United States v. Roman Sterlingov

United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT Argued May 12, 2026 Decided September 25, 2026 No. 24-3161 UNITED STATES OF AMERICA, APPELLEE v. ROMAN STERLINGOV, APPELLANT Appeal from the United States District Court for the District of Columbia (No. 1:21-cr-00399-1) Tor Ekeland argued the cause for appellant. With him on the briefs were Marc Fernich, Maksim Nemtsev, Daniel Aaron, and Amy C. Collins. Joseph A. Scrofano was on the brief for amicus curiae Chainargos in support of appellant. Jenny C. Ellickson, Attorney, U.S. Department of Justice, argued the cause for appellee. With her on the brief was Jeanine Ferris Pirro, U.S. Attorney. David M. Lieberman and Scott A. Meisler, Attorneys, entered appearances.  2 Karl J. Mihm and Aileen M. McGrath were on the brief for amicus curiae Chainalysis, Inc. in support of appellee. Before: MILLETT, PILLARD, and WILKINS, Circuit Judges. Opinion for the Court filed by Circuit Judge WILKINS. WILKINS, Circuit Judge: Appellant Roman Sterlingov, a dual Swedish-Russian national, was accused of creating and operating a bitcoin “mixer” called Bitcoin Fog for the sole purpose of aiding money laundering and hiding illicit activity. After a jury trial, Sterlingov was convicted of one count of conspiracy to commit money laundering under 18 U.S.C. § 1956(h) (“Count I”), one count of substantive money laundering under 18 U.S.C. § 1956(a)(3)(A) and (B) (“Count II”), one count of operating an unlicensed money transmitting business under 18 U.S.C. § 1960(a) (“Count III”), and one count of conducting a money transmission business without a license in violation of D.C. Code § 26-1023(c) (“Count IV”). He now appeals his convictions, as well as his 150-month imprisonment sentence, advancing numerous arguments to reverse and vacate the judgment below. We have considered each of those arguments and find none of them meritorious. Accordingly, we affirm the District Court. I. Some general background and definitions are necessary to understand the prosecution’s theory and Sterlingov’s contentions. This case involves the use of bitcoin, which refers to both the most common form of cryptocurrency, as well as a “a system that facilitates financial transactions.” App. 6690 (citation modified). Bitcoin as a unit of virtual currency is “transacted over the Internet using bitcoin software,” which allows “users to create bitcoin addresses, roughly analogous to  3 anonymous accounts, and to securely transfer bitcoin from one bitcoin address to another.” Id. (citation modified). Relatedly, “bitcoin the system is a peer-to-peer network enabling proof and transfer of ownership . . . [of bitcoin] without involving a third-party such as a bank.” Id. (citation modified). Bitcoin transactions are anonymous—the sending address(es), receiving address(es), and transaction ID(s) are identified only by a long set of numbers and letters. The transactions are also public—the above-mentioned information, as well as the amount exchanged and the timing of the exchange are all visible on the blockchain, which is publicly accessible to anyone who has a hankering to investigate bitcoin transactions. The anonymity built into bitcoin and the blockchain can be manipulated to obfuscate illicit transactions. Those who intend to use cryptocurrency for criminal purposes sometimes use bitcoin “mixers.” Mixers generally operate by allowing multiple users to deposit bitcoin into a shared pool and then withdraw funds from that same shared pool. This mixing makes it difficult for anyone following the transaction history to trace a specific deposit to a later withdrawal. Moreover, the casual observer of a blockchain would not be able to discern who made a deposit because the sending/receiving addresses memorialized on the blockchain do not use real-world identities, nor would the casual observer be able to tell whether the same person who deposited bitcoin later withdrew those funds from the mixer, since all of the deposits have been pooled together. Law enforcement officials, however, have created new tools to help investigate potentially illicit bitcoin transactions, including by “clustering” bitcoin addresses and associating those clusters with known users or entities. Bitcoin mixers can operate on something known as the “darknet,” “a collection of hidden websites accessible only through anonymization software that obscures users’ internet  4 protocol addresses by filtering their traffic through a network of relay computers called the Tor network.” United States v. Harmon, 474 F. Supp. 3d 76, 82 (D.D.C. 2020) (citation modified). Within the darknet are marketplaces, which “operate similarly to ordinary internet marketplaces” like Amazon or eBay wherein vendors sell items and sometimes communicate with potential buyers to execute transactions. United States v. Le, 902 F.3d 104, 107 (2d Cir. 2018). While such marketplaces can function for legitimate purposes, the “transactions overwhelmingly involve contraband.” Id. At the center of this tale is a bitcoin mixer named “Bitcoin Fog,” launched in 2011 by someone identifying himself as “Akemashite Omedetou”—who the government alleges is actually Roman Sterlingov. The government asserted that Sterlingov, using this alias, created Bitcoin Fog for the purpose of evading government oversight and facilitating illicit transactions. To support its theory, the government introduced evidence during trial allegedly tying Sterlingov to Bitcoin Fog. This evidence included an internet protocol (“IP”) analysis that identified IP addresses connected to Sterlingov that interacted with Bitcoin Fog, Sterlingov’s 2011 activity wherein he appeared to express interest in other bitcoin mixers, and Sterlingov’s promotion of illegal activities on the darknet in 2012, recommending that users buy drugs from a darknet site called Silk Road. Sterlingov and Bitcoin Fog’s alleged connection to darknet vendors like Silk Road also became a central tenet of the government’s theory of the case, particularly its theory of conspiracy. To support its assertions that Sterlingov engaged in the charged crimes, the government presented evidence of a bitcoin clustering analysis that tied Bitcoin Fog to over 900,000 addresses that were engaging with other darknet vendors also selling illicit products. These darknet vendors included Silk  5 Road, AlphaBay, Agora, Nucleus, Abraxas, Pandora Openmarket, Sheep, Black Bank, and Welcome to Video, all of which both directly sent bitcoin and directly received bitcoin from Bitcoin Fog. The government also presented additional evidence regarding Bitcoin Fog’s operations and how they were purposefully created to hide illicit conduct, including how Bitcoin Fog deleted its records every week, and how Bitcoin Fog fees were charged on a randomized basis to prevent investigators from calculating precise withdrawals. Bitcoin Fog’s hallmarks for obfuscating criminal activity were lauded by Akemashite Omedetou, who described the platform as a service that would “never be found” and would “not cooperate with any authorities,” with Bitcoin Fog’s public website further highlighting that the platform made “it impossible to prove any connection between a deposit and a withdraw[al].” App. 2777– 78, 3721. Between 2011 and Sterlingov’s arrest in 2021, Sterlingov had approximately 40 financial accounts, which collectively received total bitcoin deposits of approximately $1.8 million. At the time of his arrest at Los Angeles International Airport in April 2021, marking only his second trip to the United States, Sterlingov had bitcoin in a wallet stored on his phone worth more than $500,000. App. 3924–26. Bitcoin Fog also stopped operating two days after Sterlingov was arrested, with the last withdrawal occurring on April 29, 2021. A jury convicted Sterlingov of Counts I through IV, and the District Court sentenced him to 150 months’ imprisonment. Sterlingov now appeals. We have jurisdiction to review under 28 U.S.C. § 1291 and 18 U.S.C. § 3742(a).  6 II. Sterlingov raises a number of grounds to vacate his conviction. We consider and reject each of those in turn below. A. Venue The Constitution requires that crimes be tried “in the State where the . . . Crimes shall have been committed.” U.S. CONST. art. III, § 2, cl. 3; see id. amend. VI. The Supreme Court has interpreted that requirement to mean that “a trial may be held where any part of a crime can be proved to have been done,” even if the chosen district is not “the district in which [the defendant] is personally at the time of committing the crime.” Smith v. United States, 599 U.S. 236, 243–44 (2023) (citation modified). Sterlingov asserts that venue is unconstitutional in the District of Columbia (“D.C.”) for all four charges levied against him. He originally raised these objections in a motion to dismiss for lack of venue. The District Court denied the motion, finding that “the indictment adequately allege[d] venue.” App. 2629. However, as Sterlingov timely challenged venue and raised a genuine issue of fact material to the crime’s connection to D.C., the District Court found that venue was also a jury question at trial. United States v. Sitzmann, 893 F.3d 811, 824 (D.C. Cir. 2018) (per curiam). Under our precedent, the government had to demonstrate to the jury by a preponderance of the evidence that venue is proper. United States v. Slatten, 865 F.3d 767, 786 (D.C. Cir. 2017) (per curiam). At this juncture, where a defendant has renewed his objections to venue, “this Court views the evidence in the light most favorable to the government.” Id. at 786 (citation omitted). Under these principles, we hold that venue is proper in D.C. for all four Counts.  7 Key to the question of venue is a sting operation conducted by Special Agent Matthew Price in D.C. In 2019, Agent Price created a Bitcoin Fog account, deposited approximately $250 worth of bitcoin, and then withdrew almost all of it the next day. Bitcoin Fog sent a message upon the submission of Agent Price’s withdrawal request saying that the payment had been completed successfully, and that any record of the transaction would be “removed from [its] logs.” App. 2853. A few months later, in November 2019, Agent Price conducted another undercover transaction, sending bitcoin to his Bitcoin Fog account from an account that he had created on a darknet market. The following day, he sent a message to Bitcoin Fog’s administrators via the chat function stating that he had “created [his] account to clean [his] coins from selling ecstasy” and that he had “more coins” to “clean[],” but that he wasn’t sure whether he could trust the platform. App. 2870–71. Two days later, Agent Price had not received any response to his message, but he proceeded to withdraw his funds anyway, which prompted a message stating that the payment was complete. 1. Count II – Substantive Money Laundering Keeping the above series of facts in mind, we begin slightly out of order with Count II, the substantive money laundering charge. Count II of the indictment charged Sterlingov under 18 U.S.C. § 1956(a)(3)(A) and (B), which impose criminal liability on anyone who “conducts or attempt to conduct a financial transaction involving property represented to be the proceeds of specified unlawful activity, or property used to conduct or facilitate specified unlawful activity” with the intent to “promote the carrying on of specified unlawful activity” or “conceal or disguise the nature, location, source, ownership, or control of property believed to be the proceeds of specified unlawful activity.” The statute  8 contains a venue provision that states that venue is proper in “any district in which the financial or monetary transaction is conducted.” Id. § 1956(i)(1)(A). The statute further specifies that a “transfer of funds from 1 place to another” constitutes “a single, continuing transaction,” and a person who conducts “any portion of [a] transaction may be charged in any district in which the transaction took place.” 18 U.S.C. § 1956(i)(3). The government asserts that because Agent Price represented to Bitcoin Fog that the money he was sending into the platform was the result of illegal ecstasy sales—i.e., “specified unlawful activity”—and because Agent Price was able to withdraw his money from the platform a few days later, while sitting in his office in D.C., venue is proper in that jurisdiction. We agree. Sufficient evidence presented at trial allowed the jury to find that Agent Price received the purported laundered funds in D.C., including his own testimony, as well as photos and videos of his interactions with Bitcoin Fog. Sterlingov claims that venue cannot rest on such grounds because the government did not demonstrate that Bitcoin Fog administrators would have known that the bitcoin Agent Price deposited was the result of “specified unlawful activity.” Sterlingov’s argument is two-fold: First, the mere fact of bitcoin being sent to Bitcoin Fog does not establish that the funds were illicit; and second, because the government had not presented any evidence that Bitcoin Fog’s administrators saw the messages from Agent Price regarding his desire to launder illicit funds, it had further not established that Sterlingov knew he was promoting or concealing unlawful activity. This is a challenge to the sufficiency of the government’s proof that Sterlingov ever saw Agent Price’s message, which goes to guilt rather than to whether venue is constitutional in D.C. Regardless, the challenge fails. The government presented evidence that Sterlingov was the administrator of Bitcoin Fog and that the chat function on Bitcoin Fog was operational and  9 provided a means to communicate with the mixer’s administrator. The jury could reasonably infer from such evidence that Sterlingov or another coconspirator saw Agent Price’s message. In sum, we hold that venue for Count II is proper in D.C. 2. Count I – Conspiracy to Money Launder We now turn to Count I, conspiracy to commit money laundering under 18 U.S.C. § 1956(h). The statute provides that venue is proper for conspiracy either “in the district where venue would lie for the completed offense under” § 1956(i)(1) “or in any other district where an act in furtherance of the . . . conspiracy took place.” Id. § 1956(i)(2). The government’s theory for conspiracy was that “Sterlingov or a co-conspirator allegedly mixed the [undercover] agent’s Bitcoin and transferred it to a receiving account after being informed that the Bitcoin was the proceeds of an ecstasy sale on the darknet market[.]” App. 2635. In light of this theory, because Sterlingov transferred bitcoin to and from Agent Price in D.C., and thereby furthered the conspiracy in that jurisdiction, venue was proper for Count I. The involvement of an undercover agent rather than an alleged conspirator in triggering the illicit action does not negate this conclusion, so long as the government proved by a preponderance of the evidence that Sterlingov took an action in furtherance of the conspiracy by transferring bitcoin to D.C. See Sitzmann, 893 F.3d at 820, 826 (affirming district court’s venue finding based on co-conspirator’s wire transfer to government informant in D.C.). Here, as mentioned above, the government presented a plethora of evidence establishing that transfer of funds to and from Bitcoin Fog furthered Bitcoin Fog’s ability to launder the funds of all users.  10 Sterlingov’s main rebuttal is that the “District Court . . . erred by instructing the jury that an overt act by a Government agent could establish venue for a conspiracy as to Count [I].” Appellant Br. at 22. According to Sterlingov, because the indictment alleged that the government mixed Bitcoin in D.C. only in Count II, that action could not “serve as the basis for venue for Count [I].” Id. Sterlingov did not make this argument below, and as such, we review for plain error. United States v. Bostick, 791 F.3d 127, 144 (D.C. Cir. 2015). But Sterlingov has done little to show that the District Court erred in its instruction, let alone that it plainly did so. He provides slim reasoning for his argument, including no pertinent authority or explanation for why the District Court’s instructions were unlawful. 1 Consequently, we hold that venue is proper in D.C. for Count I. 2 1 We note that Sterlingov’s objection to the District Court’s venue instruction is based solely on the government’s failure to allege in Count One that Agent Price’s transaction occurred in the District. See Appellant Br. at 23 (arguing that the District Court “allowed the jury to find venue on Count One via conduct only alleged in Count Two”). Sterlingov does not challenge the instruction on the basis that it suggested a government agent’s actions can alone establish venue for conspiracy charges. We therefore do not pass on that question, which—had it been properly before us—would still require Sterlingov to show that any error “affected the appellant’s substantial rights.” Bostick, 791 F.3d at 144. 2 As explained in the preceding paragraphs, venue for Counts I and II are proper based predominately on Agent Price’s engagement with Bitcoin Fog from his office in D.C. Concurrent with his broader venue arguments, Sterlingov raises that “[a]llowing venue to rest solely on the Government’s single, unrequited message and the mixing of licit Bitcoin would allow prosecutors to fabricate venue in any district at will[.]” Appellant Br. at 25. While this Court has left the possibility of “venue entrapment” open, we have reasoned that the only way that such a thing could occur is if the “prosecution,  11 3. Counts III and IV – Unlicensed Money Transmission Count III of the indictment charged Sterlingov with operating an unlicensed money transmitting business under 18 U.S.C. § 1960(a). The statute prescribes criminal liability for whoever “knowingly conducts, controls, manages, supervises, directs, or owns all or part of an unlicensed money transmitting business.” 18 U.S.C. § 1960(a). As relevant here, “unlicensed money transmitting business” includes a business that is “operated without an appropriate money transmitting license in a State where such operation is punishable.” Id. §1960(b)(1)(A). “Money transmitting” includes “transferring funds on behalf of the public by any and all means[,] including . . . transfers . . . by wire.” Id. § 1960(b)(2). Similarly, Count IV of the indictment charged Sterlingov with violating D.C. Code § 26-1023(c), the local analog to the federal crime under 18 U.S.C. § 1960(a). Like its federal counterpart, the D.C. Code also imposes criminal liability on anyone who conducts a money transmission business without a license, where “[m]oney transmission” means the “sale or issuance of payment instruments or engaging in the business of receiving money for transmission or transmitting money within preferring trial elsewhere, lure[d] a defendant to a distant district for some minor event simply to establish venue.” United States v. Sitzmann, 893 F.3d 811, 823 (D.C. Cir. 2018) (per curiam) (quoting United States v. Spriggs, 102 F.3d 1245, 1251 (D.C. Cir. 1996), as amend. (Feb. 20, 1997)). Regardless of whether “manufactured venue” is a valid theory, it is clear that here, Bitcoin Fog operated worldwide and without regard to the location of its users and thus was not “lured” to D.C. by Agent Price. Accordingly, we find there is no viable claim of “venue entrapment.”  12 the United States, or to locations abroad, by any and all means,” including “wire . . . or electronic transfer.” D.C. Code § 26- 1001(10). Both 18 U.S.C § 1960(a) and D.C. Code § 26- 1023(c) do not have any specific venue requirements. Accordingly, we look to where the “conduct constituting the offense” occurred to determine where venue may be properly invoked. United States v. Rodriguez-Moreno, 526 U.S. 275, 279 (1999); FED. R. CRIM. P. 18. Sterlingov contends that for both Counts, venue is improper in D.C. because he engaged in no “business conduct” in the District, nor any business “operat[ion].” Appellant Br. at 25–27. The government disagrees, arguing that venue is proper in D.C. because the jury reasonably could have found that Bitcoin Fog served customers in the District. Sterlingov concedes that such conduct would be sufficient, Appellant Br. at 26, and we conclude that the government introduced sufficient evidence for a jury to find that Bitcoin Fog served customers in D.C. The evidence presented at trial, predominately Agent Price’s sting operation, demonstrated that Bitcoin Fog was receiving funds from and issuing funds to a person in D.C. Additional evidence also established that D.C. law required a money transmitting business to obtain a license from the D.C. government, but that neither Bitcoin Fog nor Sterlingov had obtained such a license. Because this is a crime of failure to do a “legally required act, the place fixed for its performance fixes the situs of the crime.” Johnston v. United States, 351 U.S. 215, 220 (1956). In other words, venue for Counts III and IV is thus proper in D.C. 3 3 There is some question of whether liability under the D.C. provision required Bitcoin Fog to have a physical operational presence in D.C. See Appellant Br. at 27 (suggesting that “[t]he statute . . . contemplates an entity actively operating a money- transmitting business within the District”). But this question was not squarely presented to us by Sterlingov, and we decline to reach it.  13 B. Statute of Limitations Sterlingov next asserts that there was “insufficient evidence to establish criminal conduct” within the statute of limitations for each of the Counts. Appellant Br. at 97. We review such preserved claims de novo, see United States ex. rel. Miller v. Bill Harbert Int’l Constr., Inc., 608 F.3d 871, 878 (D.C. Cir. 2010), taking the facts in the light most favorable to the jury’s verdict, and now affirm the District Court’s rejection of Sterlingov’s claims. Each of the alleged violations had a limitations period of five years, apart from Count IV, which had a limit of six years. Sterlingov was indicted on Counts II, III, and IV on June 14, 2021, and indicted on Count I on July 18, 2022. This means that the relevant offenses must have occurred on or after June 14, 2015, for Count IV, June 14, 2016, for Counts II and III, and July 18, 2017, for Count I. The superseding indictment alleged that the offense activity of Counts I, III, and IV all began on or about October 27, 2011, and continued until at least April 27, 2021.4 For Count II, the superseding indictment alleged that the money laundering occurred on November 18, 2019. The crux of Sterlingov’s argument on appeal is that there was “insufficient evidence to establish criminal conduct” because “[a]lmost all the darknet markets in question were shut down by the Government or ceased operations outside the statute of limitations.” Appellant Br. at 97. It is true that 4 Conspiracy and unlicensed money transmission are continuing offenses, which means that the statute of limitations period begins to run once the offenses cease. United States v. McGoff, 831 F.3d 1071, 1078–79 (D.C. Cir. 1987).  14 darknet vendors like Silk Road, Nucleus, AlphaBay, Agora, Nucleus, Abraxas, Pandora Openmarket, Sheep, and Black Bank all shut down prior to 2017. But it is unclear what this fact has to do with the statute of limitations period for the substantive money laundering and licensing counts. Indeed, Counts II, III, and IV are all grounded in Agent Price’s sting transaction that occurred on November 21, 2019—evidence of which would allow a reasonable jury to infer that as of that date, Bitcoin Fog was still operating, and that money was being laundered through the platform. The only rebuttal that Sterlingov gives to this is that the government “offered no evidence that Sterlingov received or read the messages accompanying the undercover transactions,” Appellant Br. at 100, but as explained above in our analysis of Sterlingov’s venue claims, the jury could reasonably conclude otherwise. Because Agent Price’s transactions with Bitcoin Fog happened within five and six years of the superseding indictment, we reject Sterlingov’s challenges to the government’s proof of compliance with the statutes of limitations for these Counts. Sterlingov’s arguments regarding Count I fail for similar reasons. It is true that many of the darknet market vendors that the government discussed at trial had shutdown outside of the statute of limitations period. See, e.g., App. 6411 (discussing Silk Road, shut down in 2013), 6415 (discussing Sheep, shut down in 2013). The final identified transaction between Bitcoin Fog and one of the named darknet vendors, AlphaBay, occurred on July 5, 2017, just 13 days shy of the limitations period. App. 6412. But Count I is timely if the jury can infer that the conspiracy continued with unknown co-conspirators for at least two weeks following the final identified transaction with a named darknet vendor. A plethora of circumstantial evidence supported such an inference, including Agent Price’s  15 transactions with Bitcoin Fog in November 2019. Further, the continued operation of Bitcoin Fog until Sterlingov’s arrest in 2021, and its continued profitability following the shutdown of the last named darknet vendor, is sufficient circumstantial evidence to allow the jury to infer that the conspiracy to money launder continued with unknown co-conspirators within the limitations period. Accordingly, Sterlingov’s statute of limitations arguments fail. C. Expert Testimony Sterlingov next contends that the District Court erred in admitting the testimony of three experts: former FBI task force officer Valerie Mazars de Mazarin, FBI agent Luke Scholl, and Chainalysis Government Solutions (“Chainalysis”) analyst Elizabeth Bisbee. Sterlingov’s main contention against the admission of their expert testimony was that their testimony did not satisfy “the reliability requirements of Fed. R. Evid. 702 or Daubert.” Appellant Br. at 27. This Court reviews the decision to admit expert testimony for abuse of discretion, granting the “district court . . . broad latitude when it decides how to determine reliability,” as well as in its “ultimate reliability determination.” United States v. Morgan, 45 F.4th 192, 200 (D.C. Cir. 2022) (quoting Kumho Tire Co. v. Carmichael, 526 U.S. 137, 142 (1999)). We have considered Sterlingov’s arguments regarding each expert and ultimately find none to be persuasive. Federal Rule of Evidence 702 governs the testimony of a witness who is “qualified as an expert by knowledge, skill experience, training, or education” and outlines four factors that must be met before such expert testimony can be admitted: (1) the expert will “help the trier of fact to understand the evidence or to determine a fact in issue”; (2) “the testimony is based on sufficient facts or data”; (3) “the testimony is the  16 product of reliable principles and methods”; and (4) “the expert’s opinion reflects a reliable application of the principles and methods to the facts of the case.” FED. R. EVID. 702. The Supreme Court outlined certain considerations for the Rule 702 inquiry in its seminal case Daubert v. Merrell Dow Pharms., Inc., 509 U.S. 579 (1993). These considerations include whether the theory or technique the expert is testifying about has been tested, whether it has been the subject of peer review or publication, the known or potential rate of error for the theory or technique, and finally, whether the theory or technique is generally accepted. Id. at 593–94. Daubert highlighted, however, that these considerations were not “a definitive checklist,” id. at 593, and subsequent Supreme Court precedent is clear that the “factors identified in Daubert may or may not be pertinent in assessing reliability, depending on the nature of the issue, the expert’s particular expertise, and the subject of his testimony.” Kumho Tire, 526 U.S. at 150 (citation modified). Whether an expert’s testimony should be admissible is thus a deeply fact intensive question, with much “depend[ing] upon the particular circumstances of the particular case at issue.” Id. 1. Testimony of Valerie de Mazars Mazarin Keeping the above governing rules and principles in mind, we begin by reviewing Sterlingov’s claim that the District Court erred in admitting the expert testimony of Valerie de Mazars Mazarin, a former FBI task force officer. Mazars testified that, as part of her work in digital forensics, she would often “analyz[e] web logs . . . [and] IP log-ins . . . searching for patterns and key information,” and would “write and develop tools to help review that type of evidence.” App. 1359; see also App. 1374. An IP address is “an identifier that a computer connected to the internet uses so that the rest of the internet can  17 find it.” App. 1363. When a user interacts with a website, the website typically records the IP address associated with the interaction. App. 1371–72. A user’s IP address is usually not specific to the device used to interact with the website. Instead, the user’s IP address for that interaction is based on how the internet connection was made with the website, so the user’s IP address for a specific interaction could be that of a home router, of a proxy server, of a public WiFi network, of a Virtual Private Network or of a Tor Network node, among others. See App. 4846–50. Specific to the investigation into Sterlingov, Mazars stated that she had reviewed “account login records [provided by the IRS to Mazars] for a number of different accounts tied to” Sterlingov and Bitcoin Fog to conduct an “IP overlap analysis.” App. 1391. She identified instances in “which the same IP address was used to access multiple accounts,” and then filtered that large data set to perform a “microanalysis” and focus on “the connections that were closest in time.” App. 1375. Mazars testified that she filtered the data set by applying time cutoffs based on inferences about the universal time code convention (Greenwich Mean Time) and then created overlap windows, further explaining why she had chosen the specific filters that she did. As a result of her analysis, Mazars concluded that the same user “likely” accessed accounts associated with both Sterlingov and Bitcoin Fog. App. 4624. During cross-examination, Mazars admitted that it was her “first time” using that specific methodology and that the method that she had used was not peer reviewed as it was not a “scientific construct” and could not be studied. App. 1404–05. Sterlingov latches on to these admissions by Mazars to argue that her testimony is not reliable under Daubert. Sterlingov’s contention is that because the government did not put on evidence to demonstrate that the testimony was reliable  18 under all of the factors outlined in Daubert—i.e., that the IP Overlap Analysis had been tested, was the subject of peer- review, had a low error rate, and was “generally accepted”— then the logical conclusion must be that the District Court abused its discretion in admitting such testimony. However, as we have explained, the factors outlined in Daubert are not the sole basis for qualification as an expert and there is “[n]o specific inquiry . . . demanded of the trial court.” United States v. Straker, 800 F.3d 570, 631 (D.C. Cir. 2015) (per curiam). While it is true that Mazars did not present evidence that the technique that she used was widely accepted or had a low error rate, she did present ample testimony explaining her methodology, including why she had selected different overlap windows and made certain inferences about the time stamps within the IRS-provided sheets. She also explained that she had experience in reviewing and analyzing IP log-ins and patterns, and that while it was the first time that she had conducted “that specific methodology,” see App. 1404, she would often analyze IP logins for patterns, App. 1359. In this way, Mazars’s testimony was “grounded in an accepted body of learning or experience in the expert’s field.” See FED. R. EVID. 702 advisory committee’s note to 2000 amendment. Further, the District Court permitted Sterlingov to probe the basis and reliability of Mazars’s methodology with “[v]igorous cross-examination.” Daubert, 509 U.S. at 596. Accordingly, the District Court did not abuse its discretion in admitting Mazars’s testimony regarding the IP Overlap Analysis. 5 5 Sterlingov challenges Mazars’s testimony and methodology generally, and not specifically whether Mazars’s conclusion that the same user “likely” accessed accounts associated with Sterlingov and Bitcoin Fog was unsupported expert testimony. We decline to decide that question here.  19 2. Testimony of Luke Scholl and Elizabeth Bisbee The same conclusion arises for Sterlingov’s other Daubert claims, which relate to government experts Scholl and Bisbee. Both individuals testified regarding “Reactor,” a Chainalysis tool used to trace cryptocurrency transactions by “clustering” bitcoin addresses to a single entity. United States v. Sterlingov, 719 F. Supp. 3d 65, 68 (D.D.C. 2024). Both experts testified that they used this technology to examine the transactions between Bitcoin Fog and a variety of darknet markets, App. 564, 610, ultimately testifying that Reactor had “clustered and attributed” to Bitcoin Fog over 900,000 Bitcoin addresses, with eight darknet markets sending approximately 80,000 bitcoin to the mixer. See, e.g., App. 6956. Sterlingov contends that both witnesses’ testimony is unreliable under Federal Rules of Evidence 702 because it was not peer-reviewed or independently tested and completely lacked “any known error rates, false positive rates or false negative rates”—all of which, he argues, demonstrate that the Reactor evidence and related expert testimony failed to meet the Daubert standards. See Appellant Br. at 31. Prior to delving into whether the testimonies were reliable, it is necessary to first understand what Reactor is and how it operates, as well as reiterate how blockchain functions. As deftly explained by the District Court in this case, cryptocurrency transactions are recorded on the blockchain, with both sending addresses and receiving addresses being public. It is also possible for one person—or one virtual wallet—to hold multiple addresses. Those addresses can contain different amounts of bitcoin and can be leveraged for purchases, with all the addresses requiring a private key for any transaction. So, for example, Person A may have one wallet with three bitcoin addresses, but the first bitcoin address may only have 3 bitcoin, the second only 2, and the third only 1. If  20 Person A desires to purchase a good from Person B with their bitcoin, but that good costs 5.5 bitcoin, Person A would need to transfer the bitcoin from all three of their addresses in order to fund the transaction. In conducting such a transaction, Person A’s identity would be anonymous, but the fact that three addresses simultaneously sent bitcoin to an anonymized Person B would not be. One can imagine, then, that if you could “cluster” the three addresses together based on certain parameters, you could trace the entirety of the transaction back to Person A, and then identify Person A through additional means. See generally Sterlingov, 719 F. Supp. 3d at 71–74. Note as well that in the example above, Person A would be giving Person B an additional 0.5 bitcoin, which is returned as change. This is a requirement of the way cryptocurrency works. Person A cannot “break up” the 1 bitcoin in their third wallet the same way that one cannot obtain change for a $20 bill on a $10 purchase by merely ripping up the $20 bill. App. 606–07. For that 0.5 bitcoin of change, the wallet software will generate a new “change” address, meaning that instead of three addresses in one wallet, Person A now has four addresses in one wallet—three addresses have no bitcoin within them, and one address has 0.5 bitcoin. App. 607; see also Sterlingov, 719 F. Supp. 3d at 74. This is known as the “change address analysis.” Id. All of these principles are essential to understanding how Reactor works. As Bisbee testified, the clustering done by Reactor depends on three separate heuristics. The first is known as the “co-spend” heuristic, which assumes that a single person or entity controls a group of input addresses used together in a single transaction. App. 605, 610. Put in terms of the example used above, the co-spend heuristic facilitates the assumption that only one person—Person A—controls a common set of sending or receiving addresses. The second  21 heuristic is known as the “behavioral heuristic,” which is “the behavior of how the transactions are occurring on the blockchain.” App. 606. Reactor uses a proprietary algorithm—the underlying factors which can include the change address analysis discussed above, as well as the “digital fingerprint that is left behind” “every time a transaction occurs on the blockchain”—to cluster addresses that engage in transactions matching certain behavioral patterns. Id.; Gov’t Br. at 37. The third heuristic is “intelligence-based clustering,” which uses information obtained from data leaks, court documents, and data partnerships to further determine connections between addresses and entities. App. 608. Using each heuristic individually, or through a combination of the heuristics, Reactor is able to “cluster” sending and receiving addresses together to ultimately demonstrate the magnitude of transactions involving Bitcoin Fog and various darknet sites. Both experts admitted that Reactor was not peer-reviewed and that they did not know the error rate for the software. App. 622–23, 4142–43. Sterlingov claims that this definitively demonstrates that Scholl and Bisbee’s expert testimony was unreliable under Daubert. But again, the Daubert factors are not exhaustive. See Kumho Tire, 526 U.S. at 150. And the experts’ testimony provided other markers of reliability. One such marker was anecdotal evidence. Scholl testified that he could not recall a time where he “reviewed a subpoena where [Reactor] attribution wasn’t correct,” App. 4137, and Bisbee testified similarly, noting that she could not recall a time, over the process of thousands of reviews, where Reactor “said something was clustered in a way that was not correct.” App. 638–39. Sterlingov asserts that the District Court erred in accepting such testimony as proof of Reactor’s reliability because “anecdotal case reports are universally regarded as an insufficient