Samourai Wallet crypto mixer’s co-founders sentenced to prison

The two co-founders of cryptocurrency mixing service Samourai Wallet will each spend about a half-decade in prison after pleading guilty to knowingly handling more than $237 million in illegal transactions through the platform.

U.S. prosecutors on Thursday announced the sentencings in New York of Keonne Rodriguez and William Lonergan Hill. The pair had pleaded guilty in late July to participating in a conspiracy “to operate a money transmitting business in which they knowingly transmitted criminal proceeds.”

Samourai Wallet handled funds from “drug trafficking, darknet marketplaces, cyber-intrusions, frauds, sanctioned jurisdictions, murder-for-hire schemes, and a child pornography website,” prosecutors said Thursday.

Rodriguez, 37, and Hill, 67, were sentenced to four years and five years in prison, respectively. They forfeited more than $6.3 million to authorities, representing the fees Samourai Wallet earned for the illegal transactions, prosecutors said. Both also were sentenced to three years of supervised release and ordered to pay fines of $250,000.

Their arrests were announced in April 2024, with the Department of Justice (DOJ) reporting that Samourai’s domain and servers were seized with the help of authorities in Iceland. Rodriguez was arrested in the U.S., and Hill was detained in Portugal and later extradited.

Founded in 2015, Samourai Wallet was oriented around two features: “Whirlpool,” which mixed bitcoin among Samourai users, and “Ricochet,” which enabled users to “introduce additional and unnecessary intermediate transactions — known as ‘hops’ — between sending and receiving addresses,” prosecutors said.

Rodriguez and Hill “actively promoted Samourai to criminal users and encouraged criminal activity,” prosecutors said, citing activity on dark web markets, messaging services and public social media.

The $237 million directly tied to illicit activity by prosecutors represents just a fraction of Samourai’s overall cryptocurrency transactions.

“[F]rom Ricochet’s launch in 2017 and Whirlpool’s inception in 2019, more than 80,000 Bitcoin—valued at over $2 billion at the time—passed through these services,” the DOJ said.

Recent actions against cryptocurrency mixers include the seizure of the eXch platform in May by German police, the arrests in December 2024 of Russian nationals accused of running the Blender and Sinbad services, and the sentencing of an Ohio man in November 2024 for running the Helix mixer.

Operators of the cryptocurrency mixer Tornado Cash continue to face pressure from international law enforcement. Co-founder Roman Storm was convicted in August of conspiring to operate an unlicensed money-transmitting business.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Joe Warminsky

Joe Warminsky

is the news editor for Recorded Future News. He has three decades of experience as an editor and writer in the Washington, D.C., area. He previously he helped lead CyberScoop for more than five years. Prior to that, he was a digital editor at WAMU 88.5, the NPR affiliate in Washington, and he spent more than a decade editing coverage of Congress for CQ Roll Call.

 

Total
0
Shares
Previous Post

Russia blacklists S.T.A.L.K.E.R. game developer, accusing it of aiding Ukraine’s war effort

Next Post

Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows

Related Posts

GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs

Cybersecurity researchers have disclosed a new set of three extensions associated with the GlassWorm campaign, indicating continued attempts on part of threat actors to target the Visual Studio Code (VS Code) ecosystem. The extensions in question, which are still available for download, are listed below - ai-driven-dev.ai-driven-dev (3,402 downloads) adhamu.history-in-sublime-merge (4,057
Read More

Why Organizations Are Abandoning Static Secrets for Managed Identities

As machine identities explode across cloud environments, enterprises report dramatic productivity gains from eliminating static credentials. And only legacy systems remain the weak link. For decades, organizations have relied on static secrets, such as API keys, passwords, and tokens, as unique identifiers for workloads. While this approach provides clear traceability, it creates what security
Read More

India Orders Phone Makers to Pre-Install Government App to Tackle Telecom Fraud

India's telecommunications ministry has ordered major mobile device manufacturers to preload a government-backed cybersecurity app named Sanchar Saathi on all new phones within 90 days. According to a report from Reuters, the app cannot be deleted or disabled from users' devices. Sanchar Saathi, available on the web and via mobile apps for Android and iOS, allows users to report suspected fraud,
Read More