Code, Compliance, & Consequences: What’s Regulated & What Isn’t | Bitcoin 2026

Hello, good afternoon everyone. My name is Sasha Hotter. I'm founder and principal attorney with Hotter Law Firm. And today's panel is about uh code compliance and consequences. And we're going to be speaking with uh two of the industry's top lawyers. Uh they've been dealing with on the ground with the free samurai case and the Roman Sterlingov case. Um to Zach Shapiro, I'll let you guys introduce yourselves. >> Uh hi, I'm uh to Acklland. And I represent a lot of people accused by the federal government of computer crime. And as Sasha said, uh I represent Roman Sterlingoff, who currently is litigating his appeal for his conviction for running the uh Bitcoin Fog Mixer. Um Zach Shapiro, head of policy at the Bitcoin Policy Institute. Uh we do Bitcoin policy in DC. Um, part of my role there is I'm also uh executive director of the peer-to-p peer rights foundation uh which is nonprofit litigation fund uh to protect developers who build non-custodial tools uh from the type of prosecution that I think we're going to talk about today. Um, and then I I run a law practice called Reigns LLP uh where I work with uh a lot of people building this technology and help them navigate uh questions of where is the line between uh money transmission and not >> very good. And maybe just as the first thing, can you guys each introduce both of your cases that you've been working on and give the the audience a little background on what's going on with Roman Sterlingov and what's going on in the Samurai case? Um, so the Samurai Wall case, I'm I'm not uh defense council in that case. They do have uh had excellent defense lawyers. Um, that case unfortunately uh is is done. It ended in in guilty pleas for both defendants uh to unlicensed money transmission um in return for the government dropping uh the the moneyaundering charges which would have carried uh harsher penalties. And um this was really, you know, to my mind a clear example of the government just exerting pressure uh to plead to something that that doesn't make a ton of sense. Um the the defendants in the Samurai Wall case uh weren't transmitting anyone's money. Uh their users were transmitting their own money through a non-custodial tool called a a coin join uh where it's, you know, not even transmitting it from themselves to someone else. In most cases, it was people using uh Samurai's whirlpool coin join to send their own money to themsel uh just using this uh software uh that that was available. Um and in in exchange for uh you know not carrying uh the threat of of 20 years in prison over the heads of these developers um they had to allocate to uh knowingly transmitting criminal funds which is a deeply unjust result. and we're hoping that the Trump administration uh might see fit to to pardon those defendants. >> Um, so like I said, I represent Roman Sterling off and Roman is a dual Swedish Russian national citizen who has been living in Sweden since he was 14. Uh, he got into Bitcoin in about 2010 and as probably everybody in this room knows, in 2010 you could get a Bitcoin for about 32 cents. Um, I'm convinced he's completely innocent. what he was convicted of. He was convicted of running uh a custodial mixer called Bitcoin Fog, which starts uh in October 2011. Uh mind you, he's in Sweden the entire time. Uh he gets off an airplane in LAX in 2021 and all of a sudden he's arrested uh by the FBI. He's all of a sudden told he's being arrested for money laundering through Bitcoin fog. You know, unlicensed money transmission. And the same thing they got the Samurai wallet guys on. And when they arrest him, he's carrying three laptops, you know, 10 years worth of diaries, thumb drives cuz he's a digital nomad. And not a single piece of evidence on any of his devices ever shows him operating Bitcoin fog. Uh there were no eyewitnesses at trial saying, "Oh, we saw him operate Bitcoin fog." The entire case was circumstantial. Uh it was after the-act government investigators testifying uh of their use of a new proprietary software you may be familiar with chain analysis reactor. Um nonetheless the jury found him guilty even though there was no evidence really of him ever operating Bitcoin fog and this is something that should worry anybody anywhere in the world. There was no evidence that he ever did anything in the United States yet. They put him on trial in Washington DC. Uh right now he's doing a 12 and a half year sentence. He's done about uh five years. I've never had a case where I've been so convinced that my client is innocent. I have represented probably some of the best hackers in the English speaking world. Uh at this point about doing this for about 15 years, I have never ever had a client where the government arrested him, got all of the clients devices, and there was of evidence on the devices of them doing anything. I like I just don't know anybody who's that good. So either he's some super genius who's better than anybody I've ever seen, which I think kind of they should release him for that maybe if that's true, or the reality is I think he's just completely innocent and just got railroaded in this crazy war on crypto. >> Yeah. And there's also the uh Roman storm situation or tornado cash is very similar to these ones where it's non-custodial software and you know in in his case being charged with uh unlicensed money transmission and it's you know h how are you transmitting money if you have no ability to stop the transaction midway. So, um, maybe you guys can speak to where is the line between operating software, publishing software, and then being considered a money transmitter. >> Well, I guess it depends uh if you're asking me or asking the Southern District of New York because you'll get get different answers. Um, uh, where do I think the line is? Um if you read the criminal statutes that are you know implementing the bank secrecy act where all these laws come from uh the line is are you accepting and then transmitting funds on behalf of the public. Um if it sounds like between accepting and then transmitting you need to have control or custody of the funds uh I I agree with you. Um and so I I think that's that's where the line is and and when I talk to people building in the space um the question is do you have custody uh which is really about sort of access to keys uh or do you have control which is the unilateral ability to send funds to whatever destination you so choose. Um and if you do uh then you would be regulated as a money transmitter and money service business and subject to the bank secrecy act and KYCL obligations. uh and if you don't uh then you're you're just building software and it's your users that are transmitting funds and not you. Um and so what what is so upsetting I think about you know specifically the the Samurai Wall case and the Tornado Cash case is um you could have followed that line to a tea and and in fact uh both Roman Storm and and and Bill and K all did get legal advice on this exact question uh and and the government is prosecuting them anyway. um the government's theory uh the the the Samurai wallet case ended um more quickly than we got sort of a full view of the government's theory. But in tornado cash, we got a better sense of how how the government thinks about this specifically. And their view is essentially if you facilitate uh the movement of funds, you're you're a money transmitter. And the the deeply frightening thing about that is it doesn't have a limiting principle. Um you know, where does that stop with facilitation? And sort of like the mental model I have is if you're the like timber company that chops down the tree, that makes the wood, that makes the paper, that makes the envelope that one criminal uh uses to hand cash to the other criminal, you know, do you need to KYC everyone who used your envelope? Like that that doesn't make any sense. Um, in in the government's brief in the tornado cash case, they said, you know, money transmission doesn't require custody or controlled because a frying pan, these are the real examples they used. A frying pan transmits heat and a USB cable transmits data and and neither has custody of of the the thing it's allegedly transmitting. Um, but I I think they're making their case, you know, too clear, right? Like is a frying pan guilty of it does not make any sense. And so um the line I think is and should be this this line of cussy and control and that is the line in the uh BRCA provisions of the clarity act uh which is the crypto market structure bill um making its way through Congress right now that we're uh really hoping will pass uh before July of this year. Um and that would hopefully prevent cases like tornado cash and Samurai wallet from happening in the future. Um but you know there there is what you know the the bank secrets act seems to say and then there is what a judge or prosecutor can interpret it as and that that is the uh the gap we need to close. >> Yeah. And you know we saw in the in the Samurai case they were looking a lot at intent and at tweets and same thing with Roman Storm. I think they they referenced a t-shirt that he wore and they put two text messages that he sent several months apart next to each other as if it was, you know, a a a congruent sentence or, you know, >> that was that's a slightly separate question, right? So, each of the defendants in those cases, in addition to unlicensed money transmission, were charged with substantive moneyaundering offenses. And that that's really about intent. And um I don't think any of those defendants are are truly guilty of moneyaundering. Um, there was a hung jury for Roman Storm and the government dropped the moneyaundering charges against against Bill and Keone. But at least you can make sense of the government bringing those charges and what they mean, right? It's like, did you intend to help criminals? And yes, all of the evidence there was a stretch. In the Samurai Wall case, it was it was joking tweets. In the in the tornado cash case, it was this t-shirt. Um, but you have to prove specific intent. And what's so pernicious about the moneyaundering thing is it's not about intent. They're getting you on a technical compliance failure uh that you had no reason to know applied to you. Actually, I want to actually make a comment on that intent thing because we had something happen in our case that what you just cited was like what the law should be, but what they did in in in our case with Roman with the moneyaundering uh if you read the statute, it says you need specific intent, right? Like exactly like you would read it. They introduced something called a willful blindness instruction, which is in a totally judicially invented doctrine nowhere in the statute uh that Congress passed. And what it essentially says is, well, maybe you didn't know anything about it because they really didn't have any evidence of him knowing about anything because there was no direct evidence in this case, but you you should have known about it. And that's really scary, right? Because that's not a criminal Men's Rehea uh standard. It's more like a negligent civil standard. And you can convict anybody in this room on that standard. So you know and I think this goes to one point here is there is no clear line because this is such a new area uh of law. It's undefined. It's a new technology. I see this in my other computer cases. And when you have this sort of zone of law that's undefined. It allows prosecutors to run a mock and that's what they're doing in the Bitcoin space. And I fundamentally think that all of these prosecutions are political prosecutions. Um, you know, I see it generally with DOJ with administrations. When the administration changed, the prosecutorial priorities change, but these these prosecutions, they're not nobody's really done anything bad. There's no victims from Samurai or, you know, Tornado Cash. It's just these people who have this mindset that we need to control the money because if you control the money, you control the people. And they're launching these political prosecutions that are are devastating to people, devastating to innovation, and devastating to privacy. >> And welcome to predict. The world is a market. Everything is a market. Get a 100% cash back up to $100 on your first predict bet if it loses. Predict where everything is a market. And we were all very hopeful with with the administration change. You know, most of these cases started under the Biden administration and Trump came in and he said he was going to free Ross Albbright and, you know, it was hopeful that all these cases would be dropped and a lot of the SEC cases were dropped, but these, you know, these seemingly more important cases where people are in jail over over these charges that they haven't changed. We had the Blanch memo come out last spring that, you know, basically said they're not going to continue prosecuting this and um they are. So, so where do you think it's headed or why do you think they that these prosecutions have continued after that Blanch memo? >> Well, there's still time for the administration to do the right thing and so we're we're hopeful on that. Um the Blanch memo and uh frankly what what Todd Blanch said at this conference yesterday um is a really sort of laudable viewpoint on on how these cases should proceed, right? That that we should not bring more of these cases. we should not hold uh third party developers responsible for what the users of their software do unless they are specifically aiding them. Um and you know I personally reading the Blanchch memo I I think that tornado cash and Samurai Wild cases are plainly inconsistent with both the spirit and and the letter of the Blanch memo um the the again the southern district New York seems to take again a different view on that uh than than mine. Um this is going to become a much bigger problem with AI um at at really the highest level. The the question is uh Bitcoin and blockchain technology blurs the line between regulated financial activity and software. And that's a really important line because software is protected by the first amendment. Um and uh if you overreach uh criminal regulations over uh regulated financial services into the software space that is a really chilling impact on on freedom. Um that line is about to be even more blurred when we have agentic commerce and and people use whatever you know two generations now a few years from now like OpenClaw that's way smarter than what we have now and they say go make money and then the open claw spawns another open claw that goes and does something on DeFi and and it's like completely unforeseeable right what the fourth open claw down the line is going to do based on your prompt go make me money and how are we possibly going to handle this if like we say that if you facilate ate the movement of money. You're you're regulated as if you were a literal bank. Um and so I think it is incredibly important to get this line right. Um and I think in spirit the Blanch memo does that. And in spirit, a lot of what this administration says does that. But there is this really sort of, you know, difficult. One of the things that that acting attorney general Blanch said yesterday that I take issue with is he said specifically software developers shouldn't fear being held responsible uh for the acts of their users unless they are, you know, helping those users commit crimes or know that they're committing crimes. And that line between helping and knowing is like he said it like nothing. It's all the difference in the world, right? If you're if you're Apple, uh you know people are using MacBooks to commit crimes, right? If you're Victory Knox, you know that people are stabbing each other with Swiss Army knives from time to time. We don't hold you criminal responsible for that. We hold you criminal responsible if you aid in a bet the crime. Um and the government in both the Samurai wallet and tornocash case couldn't make out, right, in the in the tornado, they couldn't convince a jury uh that that Roman intended to help the North Koreans launder money. Um that government dropped that same charge in the samurai wallet case. Uh and so they use this lower knowledge standard that has absolutely no place in the criminal law when we're talking about building software tools. >> Yeah. And and on the blanch memo like I think the blanch was dead on. Like I I read it. I was like this is great. And and you know Attorney General now serving attorney general Blanch says in it he says listen we're not going to make um you know mixer operators responsible for the crimes of their end users, you know, unless they know about it, right? I and so I thought great, you know, this is Roman Sterlingoff's case. I read the memo. I'm great. I I send a a letter with the memo to the the appellet lawyers at DOJ handling of the case. I get crickets, right? So, it's a really nice memo. It'd be great if DOJ followed it. And I can't tell right now if there's just so much chaos in DOJ. There's, you know, it's not this singular institution. There's like the Southern District of New York is called the Sovereign District of New York. There's a lot of push back. There's factions. There's all this stuff. So, I don't know what's going on, but if they followed the letter of that memo, all of the crypto prisoners would be free. So, I I just don't understand the dissonance there and and you know what's going on. Maybe they don't have control of DOJ, but if they do have control of DOJ, they should just follow the memo and set them all free. >> Absolutely. Yeah, completely victimless crimes. And it, you know, in Kone's letters from the inside, when I read that he is there cleaning toilets, it was just like one of our our industry's brightest minds is in there stuck like that. It's just um it's just awful. Um in in Storm's case, they said that the criminal liability kicks in when the platform is used in large part by criminals. And it's another thing like that knowing or you know it's they they keep using these standards that are very difficult to to know okay here's the line like in large part it's used by criminals right now they're saying with the BTM industry Bitcoin ATMs that that really is being used in large part by criminals but who's determining that number you know it's the government coming in and saying oh yeah this industry there's so many scams we've we've done analysis on it and determined that most transactions I think they came out at 91% % they're saying are scams. I I I don't know how they came up with that, but in in Tornado Cash, I think they came up with a 15% um of the transactions being scammed and or being, you know, with some kind of criminal element to it. And then in Samurai, I think it was only 2% that they said were were being used for illicit transactions. Um, so what what what can we do with these kind of moving target lines from from the government like substantially >> I mean that's just not what the law is right like uh privacy technology is not illegal it's not illegal unlicensed money transmission is illegal um but at least on the non-custodial side there's no money transmission and so like we just need to follow the blanch memo is is really sort of the answer again and again to this um and look I I do think that we should be somewhat circumspect about there is a lot of uh fraud and crime that happens including using these tools. I think especially with with Bitcoin ATMs, we have a really bad problem with these pig butchering scams that are like really horrible and victimize people in these terrible ways. And and by the way, the people perpetrating these crimes live in these like horrible slaverylike conditions in Cambodia. Um but what we should do is focus our law enforcement efforts on disrupting that on helping the victims um rather than the infrastructure itself. And I think it would be one thing if what we saw is, you know, and and maybe maybe we disagree with this, but but I would welcome some version of like real thoughtful consumer protection laws that say, you know, maybe we want like a warning screen on a Bitcoin ATM to say like, is someone pressuring you to do this? Are you, you know, withdrawing money for an opportunity that seems too good to be true? Do you know the person you're sending money to? Do you understand the risks involved? Like if that is what we were doing to stop people, you know, from falling victim to crime, great. Um, focusing on the people who build the tools, uh, aside just from not being how the law works and and being really bad for is just a a really bad distraction, uh, from the sort of legitimate functions of law enforcement in helping the people who um, you know, are are scammed, you know, using cryptocurrencies. And I don't believe the government statistics and I don't think just because the government says it's true that it's true. The software, the primary software that they use for these statistics, it's called chain analysis reactor. And we were the first uh I think as far as I can tell the first case to challenge that that software. And when I cross-examined their expert in something called a Dalbert hearing, all I did was I just asked the questions that the leading Supreme Court case asked you to ask about, you know, any kind of expert forensic technology. And I asked, can you tell me your software's error rate? They said, no. Can you tell me the software's rate of false positives? No. Can you tell me its rate of false negatives? No. Can have you done any internal error analysis on your software? No. Can you name me one scientific peer-reviewed paper attesting to the accuracy of your software? No. And yet the judge still let it in based on the judge was former DOJ too, but that's another story. Based on the antidotes of law enforcement, right? Like so first thing is I'm not going to give any credit to their statistics because this is completely unregulated field without any standards and they're just making up left and right and they're saying you need to believe it because we're the government. The other point is they would never do this kind of stuff with banks. So if you go and you look at what the banks do for just basically the same kind of behavior and you were using that as your model for what's legal in Bitcoin or crypto, you'd be making a huge mistake because they're going after the crypto people, throwing Bitcoin, whatever, and throwing them in jail in a way that when banks launder billions of dollars of money, they get a slap on the wrist. They get a deferred prosecution agreement because DOJ's primary core function it seems to be and even in this administration that the way they're acting is to defend the fiat money system. And that's messed up. And that goes back to these things essentially being political prosecutions and arbitrary in the sense that they're just making them up. >> Well said, Tori. Yeah, there's no bank CEOs in jail right now for for you know all the all the moneyaundering. Um yeah, and so where do you guys think the line should be? Like h how should non-custodial Bitcoin be regulated or you know, if any regulation? I I'm kind of of the opinion that Fininsen got it right in 2019 when they published that guidance saying non-custodial um you know is is not regulated. But if you're holding funds, you have the I've always kind of looked at it with the model of, oh, if you can steal the funds from the customers, then sure, you should be regulated, you know, the same as as a bank. At first, when we were learning about this industry, everyone was up in arms even at that that you know, a custodial one would have to be regulated, but but the non-custodial, it seems, you know, pretty clear Fininsen got it right originally and then now they've just pushed the line. So, if if you were able to, you know, set the law, how how would you do it? >> No, I think that's a fine place uh to set the law. I mean, there's still uh obligations you have under OFAC um sanctions rules not to do business with uh sanctioned parties. That that seems relatively reasonable to me. Uh it's really where the you know, affirmative obligations under sort of criminal penalties, you know, like a bank where it's it's just not feasible to comply with this with most non-custodial tools. Um I I would want to pivot to a related topic and say um Bitcoin was not the first attempt at doing what Bitcoin did. Um and the the reason why most of its predecessors failed is because there was a central intermediary of some sort that the government could exert pressure on uh or arrest someone and stop it. And and Bitcoin is a truly um decentralized sort of resistant uh ecosystem that that could thrive on its own. And if we're going to get out of this, like it, I'm increasingly pessimistic that it's going to be because of the grace of the regulators. Um, we're going to have to build our way out of this and and do it in sort of the same cipher punk way and the same spirit that Satoshi built Bitcoin. And um, this is something I believed for a while and and always the hard part of that is the user experience around non-custodial tools is difficult, right? Learning how to use a smart contract directly instead of doing it through a front end like you know in the s in the tornado cache case is really difficult. um having something truly sort of robust and anti-fragile is is really difficult. And I really have recently become very optimistic. This is another area where sort of AI comes to the rescue. Um both in terms of just the ability to build and proliferate software without having to raise venture capital. People can vibe code tools to their heart's content and a thousand flowers can bloom and some of them are going to turn out to be really useful. And then just in terms of the user experience, um, getting someone to use, you know, a non-custodial lightning wallet that can be without KYC instead of a custodial model, uh, where where, you know, it has, uh, money transmitter licenses, you don't need to learn how to balance liquidity anymore, like Claude can do that for you, right? And and as people become sort of more and more used to using AI agents as the sort of like gateway to their computers, um I think there is this really tremendous opportunity to build a groundup non-custodial ecosystem that whatever the government wants to do, whatever this administration, whatever the next administration, um these are peer-to-peer tools that are run over decentralized networks like Noster that just can't be stopped. And in the same way that, you know, Bitcoin just was so self-evidently a peer-to-peer system that there was no one to throw in jail, right? Like there's, you know, it didn't depend on Satoshi. Um I I am optimistic that we have an opportunity now to do that sort of writ large uh with all of the infrastructure we need uh to move this industry and this movement forward. >> I would regulate the regulators and I would regulate the forensic software that they're using. For instance, in our case, uh, Chainalysis Inc., which owns Chain Analysis, uh, Reactor, the main proprietary closed source software that we weren't allowed to see the code for, uh, they bought a company 5 months after Roman was arrested from the primary IRS criminal investigator in the case. They also hired during dependency of the case, one of the prosecutors. And the message that sends to the prosecutors is if we do good for chain analysis, chain analysis is going to give me a nice cushy job after this, right? Chain analysis, blockchain forensic software is completely unregulated. There's no standards. There's no peer review. There's absolutely nothing. So remember, when you hear all these statistics about all this money laundering going on and all this clustering and all this stuff, they don't have any reliable scientific evidence for that. So stop believing that crap. And the first step is reigning in the regulators and regulating this crappy forensic software that they're using to accuse everybody, right? And I think if they're going to make attributions, they really need to have the private keys to these addresses because in Roman's case, they were doing traces that they were attributing, you know, uh, funds to him that would be like two dozen hops on the on the blockchain without a single private key. You know, they they Roman was in in Miami in 2017. They put him under a wire tap, you know, all this stuff. No evidence he's running Bitcoin fog. He had a server in Romania for VPN business. They put that under a wiretap. No evidence he was running Bitcoin Fog and they never bothered to search his apartment in Sweden after he was arrested to get his home computer. And that tells me that they were worried that when they got that they would find nothing. The regulators need to be regulated. >> Absolutely, Tor. Well said. And and what can people in the audience do to to help Roman Sterlingov or any of the other crypto prisoners? Like what what can we do at this point? >> Uh two things. Um one is uh make noise for the uh free samurai and and and free romantor movement uh and make it clear to the White House that if we're going to be the crypto capital of the world, we can't have crypto political prisoners. That that those two things don't don't work together. Um and the other is um please call your congressperson uh or your senator and advocate for the passage of the clarity act specifically with the developer protections from the blockchain regulatory certainty act. Um you know it seems like 50/50 whether clarity act is going to pass and there's a real danger uh that there is going to be a deal where they cut out the developer protections in order to basically legalize ICOs which is what a lot of the money behind that law is meant to do. Um, and you know that that would be a horrible trade. Um, and calling is much better than writing. Uh, when you call uh your cent's office, their staffers actually keep track of how many people call about an issue. Um, so if you can, you know, just take the time to pick up the phone and say, "This is an issue you care about." That really does go a long way. >> Just make a bunch of noise about it. Talk to everybody. Google, you know, free Samurai, the website will come up. Free Roman.org. Free all the Romans. Just keep talking about it. You know, all politics is local. Doesn't matter where it is, at the dinner table, at the bar, wherever. Raise awareness of it because all these people, they're innocent and they should be free. Absolutely. Well, thank you everyone. Every year, this community comes together to celebrate, to debate, to build what comes next. And every year, the stage gets bigger. Sound money, center stage. So, where do you go to celebrate the next chapter in Bitcoin history? You come home. Nashville, July 2027.