Ilhwan Yum

Ilhwan Yum testified for the prosecution on Day 9 about seizing Silk Road server evidence and tracing bitcoin transfers to wallets recovered from Ulbricht's laptop. The former FBI special agent described copying a backup server outside Philadelphia, seizing marketplace and bitcoin server evidence in Iceland, and verifying forensic copies with hashes. He observed the website become inaccessible when the marketplace server was switched off and return after restart. He also described installing the seizure banner, transferring a little over 20,000 bitcoins from the Iceland server, and separately transferring approximately 144,000 bitcoins using the laptop wallet file.

For his later consulting analysis, Yum extracted wallet addresses, removed duplicates, and searched the public blockchain for direct transfers. He reported 3,760 transfers totaling 700,253.91 bitcoins from Silk Road addresses to laptop wallet addresses between September 24, 2012 and August 21, 2013. He valued those transfers at approximately $13 million using daily CoinDesk closing prices and said they represented almost 89 percent of bitcoins received at the laptop addresses. The court admitted the transaction list and summary charts over defense objections, including foundation, hearsay, and Crawford objections to the list.

Yum qualified what those figures established. Blockchain records alone did not identify the people behind the addresses, and his incoming-transfer analysis covered direct one-to-one transactions, not transfers through intermediate addresses. He could not directly link another 89,854 incoming bitcoins to Silk Road and did not establish another source for them. On resumed direct examination, he also used admitted Exhibits 630 and 631 to connect laptop wallet addresses to outgoing transfers of 1,670 bitcoins on March 31, 2013, and 3,000 bitcoins on April 8, 2013, explaining that the wallet files contained the private keys needed to spend them.

On cross-examination, Joshua Dratel tested whether the analysis established more than transfers and possession of wallet files. Yum acknowledged that wallets could be moved and that user withdrawals could generate transfers from Silk Road wallets, but cited pre-arrest file-access dates when questioned about timing. He explained that a colleague typed the analysis code while they worked together on its logic. He also acknowledged not tracing later small payments to the government seizure address and conceded that calling them spam was speculation. The government declined further examination, and Yum was excused.