Beginning in early 2023, K.W., resident of Simpsonville, S.C. received a Telegram App call from a female who identified herself as Aggie Smith. She approached K.W. about online investing in crypto currency. These calls evolved into video calls with this Aggie Smith, who convinced K.W. to open and invest in a web platform called coinlink-web3, which is markedly similar to Chainlink-web3, which is a legitimate investment website. When K.W. made attempts to withdraw, he was prompted to pay fees in excess of $10,000.00. He attempted to make further communication with Aggie Smith, and make further efforts to withdraw the funds, but to no avail. i. K.W. opened an account on the suspect trading platform and made numerous deposits into his account wallet addressed:

0x7F1392E44e1ef7578E486F0Ec33881cC3379AE3a. Over a several month period, K.W. made approximately 8 deposits into this wallet totaling around $135,000.00, believing this was a secure trading account that only he had access to. In reality, the funds were immediately moved out of his account into a wallet address that only served the purpose of receiving funds for a short period, compiling 8 6:23-cv-05160-TMC Date Filed 10/16/23 Entry Number 1 Page 9 of 16 with other deposits and being forwarded on to other wallet addresses. This is often referred to as a Burn Wallet (Burn Wallet 1)2. These wallets do not serve legitimate business purposes. The address of

This wallet had been active for a little over four months and had received 58 transfers totaling approximately $1,176,296.00 USD. In each case, the funds were received, comingled with other funds for a short period of time and then forwarded on to a handful of wallet addresses. i. Special Agent Joseph Lea (SA Lea) reviewed the transaction history for Burn Wallet 1 in a commercial blockchain analysis platform. Below is a summary of his review: (1) On July 25, 2023, at 11:48Hrs 9,956 USDT was deposited into Burn Wallet 1 via transaction ID: 0x8fdfb61caf0603f08bcab4f5fb7accf66fa76b8d50ea564ee37813a8 821c7a67. Based on his training, experience and information from the victim, SA Lea believed this deposit was from K.W. and matched the account information provided to the Simpsonville Police Department. Those funds were quickly sent out to wallet 0x9C93d68EEe5A40b1ee176E4e157d4D65e84F8038

(Burn 2 A burn wallet address is one that is specifically used as a intermediary wallet where the funds come in and are comingled with other funds and then immediately sent out. This is done to further obscure the location, nature, and source of the illicit funds. 9 6:23-cv-05160-TMC Date Filed 10/16/23 Entry Number 1 Page 10 of 16 Wallet 2). j. SA Lea reviewed transaction history for Burn Wallet 2 in a commercial blockchain analysis platform. This wallet was only active for two months, but during that time it received 60 transactions totaling $1,608,493 00. Below is a summary of his review: (1) On July 26, 2023, at 13:50 17,000 USDT was deposited into from 0x126cfc1Bb7e6424A2B25A98f8a1C27e2BF03EEc9 to Burn Wallet 2 via transaction ID: 0x4f9f931a8049b1f983cca18c22a2770c523ce73026ca67e04785d06a5217 0742. Based on his training, experience, and information from the victim, SA Lea believed this deposit was from the funds derived from victim K.W. From