The murder-for-hire case of Ron Ilg, seems like it was pulled directly from a Netflix documentary, but this is a real life case involving cryptocurrency and multiple FBI agents. Beth Bisbee (Director Product Strategy, Chainalysis Government Solutions) leads the discussion with the Supervisory Special Agent, Forensic Analyst and Special Agent that were tasked with this complex and riveting case.
You can listen or subscribe now on Spotify, Apple, or Audible. Keep reading for a full preview of episode 173.
Public Key Episode 173:Cracking the Chain: A Case Agent’s Journey Into Crypto Investigations
The murder-for-hire case of Ron Ilg, seems like it was pulled directly from a Netflix documentary, but this is a real life case involving cryptocurrency and multiple FBI agents. Beth Bisbee (Director Product Strategy, Chainalysis Government Solutions) leads the discussion with the Supervisory Special Agent, Forensic Analyst and Special Agent that were tasked with this complex and riveting case.
This FBI-led investigation involving a murder-for-hire case facilitated via the dark web, featuring cryptocurrency payments, seed phrases on sticky pads, guns, cash and biometric safes.
The team details their journey, from the initial tip-off involving a custody dispute and an alleged plot to harm a spouse, to navigating the complexities of tracing cryptocurrency on the blockchain. The discussion zeros in on how the newly created Virtual Currency Response Team played a critical role in unraveling this case by leveraging blockchain analysis despite the perpetrator’s attempts to obfuscate transactions using mixers. With cooperative efforts involving international exchanges and Bitcoin ATMS.
This gripping discussion highlights how the FBI team unraveled the complexities of the case using modern investigative techniques involving blockchain forensic analysis and traditional detective methods combined to thwart a potentially tragic crime.
Quote of the episode
”Early on in the investigation through some very reputable cryptocurrency exchanges, we were able to get information from them, that directly tied to Ron Ilg. Specifically name, date of birth, social security number,his phone number that was used for two-factor authentication, a selfie that he had taken and sent into the exchange, that kind of information was really powerful in tying Ron Ilg to the person who was behind the keyboard, trying to order up this hitman service.” – Supervisory Special Agent (SSA), Federal Bureau of Investigation (FBI))
Minute-by-minute episode breakdown
2 | FBI Agents Entrance To Crypto By Using It To Investigate Darknet Markets
5 | Exploring the Murder-For-Hire Case of Ron Ilg
8 | Introduction of the Virtual Currency Response (VCR) Team
12 | Major Breakthrough in Case When Reconstituting Crypto Wallets
17 | Connecting Intelligence From Exchanges and Bitcoin ATMs
22 | Main Accelerants in the Case That Drove Huge Results
25 | Finding the Seed Phrase Safe at Ron’s House Changed Dynamic of Case
29 | Challenges and Hurdles That Arose During the Investigation
33 | The FBI Leverages Previous Murder-For-Hire Case in Investigation
35 | Analyzing Ron Ilg’s Plea Deal and Sentencing
37 | The Biggest Takeaways for the FBI in this Crypto Investigation
Related resources
Check out more resources provided by Chainalysis that perfectly complement this episode of the Public Key.
- Website: Mission First: To protect the American people and uphold the Constitution of the U.S.
- Press Release: Former Spokane Neonatologist Pleads Guilty in Plot to Hire Multiple Hitmen to Kidnap His Estranged Wife and Assault a Former Colleague
- Report Online Scams: Internet Crime Complaint Center (IC3) is the central hub for reporting cyber-enabled crime.
- Blog: The 2025 Geography of Crypto Report (Download Now!)
- Blog: DOJ Seizes $15 Billion in Bitcoin as U.S. and U.K. Target Massive Southeast Asian Crypto Scam Network
- Blog: How Coinbase’s Proactive Fentanyl Investigation Sprint Disrupted Criminal Networks with Chainalysis Intelligence
- YouTube: Chainalysis YouTube page
- Twitter: Chainalysis Twitter: Building trust in blockchain
Speakers on today’s episode
- Beth Bisbee (Director Product Strategy, Chainalysis Government Solutions)
- Supervisory Special Agent (SSA), Federal Bureau of Investigation (FBI))
- Special Agent (SA), Federal Bureau of Investigation (FBI))
- Forensic Analyst, Federal Bureau of Investigation (FBI))
This website may contain links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
Our podcasts are for informational purposes only, and are not intended to provide legal, tax, financial, or investment advice. Listeners should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with your use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in any particular podcast and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
Unless stated otherwise, reference to any specific product or entity does not constitute an endorsement or recommendation by Chainalysis. The views expressed by guests are their own and their appearance on the program does not imply an endorsement of them or any entity they represent. Views and opinions expressed by Chainalysis employees are those of the employees and do not necessarily reflect the views of the company.
Transcript
Beth
Welcome everyone to the chain analysis podcast. I am Beth Bisbee, and I’m the Director of Product Strategy with chain analysis, Government Solutions. I’m really excited to be able to have a discussion on a really interesting case that was led by the Federal Bureau of Investigation and a team related to something that’s pretty juicy for many people, and it’s considered to be a murder for hire, and I am joined by the Supervisory Special Agent, the special agent and the forensic analyst that supported the investigation. And so what I would like to do is be able to introduce these folks and let them come in and describe what their background is, in order to get them to where they were to start investigating this case. So starting off with that, I would like to be able to hear the background of the Supervisory Special Agent.
Supervisory Special Agent
Hello, I’ve been with the FBI as an agent for just over 21 years. A lot of that time has been investigating complex financial crimes and other white collar crimes such as public corruption and civil rights matters, been in various field offices with the FBI. Prior to the FBI, I worked in public accounting and was licensed as a CPA, perfect.
Beth
Thank you so much for joining and now to the special agent.
Special Agent
Got a similar background to the supervisor here investigate a variety of crimes, including financial and cyber criminal cases. And how long have the two of you been working together? Eight or nine years? Yeah, yeah, about nine years. Perfect. And now introducing the forensic analyst.
Forensic Analyst
Yes, I’m the forensic analyst. I’ve been with the Bureau since 2016 and almost immediately began working complex financial crimes well as cyber investigations, including ransomware, counter terrorism, initial access brokers, crimes against children, drug cases, you name it, anything that had a financial component. I was in charge of conducting the financial analysis for the cases. And prior to joining the bureau, I was a CPA in public accounting for about five years.
Beth
Very impressive background. And how long have you been working with the Supervisory Special Agent and Special Agent,
Forensic Analyst
Since the summer of 2021 when this case began?
Beth
That leads into describing what your journey was before we actually jump into the case. So can each one of you walk through what you all did in becoming familiar with cryptocurrency within investigations. And we’ll go ahead and start with the Supervisory Special Agent. So back in 2014
Supervisory Special Agent
we began working in undercover investigation on the dark web, buying and selling the illicit goods. And as part of those investigations, we used cryptocurrency to buy and sell. And so that was probably my first experience with cryptocurrency. And then, of course, as the years went on, more and more of our investigations involved cryptocurrency, where a victim was asked to take money from their account and convert it to Bitcoin, or in some way sending cryptocurrency to the subject of the investigation. So you really had a background of being able to handle cryptocurrency and engage in an undercover capacity. Correct? Yes, more of using it rather than tracing it early on, but it evolved into more of a tracing function as the years went on and we saw more cases using cryptocurrency.
Beth
And how about for the special agent
Special Agent
I wasn’t as heavily involved in the undercover operation that supervisor spoke about, but I did assist on it, and so I had a general familiarity with Bitcoin and blockchain and had some general trainings. But there’s really this case where I working with the virtual currency response team that I gained a lot more knowledge about cryptocurrency.
Beth
So we’ll follow up with the virtual currency response team in just a second. But from the forensic analyst view, when did you become familiar with cryptocurrency within investigations?
Forensic Analyst
So I became familiar with it in early 2016 when I went to the FBI training academy, and we were given training on cryptocurrency. Mainly it was Bitcoin, and there weren’t any case studies back in 2016 when I went through the academy, but it was mainly focused on conceptual components, and so after attending the Academy, I came back to my home office and began to research Bitcoin on my own. There wasn’t a lot of training available back then, but I began to get my own wallet, read articles, watch documentaries, buy textbooks and just start to familiarize myself. And that segued into going through our databases and finding potential cases to open near my home office. So I looked for victims that were near our office or in our area of responsibility, and I went to my supervisor and asked if we could open up one of these cases, and that was 2016 and we began to investigate those types of cases. And these were primarily white collar cases back then, like scams or tech support scams and frauds, or in Ponzi schemes involving cryptocurrency. And that’s how I began investigating it. I went and sought out those cases to try to learn this from an investor. A gate of point of view.
Beth
So really a dynamic sense of experience across this team. So can you guys start walking through of how did you become involved with this interesting case of the murder for hire?
Supervisory Special Agent
Yes. So there was a day in April 2021 where we received a call, a communication from a local attorney in Spokane, Washington, and he had a client that was going through a divorce, and that client had been contacted by a news agency with information that someone had attempted to hire a hit man on the dark web to kidnap and assault her. As we got more information, she was currently going through a divorce and a bitter custody dispute, and this news agency had an anonymous informant or source that was providing information to them. They weren’t willing to give us that the identity of that source, and so just really, from the outset, there were a lot of things that make this claim not very credible, given that there was a lot of incentive, or, you know, one of the parties that’s in the middle of this legal battle to make up horrible things about somebody else. There was an anonymous source, and then there was the underlying story itself, that somebody’s, you know, hiring a hit man on the dark web to kidnap and assault this woman for the purpose of getting her to return to her husband. And so you put all those things together, and it’s kind of a unique story that that doesn’t make a lot of sense, and may not be very believable, but we need to kind of run all things to ground. And so I assigned this tip or this complaint to a special agent here in the office, and so he was able to run with it, and very early on, you know, made the determination that there, there might be something there.
Beth
The special agent that became involved, what was the first thing that you did once you received this tip?
Special Agent
Yeah, when the supervisor signed the complaint to me, we both thought it was kind of a wild allegation initially, but we see if any pieces of it are true, and so through a variety of means, we’re able to eventually make contact with the journalists who had contacted the attorney’s client about this supposed hit on her, and were able to, through some kind of open source research, determine that, you know, that there was a journalist associated with a major news outlet with this name, and he had an email tied to that. And then I was also able, through the FBI, to determine that there was a similar case that this journalist had kind of given a heads up on out of Wisconsin where there was a murder for hire. Just in this case, ours wasn’t a murder for hire. It was a kidnap for hire and then an unrelated also assault for hire a couple months prior to that, but we hadn’t seen anything like this before, where someone was trying to have someone kidnapped, then addicted to drugs and blackmailed and then encouraged to have sex with their ex when they returned to them. So it was rather unusual and kind of wild allegations.
Beth
So from the aspect of receiving the tip and then running some of that down with the reporter that ended up being able to provide some of the information, what did you end up doing? From an investigative lens for the blockchain,
Special Agent
once you realized there was cryptocurrency involved, I immediately reached out to a couple of people that I knew had a bit more knowledge about it. As I said before, I was generally familiar with it, but we didn’t have any experts in the field. And it wasn’t like it is now, where there’s multiple people with chain analysis licenses and field offices. And so that was the initial contact with the virtual currency response team. And we got some good assistance there to identify the exchanges we needed to get records from. And then eventually our first contact actually left the bureau. And then we got the team member from the response team that is on the call right now.
Beth
Let’s dive into a little bit of background with the virtual currency Response Team. And this, I think, falls into how the forensic analyst became involved. So if the forensic analyst isn’t mine, giving an overview of what that actually is and how the Bureau has been able to actually grow that program to what it is to be able to help with these types of investigations.
Forensic Analyst
The virtual currency response team as and we refer to it as the vcrt is a group of many individuals inside the FBI across many different field offices that hold cryptocurrency expertise. So you know, we have some centralized components of cryptocurrency knowledge at FBI Headquarters, but the virtual currency response team is decentralized across the United States for the FBI, and what that team does is lend assistance to each other. So if there is, say, a case in Los Angeles that they need specific cryptocurrency expertise on a specific, complicated matter dealing with cryptocurrency, then they might reach out to the vcrt member, who’s in Miami, Florida, that has expertise there. So it’s a way to leverage the Bureau’s cryptocurrency experts to help each other on investigation. So that’s really what it is, and it’s not a full time job. Usually it is a added duty where you assist the other offices through the vcrt. So the.Not like there are full time vcrt members in these different offices. So that’s generally how the vcrt works. And the vcrt was founded just before I got the call for this case, which was about the summer of 2021 s
Beth
o when you became involved in the case in summer of 2021 how was it that one you were able to get up to speed with everything that the Supervisory Special Agent and the special agent knew, but then also to be able to expand the investigation with what you’re able to use with your expertise.
Forensic Analyst
This case is actually really unique, because the special agent and supervisory special agent had already done incredible work in the short time from when they started the case to when I got involved. And that’s not what’s unique is what’s unique is that they already had the suspect identified through what the special agent was discussing, the tip that came through from the news agency, and all of that. So normally, in cases that I get brought on to I’m focused on finding the ghost, finding the people that are hiding behind crypto currency transactions, and I get brought in to find who those people are. But in this situation, the agents had already done fantastic work, and they already had the guy identified. So this was a change of pace. And so initially, the agents gave me the a couple of Bitcoin addresses that were involved. They gave me the Hitman payment addresses that they use to receive the payment, and therefore I could back into the payments made by our suspect. And so that is where I started the analysis from there.
Beth
So from the perspective of the Special Agent bringing in somebody that not necessarily in your field office, like a secondary member, if you will, how was being able to work with the Forensic analysts to be able to expand the case. What was your experience within that?
Special Agent
It was great Bureau as large as it is. You know, we do work with people on their field offices across the country. And then also coming out of covid, I think people have gotten a little more used to some virtual work. So him not being in our actual office in Spokane wasn’t an issue.
Beth
So what were some of the things that really broke open the case after the three of you were able to work together and collaborate and actually build out the investigation through the crypto angle?
Special Agent
If there were few milestones I recalled, and I think the first big one was it was a Sunday and it was when Ill was flying back into the country from Mexico, and so our entire office pitched in to both approach him at the airport for an interview, while at the same time execute a search warrant at his house and interview some other folks who were involved that day. And everything yielded fruitful results, and then the most useful was then at the search horn in the house, we recovered ilk’s username and password for the Hitman site, and then also seed phrase for a wallet. And those things combined, got us great evidence, because we were able to directly recover some of his messages to the Hitman site, and then also the vcrt member was then able to reconstitute that wallet, which helped put everything together on the crypto side,
Beth
was there anything specific with the reconstitution of the wallet, whether that day or the next day or later on in the investigation, that were really pivotal in being able to expand the investigation?
Special Agent
I would leave that to the VCR team member to explain further. I mean, I would just say having him on board with those pieces of evidence was able to accelerate things, as opposed to us stall out trying to figure it out. And then his eventual final report on the Bitcoin analysis was a huge piece of getting this case to a plea agreement. I think he was able to attribute more than 99% of the deposits to ILB that were in the Bitcoin wallet that made the payments to the Hitman site.
Beth
So from the forensic analyst perspective, can you walk through what that was and piecing all of that together that then ultimately went into the report that you presented?
Forensic Analyst
So this happened in multiple phases. So before I was provided the seed phrase. I had done blockchain analysis of the Hitman payments. So ultimately, we identified five payments made by our subject to the hitman, and those were all in Bitcoin. And I was able to analyze those payments and use, you know, co spending, change address analysis techniques like that, to build out the wallet based on on chain analysis. So this is without the seed phrase, and I had built out most of the wallet and identified most of the five payments came from this wallet that I built out on chain. However, once we got the seed phrase and reconstituted the wallet, it was a massive improvement, and so I actually had to reconstitute the wallet twice, because the first time we reconstituted it in 2021 the tools to use for this type of reconstitution were not nearly as good as they are now. So back in 2021 when we were trying to reconstitute the wallet without necessarily creating our own wallet, but finding the addresses derived from.These seed phrases, or from the seed phrase, we were able to get additional addresses clustered within that same wallet that I had built out. So my initial analysis, from blockchain analysis, produced a set of addresses, and the first reconstitution of the wallet produced even more addresses clustered in that same wallet. And then finally, I think was in 2022 is when we reconstituted the wallet again with better tools, and that produced even more addresses. And all of that combined, you know, all of those addresses combined that we could prove were under ills control, because we found those in a seed phrase in his house, we were able to attribute all five Hitman payments to his wallet that was the first phase of it is to understand his unhosted wallet, or private wallet that we reconstituted from the seed phrase, did in fact, make all five payments. And then the next step was to identify, can we prove? How did he source these payments? Walking through how to be able to map with the five known payments that was also done leveraging the access of the username and password of the dark web platform. Is that correct? Correct?
Beth
There’s like a mix of investigative tactics that are being leveraged, right? So from the Supervisory Special Agent background of being able to conduct undercover payments, you kind of understand how that operation works, but then also being able to then begin tracing it, to build out the case, to then lead into the recovery of the wallet, within being able to understand where they were able to actually access the crypto. So meaning taking the Fiat or cash and converting it into crypto to make these payments. What were some of the things that you were able to identify?
Supervisory Special Agent
Well, I think that some of the things we were able to identify, you know, early on in the investigation, through some very reputable cryptocurrency exchanges, we were able to get information from them that directly tied to Ron Hill, specifically name, date of birth, social security number, his phone number that was used for two factor authentication, a selfie that he had taken and sent into the exchange. That kind of information was really powerful in tying Ron ill to the person who was behind the keyboard trying to order up his Hitman service. And then, as as it went on, each of the other sources that included Bitcoin ATMs, you know, they’re taking photos of the individual standing in front of that ATM. And so, you know, along with the forensic analyst, we’re looking at the sources of funding for this wallet. It all came back to essentially Ron Elks picture, either from a bitcoin exchange or from him standing in front of a Bitcoin ATM. And so that was really powerful evidence that the forensic analyst put together in a very straightforward chart that made a very complicated subject become understandable if this were to go to a trial and be viewed by a jury.
Beth
So that leads to an also interesting topic is, how were you all able to relay this complex investigation to a prosecutor in order for them to be able to take it forward, and what was some of the most challenging things that you encountered when trying to piece together that story that simplified it?
Forensic Analyst
Our VCR team member here did a great job of explaining in layman’s terms how some of these things worked. It’s one of the more things that could have made it more complicated was Brent did try to use a mixer, and then didn’t really use it properly, but our VCR team member was all over that, and was able to identify his cryptocurrency going in and out of this to continue tracing it.
Special Agent
Yeah, and I would add a couple of things. One of the ways that I was taught through the academy and just going through trials and other prosecutions was to make a timeline. Juries will make timelines, and we can either give them a timeline from the facts, or they can create their own. And that approach and mentality, I think, has served many people well. So I decided to make a timeline for this case. So I started, and it’s a very visual timeline. I began the timeline when he made his first Bitcoin purchase through his Exchange account, and then just had little bubbles along that timeline to show exactly when was he purchasing. When did he exchange messages on the dark web with these hit men, and then when did he make the payment to them? And what’s interesting is along the way, we had great real world corroborating evidence. And what I mean by real world is sometimes when things happen on the blockchain. It’s hard to convey that in a real world layman’s terms, but when we have Ron ilk messaging the hitman, saying, Hey, I’ve got $40,000 of Bitcoin in my wallet, I’m ready to send this to you, and we have the timestamp of that message, well then we can go and look at the blockchain, and look at his wallet that we were tracking on the blockchain and see that he did, in fact, have $40,000 at that date and time. And so that’s real world evidence that corroborates what we see on the blockchain. So I think that was really important, the timeline and these little points in time, and also analogies and.Analogies have been really helpful when explaining this to not just prosecutors, but also to juries and judges, whether it’s an affidavits, but analogies have proven to be very helpful to explain cryptocurrency transactions to people who might not be as involved in them in a daily sense.
Beth
Do you happen to have any of the analogies that you leveraged in order to convey this to the prosecutor or even the rest of the investigative team.
Special Agent
The most common analogy we use when we deal with CO spending and change is an example of going into like a coffee shop. So you know, you go into a coffee shop and you have five $1 bills in your wallet, but you you don’t have your credit card, you just have five $1 bills and you want to buy a cup of coffee for $3 well, you would hand over three of the $1 bills to the cashier, and that’s called co spending, because those three $1 bills are under your control, and you are spending them all together in order to make an output. So in that situation, if you take three $1 bills and pay for your $3 cup of coffee, then you don’t get any change back. That’s just a one for one. So that’s co spending. And if we want to take it a step further and discuss what change is like on the blockchain, so like when Ron ilk made a payment to the hitman, he received change for into his bitcoin wallet. And so that’s like walking into a coffee shop with a $5 bill. You don’t have any $1 bills, but you walk into a coffee shop with a $5 bill, you hand it to the cashier, and they give you your cup of coffee and $2 back. So those $2 you get back that is changed from the transaction. And so that’s one of the most basic analogies we use when trying to explain how Bitcoin works, how it co spends, how change addresses occur, and how we can piece together who owns specific addresses in the same wallet. I don’t think I’ll ever walk into a coffee shop the same way now with that visual.
Beth
Thank you. So one of the things that I am curious about as we know that investigations ebb and flow. And sometimes there’s things that accelerate it, and then there are things that stall. Were there certain instances in this investigation where it accelerated? And then, likewise, when did it seem to stall? If ever?
Supervisory Special Agent
Well, I think one of the things that accelerated the investigation when we, you know, we got the initial complaint, and over the course of about a week, began to verify some of the information we were provided. And Ron el at this time, was in Mexico on vacation, but was coming back to the Spokane on Sunday night. And so that was an accelerating moment in that we felt like we needed to act. Because we, at that point, had had determined that this was a legitimate threat, that there was a legitimate possibility that somebody was going to be injured here. And so on that Sunday night, we needed to be prepared to act at the airport to approach and interview Ron yelg. We needed to be ready with a search warrant at his residence to look for evidence of the crime there. And so that was one of the times that we, you know, we felt like we needed to move pretty quickly.
Beth
What about from the special agent or the forensic analyst perspective?
Special Agent
I think what he said is exactly true. If there was anything that stalled, or that may have been Ron il suicide attempt shortly after the search warrant that kind of bought us some time to get a complaint written to arrest him as he was released from the hospital, but otherwise, the VCR team members final report, I think that may have been another accelerator towards a plea. Otherwise, you know, this case potentially could have stalled out with negotiations, trying to come to a resolution and could have gone to trial.
Forensic Analyst
The accelerant on my side, even though I was not involved really at all, with what the special agent and supervisor Special Agent are talking about when they were at the airport and when they were doing a search warrant at his house. I wasn’t involved in that. So everything that I was doing was, you know, after the fact, but I think an accelerant was when I obtained the seed phrase that really accelerated the analysis, the blockchain analysis, and then this when we reconstituted the wallet for a second time and captured all of the addresses that was an accelerant, because at that point we had strong, strong evidence pointing to Ron ILGA is making all of those payments. So I think that accelerated the writing of the report that I wrote for the team and the defense. And from my point of view, that was probably the accelerant. But really it was, after all, the fast action that happened at the very beginning of this case.
Beth
So going back to what may have stalled the case just a little bit was the probably surprise to maybe the investigative team of the suicide attempt, in terms of, like, the stall for that, it basically allowed you to kind of slow down a little bit to be able to piece together the rest of the evidence that you may have either not been able to tighten up as much, but then also look for other ways to be able to tighten up some of the evidence. Would that be an accurate statement
Special Agent
to some degree? Yes, I think it is less likely that he was going to be able to secure someone else to carry out any sort of hit if he was in a hospital bed. So that was.Is good for our victims to not have to worry about him following them out on the street before we could arrest him. So talking about the accelerating aspect, so being able to identify the recovery seat, that’s an exciting thing.
Beth
Can you walk me through how you were actually able to get access to the recovery seat and where it may have been located, or what information may have been provided by the individual.
Supervisory Special Agent
Yes, so I was part of the team that was interviewing Brent ILG at the airport, and while we were communicating with him, I was also in communication with the search team at his house. And so as we were nearing the end of our interview and our search of his luggage, the team at the airport indicated that they were basically done, but there was a couple of safes that they needed to open and search. And so they asked if he would be willing to provide the combination to get in the safes. And so when I asked him, he said, Well, it’s biometric. It opens with my fingerprint. And I said, Well, we would be happy to give you a ride to your house if you’d like, if you’re willing to open those for us. And he said that he would do that. And so we drove him out. And soon after that, we arrived at his house, and he put his thumb print on the safe, and it opened up, and inside the safe were some things that you would expect to find in a safe. There was there was some cash, and there was a handgun, and there was a sticky note that included what appeared to be a username and password, and these 12 random words that turned out to be the seed phrase when the safe opened. Did he have any acknowledgement of what was discovered in there, or that he may have forgotten within a safe, because sometimes people may not access the safe on a regular basis. Was there any surprise from him? Yeah, his demeanor changed at that point. You know, all during the interview and car ride home, you know, he made it clear he was the smartest person in the room, and when he saw that safe open and we pulled out the sticky note that Demeter changed, you know, the look on his face dropped a bit, and there seemed to be an acknowledgement by him that he was in a lot of trouble. Now,
Beth
sometimes those are the most priceless acknowledgements, right? When working this investigation, in general, like most complex investigations, take a village, and we’ve walked through the support that the bureau provided with the virtual currency Response Team. But then, were there other partnerships that you guys leveraged in order to help build a strong foundation for the investigation?
Special Agent
Our task force officers, which are from a variety of agencies for our Safe Streets. At the time, they were great partners, because that Sunday where Bill was approached at the airport and the search was at his house, that required everyone here to pitch in those initial days, and everyone went out on a Sunday to either go to the airport to interview people or to go to his house to search. And without that manpower, I don’t know if we would have been able to do that as quickly and successfully as it was.
Supervisory Special Agent
Maybe the other thing I would add, you know, and obviously our virtual currency Response Team, you know, is here on the call. So they’re obviously a key partner, and did a great job. The other partners that I would add here would be the prosecutors at the United States Attorney’s Office, you know, really, from day one, they were very much involved in this case and aggressive. And you know, whatever it was we needed as far as legal process, they were ready to provide it. And so they have been great partners through this whole investigation, the prosecution
Beth
, in terms of any of the technical or investigative hurdles that this team encountered, what were some of the most difficult ones that you recall.
Special Agent
Think one aspect of this case was that, at least in my opinion, Ill was a manipulative psychopath. And so up until he was sentenced from his jail cell, he was continuously trying to manipulate people to either do things for him or change the narrative his case. He did try reaching out to a victim a couple times, either directly or through other means, and so that was a constant thing of monitoring what he was trying to do and staying on top of that,
Forensic Analyst
I would add, from the cryptocurrency point of view, OBS use of mixers was initially a technical hurdle. However, the way he used them made it a lot easier for us to quickly overcome that hurdle. And something I think is really key here is when the agents found the seed phrase, they found that seed phrase in three different locations, and one of them was on his phone in the safe in his house, and then the third one was in a book. It was written down in a book that they found in his luggage coming back from Mexico. And the fact that they flipped through all those pages to find these 12 random words on a page inside a pretty full book was really impressive. And so I think that really made a lot of things easier. And so I want to make sure they get kudos for that attention to detail, but I think for technical hurdles, you know, Ill really just used exchanges and Bitcoin ATMs to fund the unhosted wallet. We have the seed phrase for that unhosted wallet which he then directly paid the hitman. So for blockchain analysis, it was not very difficult, but the mixer would have been the biggest technical hurdle from the beginning.
Supervisory Special Agent
And maybe I just add one thing as a teaching point, forensic anneal has just talked about the attention to detail and finding these seed phrase in three different locations that.True. Eventually, the first time we recognized that we had found the seed phrase was in that sticky note in his safe at his house, later, as we were reviewing his phone, we found it again there in his phone. We also found a picture of the handwritten seed phrase in a book, and that’s when we recognized that we had seen that book before, which was in his luggage as he was coming back from Mexico. So that prompted another search warrant to go back and retrieve that book. And so I mentioned that really as a teaching point, that you know these 12 random words could look like anything. It could be anywhere, even written in the back cover of a book that you may not think anything about
Beth
so interesting that you mentioned that as well, because you also mentioned that you saw a picture of the 12 words in a book, so he also had a picture on his phone of the book with the 12 word seed phrase, yes, so really four locations, then, right? That’s pretty wild in the nature of this case. As like, it’s very prominent to be able to be Hitman for hire. There’s a sense of this to be like, headline catching. So how did you guys work on, like, the high profile nature of this case, as well as the individual? He was a pretty high profile individual as well, correct?
Supervisory Special Agent
He was a fairly prominent physician in the area. He was a neonatologist, and so he was fairly wealthy in the sense of, you know, being a successful physician, you know. And so it did get some local media attention, some national, even some international, because of the source of the initial reporting was an international news agency. And so there was some of that, but it didn’t really affect our investigation, because we still had the same elements that we needed to prove that he had committed the crime, and we just went about our activity, and he tried to make it about himself and about his lifestyle, and try to create that distraction, both in the media as well as in court, and fortunately, in court where it matters, nobody was really fooled about why we were really there. We weren’t going after him because of his lifestyle. We were investigating and prosecuting him because of the crimes he had committed.
Beth
So typically, when in investigations, you draw from previous experiences, and that helps build foundations to investigations and then also lessons learned. Had any of you worked a hitman for hire investigation prior to this one,
Special Agent
there was a hitman for hire here in Spokane, maybe six, seven years earlier. It did not involve the dark web or cryptocurrency. I assisted with the trial that was not involved in the case, but the supervisor, you probably have a bit more involvement in
Supervisory Special Agent
that one. Yeah, that was, you know, different in some ways, but similar in that involved a hit man for hire. We ultimately indicted six people in that conspiracy that included the ringleader that you know, ordered the hits, as well as the man, the individual who committed the two killings, one in North Dakota and one in Spokane, and then four others that were involved in the conspiracy to cover it up or conceal evidence, or things like that.
Beth
From the perspective of that investigation to this one, what were some of the strong parallels that you were able to then leverage from what you learned on the first case to what you saw within this one.
Supervisory Special Agent
I think one of the parallels was the high level of motivation in the earlier case that involved two people that were actually killed. There were multiple attempts to have those people killed, and those attempts continued until the main subject was successful in getting his desire. And we saw that same thing with Ron ilk. He approached one hit man on the dark web, realized at some point that he had been scammed after he’d sent Bitcoin, and he was just being scammed, and he continued to look and send money to people in an effort to get a former business partner assaulted and her hands broken, and to get his estranged wife kidnapped and drugged and assaulted, and it was clear he was not going to stop until he got what he wanted. And so I think for me, that’s the most similar circumstances of those two cases, is they were going to go until they got what they wanted, and Ron elk had the financial resources to make it happen.
Beth
So do you also feel that that was one of the reasons, the initial part of being able to apprehend him when he came back from Mexico, and the urgency for that, just because of the desire and urgency on their end to try to solidify and motivate them to finish the job,
Supervisory Special Agent
I think that was part of it, although we may not have known at that time of his multiple attempts, but because of the forensic analyst’s great work, we could see later on his multiple attempts. You know, as the case went on, we better understood his personality and really the lengths he was willing to go to have these people assaulted.
Beth
I know that we’ve mentioned it a couple of times that there was a plea. Can you walk through what the outcome of the case was ultimately.
Special Agent
The ultimate outcome was he pled to arranging. The judge sentenced him to eight years imprisonment, $100,000fine, an additional $25,000 restitution to the victims, and in terms of leading up for understanding whether it was going to be.A plea or a trial? What was it leaning towards? Were you expecting it to go to trial just based off of his personality, or were you expecting more of the negotiation for the plea? We knew we had a very strong case, but we also had a very interesting personality in Dr Ilg, who also had the financial means to go to trial with expensive attorneys that he so choose to do. Thankfully, I think his attorneys realized that after they lost a number of motions pre trial in court, that they didn’t have any more bags of tricks that they could try and pull, they were able to convince him that a plea was in his best interest. And I think he did get a very fair deal. And then that’s how we came to the plea, from the aspect of the investigation, looking forward to other investigations that you’re either currently supporting or will be supporting.
Beth
What are some of the things that you taken from this investigation to then apply to future investigations? And this is open to all
Special Agent
thing investigation, particularly since it was one of the first where cryptocurrency was intricately involved, I’d say, as soon as you recognize that cryptocurrency or something on the blockchain is going to be a significant part of your case. If you’re not one of the experts, don’t hesitate to reach out to the virtual currency response team or one of the other many assets that are in field offices. Now
Supervisory Special Agent
I think one of the things I would think I learned in this process that I have applied to other cases is is just because a case involves cryptocurrency doesn’t mean can’t solve it. Fact, there’s so much about cryptocurrency and the way that it works that it can help to identify people. It can help to identify where ill gotten gains have been transferred. And so, you know, especially exchanges in the United States, they have all the information that a bank would have on who these customers are. And so what we’ve also found is, outside the United States, where our legal process, they’re not required to produce information, they’re still often willing to give over that information, because there’s a push to maybe destigmatize cryptocurrency that it’s not always used for criminal activity. And so we can often get information from exchanges throughout the world.
Forensic Analyst
I had numerous takeaways from this investigation that I have applied to many other investigations, and the first thing is to keep it simple, and is it, can I tell the story with the financials? Because at the end of the day, the ultimate audience is the jury at trial, and can I explain it to them with analogies to help them? Since they don’t they probably don’t have the time to do deep dives on cryptocurrency and blockchain analysis in their free time. So can I keep it simple and tell tell the story of the financial activity? Number two, it really taught me how to use analogies when working with prosecutors and when drafting my long report that detailed every single transaction that ilk had made to the hit men and explain basic concepts, you know, like we talked about, the Bitcoin Blockchain, co spending change what a seed phrase is, what private keys are. How do private keys come from seed phrases, all of that stuff. And then the last thing that I took away was the importance of real world corroboration of the evidence, like I talked about earlier. So if not for the agents paying such close attention to the details on gathering evidence, my analysis would not have been as strong. So it really is that team effort of gathering real world evidence, mixing that with the blockchain analysis to make a really compelling story at trial. So that those are the main takeaways that I had.
Beth
Sounds like all three of you had great takeaways from this investigation. So finally, what I would like to be able to kind of drive home is, was there a moment in or story from this investigation that stuck with you, whether it’s a breakthrough in near miss or something that defines the human side of this work that makes you want to pursue additional cases. There are so many of those moments from this case,
Supervisory Special Agent
I guess I’ll try to just pick one. The reason that I have made a career of this is because there are people out there. It could be a neighbor, it could be a grandparent, it could be, you know, a friend that has become a victim of a crime. And in this case, we had two direct victims, and then other people who were victimized by this man, and so what was powerful to me was to sit next to these victims, surrounded by their family in a courtroom as this man was being sentenced for his crimes, and the relief that they felt and the gratitude they felt For the investigative team was very memorable for me, and ultimately that’s the reason we do what we do is to protect victims and hold people accountable so that there are no victims in the future.
Special Agent
I was going to say something very similar. What stood out to me was sentencing, hearing the victim statements from three different individuals really drove it home that folks threats were very real to these individuals, having him locked up from some degree of closure and safety to a fearful and challenging time in their life,
Forensic Analyst
I would say something almost completely identical, that the sentencing when the victims spoke, and how much that affected me and seeing the effect of our work play out to bring them justice was really crucial.
Beth
Finally, with that, if a person does, be.Become a victim or know someone who is what can they do?
Supervisory Special Agent
Well, they can contact their local field office, submit a tip [email protected] tips.fbi.govif the crime involved an online component, they should report that to the Internet Crimes Complaint Center, and to do that, they would go to IC three.gov and report the information there. Those would be the three main areas is, you know, the contact the Field Office reported online at FBI or at IC three.
Beth
Thank you. And I want to personally thank the Supervisory Special Agent, the special agent and the forensic analyst on walking us through the important investigation and impactful investigation. Thank you so much.
Special Agent
Thank you. Thank you. Thanks.