divorce, not after you've settled, you know, so really have to be careful
with that. Yeah, it, it's really trying and
it's, it's a lot of undue stress and burden on
both parties, you know, to, to have that conflict when you could resolve
it with better language, really. Mm.
So what, how do you, how
do you think that expert testimony shapes
the litigation process when it comes to this? Like how, how, how much, how much
does it shape the outcome and what does
that look like? I guess. Yeah, it really, I mean, it really depends.
So my. I really try to talk
myself out of work a lot. I really encourage
clients to settle whether I'm on the side of the crypto spouse and non crypto
sales, but they have to do that with knowledge. You
know, with knowledge and information. You can't really settle if you don't know what all
there is or what happened to it, you know, or whether somebody there's. I
don't typically get involved in cases that are not contentious. You know, when I
get called, parties don't trust each other. They don't believe a single word out of,
out of the mat. You know, they are very angry. It's contentious.
They're in no way amicable, you know, and so you have to.
And I'm not your advocate. That's kind of the other Confusion. When
somebody's paying another person, you think that they're supposed to do
what you want them to do. That's not how this works. I'm an
objective expert, and so I'm going to find facts and I'm going to
conclude on the basis of those facts. I'm not going to be
like, he absolutely is a criminal as a result of this. Like, I would never
say those words in a report, report or trial or whatever, regardless of,
you know, how badly you want them said. And that that can
really be difficult for someone to realize. There's.
I've not taken on cases because the client
had data that they probably shouldn't have had or wanted
too much kind of input into the expert report.
But that's not how this works. And so we're. I'm done to go find
somebody else. But how it shapes, how it shapes the
conclusion, it really, really depends. You know,
I've been encouraging other people in financial forensics to get into
blockchain forensics because there is a huge,
gaping need for more experts
who are actually qualified to be experts and not just random
people that are presenting themselves as that. You know, that that causes
much more stress and costs on, on both parties,
and it can shape the outcome in that
the trier of fact will walk away, and that's the, the judge or the jury,
whoever, the trier factor will walk away with a better understanding of
this technology. And that's a good thing because in their next case, they'll know
exactly what to look for and can kind of start to see through
some of the, the wool, I guess, you know, from either side.
The. What typically happens is that one party or
the other is trying to make, make the other one, I guess,
run out of money, you know, and so if one party hires an
expert, then the other party hires an expert, and then you're going to end up
with a battle of the experts, which is a really common complaint among
judges. Right. How do you have in, in traditional financial forensics, how do you
have two objective experts come to completely
different, you know, conclusions? The values here, the values here,
you know, they've got this many assets. Got this many assets. How do you have
that if you're both supposed to be objective? And the answer is one
of us isn't, and you have to, as the judge, you have to figure out
who that is. And now with kind of the new, new rules
around how judges should treat experts, before
it was a lot of times judges would use the excuse to
say, oh, I'll just, I'll hear from both experts. And if one is
shown to be not credible, that'll just go to the weight of the testimony. Now
there's new kind of rules around what judges are supposed to do where
they need to make more of an effort to exclude experts
who are not qualified to provide testimony. And that's a
good thing for the industry. It's a bad thing if that's your
expert that just got disqualified. Because disqualification doesn't
happen at the beginning of a case. It happens years later when you're
going to trial know, or it can happen a little bit before that. But after
a couple of years of dragging of a case dragging out, those fees are very
high. You don't get that back. And when your expert's disqualified, you're
just, you're just left with no expert, no testimony. You have to either go
hire a new one or try to present your case on your own. And
so it, it, that can be a big problem. As
far as the shape of the case goes, I haven't seen, haven't seen judges really
willing to do that on the crypto side of things so, so much
because it is such a complex topic and they just don't have the
skills to differentiate between someone who's full of it and someone who's not.
Not yet anyway. That's, that's where your expert comes in.
If you're, if your expert's going to have a hard time explaining something
complex to you, like to the attorney, then you may
need to find a different expert or at least find a supplemental expert that,
that can bridge that gap. Because you don't want somebody who's highly
technical or who has no sense of humor or who can't
relate to the judge or the jury. Those things are
really important there. They may be as
important or more important than the technical side of things. So you've got to have
that technical skill set and then you have to have people skills. That's
a rare combination, I think, but I guess, I mean, as far as shaping
the outcome, it's critical when, with
complex assets for you to have a financial expert,
either a neutral expert that's, that's kind of working paid
by both sides, or each their own expert and a neutral
expert differentiating between them. But it's critical when assets are complex
that, that both sides have their chance to explain
what's going on in a cohesive manner. I think
that's really important. So
you mentioned that there's a, you know, there's a lack of supply of folks serving
this aspect of the industry. What advice would you give
professionals that are new to blockchain forensics and want to jump
into this field? Maybe they're tradition, they do traditional forensics
in this realm, but those folks that are qualified
from that aspect but want to jump into the crypto
blockchain side of things. Yeah, I mean, I'm a big proponent
of the skill set you need for blockchain forensics is a
traditional financial forensic skillset. You need to learn the new
technology and it's exactly analogous to PayPal in,
in the 90s, you know, the late 90s, early 2000s when PayPal came
out, financial forensic experts had to learn
what those records looked like. How do you request them? What does an account setup
transaction look like? You know, the little since in and since out. Yeah,
yeah, right. What does that look like? How do I ask for records? How do
I analyze these records when I get them? It's exactly the same.
And like Bitcoin is not that much younger than PayPal.
You know, it's only 10 years younger. And so to have a deep understanding of
how peer to peer transactions work when they're payment services
and to just miss the boat completely on blockchain is
a problem. People know how to do PayPal, it's relatively straightforward.
So it is helpful that that's the case. But they don't know how to do
anything related to blockchain. You have to learn it and you have to
keep learning it because new blockchains happen, new token standards
happen. Right. You've got to, if you've got, you got
something that's on the Cardano blockchain, you have to go understand
the programming language that Cardano has written in so you can understand those
transactions. And he, he, I mean, he didn't write
the language himself, but he did revive it. Right? It was a dead programming
language. It brought it back, revived it. Now you have to go learn it so
you can understand those transactions. Same is true for the XRP ledger. You need to
understand what the details of that transaction are
and how they work, you know, and what, what's the software that runs on top
of the XRP ledger? If it's one of those like flow through payments,
which is kind of like a really big deal on the XRP ledger. You
need to understand how that works. Where do you go to learn it and how
technologically advanced are you? Right. I happen to have
a minor in computer science, which is not much computer science as far as
the. I learned fortrean and Java very
early Java, but tried to learn C Sharp and then dropped it because it was
such garbage. And so it went back to C and objective C.
Like you need to have Pythons in there. You need to
have at least the ability to read pseudocode,
at least that ability. And if you get some familiarity with
Python that would be great. But you have to have that, you at least
have to have that curiosity to figure
out what this is, you know. And I refer to
that as, as like when I'm hiring somebody new, I kind of ask them how
they interact with a computer. When they were younger, are they a button pusher or
did they like follow the instruction manual? I was a button pusher. I
broke our family computer so many times
where one issue was my, my uncle had to come over to fix our computer
and, and his reaction was
I, I don't even understand how you got
to this. How did you get. This is the deep inner workings
of this stuff. Later when I was in college I learned that that was like
the, the machine code, right? Or the assembly language is an old DOS computer
is relatively easy to get to. But anyway that's the cure, that's the
gene you need to be successful in this. And if
you don't have that, maybe stick to traditional stuff but
you kind of need that traditional financial forensics also. So to go learn blockchain, you've
got the, got the traditional skill set, you've got that curiosity
part in you, right? There's a few really good
places to go start learning the technical side of things. One is a website,
bitsonblocks. And it does a really good job of presenting very
technical information in, in a readable format. And
so it's accessible to someone who's kind of non technical. But my, I mean
you can go do a credential. Credentials are getting better. A few
years ago they were, they were kind of garbage credentials like pay to earn, you
know, just pay for the piece of paper to hang on your wall or whatever.
Now there's a few more out there that are a little bit more rigorous but
they tend to lean towards the, the criminal side of things. And like a money
laundering investigation side of things or risk management. There's,
there's still not a good credential out there for civil financial
forensics. I'm working with a guy to maybe build one
or at least get some more information out there for that. Because it's different than
the criminal side of things. What you're looking for is different how you're
tracing and sometimes evaluation is even different. But really I think
the best thing that somebody could do is go build something
on the blockchain, right? Go, go to the, the build guild
and follow that, that little course. It's, it's a great little course. It'll teach you
everything you need to know about building things on a blockchain. Go
create some NFTs and you know, see what
those look like. Look at the parameters that you can change when you create those
things. That'll give you a really good understanding of one,
how complex transactions can be. But also it'll give you a good
understanding of how to recognize when someone is trying to pull the wool over your
eyes with their explanation. And that, you know, that can come from a traditional
interview skill set and it can come from a deeper knowledge of the
technology that you're discussing. And so it's, there's a. I guess that's kind
of a lot, right? I keep telling. No, I think that's great and I'm glad
you brought up the experiential piece as well because I think that that's, it's so
critical. Critical in crypto tax reconciliation.
I don't think you can be in this field, at least in, on the, on
the reconciliation side of things without having some hands on
experience of actually trading, holding, moving,
accessing these assets. I think what you're talking about is deeper and I
think it's more necessary for your type of field when you really need to understand
the underlying technical aspect of what's happening. For my field, it's less
necessary for folks to build things on chain, but I think at the bare
minimum you have to have used these assets and you don't have to
mortgage your house and go all in on Bitcoin to do that. You
can take $10 and go play around on Optimism or
Polygon or Solana or whatever and you can do 90% of
DeFi activities with that small amount because they have low fees.
So you're playing around with some Dexes, do some swaps on
there, throw some collateral on aave, see
what borrowing against that collateral looks like. Follow the chain of events on
Chain to see what the block explorers tell you about what's happening. And then with
your knowledge of what actually happened because you did it yourself, you can
kind of tie those pieces together. So I always, when
anyone's trying to get into anything related to blockchain, I say get your feet wet.
Doesn't have to be with a lot of money. But I love that you're talking
about building on Chain as well, because I think for what you're talking with
your field. It's more important to understand that technical aspect, which honestly is
beyond me. I don't know anything about solidity other than, you know, it's the
programming language of Ethereum. You know, I don't know anything about, you know, the
programming language of, of Cardano.
That's the name of it. Couldn't think of it earlier. Yeah, so,
but, but I think it's incredibly important and it can't be emphasized enough
that if you want to start operating in this space, you
cannot do so without being. You don't have to be invested, but
at least play around in the space. Well, I mean, I think, I think to
clarify, you absolutely can. You'll just be bad at it, right?
Yeah, yeah, be bad. I mean, that's the other way to learn, right? You
could practice. And that's what, that's what I do at my firm is,
is I have associates that will practice on an
old case. And so they're going to make a lot of mistakes, they're going to
misunderstand a lot, and then we can correct those. Right. And
then, you know, they've got to go through some of the, the training for building
on the blockchain. They've got to look at really complex transactions
and, and parse that out. And it takes a long time
to. Harder. It's harder
for people, I feel like, that are already educated. So people
with a master's degree or two master's degrees are,
Are much more kind of ingrained in their ways. And you've got to kind of
go. Go through this process of unlearning before they can learn. Like my, my
most successful hirees have been people that have a high school
education, which is kind of wild. Other people are starting
to recognize that now that, you know, degrees have decrease. Have been on the
decline for a while, if we're honest. But you
really ultimately need that curiosity. You
know, what does this do? What does this button? What does it look like when
you're engaging in those transactions? What does it look like in the wallet
software that you're using? What's the, you know, contrast that against what somebody can see
publicly, then you'll understand why when you're disclosing something, you can't just
give over a list of addresses. You've got to give the wallet software
details also. And that's, that's really difficult for,
for people to wrap their heads around. A lot of times I hear I don't
have to give you that because all the transactions are public. You
do have to give me that because What I'm limited to is just
the addresses you say you have. You've got to prove that those are all of
your addresses. And then for complex transactions, you, you may not be
able to discern what's going on on the blockchain, but that you've got to have
those, those details from the wallet software or at least
you can discern it from the blockchain, but it's easier for the wallet holder to
provide it. That's also, you know, something that comes up in matrimonial divorce a
lot. Equal access isn't the same. You know, doesn't. Just
because it's public doesn't mean both parties have, have equal access to that, that
data. Well, this has been a super
enlightening conversation. I really appreciate you taking the time. Do you have any final thoughts
or anything you'd like to share about the, the field or anything, anything else you'd
like to say? I think, I think the, the end
note would be don't be afraid of it. You know, for, for somebody in
traditional financial forensics, this is not
insurmountable. You know, it, it will take some work, it
does take some effort, but you can gain enough knowledge that
you can feel comfortable taking on a crypto case and maybe, you know, be an
opposing expert on the case that I'm on or something like they, we absolutely
still need it. And I think it's important for people to, to get out there
and, and try to learn this stuff so that we've got more people that are
qualified to do this kind of work. That's awesome.
And finally, can you direct listeners,
how could they connect with you or if they have a matrimonial case that
they want you to be an expert on, how would they get in touch with
you or find more information about you or your firm? Yeah, I
mean my website has a little contact form on it that's probably the easiest.
I should probably check it more often than I do. But I think my
website is ybr.solutions and use
that contact form. There's also a lot of articles on there. I put together
a lot of templates for people who are engaged in litigation. And so
if you're still in the DIY mode or
it's you, you're the, the non
propertied spouse or you don't have enough money to hire an expert, you can still
give me a call or shoot me an email because those, your attorney might still
be able to use those, those templates even if you're the crypto spouse. Right.
If you're not ready to hire an expert, at least look at those and see
what might be asked of you. And make sure you understand how to disclose it.
Well, thanks again, Dorothy, for. For sharing your expertise and your time with
us. We really appreciate it, and we hope to work on more webinars
and things like that with you in the future. Yeah. Thank you so much for
having me.
Creators and Guests



