Bitcoin Fog Operator's Conviction Upheld, Chainalysis Reactor Software Validated

The D.C. Circuit on September 25 affirmed Roman Sterlingov's convictions and 150-month sentence for operating Bitcoin Fog, which mixed users' bitcoin to obscure transaction trails. Chainalysis presented the judgment as further validation of its Reactor software in October 13 commentary. FBI witness Luke Scholl and Chainalysis analyst Elizabeth Bisbee testified that Reactor clustered and attributed more than 900,000 Bitcoin addresses to Bitcoin Fog.

Federal Rule of Evidence 702 requires the party offering qualified expert testimony to demonstrate, more likely than not, its usefulness, sufficient factual basis, reliable methods and reliable application. The appeals court explained that Daubert's reliability considerations, including testing, peer review, error rates and general acceptance, are flexible and nonexhaustive. The panel reviewed admission of the testimony for abuse of discretion, recognizing the trial judge's latitude in choosing and applying a reliability assessment.

The opinion describes co-spend clustering as treating addresses used together as transaction inputs as controlled by one person or entity. Behavioral clustering identifies matching transaction patterns, including change-address behavior and digital fingerprints. Intelligence-based clustering incorporates information from data leaks, court documents and data partnerships. The opinion also recounts IP-overlap analysis, Sterlingov's earlier activity concerning mixers and darknet promotion, financial records, and Bitcoin Fog's cessation of operations shortly after Sterlingov's arrest.

Both Reactor witnesses acknowledged that the software had not been peer-reviewed and that the witnesses did not know its error rate. The panel nevertheless found reliability markers in witness experience, comparisons with subsequently obtained legal-process information, professional use, methodological explanations and corroboration. The opinion cites a government contractor's confirmation that Reactor correctly clustered and attributed 99.9% of a large address group in another case. That result lacks a complete public sampling design and applies to those addresses in that case, not a product-wide error rate. Scholl checked five known Bitcoin Fog addresses used during government undercover transactions and found four in Reactor's Bitcoin Fog cluster. Sterlingov characterized that result as a 20% error rate. However, the panel accepted the trial court's explanation that Reactor was conservative and underinclusive for this case. Missing a known service address differs from wrongly attributing an unrelated address to that service.

The 2025 Ghost Clusters paper compared Chainalysis attribution snapshots with seized-wallet data from BestMixer, Hansa Market and Wall Street Market across the services' historical periods. The researchers found conservative coverage and few but nonzero false positives, with coverage varying by service and historical period. The paper appeared after Sterlingov's 2024 trial.

The district court ordered disclosure of Reactor's heuristics and underlying assumptions to Sterlingov's counsel and qualified experts under a protective order. The district court restricted Sterlingov's personal access because of concerns that the information could help someone circumvent tracing techniques. The panel noted that Sterlingov's experts refused to review the disclosures regardless of the protective order's scope. The appellate opinion says the district court repeatedly asked Sterlingov to explain why the source code, distinct from the disclosed methodology, was material and relevant to Sterlingov's defense. Sterlingov did not provide that explanation. The panel noted that the trial court had shown willingness to provide the code if the need was justified.

New constitutional objections concerning access to the full software, including code, received plain-error review because Sterlingov had not raised those objections below. The panel distinguished those objections from a previously raised objection concerning Sterlingov's personal access to heuristic material. The panel found the constitutional claims unpersuasive under either discussed standard. The panel rejected Sterlingov's Confrontation Clause theory that machine-generated outputs required source-code disclosure under the right to confront witnesses. The panel said that treating the outputs as inferences from human programming judgments would still not require code production on the facts presented. The panel found the Rule 17(c) subpoena challenge and related due-process claims forfeited because Sterlingov's opening appellate brief did not contest denial of that request. The panel also rejected an independent due-process theory because Sterlingov had not shown a material impairment of Sterlingov's defense.

Sarah Meiklejohn and colleagues' 2013 Bitcoin clustering paper distinguished address control from customer-fund ownership because a wallet service can control addresses holding different users' money. The paper warned that its change-address heuristic could incorrectly link unrelated clusters, particularly as transaction behavior changes. Evidence attributing addresses to a service differs from evidence identifying the service's operator or establishing a customer's ownership. Rule 705 generally permits expert opinions without prior disclosure of underlying facts or data unless ordered otherwise, but permits requiring that disclosure during cross-examination.

Explained methods, corroboration and protected access to methodology can support admission of proprietary tracing testimony. Sterlingov's failure to explain the code's material connection to the defense and the procedural handling of objections helped defeat this disclosure challenge.