7.Ilhwan Yum — Direct/Cross (Part 2)
293 linesDIRECT EXAMINATION BY MR. HOWARD:
MR. HOWARD: Good afternoon, Mr. Yum.
ILHWAN YUM: Good afternoon.
MR. HOWARD: Mr. Evert, can we please go back to page one of Government Exhibit 608 that was admitted for demonstrative purposes.
MR. HOWARD: I just want to clarify a couple things about bitcoin log files real briefly.
ILHWAN YUM: Sure.
MR. HOWARD: Earlier you testified a bitcoin wallet can contain multiple bitcoin addresses, correct?
ILHWAN YUM: Yes.
MR. HOWARD: Can each bitcoin address only contain one bitcoin or can it contain many bitcoins?
ILHWAN YUM: It can contain many bitcoins and you can use it in multiple transactions.
MR. HOWARD: In fact, earlier you testified that you moved the 144,000 bitcoins from the defendant's wallet file to one FBI bitcoin address, correct?
ILHWAN YUM: Correct. So in that instance, I had to create a wallet file for the government and in that wallet file create one address, the address that was depicted before starting 1FfmbH. And to that -- to that one single address, I made over 400 transactions in increments of somewhere around 300 bitcoins. So that whole 144,000 bitcoins all went to one single address. So you could reuse the same address over and over or create multiple addresses and spend it or send it how ever you want between all the addresses.
MR. HOWARD: Mr. Evert, can we please go to page four of Exhibit 609, which was also admitted for demonstrative purposes.
MR. HOWARD: Mr. Yum, earlier you testified that as part of your analysis, you were focusing on simply one-to-one transactions, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Can you explain a little bit more what that's about.
ILHWAN YUM: Yes. So perhaps I could use an analogy where your wallet is kind of similar to -- if you put it simply, it's like your own personal bank, so you don't have to work with any financial institution. Your wallet contains the addresses which kind of works like your bank accounts. So wallet is your bank and you can open up as many bank accounts that you want.
So in here, all the wallets that were found on Silk Road Marketplace, the Silk Road Marketplace created all these different addresses and each one of these addresses would be similar to a bank account. And on the right side, the defendant's laptop contained wallet files with all these addresses. So his wallet, his bank, contained all these different accounts that could receive bitcoins.
So, the analysis that I did, I didn't do any complicated analysis. It was very -- it was a very simple direct one-to-one transfer. So if I have a bank account and I want to wire somebody else money, all I'm doing is wiring -- using my bank to wire-transfer money directly to someone else's bank account.
So the analysis that I did was wire transfers that occurred straight from Silk Road Marketplace directly to the bank -- to the accounts that were found on the defendant's laptop.
MR. HOWARD: And to be clear, all of that information is publicly available on the block chain, correct?
ILHWAN YUM: Right. So the beauty of bitcoin is the block chain contains every single transaction that's occurred in the history of bitcoin. So if this was actually a bank, we would have to figure out what the bank is and subpoena the bank to get the bank transaction records.
In this case, block chain is on the Internet every -- by all the bitcoin users, so I could reliably go to this block chain and get the same results that I would normally have to request the bank to provide the transaction records.
MR. HOWARD: So now, let's go back to Government Exhibit 620B, please, which is where we left off before the lunch break.
ILHWAN YUM: Yes.
MR. HOWARD: Mr. Yum, what does the entire pie here represent?
ILHWAN YUM: The entire pie is all the transactions that came to the addresses found on the defendant's laptop.
MR. HOWARD: And what does the red area depict?
ILHWAN YUM: The red area -- out of all the bitcoins that the defendant's laptop received, the red area came directly -- straight wire transfer from the accounts that are found on the Silk Road Marketplace.
MR. HOWARD: And those are the one-to-one transactions you were talking about?
ILHWAN YUM: The one-to-one transactions.
MR. HOWARD: What does the blue area represent?
ILHWAN YUM: The blue area is everything that is not a one-to-one transaction. So the defendant's wallet file received those 89,854 bitcoins and I can't link that directly back to Silk Road Marketplace.
MR. HOWARD: So if Silk Road wallets were used to send bitcoins to an address that was not in the defendant's laptop file and then it was transferred --
MR. DRATEL: Objection.
THE COURT: Sustained.
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 601, which is already in evidence.
MR. HOWARD: Mr. Yum, did you do any analysis of transactions that went from the Silk Road servers to Ross Ulbricht's laptop that were not one-to-one transactions?
MR. DRATEL: Objection.
THE COURT: Hold on.
MR. DRATEL: Objection to form.
THE COURT: I'll allow it.
You may answer.
ILHWAN YUM: I'm sorry. Can you repeat the question.
MR. HOWARD: Did you do any analysis of transactions from the Silk Road server bitcoin addresses to the Ross Ulbricht laptop addresses that were not one-to-one transactions?
ILHWAN YUM: No, I did not.
MR. HOWARD: So Mr. Yum, Government Exhibit 601 is a screenshot of the block chain we discussed earlier, correct?
ILHWAN YUM: Correct.
MR. HOWARD: Could we zoom in on the bottom-two transactions here, Mr. Evert.
MR. HOWARD: Did you do any further analysis of these two transactions?
ILHWAN YUM: Yes, I did.
MR. HOWARD: And generally what did you do?
ILHWAN YUM: I looked at all the addresses, the accounts that are making this transfer. The one on the bottom is 1,670 bitcoins. The four addresses you see on the left were used to send that 1,670 bitcoins to that address on the right starting 1MwvS1. Similarly, the transaction on top, there are three bitcoin addresses accounts that sent 3,000 bitcoins to that same address starting 1MwvS1.
MR. HOWARD: And what specifically did you look into regarding these transactions?
ILHWAN YUM: I checked to see if I could locate any of these addresses on the left, three from the top, four from the bottom, and those addresses were found within the list of addresses, list of accounts that I located on the defendant's laptop.
MR. HOWARD: Could you please take a look at what's been marked in your binder as 631 -- 630 and 631 for identification purposes. Do you recognize these exhibits?
ILHWAN YUM: Yes, I do.
MR. HOWARD: What are these exhibits?
ILHWAN YUM: It's a series of screenshots that I put together to explain a transaction.
MR. HOWARD: Were those the transactions we just described on the block chain?
ILHWAN YUM: Yes.
MR. HOWARD: Did you participate in the creation of these exhibits?
ILHWAN YUM: Yes, I did.
MR. HOWARD: Are they a true and accurate screenshots of the bitcoin address list taken from the defendant's laptop as well as the bitcoin address list from -- sorry -- just from the laptop, correct?
ILHWAN YUM: Just from the laptop.
MR. HOWARD: And does it also include a true and accurate screenshot from the block chain?
ILHWAN YUM: Yes.
MR. HOWARD: The government offers Government Exhibit 630 and 631.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibits 630, 631 received in evidence)
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 630.
MR. HOWARD: Mr. Yum, can you please describe what is depicted here.
ILHWAN YUM: So I want to start with the screenshot up top up here. That is a screenshot segment of this transaction you see appear identify with transaction ID 4a0a5b. Block chain info, if you look at that transaction, it shows on March 31, 2013, these four addresses sent 1,670 bitcoins to this address on the right beginning with 1MwvS1.
So my interest was the addresses on the left. I took each one of those addresses and compared it against the list of addresses that I got from the defendant's laptop and every single one of those were found within the addresses acquired from the defendant's laptop.
MR. HOWARD: Were the private keys for those four addresses on the defendant's laptop found on the defendant's laptop?
ILHWAN YUM: Right. I'm able to get this list of addresses because I have access to the entire wallet, which includes the private keys.
So private keys are essentially -- it's like a password or a key allowing you to access the bitcoins that are linked to these public addresses. It allows me to figure out what this public address is and also the keys allow the user to spend the bitcoins in those addresses the way they want, how ever they want.
MR. HOWARD: So to be clear, the addresses on the left-hand side of the column, you identified as being addresses on the defendant's laptop, correct?
ILHWAN YUM: Correct.
MR. HOWARD: So what does this show overall about this transaction?
ILHWAN YUM: It shows that the defendant's lap -- that the wallet file on the defendant's laptop made the transaction that's shown up top. So this 1,670 bitcoins came from the wallet files of the defendant's laptop and it was sent to this address.
MR. HOWARD: Mr. Evert, can you please publish Government Exhibit 631.
MR. HOWARD: Is this a diagram depicting the other transaction in the block chain?
ILHWAN YUM: Yes.
MR. HOWARD: Can you please describe what is depicted here.
ILHWAN YUM: Again, to start from the top, this is the detail of this transaction ID e7db524, which was documented on the block chain on March -- 2013, April 8. And again, there's three addresses, three accounts that made the transaction the amount of 3,000 bitcoins to the address on the right which starts with 1MwvS1.
MR. HOWARD: So all these three of those addresses were also found, on the left, were also found on the defendant's laptop?
ILHWAN YUM: Right. I took each one of those addresses and I compared it against the list of bitcoin addresses, bitcoin accounts that were located on the defendant's laptop and I was able to successfully find all three of them.
MR. HOWARD: So like Government Exhibit 630, does this demonstrate that this transaction occurred out of the wallet found on the defendant's laptop?
ILHWAN YUM: Right. The wallet file, the important thing is it holds the private key that allows the user to be able to send these bitcoins. So all three of the addresses were found on the defendant's' laptop and the wallet file had the private keys allowing this transfer to happen from the bitcoins that are contained in the wallet.
MR. HOWARD: I think I'm concluding. Let me just check with cocounsel and I'm done. Two more questions.
MR. HOWARD: So this is separate from the analysis we were looking at before that was comparing bitcoins sent from the Silk Road servers to the defendant's laptop, correct?
ILHWAN YUM: Correct.
MR. HOWARD: And so these are transfers that occurred from the defendant's laptop, not to the defendant's laptop, correct?
ILHWAN YUM: Correct.
MR. HOWARD: No further questions.
THE COURT: Thank you.
Mr. Dratel.
MR. DRATEL: Thank you, your Honor.
CROSS-EXAMINATION BY MR. DRATEL:
MR. DRATEL: Mr. Yum, the analysis that you spent on the bitcoin wallet analysis that you've been talking about for the latter part of your testimony, you began that within the last two weeks?
ILHWAN YUM: A little less than two weeks.
MR. DRATEL: And you said you worked with one other person on it?
ILHWAN YUM: Yes.
MR. DRATEL: Who was that?
ILHWAN YUM: It's a colleague of mine.
MR. DRATEL: And what is his name?
ILHWAN YUM: Mathew Edmond.
MR. DRATEL: And what's his -- what are his credentials?
ILHWAN YUM: He has a doctorate in cryptology.
MR. DRATEL: What did he do as part of this project?
ILHWAN YUM: He worked with me to identify the wallets, extract the bitcoin addresses, and compare that to the block chain.
MR. DRATEL: Did he do that actual work?
ILHWAN YUM: We both did.
MR. DRATEL: So he did some of that work?
ILHWAN YUM: Yes.
MR. DRATEL: Correct?
How many hours did he put into that?
ILHWAN YUM: We both worked on it for about a week together, so I think we're a little short of 100 hours. He put in about 60. I put in about 40.
MR. DRATEL: And what were his contributions to Government Exhibit 620 which is the spreadsheet, the large spreadsheet with all of the transactions. Right, isn't that the --
ILHWAN YUM: Yes.
MR. DRATEL: So what's his contribution to that?
ILHWAN YUM: He assisted me in obtaining the underlying raw information for that summary.
MR. DRATEL: And how was that exhibit created?
ILHWAN YUM: That one? I believe I just summarized the Excel file, so that's an Excel spreadsheet. I took all of the raw data and created a summary chart on Excel.
MR. DRATEL: But in terms of the matching, did you use any software to match the transactions?
ILHWAN YUM: Oh, the actual analysis?
MR. DRATEL: Yes.
ILHWAN YUM: Yeah, we loaded all the information onto a table and did a query on that table to find the matching transactions.
MR. DRATEL: And what program?
ILHWAN YUM: I believe the actual matching was done through Python.
MR. DRATEL: And what is Python?
ILHWAN YUM: Python. It's a scripting language.
MR. DRATEL: Did you have any participation in writing the code for that program?
ILHWAN YUM: Actual hands-on typing was done by Mr. Edmond, but we both sat down to work out the logic.
MR. DRATEL: But I mean in terms of the program itself, did you create that program?
ILHWAN YUM: Oh, no. So the reason why we use Python is there's available software called Pie Wallet, which was also found on the defendant's laptop, it's a common Python application that's used to manage bitcoins. So we used commands that are commonly used by all the bitcoin users.
MR. DRATEL: And you don't have any notes of the work that you did?
ILHWAN YUM: It's back in my office.
MR. DRATEL: You do have notes?
ILHWAN YUM: Well, the program itself.
MR. DRATEL: So you have notes of what you went through to accomplish this, right?
ILHWAN YUM: It would be the logic within the matching.
MR. DRATEL: And it was important for you to have help in this project, right?
ILHWAN YUM: In the amount of time that we needed to do the analysis, yes.
MR. DRATEL: Well, could a layperson have done it just running off the top of their head?
ILHWAN YUM: It may be time-consuming, but every information that we used, well, we had the public addresses for all of the defendant's laptop, so that's not available to the public but we have it because the private keys were found in his laptop.
MR. DRATEL: But we had someone with a doctorate, correct, in cryptology working on this project with you, right?
ILHWAN YUM: Right, it's easy as going to blockchain.info and typing those addresses to see if you could locate a transaction that you see --
MR. DRATEL: And how long would it take you to type in all of the addresses?
ILHWAN YUM: It's time-consuming. That's why we had two people working on it.
MR. DRATEL: Figure with two people, you would have done it in a week without any of the computer work that you did, without any of your knowledge and experience that you bring to the project?
ILHWAN YUM: As a manual process, no. You can't do that as a manual process.
MR. DRATEL: So then my question is -- withdrawn. So you do have notes and a progression of what you did, right?
ILHWAN YUM: Well, the notes would be the files on the computer where this analysis was done.
MR. DRATEL: Now, when you seized the bitcoins from the servers, right, in fact, the FBI didn't even have a protocol for establishing a wallet where to put seized bitcoins, right?
ILHWAN YUM: Correct.
MR. DRATEL: You had to create that?
ILHWAN YUM: Yes.
MR. DRATEL: You talked about the concept of a wallet, right, multiple wallets, multiple wallets and multiple addresses within wallets, right?
ILHWAN YUM: Right.
MR. DRATEL: You know what I'm talking about. So, you can't tell where a particular wallet was created, correct?
ILHWAN YUM: Correct.
MR. DRATEL: It can move from computer to computer, correct?
ILHWAN YUM: Yes, it can.
MR. DRATEL: And you can also move an address from one wallet to another wallet, correct?
ILHWAN YUM: Yes, you can.
MR. DRATEL: So you can't say how long any of the addresses of the wallets were on Mr. Ulbricht's computer other than the day he was arrested, right?
ILHWAN YUM: Can you repeat the question.
MR. DRATEL: Sure. You can't say when other than the day that Mr. Ulbricht was arrested or if those wallets or those addresses were on that laptop, other than the day he was arrested?
ILHWAN YUM: Yes, but there -- the wallet files are computer files in itself. So there is a last-access date of that file. And some of them dated prior to the day of the arrest. Some, months prior; some, weeks prior.
MR. DRATEL: Now, also the wallet that the bitcoins were in on Mr. Ulbricht's laptop, the 144,000 bitcoins, right --
ILHWAN YUM: Right.
MR. DRATEL: -- that was a hot wallet, right, as opposed to a cold storage wallet, right? It had the bitcoin program in it. It was a hot wallet by definition, right?
ILHWAN YUM: It's only hot if it's online. And the wallet that contained the most number of keys on the defendant's laptop, I don't believe that was synchronized to the block chain until August.
MR. DRATEL: I'm not talking about keys. I'm talking about bitcoins themselves.
Bitcoins themselves, the wallets -- the addresses within the wallets that the bitcoin were in, they were basically in one wallet, correct?
ILHWAN YUM: The majority came from one wallet.
MR. DRATEL: Right. And that wallet had a bitcoin program running in it, right?
ILHWAN YUM: Yes, but the program hasn't run since August of 2013, so -- it will be a cold wallet at that point.
MR. DRATEL: But isn't a cold wallet where it's not connected to a program where you can actually take the wallet, put it in a file or in a folder or somewhere else on the computer and extract the program -- extract it from the program so that it can't execute any functions, right?
ILHWAN YUM: Well, a cold wallet is something that's not online. So if the wallet's last access date was August 2013, it hasn't been online since August 2013; therefore, from August until October, it's a cold wallet because it never went online.
MR. DRATEL: But it still has a program in it, right, and it's still capable of execution?
ILHWAN YUM: Right, but it didn't execute because it would have updated that last-access date on the wallet.
MR. DRATEL: But if someone doesn't use their wallet, it doesn't mean it's a cold wallet; it can still be a hot wallet. You're just not using it, right?
ILHWAN YUM: No, not correct.
MR. TURNER: Objection; asked and answered.
THE COURT: I'll allow it.
ILHWAN YUM: A hot wallet is a wallet that is currently connected to the Internet.
MR. DRATEL: At that time? At the very time?
ILHWAN YUM: At the very time.
MR. DRATEL: That's your definition?
ILHWAN YUM: Yes, it is.
MR. DRATEL: Okay. And how many bitcoin cases did you have before this one?
ILHWAN YUM: This was a second case I believe.
MR. DRATEL: Now, you talked about identifying servers and identifying bitcoin server, right, and identifying the servers from the Philadelphia servers, right?
ILHWAN YUM: Right.
MR. DRATEL: You testified about that. What you saw from the code was only an onion address, right? In other words, looking back to find the servers, correct, it wasn't an IP address. It was --
ILHWAN YUM: I'm sorry. Which address and which server are you referring to?
MR. DRATEL: The server to which the backup data was exported to the jtan -- the Philadelphia server, right?
ILHWAN YUM: Correct.
MR. DRATEL: From the Iceland server, right?
ILHWAN YUM: Yes.
MR. DRATEL: Now, what you saw there when you're looking to find that is an onion address, right, an onion url, dot-onion url, correct?
ILHWAN YUM: I was brought onto the case around that time, and I received an IP address. And my -- the investigative team, before I joined, they were the ones who did the analysis, so I can't speak to what allowed me to receive that IP address, but I received that IP address. Nothing else.
MR. DRATEL: Now, the servers were first -- you went in October to Iceland, correct?
ILHWAN YUM: Correct.
MR. DRATEL: And to be there at the time of the arrest to shut down the servers, correct?
ILHWAN YUM: Yes.
MR. DRATEL: And to put the seizure banner up, we saw at Exhibit 600, right?
ILHWAN YUM: Right.
MR. DRATEL: The government had access to the servers -- the U.S. government had access to the servers in July of 2013, correct?
ILHWAN YUM: That's what I've been told --
MR. TURNER: Objection; foundation.
THE COURT: Sustained.
MR. DRATEL: Now, isn't it true that a Silk Road user would have communications -- withdrawn.
A Silk Road user would have transactions with the Silk Road wallet, correct, and their own wallets, right?
MR. HOWARD: Objection; beyond the scope.
THE COURT: Overruled.
ILHWAN YUM: I'm sorry. Can you clarify.
THE COURT: Let's not make a hypothetical. Why don't you ask him about actual things he may have seen.
MR. DRATEL: Sure.
MR. DRATEL: Silk Road users, in the context of how the bitcoin server worked on Silk Road, --
ILHWAN YUM: Okay.
MR. DRATEL: -- Silk Road users, a purchaser of a product off of Silk Road, would have a wallet on the Silk Road server, correct?
MR. TURNER: Objection to foundation.
THE COURT: Overruled.
ILHWAN YUM: I don't believe they have a wallet, but they're given an address where they could deposit the bitcoins that they personally own.
MR. DRATEL: Right. And then they could withdraw those bitcoins, correct?
ILHWAN YUM: I believe so; yes.
MR. DRATEL: And those bitcoins being withdrawn would show up as a transaction on the block chain from the Silk Road server to one of their addresses in a bitcoin wallet, correct?
ILHWAN YUM: Can you repeat that, please.
MR. DRATEL: Sure. That if a Silk Road user puts --
THE COURT: Ask it in terms of what he's observed.
MR. DRATEL: From what you know about the operation of the server with respect to bitcoins on Silk Road, that a user would fund his address, right, on Silk Road, correct?
ILHWAN YUM: Correct.
MR. DRATEL: And then if they decided to withdraw those bitcoins rather than using them to purchase at some point if they had a balance left, they could withdraw those bitcoins and that would show up as a transaction on the block chain from Silk Road wallets, correct?
ILHWAN YUM: Correct.
MR. DRATEL: In fact, someone could use Silk Road as a wallet itself in that forum, right?
ILHWAN YUM: I guess you could, but it's kind of dangerous to trust your bitcoins in someone else's wallet management.
MR. DRATEL: But it could be done?
ILHWAN YUM: It could be done, but when we seize government -- when the government seized the Silk Road server, anyone who left their bitcoins in their Silk Road address for the purchase of buying drugs, they lost all their bitcoins, so I wouldn't maintain my bitcoins that way.
MR. DRATEL: One moment.
THE COURT: Yes.
MR. DRATEL: Now, part of your investigation, part of what you were doing is looking at the movement of bitcoins back and forth, correct, from Silk Road servers, right?
ILHWAN YUM: Not back and forth. Just one direction from Silk Road to the Ross' laptop.
MR. DRATEL: And you mentioned --
THE COURT: I want to make sure that you don't speak over the witness.
MR. DRATEL: I'm sorry.
MR. DRATEL: But you mentioned that the amount that was in the FBI wallet was actually larger than the amount that was in -- that was transferred from the laptop, right?
ILHWAN YUM: Yes. So once the transaction -- once the seizure happened, FBI address made it onto the block chain and transaction of that size normally gets noticed by a lot of bitcoin users. So once that happened, the government seizure address was publicly known at that point. And just like -- just like an email, someone could send you an email and you send end up receiving it, whether it's spam or not. So we received a lot of small transactions that also came into the government wallet -- government address.
MR. DRATEL: Bitcoin?
ILHWAN YUM: Small -- fractions of bitcoins.
MR. DRATEL: But you don't know where they were from necessarily, right, you didn't track them all down?
ILHWAN YUM: I'm sorry. What was that?
MR. DRATEL: You didn't track down where they all came from?
ILHWAN YUM: No, I did not.
MR. DRATEL: So when you say spam or something, that's just your speculation, right?
ILHWAN YUM: Right.
MR. DRATEL: That's just a theory. You don't know where those -- those bitcoins came from after Mr. Ulbricht's arrest, right?
ILHWAN YUM: Right.
MR. DRATEL: And in fact, when you talked about large amounts being noticed on the block chain by the public, in fact, you -- six weeks after Mr. Ulbricht was arrested, you noticed 195,000 bitcoins being moved, right?
ILHWAN YUM: 195,000 bitcoins?
MR. DRATEL: Yes.
ILHWAN YUM: I don't recollect that.
MR. DRATEL: I'll show you what's marked as 3511-38 and ask you if that refreshes your recollection. That November 22nd, 2013, there was a 195,000 bitcoin transaction that was then broken down quickly into three different transactions, right?
ILHWAN YUM: I'm sorry. I was reading this. Could you give me just one second.
MR. DRATEL: I'm sorry.
ILHWAN YUM: Yes. You may proceed.
MR. DRATEL: I'm sorry. It was 35, not 38. Thank you. It's the wrong one. I'm giving you 35 instead to read.
ILHWAN YUM: Sure.
MR. DRATEL: No wonder you're confused. Does that refresh your recollection: November 22nd, 2013, that there was a transaction of 195,000 bitcoin that that was then quickly broken up into three smaller transactions?
ILHWAN YUM: It looks familiar; yes.
MR. DRATEL: Now, you you're at something called FTI Consulting, right?
ILHWAN YUM: Yes.
MR. DRATEL: And you left the government to join that organization, right?
ILHWAN YUM: Yes.
MR. DRATEL: The amount of money that the company's been paid already for this work is $55,000, right?
ILHWAN YUM: We haven't been paid yet. I'm not sure what the bill is going to --
MR. DRATEL: Is that the bill you've run up, $55,000, right?
ILHWAN YUM: I'm not sure of the exact amount, but I think it's somewhere around there.
MR. DRATEL: And this was an important case, right, for you and your career?
MR. HOWARD: Objection.
THE COURT: You mean in his career with the government or at FTI?
MR. DRATEL: Well, both, your Honor.
THE COURT: All right.
Has it been important in your career in both jobs? You may answer.
ILHWAN YUM: It was a significant case considering that bitcoin was never involved in a criminal case like this, but I've worked on many other cases that were very interesting as well.
MR. DRATEL: And it's also true that another agent closely involved in this case, Christopher Tarbell, also went to FTI after the arrest in this case, correct?
ILHWAN YUM: Yes.
MR. HOWARD: Objection; beyond the scope.
THE COURT: Overruled.
BY MR. DRATEL:
MR. DRATEL: The answer is yes, right?
ILHWAN YUM: Yes.
MR. DRATEL: And you left during this -- after the arrest and before the trial, right, and you went to FTI?
ILHWAN YUM: Yes.
MR. DRATEL: I have nothing further.
THE COURT: Thank you.
Anything further from you, Mr. Howard?
MR. HOWARD: No, your Honor.
THE COURT: Thank you. You may step down, Mr. Yum.
ILHWAN YUM: Thank you.
(Witness excused)
THE COURT: Would the government like to call their next witness, please.