AO zt42 @ev.

lUil) furestWarrant
M
UurBn SrAngS DMTruCT COURT H SEAL
for the

Northern District of California

United States of America

v. )
CaseNo. CR-19-0572-CRB
)
DANIL POTEKHIN, a/Ua "cronuswar,'and DMlTRll )
JLr

KARASAVI Dl, alV a Dmitriy Karasavidi

-j.
) t"l
\J
) (--\---:::

) zi-.i
Defendant
t-ft4

ARREST WARRANT
To: Any authorized law enforcement officer :--c

YOU ARE COMMANDED to arrept and bring before a United States magistrate judge without unnecessary delay
(name of person to be arrested) DMITRII IGRASAVIDI
who is accused of an offense or violation based on the following document filed with the court:

tr Indictment d Superseding lndicbnent 0 lnformation E Superseding Information O Complaint

E ProbationViolationPetition E SupervisedReleaseViolationPetition UViolationNotice il OrderoftheCourt
This offense is briefly described as follows:
Defendants are charged with a number of counts associated with a sophisticated phishing campaign targeting users of
Poloniex and Binance's virtual currency exchanges, resulting in a loss of at least $15.7 million worth of cryptocunency,
and the subequent money laundering of the proceeds of the fraud.

ox", vlNlwtp
's signature

City and state * r,l^Jl * yYuox*1,,/+S'A* SPer"

"t
Return

This warrant was received on (date) , and the person was arrested on (date)
at (city and state)

Date:
Ar re s ting ofi cer's si gnahtre

Printed name and title

AO ,142 (Rev. 11/11) ArrestWarrant clM
Uurpp SrarBs Drsrnrcr counUNDER SEAL
for the

Northern Distict of California

United States of America

v, )
CaseNo. CR-19-0572-CRB
)
DANIL POTEKHIN, a/]da "cronuswar," and DMlTRll )
KARASAVI D l, alkl a Dmitriy Karasavidi
)
) --4
:\f 1.1

) i.r
,-.'';
Defendant i -l
,, i' "

-l'i
ARREST WARRAIYT .---_ I l)
'.): i. -,
To: A:ry authorized law enforcement officer
'i
..,-j ^.;

YOU ARE COMMANDED to arrest and bring before a United States magistrate judge withouUiinne*tdr.y delay
arrested) DANIL POTEKHIN
(name ofperson to be

who is accused of an offense or violation based on the following document filed with the court:

O Indicfinent C Superseding lndictuent O Information E Superseding Information 0 Complaint

U, Probation Violation Petition D Supervised Release Violation Petifion il Violafion Notice D Order of the Court

This offense is briefly described as follows:

Defendants are charged with a number of counts associated with a sophisticated phishing campaign targeting users of
Poloniex and Binance's virtual currency exchanges, resulting in a loss of at least $15.7 million worth of cryptocurrency,
and the subequent money laundering of the proceeds of the fraud.

Date vlql*w SPERO

MAGISTRATE JT'DGE
Is suing ofi cer's si gnatw e

City and state: f, ch s

nante and title

Return

This warrant was received on @atu) , and the person was arrested on (dote)
At (city and state)

Date
Ar res ting ffi cer's s i gnatur e

Printed name and title

 Wntte[ Stuter TBtgtrtrt {,ourt
N.RTHER* u5ro$J15,
"or,roRNrA UNDER SEAL
VENUE: SAN FRANCISCO

I': l-::\
--.- I
l
UNITED STATES OF AMERICA, ., I l

V.
F',EB iI 2fi28

sufi rrt ! ri
:l;_itl:irlfi
CLIRi( lJ.S. i!$Tr''i';'r COURT
I\iCiTiii i.)liiTni0"i i'r eALiFORIllA

DANIL POTEKHIN, a/l</a "cronuswar," and

DtVI lTRl I KARASAVIDI, alkl a Dmitriy
Karasavidi

DEFENDANT(S)

SUPERSEDING INDIGTMENT

18U.S.C.S1030(b)-Conspiracy to Commit Computer Fraud & Abuse;

18 U.S.C. SS 1030(a)(4) and (c)(3)(A) - Unauthorized Access to a
Protected Computer To Obtain Value;
18 U.S.C. S 1349 - Conspiracy to Commit \Mre Fraud;
18 U.S.C. $ 1028A(a)(1) - Aggravated ldentity Theft;
18 U.S.C. S 1956(h) - Money Laundering Conspiracy;
18 U.S.C. SS 982(aX2)(B) and 1030(i) and O, and 981(a)(1XC) and
28 U.S.C. S 2461(c) - Forfeiture Allegations
E

true
a't
Foreman

Filed in open court this )P: day of

&r ffi
Clerk

Bail, $
(wv w \

6-fu
AO 257 (Rev. 6/78)

DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION . IN U.S. DISTRICT GOURT

BY: f] coMPLATNT n truroRuRrou E rruorcrn,tgrur Name of District Court, and/or

E CHARGED
I supensEotNc NORTHERN DISTRICT OF CALIFO RNIA
o
p"tty SAN FRANCrsco or#S?*J o
PLEASE SEE ATTACHMENT E
I Hainor DEFENDANT - U.S
Misde- 0i
I- I ,n""no. Dmitriy
) DMITRI I KARASAVI DI, a/[</a Ka rasavid i

PENALTY: PLEASESEEATTACHMENT
[] Felony
DISTRICT GOURT N ,(MIDEH
cR-1 9-0s72-CRB SEAL
DEFENDANT
PROCEEDING IS NOTIN CUSTODY
Has not been arrested, pending outcome this proceeding.
Name of Complaintant Agency, or Person (& Title, if any) 1) E lf not detained give date any prior
summons was served on above charges
USSS

person is awaiting trial in another Federal or State Court,

give name of court
2) f] ts a Fugitive

3) [ ls on Bail or Release from (show District)

this person/proceeding is transfened from another district

per (circle one) FRCrp 20,21, or 40. Show District
IS IN CUSTODY
a) [ On this charge
this is a reprosecution of
charges previously dlsmissed 5) On another conviction
n SHOW [
) ! f]
which were dismissed on motion Federal State
of: DOCKET NO
6) [ Awaiting trial on other charges
E u.s.ArroRNEY f] DEFENSE
) lf answer to (6) is 'Yes", show name of institution

this prosecution relates to a

Has detainer f] Yes r lf "Yes"
f] RendinO case involving this same
JI
give date
defendant MAGISTRATE been filed?
CASE NO.
E No fired
DATE OF Month/Dayl/ear
prior proceedings or appearance(s)
ARREST
)
I before U.S. Magistrate regarding this
defendant were recorded under Or... if Anesting Agenry & Warrant were not

Name and Office of Person DATE TRANSFERRED Month/DayfYear

Furnishing lnformation on this form DAVID L. ANDERSON TO U.S. CUSTODY )
E U.S.Attorney ! Other U.S. Agency

Name of Assistant U.S.

Attorney (if assigned) Cynthia , AUSA, Tax Div,
I This report amends AO 257 previously submitted

ADDITIONAL INFORMATION OR COMMENTS

PROCESS:

n suMMoNS E NO PROCESS. g WARRANT Bail Amount:

lf Summons, complete following:
* lilhere
Arraignment defendant previously apprehended on comptaint, no new summons or
f] !lnitial Appearance
warrant needed, since Magistnte has scheduled amignment
Defendant Address:

Date/Time Before Judge:

Comments:
 UNffiER SEALr;il.i:l
PENALTY SHEE-T ATTACHMEJ.{T:
Ffg n S ?0?$

Count 1: 18 U.S.C. g 1030&) - Conspiracy to Commit Computer Fraud *.

#r#,;',,-fffif1;,lii.1r,
' u''r-r'-o;i'\i{
Maximum Penalties: (1) 10 years imprisonment; (2) Maximum of 3 years of "'
supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment

Count 2: 18 U.S.C. $$ 1030(a)(4) and (c)(3)(A) - Unauthorized Access to a Protected

Computer To Obtain Value;

Maximum Penalties: (1) 5 years imprisonment; (2) Maximum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment

Count 3: 18 U.S.C. $ 1349 - Conspiracy to Commit Wire Fraud

Maximum Penalties: (1) 20 years imprisorunent; (2) Marimum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment

Counts 4 & 5:18 U.S.C. $ 1028A(a)(1) - Aggravated Identity Theft

Maximum Penalties: (1) 2 years imprisonment (to run consecutive to any other
term imposed); (2) Maximum of 3 years of supervised release; (3) $250,000 fine
or twice the gross gain or twice the gross loss; (4) $100 Special Assessment

Count 6: 18 U.S.C. $ 1956(h) - Conspiracy to Commit Money Laundering

Maximum Penalties: (1) 20 years imprisonment; (2) Maximum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment
AC 257 (ReV.678)

DEFENDANT INFORMATION RELATIVE TO A GRIMINAL ACTION . IN U.S. DISTRICT GOURT

BY: n coMPHTNT E truroRuRroru E rruorcruerur Name of District Court, and/or Judge/Magistrate Location

OFFENSE CHARGED
I supenseotuo NORTHERN DISTRICT OF CALIFORNIA
SAN FRANCISCO DIVISION
PLEASE SEE ATTACHMENT f] P"ttv

! uinor DEFENDANT - U.S

Misde-
I- I ,"rno. DANIL porEKHlN, a/ua "cronuswa/' *-^ .
) ffi ^ ^^^^
I retony
DISTRICT COURT NUMBER
PENALTY: PLEASESEEATTACHMENT
cR-l e-0s72-cRB r*$Y3t:*J'trs*i!"rt?ullr
NOF1TH DISTRICT OF CALII:O|iiliA

DEFENDANT
PROCEEDING IS CUSTODY
not been arrested, pending outcome this proceeding
'VOTIN
Has
Name of Complaintant Agency, or Person (& Title, if any) 1) r not detained give date any prior
E]
summons was served on above charges
USSS

person is awaiting trial in another Federal or State Court, 2) [tsaFugitive

give name of court

3) f] ts on Bail or Release from (show District)

this person/proceeding is transferred from another district

per (circle one) FRCrp 20,21, or 40. Show District
IS IN
a) ! On this charge
this is a reprosecution of
charges previously dismissed 5) [ On another conviction
tr SHOW
) I !
which were dismissed on motion Federal State
of: DOCKET NO.

U.S.ATTORNEY
6) ! Awaiting trial on other charges
I E DEFENSE
lf answer to (6) is 'Yes", show name of institution

this prosecution relates to a

Has detainer ! Yes r lf "Yes"
f RendinS case involving this same
defendant MAGISTRATE been filed? J
I give date

CASE NO.
E No fibd
DATE OF Month/Dayl/ear
prior proceedings or appearance(s)
ARREST
)
I before U.S. Magistrate regarding this
defendant were recorded under Or... if Arresting Agenry & Warrant were not

Name and Office of Person DATE TRANSFERRED Month/Day/Year

Furnishing lnformation on this form DAVID L. ANDERSON TO U,S. CUSTODY )
E U.S Attorney E Other U.S. Agency

Name of Assistant U.S.

Attorney (if assigned) Cynthia F rey, AUSA, Tax Div
I This report amends AO 257 previously submitted

ADDITIONAL INFORMATION OR COMMENTS

PROCESS

E SUMMONS n NO PROCESS.
E WARRANT BaitAmount:
lf Summons, complete following:
* Where
Arraignment defendant previously apprehended on comptaint, no new summons or
I !lnitial Appearance
warant needed, since Magistnte has scheduled arnignment
Defendant Address:

Date/Time: Before Judge

Comments:
 PENALTY srmBS$ffi*Nr[J N DER SHAL
Count 1: 18 U.S.C. $ 1030(b) - Conspiracy to Commit Computer Fraud and Abuse

Maximum Penalties: (1) 10 years imprisonment; (2) Maximum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment

Count 2: 18 U.S.C. $$ 1030(a)(4) and (c)(3)(A) - Unauthorized Access to a Protected

Computer To Obtain Value;

Maximum Penalties: (1) 5 years imprisonment; (2) Maximum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gtoss
loss; (4) $100 Special Assessment

Count 3: 18 U.S.C. $ 1349 - Conspiracy to Commit Wire Fraud

Maximum Penalties: (1) 20 years imprisonment; (2) Maximum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment

Counts 4 & 5: 18 U.S.C. $ 1028A(a)(1) - Aggravated Identity Theft

l![2ximum Penalties: (1) 2 years imprisonment (to run consecutive to any other
term imposed); (2) Maximum of 3 years of supervised release; (3) $250,000 fine
or twice the gross gain or twice the gross loss; (4) $100 Special Assessment

Count 6: i8 U.S.C. $ 1956(h) - Conspiracy to Commit Money Laundering

Maximum Penalties: (1) 20 years imprisonment; (2) Maximum of 3 years of

supervised release; (3) $250,000 fine or twice the gross gain or twice the gross
loss; (4) $100 Special Assessment

Forfeiture Allegations : 18 U.S.C. $$ 982(a)(2)(B) and 1030(i) and (i), and 981(a)(1)(C)
and 28 U.S.C. $ 2a61(c)

f;-='l "t i-
ii-ril]i-:ii,I
U
,.l-\
r,i ._.1- )
/

FgB 1S 2il?0
iSUSAii Y :tr^:i r,. ..

,3f F,l'l, !;'-, ;i{i i; ;:,;;^

 1 DAVrD L. ANDERSON (CABN 149604)

UNDEH SEAL
United States Attorney
2
--a
',t -l iF -:s,
3
]-:: J-J
4
F:3 l 8 Al]?$
5
.; ; :'. -"'lt0l\G
6
: .t i,r: ll-lilil cOu

8 UNITED STATES DISTRICT COI-IRT

9 NORT}IERN DISTRICT OF CALIFORNIA

t0 SAN FRANCISCO DTVISION

11
cTlq7rl>uLlb
I.INITED STATES OF AMERICA, ) CASE NO
t2 )
Plaintiff ) VIOLATIONS: 18 U.S.C. $ 1030(b) - Conspiracy to
t3 ) Commit Computer Fraud and Abuse; 18 U.S.C.
) $$ 1030(a)(a) and (c)(3)(a) - Unauthorized Access to
14 ) a Protected Computer to Obtain Value; 18 U.S.C.
)
15 DANIL POTEKHIN, aJW a "cronuswar," and )
$ 1349 - Conspiracy to Commit Wire Fraud; 18
DMITRII KARASAVIDI, alW a Dmitriy U.S.C. $ 1028A(a)(1) - Ag$avated Identity Theft; 18
)
16 Karasavidi ) U.S.C. $ 1956(h) - Money Laundering Conspiracy;
) 18 U.S.C. $$ 982(a)(2)(B) and 1030(i) and O, and
17 Defendants. ) 981(a)(1)(C) and 28 U.S.C. $ 2a61(c) - Forfeiture
) Allegations
18 )
)
T9 ) SAN FRANCISCO VENUE
)
20 )
)
2t
22 SUPERSEDIN INDICTMENT
23 The Grand Jury charges:

24 Backeround

25 At all times relevant to this lndictment:

26 1. DANIL POTEKHIN, alWa "cronuswar," is a resident of the Russian Federation.
27 2. DMITzuI KARASAVIDI, alWaDmitriy Karasavidi, is a resident of the Russian
28 Federation

SI.]PERSEDING INDICTMENT
 I 3. Poloniex, LLC ("Poloniex") is a digital curency exchange platform based in

2 Wilmington, Delaware.

J 4. Bithex is a digital currency exchange platform, based in Seattle, Washington.

4 5. Binance is a digital currency exchange platform that was originally based in Hong Kong,

5 China, and is currently headquartered in Malta.

6 6. Bitfinex is a digital crrrency exchange platform based in the British Virgin Islands.

7 7. Gemini Trust Company LLC ("Gemini") is a digital curency exchange platform based in

8 New York, New Work.

9 8. Bitcoin ("BTC") is a form of decentralized, convertible digital crurency that exists

io through the use of an online, decentralized ledger system, referred to as a "blockchain." While Bitcoin

11 mainly exists as an Internet-based form of currency, it is possible to "print out" the necessary

l2 information and exchange Bitcoin via physical medium. The currency is not issued by any govemment,

13 bank, or company, but rather is generated and controlled through computer software operating via a

l4 decentralized network. Bitcoin is typically acquired by purchasing it from a Bitcoin seller or

15 "exchanger." It is also possible to "mine" Bitcoin by verifying other users' transactions. Bitcoin is just

t6 one form of digital cumency, and there a.re many other varieties of digital curency.

t7 9. Bitcoin exchangers typically accept payments in the form of fiat curency (such as

18 dollars, euros, or other currency that derives its value from its support by governments), or other

19 convertible digital currencies. When a user wishes to purchase Bitcoin from an exchanger, the user will

20 typically send payment in the form of fiat currency, often via bank wire or ACH, or other convertible

2t digital currency to an exchanger, for the corresponding quantity of Bitcoin, based on a fluctuating

22 exchange rate. The exchanger, often for a commission, will then typically attempt to broker the

z) pwchase with another user of the exchange that is trying to sell Bitcoin, or, in some instances, will act as

24 the seller itself. If the exchanger can place a buyer with a seller, then the transaction can be completed.

25 10. When a user acquires Bitcoin, ownership of the Bitcoin is transfeffed to the user's

26 Bitcoin address. The Bitcoin address is somewhat analogous to a bank account number, and is

27 comprised of a case-sensitive string of letters and numbers amounting to a total of 26to 35 characters.

28 The user can then conduct transactions with other Bitcoin users, by transferring Bitcoin to their Bitcoin

SUPERSEDING INDICTMENT
2
 1 addresses, via the Intemet. "Bitcoin address clustering" is a process that attempts to de-anonptze a

2 user by identifying all of the addresses that they control.

J 1 1. Little to no personally identifiable information about the payer or payee is transmitted in

4 a Bitcoin transaction itself. Bitcoin transactions occur using a public key and a private key. A public

5 key is used to receive Bitcoin, and a private key is used to allow withdrawals from a Bitcoin address.

6 Only the Bitcoin address of the receiving party and the sender's private key are needed to complete the

7 transaction. These two keys by themselves rarely reflect any identifying information.

8 12. Digital currencies, including Bitcoin, have many known legitimate uses. However, much

9 like cash, Bitcoin can be used to facilitate illicit transactions and to launder criminal proceeds, given the

10 ease with which Bitcoin can be used to move funds with high levels of anonymity. ln some

11 circumstances Bitcoin payments may be traced to accounts at traditional financial institutions using the

12 blockchain.

13 13. Ethereum ("ETH") is a digital crrrency that is open source, public, has a blockchain, and

t4 is distributed on a platform that uses "smart contract" technology. By definition, smart contracts are

15 computer protocols that automatically enforce a pre-arranged negotiation between individuals

t6 conducting a transaction. These protocols are also sometimes called self-executing contracts.

17 14. The public ledger is the digital trail of the Ethereum blockchain, which allows anyone to

18 track the movement of ETH. Smart contracts allow developers to create markets, store registries of
t9 debts, and move firnds in accordance with the instructions provided without any type of middle-man or

20 counterparty controlling a desired outcome. Smart contract technology is one of Ethereum's main

2t selling points and an important tool for companies or individuals executing trades on the ETH

22 blockchain. The ETH platform allows developers to build and deploy software and decentralized

Z) applications using the blockchain protocol. The ETH blockchain protocol allows smart contracts to

24 operate without fraud, censorship, or third-party interference.

25 15. Gnosis is a platform built as a decentralized application on the Ethereum network. GNO

26 is the digital currency token used on the Gnosis platform.

27 16. NEO, formerly called as AntShares, is China's first open source blockchain platform.

28 GAS is the digital culrency token used to pay the cost of execution on the NEO blockchain.

SUPERSEDING INDICTMENT
 I 17. Poloniex, Binance, and Gemini are exchanges that offer their users the ability to trade

2 digital currencies, such as BTC, ETH, GAS, and GNO via the Internet. Users of these exchanges could

J access their accounts with their email address and a unique password, and through this account, could

4 store, access, move, or trade digital cturency. Poloniex places transaction limitations on certain

5 accounts. Where such limitations were in place at Poloniex, the tansaction limits could be increased by

6 linking their accounts to other accounts.

7 18. The computer servers used by Poloniex, Binance, and Gemini in operating their

8 exchanges and user accounts were used to facilitate interstate and foreign commerce and

9 communication, including by interstate and foreign electronic signals, and constituted "protected

10 computers" as defined in Title 18, United States Code, Section 1030(e)(2)(B).

11 The Conspuacv and Scheme to Defrrud

12 19. As part of the conspiracy and scheme to defraud, the defendants used the Internet to

13 launch a sophisticated phishing campaign targeting users of Poloniex, Binance, and Gemini's digital

l4 crrrency exchanges. The defendants purchased and deployed multiple websites that appeared to users

15 to be the legitimate Poloniex, Binance, and Gemini digital crrrency exchanges. However, when users

t6 would log into these fraudulent websites, the defendants were able to steal their credentials, in the form

t7 of an email address, and their password information, enabling the defendants to control their actual

18 Poloniex, Binance, and Gemini accounts, withdraw some or all of their digital currency, and manipulate

t9 the market for digital crurency. This resulted in losses of digital currencies valued at approximately $17

20 million for Poloniex, Binance, and Gemini customers, including customers in the Northern District of

2l California.
22 COUNT ONE (18 U.S.C. $ 1030O) - Conspiracy to Commit Computer Fraud and Abuse)

23 20. Paragraphs 1 through 19 of this Indictment are re-alleged and incorporated as if fulIy set
24 forth here.

25 2I. Beginning at a time unknown to the Grand Jury, but no later than on or about June 8,

26 2017, and continuing through a date unknown, but at least through on or about April 15, 2018, in the

27 Northern District of California, and elsewhere, the defendants,

28 DANIL POTEKHIN, and

DMITzuI KARASAVIDI,
STIPERSEDING INDICTMENT
4
 1 did knowingly and willfully conspire and agree with each other and with others, to commit computer

2 fraud and abuse, namely, with intent to defraud, accessed a protected computer used in interstate and
a
J foreign cofirmerce without authorization and exceeding authorized access, and by means of such conduct

4 furthered the below-described fraud and obtained something of value, in violation of 18 U.S.C.

5 $ 1030(aXa).

6 22. ln furtherance of the conspiracy, the defendants used the following manner and means to

7 accomplish the object and purpose of the conspiracy:

8 a. Using fraud, deception, and social engineering techniques to gain access to the

9 user identification and passwords of victim users of the Poloniex, Binance, and Gemini exchange

10 platforms;

11 b. Using identification of others without lawful authority, and fictitious identities to

t2 create fictitious Poloniex, Binance, Gemini, and Bittrex accounts to facilitate the fraud scheme;

13 c. Using information obtained from victim customers of the Poloniex, Binance, and

I4 Gemini exchange platforms to access their digital currency addresses and transfer cryptocurrencies

15 owned by the victims without authority;

t6 d. Using unauthorized access to victim customer Poloniex accounts to manipulate

t7 the digital currency markets and take advantage of the immediate increase in digital crrrency value to

18 their benefit; and

19 e. Using multiple digital currency addresses and clusters to deposit the stolen digital

20 currencies and using a layered process for withdrawal and deposits to conceal the nature, source,

2l location, ownership, or control of the digital currency.

22 23. In furtherance of the conspiracy and to effect its objects, on or about the dates listed

23 below, in the Northern District of California and elsewhere, POTEKHIN, KARASAVIDI and others,

24 committed the following overt acts, among others:

25 Poloniex Theft Attack

26 a. Between on or about July 17, 2017, and at least on or about October 29,2017,

27 POTEKHIN created and controlled at least 13 separate fake Poloniex domains to be used in a fraud

28 scheme targeting Poloniex and its users.

SUPERSEDING INDICTMENT
5
 1 b. Between on or about July 17 , 2017 , and at least on or about October 29 , 2017 ,

2 POTEKHIN induced at least 158 victim customers of the Poloniex exchange platform, including

) Poloniex customers in the Northem District of Catifornia, to access the fake Poloniex domains, causing

4 the victim customers to input their user identification and passwords in order to access their Poloniex

5 account, enabling POTEKHIN and others to obtain the customers' user identification, which is the

6 user's email address, and passwords without authorization.

7 c. Between on or about June 8, 2017 andJuly 17, 2017, POTEKHIN,

8 KARASAVIDI, and others created five fictitious Poloniex accounts. At least three of those accounts

9 were in the names of individuals from the United Kingdom: A.C., N.8., and C.A. To create these three

10 accounts, the defendants fraudulently used the means of identification of A.C., N.B., and C.A.

1t POTEKHIN and others possessed the means of identification of A.C., N.B., and C.A. prior to the

l2 creation of these fictitious accounts. KARASAVIDI also had access to one of the other fictitious

13 Poloniex accounts.

14 d. Between at least on or about August 3,2017 and August 23,2017, POTEKHIN,

15 Kr{L{SAVIDI, and others used user identification and passwords obtained without authorization to

16 gain access to the approximately 155 victim customer Poloniex accounts and withdraw digital crrrency

t7 without authorization. POTEKHIN, KARASAVIDI, and others also used some of the five fictitious

18 accounts, described above, along with victim user identification and passwords obtained without

t9 authorization, to link to the victim user accounts, enabling them to withdraw larger sums of digital

20 currency from victim accounts without authorization. Approximately $700,000 in BTC was withdrawn

2l without authorization from victim user accounts, including digital crurency from T.S. and J.S., who

22 resided in the Northern District of California, and deposited into one BTC cluster.

23 e. Between on or about July 8, 2017 and July 15, 2017, POTEKHIN,

24 KARASAVIDI and others created three fictitious Bittrex accounts to receive BTC from the fraud

25 scheme. KARASAVIDI had access to one of the fictitious Bittrex accounts, registered using the email

26 acconnt 'n*'F***'F*'fi*****659@yahoo.com, which was the same email account used to register one of
27 the five fictitious accounts. POTEKHIN had access to the identity of one of these Bittrex accounts.

28

SUPERSEDING INDICTMENT
6
 I Between on or about August 10,2017 and on or about September 79,2017, approximately 435 Bitcoins

2 were sent from the Bitcoin cluster to these three fictitious Bittrex accounts.

J f. Between on or about August 13, 2017 and on or about September 27 , 2017 , most

4 of the BTC from the three fictitious Bitkex accounts, including one account also in the name of A.C.,

5 was converted to approximately 8,816 ETH and through a sophisticated and layered manner was sent

6 through multiple intermediary accounts, before ultimately being deposited into a Bitfinex account

7 controlled by KARASAVIDI.

8 P ol oniex Manipul ati on Att ac k

9 g. Between on or about July 18, 2017 and on or about August 13,2017, POTEKHIN

10 and others created nine more fictitious Poloniex accounts, each of which provided a residence in

11 I-Ikraine or Russia. Eight of those fictitious accounts purchased 300 GAS at relatively low prices (the

t2 "Eight Fictitious Poloniex Accounts"). One of these eight accounts was controlled by POTEKI{IN.

13 One of the eight accounts also purchased GNO. These Eight Fictitious Poloniex Accounts were then
t4 used in a manipulation attack targeting three victim Poloniex customer accounts, with a total holdings of
15 approximately $5,243,000 worth of digital currency on or about October 29,2017.

16 h. Using the same phishing means set forth above, POTEKHIN and others

t7 unlawfully and without authorization obtained the user identification and passwords for these three

18 victim accounts. On or about October 29,2017, POTEKHIN and others unlawfully and without

t9 authorization obtained access to the victim accounts. Using digital crurency in one victim Poloniex
20 account, they placed an order to purchase approximately 8,000 GAS, thereby immediately increasing the

2t market price of GAS from approximately $18 to $2,400. POTEKIIIN and others then converted the

22 artificially inflated GAS in their own fictitious Poloniex accounts into ETH and BTC. Using digital

23 currency in the other two victim Poloniex accounts, POTEKHIN and others purchased GNO. The total

24 digital crrrency contained in the Eight Fictitious Poloniex Accounts on October 30,2017, when

25 Poloniex froze the accounts, was approximately t 5,600 ETH and .16 BTC. Before the Eight Fictitious

26 Poloniex Accounts were frozen, POTEKHIN and others transferred approximately 759 ETH to nine

27 digital currency addresses. Through a sophisticated and layered meurner, the ETH from these nine

28

SI.IPERSEDING INDICTMENT
7
 1 digital currency addresses was sent through multiple intermediary accounts, before ultimately being

2 deposited into a Bitfinex account controlled by KARASAVIDI.

J Binance Theft Attack

4 i. Between on or about October 16,2017 and October 31,2017, POTEKHIN and

5 others created at least two fictitious Binance accounts using the email accounts of two individuals from

6 the United Kingdom. POTEKHIN and others possessed the email accounts of these individuals prior to

7 the creation of these fictitious accounts.

8 j. Between at least on or about at least December lg,2Ol7, until on or about March

9 2,2018, POTEKHIN, KARASAVIDI, and others induced at least l42victimcustomers of the Binance

10 exchange platform, including at least one Binance customer in the Northern District of California, to

11 access the fake Binance domains, causing the victim customers to input their user identification and

t2 passwords in order to access their Binance account, enabling POTEKHIN and others to obtain the

13 customers' user identification, which is the user's email address, and passwords without authorization.

t4 k. POTEKHIN, KARASAVIDI, and others used the user identification and

15 passwords obtained without authorization to gain access to approximately 142 victim customer Binance

t6 accounts and withdraw digital currency without authorization. Approximately 566 BTC, with a value of
l7 over $10 million BTC (valued on December 19, 2017), was withdrawn without authorization, including

18 digital curency from one victim in the Northern District of California, and deposited into one BTC

t9 cluster, as well as several other intermediary digital currency addresses. BTC from the cluster, as well

20 as from several other intermediary digital cwrency addresses, was then deposited into the two fictitious

2T Binance accounts described above before ultimately being deposited into a Bitfinex account controlled

22 by I(ARASAVIDI.

23 Gemini Theft Attack

24 l. Between on or about October 24, 2Ol7,and November 1, 2OIT,POTEKHIN,

25 KARASAVIDI, and others induced at least 42 victim customers of the Gemini exchange platform,

26 including at least one Gemini customer in the Northern District of Califomia, to access the fake Gemini

27 domains. The victim customers input their user identification and passwords, believing they were

28 accessing their Gemini accounts instead of the fake Gemini domains. In this ma.nner, POTEKHIN
and
SI.JPERSEDING INDICTMENT
8
 1 others obtained the customers' user identification, which was the users' email address, and passwords

2 without authorization.
a
J m. POTEKHIN, KARASAVIDI, and others used the user identification and

4 passwords obtained without authorization to gain access to victim customer Gemini accounts and

5 withdraw digital curency without authorization. Approximately $1.176 million in United States dollars

6 and digital currencies, was withdrawn without authorization from these accounts, including digital

1 currency from one victim in the Northem District of California. The valuation of the digital currencies

8 was based upon the average value between October 24,2017 and Novemb er l,2Ol7 . Some of the
9 stolen digital currency was intermingled with flrnds obtained by the co-conspirators in the Poloniex

10 Market Manipulation Attack. Together, those funds then were moved through several intennediary

11 digital currency addresses before being deposited into a Bitfinex account controlled by KARASAVIDI.

t2 Still other digital crrrency that was stolen from the victim Gemini accounts was deposited into a

13 Binance account that had also received digital currency from the Binance Theft Attack, before it was

t4 ultimately deposited into a Bitfinex account controlled by KARASAVIDI.

15 Money Launderingfrom the Poloniex, Binanc:e, and Gemini Attacks

t6 n. In total, at least $16,876,000 in digital and fiat currency was reported stolen in the

t7 Poloniex, Binance, and Gemini Attacks, which was obtained through the above described fraud scheme

18 by the co-conspirators. These fraud proceeds were then moved through various accounts, in an effort by

t9 the co-conspirators to promote the fraud and to conceal and disguise the nature, source, ownership, and

20 control of the funds. Specifically, the digital crlrrency from the Poloniex Manipulation Attack was

2t intermingled with the digital currency from the Poloniex Theft Attack, as well as digital and fiat

22 currencies from the Binance Theft Attack and the Gemini Theft Attack. Through a sophisticated and

23 layered manner, these fraud proceeds were sent through multiple intermediary accounts, before

24 approximately 19,600 ETH was ultimately deposited on March 11, 2018, March 18, 2018, April 9, 2018,

25 and April 15,2018 into a Bitfinex account controlled by KARASAVIDI.

26 All in violation of Title 18, United States Code, Section 1030(b).

27

28

SUPERSEDING INDICTMENT
9
 1 COLTNT TWO: (18 U.S.C. $ 1030(a)(a) - Computer Fraud)
2 24. Paragraphs 1 through 23 of this Indictment are re-alleged and incorporated as if fully set
J forth here.

4 25. On or about June 8, 2017, and continuing through a date unknown, but at least through on

5 or about April 15, 2018, within the Northern District of California and elsewhere, the defendants,

6 DANIL POTEKHIN, and

DMITzuI KARASAVIDI,
7

8 knowingly and with intent to defraud accessed a protected computer used in interstate and foreign

9 corlmerce without authorization and exceeding authorized access, and by means of such conduct

10 firrthered the intended fraud and obtained something of value, specifically digital curency addresses and

11 passkeys, containing digital crurency later withdrawn without authorization by defendants.

12 A11 in violation of 18 U.S.C. Sections 1030(a)(a) and (c)(3XA).

13

t4 COI-INT THREE: (18 U.S.C. $ 1349 - Conspiracy to Commit Wire Fraud)

15 26. Paragraphs 1 through 23 of this lndictnent are re-alleged and incorporated as if fully set

16 forth here.

17 27. Beginning at a time unknown to the Grand Jury, but no later than on or about June 8,

18 2017 , and continuing through a date unknown, but at least through on or about April 1 5, 2018, in the

t9 Northern District of California and elsewhere, the defendants ,

20 DANIL POTEKHIN, and

DMITzuI KARASAVIDI,
2t

22 and others, did knowingly conspire to devise and intend to devise a scheme and artifice to defraud as to

23 a material matter and to obtain money and properfy by means of materially false and fraudulent

24 pretenses, representations, and promises, and by concealment of material facts, and, for the purpose of
25 executing such scheme or artifice and attempting to do so, did transmit, and cause to be transmitted, by

26 means of wire communication in interstate and foreign cofitmerce, certain writings, signs, signals,

27 pictures, and sounds, in violation of Title 18, united States Code, Section 1343.

28 All in violation of Title 18, United States Code, Section 1349.

SUPERSEDING INDICTMENT
10
 1 COI-INT FOUR: (18 U.S.C. $ 1028A(a)(1) - Aggravated Identity Theft)
2 28. Paragraphs 1 through 27 of this lndictment are re-alleged and incorporated as if fulIy set
J forth here.

4 29. Between on or about June 8, 2017 and August 23,'2017, in the Northern District of
5 California and elsewhere, the defendants,

6 DANIL POTEKIIIN, and

DMITRII KARASAVIDI,
7

8 during and in relation to the crime of Conspiracy to Commit Computer Fraud and Abuse, in violation of

9 1 8 U.S.C. $ 1030(b); Computer Fraud, in violation of 18 U.S.C. $ 1030(a)(4); and Conspiracy to

10 Commit Wire Fraud, in violation of 18 U.S.C. $ 1349, did knowingly transfer, possess, and use, without

11 lawful authority the means of identification of another person, to wit, the username and password of T.S

l2 All in violation of Title 18, United States Code, Section 1028A(a)(1).

13

t4 COLTNT FTVE: (18 U.S.C. $ 1028A(a)(1) - Aggravated Identity Theft)

15 30. Paragraphs I through 27 of this Indictment are re-alleged and incorporated as if firlIy set

16 forth here.

l7 31. Between on or about June 8, 20ll and August 23,2017, in the Northern District of

18 Califomia and elsewhere, the defendants,

19 DANIL POTEKHIN, and

DMITzuI KARASAVIDI,
20

2t during and in relation to the crime of Conspiracy to Commit Computer Fraud and Abuse, in violation of

22 18 U.S.C. $ 1030(b); Computer Fraud, in violation of 18 U.S.C. $ 1030(a)(4); and Conspiracy to

23 Commit Wire Fraud, in violation of 18 U.S.C. $ 1349, did knowingly transfer, possess, and use, without

24 lawful authority the means of identification of another person, to wit, the usemame and password of J.S.

25 A11 in violation of Title 18, United States Code, Section 1028A(a)(1).

26

27

28

SUPERSEDING iNDICTMENT
II
 1 COI-INT StX: (18 U.S.C. $ 1956(h) - Money Laundering Conspiracy)

2 32. Paragraphs 1 through 27 of this Indictment are re-alleged and incorporated as if firlly set
J forth here.

4 33. From on or about June 8, 2017, through on or about April 15, 2018, in the Northern

5 District of California and elsewhere, the defendants,

6 DANIL POTEKHIN, and

DMITzuI KARASAVIDI,
7

8 did knowingly combine, conspire, and agree with each other and with other persons known and

9 unknown to the Grand Jury to conduct and attempt to conduct financial transactions affecting interstate

10 and foreign commerce, which transactions involved the proceeds of specified unlawfirl activity, that is,

11 Conspiracy to Commit Computer Fraud and Abuse, in violation of l8 U.S.C. $ 10300); Computer

12 Fraud, in violation of 18 U.S.C. $ 1030(a)(4); and Conspiracy to Commit Wire Fraud, in violation of 18

13 U.S.C. $ 1349; knowing the property involved in the financial transactions represented the proceeds of

l4 some form of unlawful activity and knowing the transactions were designed in whole or in part to

15 conceal and disguise the nature, location, source, ownership, and control of the proceeds, in violation of

t6 Title 18, United States Code, Section 1956(a)(1)(B)(i).

t7 AII in violation of Title 18, United States Code, Section 1956(h).

18

19 FORT'EITURE (18 U.S.C. $$ 982(a)(2)(B) and 1030(i) and

(,))
20

21 34. The allegations contained in this Indictment are re-alleged and incorporated by reference

22 for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Sections 982(a)(2)(b) and

23 i030(D and (i).

24 35. Upon conviction for the offenses set forth in Counts One and Two in violation of Title

25 18, United States Code, Section 1030, set forth in this Indictment, the defendants,

26 DANIL POTEKHIN, and

DMITRII KARASAVIDI,
27

28

SUPERSEDING INDICTMENT
1)
 1 shall forfeit to the United States, pursuant to Title 18, United States Code, Sections 982(a)(2)(b) and

2 1030(D and (i), any personal properly used or intended to be used to commit or to facilitate the

J commission of said violation or a conspiracy to violate said provision, and any properry, real or

4 personal, which constitutes or is derived from proceeds traceable to the offenses, including, but not

5 limited to:

6 a. 15,602 ETH and .016 BTC seized by law enforcement on or about December 14,

7 2017 (with a value of approximately $12,623,627 in USD on that date);

8 b. 238.32 BTC, $6,164,994.23 USD, .99 Bitcoin Cash @CFI),196.13 Bitcoin Gold

9 (BTG), 1199.99 NEO, and 50,000 EOS seized by law enforcement on or about

10 August 23,2019 (with a value of approximately $8,768,000 USD on that date);

11 and

12 c. a money judgment equal to the total amount of proceeds defendant obtained or

13 derived, directly or indirectly, from the violation, or the va.lue of the property used

t4 to commit or to facilitate the commission of said violation.

15 36. If any of the property described above, as a result of any act or omission of the defendant:

t6 a. cannot be located upon exercise of due diligence;

T7 b. has been transferred or sold to, or deposited with, a third parfy;

18 c. has been piaced beyond the jurisdiction of the court;

19 d. has been substantially diminished in value; or

20 e. has been commingled with other properly which cannot be divided without

2T difficulty,

22 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21 ,

23 United States Code, Section 853(p), as incorporated by Title 18, United States Code, Section 1030(iX2).

24 All pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1030, and Federal Rule

25 of Criminal Procedure 32.2.

26

27

28

SI.IPERSEDING INDICTMENT
 1 WIRE FRAUD FORFEITIIRE ALLEGATION: (18 U.S.C. $ 981(a)(1)(C) and 28 U.S.C. $ 2a61(c))

2 37. The allegations contained in this tndictment are re-alleged and incorporated by reference
a
J for the pu{pose of alleging forfeiture pursuant to Title 18, United States Code, Section 981(a)(1)(C) and

4 Title 28, United States Code, Section 2a6l@).

5 38. Upon conviction for the offense set forth in Count Three of this lndictrnent, the

6 defendants,

7 DANIL POTEKHIN, and

DMITzuI KARASAVIDI,
8

9 shall forfeit to the United States, pursuant to Title 18, United States Code, Section 981(a)(lXC) and

10 Title 28, United States Code, Section 2461(c), all property, real or personal, constituting, or derived

11 from proceeds the defendant obtained directly and indirectly, as the result of those violations; including

t2 but not limited to:

13 a. 15,602 ETH and .016 BTC seized by law enforcement on or about December 14,

T4 2017 (with a value of approximately $12,623,627 in USD on that date);

15 b. 238.32 BTC, $6,164,994.23 USD, .99 Bitcoin Cash (BCFI),796.13 Bitcoin Gold

16 (BTG), 1199.99 NEO, and 50,000 EOS seized by law enforcement on or about

t7 August 23,2019 (with a value of approximately $8,768,000 USD on that date);

18 and

19 c. A money judgment equal to the total amount of proceeds the defendant obtained

20 as a result of the offense.

2t 39. If any of the property described above, as a result of any act or omission of the defendant:

22 a. cannot be located upon exercise ofdue diligence;

23 b. has been transferred or sold to, or deposited with, a third party;

24 c. has beenplaced beyond thejurisdiction ofthe court;

25 d. has been substantially diminished in value; or

26 e. has been commingled with other property which cannot be divided without

27 diffrculty,

28 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 2l
,

SUPERSEDING INDICTMENT
 I United States Code, Section 853(p), as incorporated by Title 28, United States Code, Section 2a6l@).

2 AII pursuant to Title 18, United States Code, Section 981(a)(1)(C), Title 28, United States Code,

J Section 2461(c), and Federal Rule of Criminal Procedure 32.2.

5 G FORIEITURE ALLEGA : (18 U.S.C. $ 982(aX1)

6 40. The allegations contained in this lndictment are re-alleged and incorporated by reference

7 for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Section 982(a)(l).

8 41. Upon conviction for the offense set forth in Count Six of this lndictment, the defendant,

9 DANIL POTEKHIN, and

DMITRII KARASAVIDI,
10

l1 shall forfeit to the United States, pursuant to Title 18, United States Code, Section 982(a)(1), all

t2 property, real or personal, involved in said violations, or any property traceable to such property,

13 including, but not limited to:

t4 a. 15,602 ETH and .016 BTC seized by law enforcement on or about December 14,

15 2017 (wrth a value of approximately $12,623,627 in USD on that date);

t6 b. 238.32 BTC, $6,164,994.23 USD, .99 Bitcoin Cash (BCH), 196.13 Bitcoin Gold

t7 (BTG), 1199.99 NEO, and 50,000 EOS seized by law enforcement on or about

18 August 23,2019 (with a value of approximately $8,768,000 USD on that date);

t9 and

20 c. A money judgment equal to the total amount of funds involved in the offense.

2t
22

23

24 il
25

26

27

28

SUPERSEDING INDICTMENT
 1 42. If any of the property described above, as a result of any act or omission of the defendant:

2 a. cannot be located upon exercise ofdue diligence;

J b. has been transferred or sold to, or deposited with, a third party;

4 c. has been placed beyond the jurisdiction of the court;

5 d. has been substantially diminished in value; or

6 e. has been commingled with other property which cannot be divided without

l difficulty,

8 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21,

9 United States Code, Section 853Gr), as incorporated by Title 18, United States Code, Section 9820)(1).

10 All pursuant to Title 18, United States Code, Sections 982(a)(1) and (b)(1) and Federal Rule of
11 Criminal P r ocedur e 32.2.

12

13 DATED: A TRUE BILL

l4
t5 L tp T(n-O
FOREPERSON
t6

t7 DAVID L. ANDERSON
United States
18

t9
20 FREY
As United S Attorney
2t

22

23

24

25

26

27

28

SUPERSEDING INDICTMENT
 UNITED STATES DISTRICT UI*DEH SEAL
NORTHERN DTSTRTCT OF CALTFORNTA
Fii=Fr-.],
CRIMINAL COVER SIIEET FEE tE Z$Z$

fnsfiuctions: Effective November t, 2016, this Criminal Cover Sheet must tr 6,q4fit$!H\M:{"WaO
along with the Defendant Information Form, for each nsw criminal case. f,:iiii]'i;l,i:iil ;: Cl;;ilii,;;l:,t

Casr Naw: CasrNur,Brn:

USAv. DANIL POTEKHIN, &4./! "6oEwe," ed DMITRII KARASAVIDI, e/L* Dmitiy Kllevidi cR 19-0572-CRB
Is This Case Under Seal? Yes / No

Total Number of Defendants: I 2-7 { 8 or more

Does this case involve ONLY charges

under 8 U.S.C. S 1325 andlor 1326?
Yes No {

Venue (Per Crim. L.R 18-1): sF / oAK SJ

Is this a potential high-cost case? Yes No {

Is any defendant charged with
a death-penalfy-eligible crime?
Yes No {

Is this a RICO Act gang case? Yes No {

Assigned AUSA
(Lead Attorney): CYNTHIA FREY, AUSA Date submitted: )ll$12020
Comments:

Form CAND-CRIM-COVER @ev. I l/16) RESET FORM , SAVE PDF

 1 DAVID L. ANDERSON (CABN 149604) UNDER SEAL
United States Attorney
2
HALLTE HOFFMAN (CABN 210020)
a
J Chief, Criminal Division FILED
4 CYNTHTA FREY (DCBN 47s889)
Assistant United States Attorney FtB 1 BZ0?0
5
450 Golden Gate Avenue, Box 36055
6 San Francisco, Californi a 9 4102-3 49 5 ,,,#rff'#gji+l}?ftFem^
Telephone: (41 5) 43 6-7 200
7 Fax: (415) 436-7234
cynthia. fr ey@usdoj . gov
8
Attorneys for United States of America
9
UNITED STATES DISTRICT COURT
10
NORTHERN DISTRICT OF CALIFORNIA
11
SAN FRANCISCO DTVISION
t2
13 UNITED STATES OF AMERICA, ) No.: CR-19-0572-CRB
)
t4 Plaintiff, ) MOTION TO SEAL SUPERSEDING
) TNDTCTMENT AND [P&OPOSED] ORDER
15 v )
)
(UNDER SEAL)
16 DANIL POTEKHIN, alW a"cronuswar," and )
DMITRII KARASAVIDI, a/k/ a Dmitriy )
17 Karasavidi )
)
18 Defendants. )
)
19

20 The government hereby moves the Court for an order sealing the Superseding Indictnent, this

2t motion, and the Court's sealing order until execution of the arrest warrant for defendants DANIL

22 POTEKHIN, alWa "cronuswar," and DMITRII KARASAVIDI, alWa Dmitriy Karasavidi. In order to

23 reduce the chances that the defendants will flee and for reasons of offrcer safety, the United States

24 requests that the fact of

25

26

27

28 il
MOTION TO SEAL SLIPERSEDING INDICTMENT
AND I'PROPOSEDI ORDER I rl ^
 1 the arrest warant remain under seal until the warrant is executed. The Court's sealing order will be

2 lifted automatically once the arrest warrant is executed.

4 DATED: February 13,2020 Respectfully submitted,

5 DAVID L. ANDERSON
United States Attorney
6

8 FREY
Assistant United S
9

10

1l IPROPOSEDI ORDER
t2 Based upon the motion of the government and for good cause shown, IT IS IIEREBY

13 ORDERED that the Superseding Indictment, this motion, and this sealing order shall be sealed until

t4 execution of the arrest wa:rant for defendants DANIL POTEKHIN, akla "cronuswar," and DMITzuI

15 KARASAVDI, akla Dmitriy Karasavidi or until further order of the Court, whichever occurs first.

t6 This sealing order shall not prevent the Clerk from providing copies of the aforementioned documents to

17 the United States upon rqquest of an attorney for the United States

18

t9 DATED: ,,fiil*n
H
20 Chief United Magistrate Judge

2t

22

Z)

24

25

26

27

28

MOTION TO SEAL SI.IPERSEDING INDICTMENT

AND [PROPOSEDI ORDER .,)