Bitcoin Fog: What Roman Sterlingov Was Convicted Of

The case in plain English

Bitcoin Fog accepted bitcoin from users, pooled it with other users’ funds and paid bitcoin out to different addresses, making deposit-to-withdrawal connections harder to follow. Prosecutors said Roman Sterlingov operated the service to help launder criminal proceeds. A jury convicted him on four counts on 12 March 2024; he received a 150-month prison sentence on 8 November 2024. On 25 September 2026, the U.S. Court of Appeals for the D.C. Circuit affirmed the convictions and sentence. DOJ’s verdict and sentencing account; appellate opinion, opening and III.

The important question is what connected the service, the operator and the criminal conduct. Blockchain tracing was part of the answer. Account records, internet login analysis, service communications, the design and promotion of the business, and an undercover transaction supplied other parts. Sterlingov disputed that he operated Bitcoin Fog and challenged the government’s expert evidence. The appellate court rejected his grounds for reversal. Opinion, I, II.A and II.C.

Need the basics first? Read Blockchain and Cryptocurrency Explained: Follow the Money for wallets, custody and the difference between a visible transaction and an identified person.

Bitcoin Fog timeline: operation, conviction and appeal

• October 2011–April 2021: the operating period described by prosecutors. The appellate opinion records the service’s 2011 launch and its continued operation until shortly after Sterlingov’s arrest. DOJ account; opinion, I.
• November 2019: an undercover agent used Bitcoin Fog and told its administrators through the service’s chat that he wanted to clean coins from ecstasy sales. The opinion identifies the 21 November 2019 sting transaction as relevant to the substantive laundering and licensing counts. Opinion, II.A and II.B.2.
• 27 April 2021: Sterlingov was arrested at Los Angeles International Airport. The opinion records Bitcoin Fog’s last withdrawal on 29 April 2021. DOJ, arrest paragraph; opinion, I.
• 12 March 2024: a jury returned guilty verdicts after a month-long trial. DOJ, verdict paragraph.
• 8 November 2024: the district court imposed 150 months’ imprisonment—12 years and six months—and forfeiture orders. DOJ sentencing announcement.
• 25 September 2026: the D.C. Circuit affirmed the district court in United States v. Sterlingov, No. 24-3161. Opinion, III.

Status at this review: the confirmed appellate outcome is the 25 September 2026 affirmance. Targeted official-source checks on 29 October 2026 did not establish a later rehearing or Supreme Court disposition. This is not a claim that further review is unavailable or exhausted, or a statement of present custody.

What were the four convictions?

The opening of the appellate opinion identifies each count and its statutory provision. These are distinct offences, even where they draw on overlapping conduct. Court’s count-by-count identification, printed page 2.

1. Count I: conspiracy to commit money laundering — 18 U.S.C. § 1956(h). This concerns an agreement to commit a money-laundering offence. The court addressed the government’s conspiracy theory and evidence of continuing operation with unknown co-conspirators; its analysis did not require every later user to be individually named. Opinion, II.A.2 and II.B.2.
2. Count II: substantive, or “sting”, money laundering — 18 U.S.C. § 1956(a)(3)(A) and (B). The provision addresses transactions involving property represented to be criminal proceeds, or used to conduct or facilitate specified unlawful activity, with the required promotion or concealment intent. The undercover nature matters: the offence does not depend on the agent actually having sold drugs. Opinion, II.A.1.
3. Count III: operating an unlicensed money transmitting business — 18 U.S.C. § 1960(a). This was a separate federal conviction concerning the money-transmission business. Do not reduce it to a generic finding that cryptocurrency is illegal. Opinion, opening and II.A.3.
4. Count IV: conducting a money transmission business without a licence — D.C. Code § 26-1023(c). This was the distinct District of Columbia licensing offence. The opinion also addresses the service’s transactions into D.C. when considering venue. Opinion, opening and II.A.3.

Why the undercover exchange mattered

In the November 2019 operation, the agent sent bitcoin from an account on a darknet market and then messaged Bitcoin Fog’s administrators about cleaning ecstasy-sale coins. He received no reply before withdrawing the funds two days later. The defence argued that the government had not shown Sterlingov saw the message. The court held that evidence identifying him as administrator, together with an operational chat function, allowed a reasonable jury to infer that he or a co-conspirator saw it. That is an evidential inference upheld in this record; it is not evidence of an express reply accepting the proposal. Opinion, II.A.1.

What blockchain analysis established—and what needed other evidence

The government’s experts used Chainalysis Reactor to group, or “cluster”, bitcoin addresses and attribute clusters to entities. The opinion describes three approaches: co-spending inputs in one transaction; transaction behaviour, including change-address analysis; and intelligence from sources such as court documents, leaks and data partnerships. Experts testified that Reactor attributed more than 900,000 addresses to Bitcoin Fog and examined flows between the service and darknet markets. These are analytical conclusions described in the court record, not names written into the blockchain. Opinion, II.C.2.

Separate four evidential questions

1. What transaction occurred? The public ledger supplies addresses, amounts and transaction history. Preserve the actual transaction identifiers and relevant times, not just a screenshot of a vendor’s label.
2. Which addresses may belong together? Clustering applies assumptions and supporting intelligence. Record the method, exceptions and confidence limits. A cluster is an analytical grouping; it is not automatically a verified customer account.
3. Who controlled the service or account? That requires attribution. DOJ described records from Sterlingov’s true-name exchange accounts and tracing of deposits back to Bitcoin Fog clusters. The opinion describes an IP-overlap analysis of account logins, alongside other evidence connecting him to the service. DOJ, exchange-account evidence; opinion, I and II.C.1.
4. What did the person know or intend? A transaction path does not directly display a person’s state of mind. The prosecution relied on service promotion, operational features, darknet-market connections and the undercover transaction as well as financial tracing. Opinion, I, II.A.1 and II.H.

The four-question sequence is LearnAML’s investigation framework. It is not a claim that every tracing tool uses the same methods or that all four questions were proved by a single expert.

The expert-admissibility holding was specific to this case

The D.C. Circuit reviewed the admission of expert testimony for abuse of discretion under Federal Rule of Evidence 702 and the Daubert framework. It upheld admission of the IP-analysis testimony and the Reactor-based testimony. The court explained that the familiar reliability considerations are flexible, rather than a rigid checklist that every technique must satisfy in the same way. Opinion, II.C.

The Reactor witnesses acknowledged that the software had not been peer reviewed and that they did not know its error rate. The court nevertheless accepted other indicators of reliability: explanations of methods and assumptions, comparisons with later legal-process records, use by investigators and specialists, and corroboration. One check found four of five known undercover addresses in the Bitcoin Fog cluster; the court treated the missing address as consistent with conservative, underinclusive clustering. That small check is not a universal accuracy rate. Nor is a separate-case corroboration figure mentioned in the opinion a guarantee for all addresses or future investigations. Opinion, II.C.2 and footnotes 6–7.

There is a further limit on the IP holding: the court expressly declined to decide whether the expert’s particular conclusion that the same user “likely” accessed the accounts was unsupported, because Sterlingov challenged the methodology generally rather than that specific conclusion. The holding therefore should not be presented as blanket judicial certification of every attribution or inference. Opinion, II.C.1, footnote 5.

Knowledge, record deletion and willful blindness

The appellate court also upheld a willful-blindness jury instruction. It considered evidence that Bitcoin Fog automatically deleted records every week, asked no questions of users and lacked account verification. Taken together in this case, the court said those features supported an inference of deliberate steps to avoid learning about illicit conduct. Opinion, II.H.

The instruction distinguished deliberate avoidance from negligence, recklessness, carelessness or foolishness. The court applied the parties’ agreed test: a claimed lack of guilty knowledge and trial proof supporting an inference of deliberate ignorance. A compliance control failure is therefore not automatically equivalent to criminal knowledge. Conversely, designing a system to avoid information does not necessarily insulate its operator from evidence of knowledge. Both the design and its context matter. Opinion, II.H.

How to read the approximately $400 million figure

DOJ reported that Bitcoin Fog processed more than 1.2 million bitcoin, worth approximately $400 million at the times the transactions occurred. This is a historical transaction-value figure. It is not a valuation at today’s bitcoin price, Sterlingov’s personal profit or a count of distinct victims. DOJ separately reported a forfeiture money judgment of $395,563,025.39 and other asset-forfeiture orders; those measures should not be mechanically added to transaction throughput to invent a larger loss figure. DOJ sentencing announcement.

For sentencing, Sterlingov argued that the value should be no greater than approximately $78 million attributed to known darknet markets. The government sought approximately $400 million, and the district court used that amount in calculating the advisory Guidelines range. The D.C. Circuit upheld the calculation under the rule for commingled legitimate and criminal funds in U.S.S.G. § 2S1.1, commentary note 3(B). Opinion, II.I.

As the opinion explains, criminally derived funds alone are counted where the defendant supplies sufficient information to separate them without unduly complicating or prolonging sentencing. If separating them is difficult or impracticable, the total commingled amount is used. The court concluded that Sterlingov had not supplied the information needed to separate allegedly legitimate funds. It did not decide a constitutional or statutory objection to that allocation of the burden, because none was presented. Opinion, II.I.

Practical lessons for cryptoasset controls and investigations

Original LearnAML teaching analysis. These lessons are not additional court findings or a statement that identical duties apply to every service in every country.

1. 01Map custody and control
2. 02Corroborate the evidence
3. 03Decide and escalate
4. 04Preserve the rationale

1. Identify who can move the assets

For a service that pools funds, establish who controls signing keys, withdrawal permissions and internal balances. Separate the blockchain balance from the provider’s customer ledger. A technology description such as “privacy service” does not resolve who performs custody or transmission, or which registration and licensing requirements may apply. Identify the actual entity, activities, customer access and jurisdictions.

2. Test the provider’s controls

Ask what identification, transaction review, escalation and record-retention processes operate in practice. Obtain evidence for the relevant service and customer population. A supplier’s licence or an analytics subscription does not establish that every transaction is lawful or that the controls work. Material gaps need a named owner, an action and a review point.

3. Preserve evidence so another reviewer can follow it

Retain transaction references, analysis dates, asset and network, the source and date of address labels, relevant customer records and the reasoning linking them. Record whether an exposure is direct or several steps removed, and whether the label is current or historical. Preserve alternative explanations and material limitations alongside the conclusion. Retention and disclosure should follow applicable law and authorised procedures.

4. Investigate suspicion without overstating it

A mixing-service exposure can justify further review in context. It does not by itself establish the customer’s identity, knowledge, predicate offence or guilt. Conversely, an absence of a labelled direct market transfer does not prove a clean source. Consider the customer’s explanation, source-of-funds evidence, transaction pattern and corroborating records together.

5. Write a defensible suspicious-activity narrative

Where the applicable reporting threshold is met, explain the observed conduct, why it gives rise to suspicion and what remains unresolved. Distinguish an identified transaction from a tool’s attribution and an investigator’s inference. Name the service, dates and amounts accurately; avoid importing a court’s sentencing total as the suspicious amount in an unrelated customer review. Reporting decisions and interim restrictions require the institution’s authorised process and current local rules.

Take one lesson back to work

Pick one recent cryptoasset review and ask whether another reviewer could distinguish the transaction evidence, service attribution, identity evidence and inference about intent. If those layers have been compressed into one risk label, make the reasoning visible before relying on the conclusion.

Educational analysis. Apply current requirements and your institution’s authorised procedures to live matters.

Sources and editorial record

1. U.S. Court of Appeals for the D.C. Circuit: United States v. Sterlingov, No. 24-3161Decided 25 September 2026 · Full 38-page opinion reviewed.Evidence locations: opening (four counts); I (background); II.A.1 (sting); II.C (expert testimony and limits); II.H (willful blindness); II.I (commingled funds); III (affirmance).
2. U.S. Attorney’s Office, D.C.: Operator of Bitcoin Fog sentenced to more than 12 yearsEvent and displayed release date: 8 November 2024 · Displayed update: 12 November 2024.Evidence locations: verdict, operational history, tracing and exchange-account evidence, and arrest paragraphs. This is the prosecution’s account.
3. DOJ Office of Public Affairs: Bitcoin Fog operator sentenced for money laundering conspiracyEvent and release date: 8 November 2024 · Archived page updated 6 February 2025.Evidence locations: sentence, historical transaction valuation and forfeiture paragraphs. Historical asset valuations are not current prices.

Prepared by FinCrime Wire Research Desk for LearnAML. Published and sources checked: 29 October 2026. Version 1.0. Court findings, prosecution accounts and original educational analysis are distinguished above. The exercise and its customer details are fictional. The latest confirmed appellate event is the 25 September 2026 affirmance; further-review exhaustion is not asserted. No external review, accreditation or endorsement is claimed.