William Hill had been living in Portugal for almost a year. Shortly after landing from France, where he had previously lived with his wife, he began to be monitored 24 hours a day by the Judicial Police, at the request of the FBI. From his apartment, in the historic center of Lisbon, the 65-year-old American managed the Samourai cryptoasset portfolio, which he founded in 2015 with Keonne Rodríguez, who lives in Florida, USA, and which since 2022 he tried to be a tool of money laundering for Russian oligarchs covered by Western sanctions. And this, as The Observer knows, is one of the most relevant points of the investigation: the efforts of those responsible for Samourai to transform the application into a platform for the circulation of Russian money without any control.

Hill was preparing for another normal day, when on April 24 he was surprised by a mega operation – which the National Unit to Fight Cybercrime and Technological Crime of the PJ had been preparing for a long time and which had the collaboration of the Investigation Division US Internal Revenue Service Criminal (IRS-CI). That same day, US authorities also raided Rodríguez’s home.

In Lisbon, the judiciary seized computer equipment, servers and other evidence. A seizure that, according to the investigation, could have amounted to several tens of millions of euros.

The plan had been prepared in detail and the investigation was faced with an increasingly common reality. “We have been used to it for some time now, when it comes to ransomware, cyberattacks or malware. “Here we had cybercrime as a provision of services for other cybercriminal groups to carry out this type of cyberattacks,” a source from the Judiciary explains to the Observer, clarifying that it is something that has increased a lot.

The application was downloaded 100 thousand times.

In short, Samourai was an application for mobile phones (100,000 downloads had already been made) that allowed users from all over the world (it had clients in several countries, including Portugal) to store their private keys (password of the owner of the cryptocurrency). Although the private keys were not shared with Samourai employees, this platform operated a centralized server that, “among other things, monitors and facilitates transactions between Samourai users and creates new BTC addresses used during transactions,” explains the Prosecutor’s Office. of the United States.

And, by mixing cryptoassets from illicit activities with cryptoassets from legal operations, it made it impossible for authorities to track the cryptocurrencies: Follow the money, as known in traditional banking. It was, therefore, a “platform for mixingthe well-known Whirlpool.”

In addition to this service, the indictment from the Prosecutor’s Office of the Southern District of New York, to which the Observer had access, reveals that Samourai also provided services for Ricochet, in the words of the PJ, a “cryptoactive exchange, which is dedicated to developing solutions “Through both services, Whirlpool and Ricochet, the defendants are believed to have earned the equivalent of more than $4 million (they only received through cryptocurrency mixing). ). fee of 3.4 million dollars).

According to the Judicial Police, it was found that, in total, “more than a billion dollars in bitcoins and more than 680 million dollars in BTC were moved, used in Ricochet transactions.”

In addition to the Portuguese police, the Icelandic police also collaborated in the investigation, so “the web servers and the Samourai domain (https://samourai.io/) were seized,” the indictment reveals. Like the website, the app previously available on the Google Play Store has also been disabled in recent days.

The American’s life since his arrival in Lisbon

William Hill had lived a long time in Europe. In the indictment of the Southern New York Prosecutor’s Office, prosecutor Damian Williams even explains that the accused was on this continent at the most relevant moments of the plan.

The move to Portugal, to an apartment in the historic center of Lisbon, took place in the summer of last year. Authorities believe he brought the family in search of a quality of life that has attracted many foreigners: a safe country with features they appreciated.

Day-to-day life was perfectly normal, considering that he saw samurai as his professional activity, which he carried out from home. But he went out regularly.

“He had his equipment, he had his materials, he had everything he needed in his house. Therefore, he led a perfectly normal life,” says a source familiar with the investigation, adding that to manage Samourai he did not need much space at home: “There are tools that, yes, need space, because they need computing power or We need have servers with a lot of capacity. And then it is necessary to have some specificities, such as refrigeration, but that is not the case.”

PJ inspectors followed him 24 hours a day

For months, the Judiciary followed the American’s steps to always know where he was. The information constantly exchanged with the North American counterpart showed that her relevance in the alleged money laundering scheme was great and it was important to guarantee that she would not leave the country, especially given the ease she has to move around Europe, since she is married to a citizen. of the European Union.

A source from the Judiciary even explains that, therefore, monitoring was carried out, with inspectors on the ground, from the moment the FBI requested collaboration.

“It was monitored 24 hours a day, obviously knowing the importance it had in this network. The monitoring was carried out during these months by a sufficient number of operatives,” he explained, noting that it is the common procedure when dealing with suspects of this relevance. Hill never realized that the police were following him.

The origin of cryptocurrencies invested in the wallet

The secret of the Samourai wallet was exactly the origin of cryptocurrencies: transactions had legal and illicit origins. It was precisely the mixing of both sources in new currencies that prevented the authorities from acting.

Of all the illegal transactions made by the platform, which will be worth approximately $2 billion, authorities believe that at least the equivalent of $100 million were money laundering operations from illegal dark web markets, such as Silk Road and Hydra Market. . But also values ​​derived from computer intrusions and phishing actions.

Silk Road is a darknet marketplace known for selling large quantities of drugs. And Hydra Market is a website, also on the darknet, in Russian and for Russian speakers, also dedicated to the sale of drugs. Created in 2015, it also allows the transaction of false documents, stolen information and money laundering services.

“Keonne Rodríguez and William Hill managed accounts on Twitter (which has since changed its name to social network X), encouraging and inviting users to money laundering operations through Samourai,” adds the North American investigation.

But after all, how did he come to the conclusion that he could help the Russian magnates?

In June 2022, four months after the start of the war in Ukraine, the founders of Samourai try to take a big leap, opening the doors to other types of transactions: those that were blocked by the sanctions imposed by the West on Russia.

The accusation even reproduces a publication on Samourai’s Twitter account, made by Rodríguez on June 30: “Welcome Russian oligarchs, new users of the Samourai wallet.” Coincidence or not, at that time the sixth package of European sanctions against Russia had been approved, which reinforced the measures already taken and expanded those targeted by the sanctions.

Returning to the accusation, at another point the example is given of a conversation between Hill, through the “Samourai Dev” account, and a Twitter user, in which the founder of the platform, resident in Lisbon, talks about the use of Samourai in related operations. to illegal transactions.

Marketing and the reaction to a Europol alert

Also through the “SamouraiDev” account, on what was then Twitter, in March 2021, William Hill commented on the concerns of the police, in this case Europol, with the activities carried out by the application he founded: “Europol also highlighted the wallet Samourai as a “major threat” emerging in the same article. Do you think we’re scared to death?

In addition to these comments and public positions, potential investors were also exposed to materials promoting the Samourai portfolio in which, according to the US indictment, they explained how they were open to people with illicit activities who sought privacy or even who simply sought to escape from the legal control mechanisms.

One of these marketing materials is titled: “Who’s willing to pay for privacy?” In other material they recognize that the income comes from the illicit market. When they refer to the group of people who use the “Dark/Gray Market”, they realize that with Samourai they can “exchange bitcoins with multiple parties, destroying the metadata that was created.” In other words, they can launder money.

The United States will request extradition. Prosecutor thanks PJ for his work

According to a statement from the Attorney General’s Office of the Southern District of New York, the United States will begin the process to extradite Hill, with the aim of putting him on trial on North American soil, in a case that has been handed over to the Prosecutor’s Office. District Judge Richard M. Berman.

“Rodriguez, 35, of Harmony, Pennsylvania, and HILL, 65, a U.S. citizen who was arrested in Portugal, are charged with co-authorship of the crime of money laundering, punishable by a maximum sentence of 20 years in prison. “, says the note from the Public Ministry, and adds that both are also accused of a crime related to the creation of an illegal money circulation scheme, “which is punishable by a maximum penalty of five years in prison.”

“Operation Samurai.” The PJ arrests an American in Lisbon suspected of “laundering” criminal fortunes with cryptocurrencies

The statement includes words of gratitude from prosecutor Damian Williams to the US authorities and the entities involved, but also “to Europol, the Portuguese judicial police and the Icelandic police.”