Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 1 of 20

Approved: _________________________________
MATTHEW PODOLSKY/ANDREW THOMAS
Assistant United States Attorneys

Before: THE HONORABLE SARAH NETBURN

United States Magistrate Judge

21 MAG 2220
Southern District of New York

- - - - - - - - - - - - - - - x
:
UNITED STATES OF AMERICA : SEALED COMPLAINT
:
v. : Violations of
: 18 U.S.C. §§ 1348, 1349, &
APOSTOLOS TROVIAS, : 2
a/k/a “The Bull,” :
: COUNTY OF OFFENSE:
Defendant. : NEW YORK
:
- - - - - - - - - - - - - - - x

SOUTHERN DISTRICT OF NEW YORK, ss.:

ROBERT HUPCHER, being duly sworn, deposes and says that he

is a Special Agent with the Federal Bureau of Investigation
(“FBI”) and charges as follows:

COUNT ONE
(Securities Fraud)
1. From in or about December 2016, up to and including at
least in or about August 2020, in the Southern District of New
York and elsewhere, APOSTOLOS TROVIAS, a/k/a “The Bull,” the
defendant, knowingly and intentionally executed, and attempted
to execute, a scheme and artifice to (a) defraud persons in
connection with securities of an issuer with a class of
securities registered under Section 12 of the Securities
Exchange Act of 1934 and that was required to file reports under
Section 15(d) of the Securities Exchange Act of 1934, and (b)
obtain, by means of false and fraudulent pretenses,
representations, and promises, money and property in connection
with the purchase and sale of securities of an issuer with a
class of securities registered under Section 12 of the
Securities Exchange Act of 1934 and that was required to file
reports under Section 15(d) of the Securities Exchange Act of
1934, to wit, TROVIAS defrauded and attempted to defraud
securities issuers by misappropriating confidential business
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 2 of 20

information which he then converted to his own use by selling it

on the Dark Web with the intention that others would trade on
it.

(Title 18, United States Code, Sections 1348, 1349, and 2.)

The bases for my knowledge and for the foregoing charges

are, in part, as follows:

2. I have been a Special Agent with the Federal Bureau of

Investigation (“FBI”) for approximately three years. I am
currently assigned to a squad within the New York Division
responsible for investigating violations of federal securities
laws and related offenses. I have participated in numerous
investigations involving insider trading, investment frauds, and
other complex schemes. I am familiar with the use of computers,
cellphones, and cryptocurrencies in connection with criminal
activity.

3. The information contained in this Complaint is based

upon my personal knowledge, as well as information obtained
during this investigation, directly or indirectly, from other
sources, including, but not limited to: (a) business records;
(b) correspondence and electronic communications, including
emails and instant messages; (c) bitcoin transaction data and
bitcoin blockchain analysis tools; (d) publicly available
documents; (e) conversations with, and reports prepared by,
other FBI agents and agents of the Internal Revenue Service,
including the agents referred to below as “UC-1,” “UC-2,” and
“UC-3”; (f) audio recordings and screen activity recordings; and
(g) information supplied by the U.S. Securities and Exchange
Commission. Because this Complaint is being submitted for the
limited purpose of establishing probable cause, it does not
include all the facts that I have learned during the course of
my investigation. Where the contents of documents and the
actions and statements of and conversations with others are
reported herein, they are reported in substance and in part.
Where figures, calculations, and dates are set forth herein,
they are approximate, unless stated otherwise.

Background

4. Since in or about 2017, federal law enforcement has

been investigating an individual who identifies himself by the
pseudonym, “The Bull,” or similar variations, such as “dabull”
or “geobull,” and who solicits and sells confidential, non-

2
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 3 of 20

public information about publicly traded companies (“Inside

Information”).

5. As detailed below, “The Bull” makes his offers to buy

and sell Inside Information, in part, on websites that form part
of the Dark Web. Based on my training and experience, news
articles describing the Dark Web, and conversations with agents
specializing in cybersecurity issues, I understand that the Dark
Web refers to websites that are not indexed by conventional
searches engines and to which access may be restricted to those
using specific anonymizing browsers or computer settings.

6. Based on my training and experience, my review of

sworn affidavits discussing Dark Web sites, and my participation
in this investigation, I have learned, in part, the following:

a. AlphaBay Market (“AlphaBay”) and Dream Market

were online marketplaces that enabled users to buy and sell
illegal goods, including controlled substances, stolen and
fraudulent identification documents and access devices,
counterfeit goods, malware and other computer hacking tools,
firearms, and toxic chemicals. The sites also allowed users to
buy and sell illegal services, such as money laundering.
AlphaBay operated from in or about 2014 until in or about July
2017. Dream Market operated from in or about 2013 until in or
about April 2019.

b. Both AlphaBay and Dream Market were accessible

from, among other places, the Southern District of New York.

7. As detailed below, “The Bull” required payment for

Inside Information in cryptocurrency, particularly Bitcoin.
Based on my review of a report published in October 2020 by the
United States Attorney General’s Cyber Digital Task Force
concerning cryptocurrency, information published by the U.S.
Securities and Exchange Commission and the U.S. Commodity
Futures Trading Commission, my training and experience, and my
own participation in this investigation, I have learned the
following:

a. Cryptocurrency is a digital representation of

value that, like traditional coin and paper currency, functions
as a medium of exchange—that is, it can be digitally traded,
transferred, or used for payment. Unlike traditional fiat
currency such as the United States dollar, digital currency is
not issued by any government and does not have legal tender
status in any particular country or for any government or other
creditor. Instead, the exchange value of a particular digital

3
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 4 of 20

currency generally is based on agreement or trust within its

community of users. Examples of digital currencies, which come
in the form of unique digital “tokens” or “coins,” are “Bitcoin”
(“BTC”) and “Ether” (“ETH”), and, generally speaking,
“altcoins,” which typically refer to cryptocurrencies other than
Bitcoin.

b. Cryptocurrency tokens or coins are issued and

distributed on a “blockchain.” A blockchain is a digitalized,
decentralized, and cryptographically-secured ledger that allows
market participants to keep track of digital currency
transactions without central recordkeeping. Blockchain records
are published online and available to the public.

c. Cryptocurrency can be exchanged directly from

person to person; through a digital asset or cryptocurrency
exchange; or through other intermediaries. The storage of
cryptocurrency is typically associated with an individual
“wallet,” which is similar to a bank account. Wallets can
interface with blockchains and generate or store the public keys
(which are roughly akin to a bank account number) and private
keys (which function like a personal identification number or
password) that are used to send and receive cryptocurrency.

8. Based on a review of regulatory filings with the U.S.

Securities and Exchange Commission for certain of the issuers
described below, I know that the Bull’s scheme related to the
securities of issuers with a class of securities registered
under Section 12 of the Securities Exchange Act of 1934 and that
was required to file reports under Section 15(d) of the
Securities Exchange Act of 1934.

The Bull Sells Insider Stock Tips Through AlphaBay

9. Based on a query of a database containing AlphaBay’s

server images, which were obtained from a foreign government by
U.S. law enforcement pursuant to a request for legal assistance,
and a review of screen-recordings of AlphaBay activity, I have
learned, in part, the following:

a. A particular AlphaBay user with the screenname

“TheBull” registered with the site in or about December 2016.
Between December 2016, when he registered for the site, and July
2017, when AlphaBay ceased operations, “TheBull,” referred to
here as The Bull, offered for sale stock tips that were based on
non-public inside information about certain securities issuers
and which could be purchased individually, on a weekly basis, or

4
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 5 of 20

on a monthly basis.

b. Specifically, on or about December 7, 2016, in

the “Fraud > Other > Other” category, The Bull published a post
entitled, “Hedge Fund Insider | Stock Trading Tips $ Promo Price
$[.]” The post appeared as follows:

c. On or about January 4, 2017, in the “Fraud >

Other > Other” category, The Bull published a post entitled
“Monthly Plan.” The post contained the following text:

Trading tips daily for one calendar month

Inside trading tips coming from an actual

office clerk working in a trading branch. I am
offering information on certain NYSE, NASDAQ
and OTC (over the counter) stocks Buying my
service will you an edge by knowing what the
big boys are buying or selling

d. On or about March 3, 2017, in the “Fraud > Other

> Other” category, The Bull published a post entitled “Weekly

5
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 6 of 20

Plan,” which offered “Trading tip daily for one week” with an
identical description of the “Inside trading tips” as the
Monthly Plan.

e. The prices associated with an individual tip, a

weekly subscription, and a monthly subscription were $29.95,
$99.95, and $329.95 respectively.

AlphaBay Users Buy The Bull’s Tips and Trade on Them

10. Based on a query of the database containing AlphaBay’s

server images, I have learned, in part, the following:

a. Between December 2016, when The Bull’s account

was registered, and July 2017, when AlphaBay ceased operations,
The Bull completed the sale of dozens of individual tips,
approximately three weekly plans, and approximately three
monthly plans, for a total of approximately 45 transactions
through the AlphaBay marketplace.

b. Using the private message features of AlphaBay,

The Bull described his service and The Bull’s customers
described trading on his tips. For example:

i. On or about May 30, 2017, The Bull provided

user “Dayquil” with the tip: “Ticker: MOBL (NASDAQ) LONG | BUY
AFTER THE OPENING | CONFIDENCE LEVEL 8[.]” On June 18, 2017, The
Bull followed up with “Dayquil,” inquiring, “Everything alright
with the previous tip?” “Dayquil” then responded, “Went
perfectly! Thank you and looking forward to the next tip!”

ii. On June 11, 2017, The Bull responded to a

question from user “JacksonHawaii” about the possibility of
paying for tips on a percentage basis, rather than by upfront
fee. The Bull wrote, in part, “The tips are coming from a
company’s order book and are based on big buy/sell orders. I am
keen on sharing the profits, actually [I] am already working
with quite a few people on a percentage deal.”

iii. On or about June 13, 2017, The Bull provided

user “fuffylo” with a tip: “OMNT (NASDAQ) LONG | BUY AFTER THE
OPENING | CONFIDENCE LEVEL 8.” Two days later, on June 15, 2017,
“fuffylo” wrote The Bull, in part, “Did you see OMNT? shit I
take only 8%[.]”

c. Using the seller feedback feature of the AlphaBay

site, The Bull’s customers also occasionally reviewed his inside

6
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 7 of 20

tip service. For example:

i. User “joshmcpoyle” wrote, “The Bull is a

legend 3/3 for me so far :)[.]”

ii. User “metacapitalist” wrote, “great

experience gives you a bespoke service in making sure you get
the tips you need @ the right time[.]”

iii. User “funani” wrote, “Good Pick, had very

good communication with the seller. He care[s] for the needs of
his clients.”

The Bull Sells Inside Information to UC-1

11. In or about June 2017, a federal agent acting

undercover (“UC-1”) responded to The Bull’s AlphaBay posts and
subscribed to The Bull’s stock-tip service through AlphaBay’s
marketplace. UC-1 recorded the transaction using screen-capture
software. Thereafter, The Bull, writing from the email address
“[email protected],” provided stock tips to UC-1 by email.
Based on a review of the messages between UC-1 and The Bull, I
have learned that, as advertised, The Bull provided stock tips
and pre-release earnings information.

a. For example, on or about June 16, 2017, The Bull

wrote the following:

Hello there,

The tip for today is

Ticker: PTCT (NASDAQ) | SHORT | SELL AFTER THE

OPENING | CONFIDENCE LEVEL 8

Confidence level is a 1-10 scale [I] provide

alongside the tip. The higher it is, the
higher the expected return of the tip might be

b. On or about June 19, 2017, by email, UC-1

inquired about the source of the information, asking, “The info
is coming from a trading branch?” To which The Bull, by email
the following day, responded, “Yes they are coming from their
order book.” Based on my training and experience, and in light
of The Bull’s posts on AlphaBay, I believe that “order book”
here refers to a confidential list of customer buy and sell
orders submitted to a market maker or brokerage before the
opening of a trading day, and that this message reflects The

7
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 8 of 20

Bull explaining that his stock “tips” are based on confidential

customer trading information misappropriated by a “clerk” and
provided to The Bull.

c. In a tip email on June 23, 2017, The Bull also

informed UC-1, “[I] am also waiting for some unpublished
earnings reports.” On or about July 7, 2017, when the UC-1
inquired about the report, The Bull responded, in part, “[I] am
still waiting for the report. I’ll probably have it till
Monday.” Then, on July 10, 2017, The Bull wrote, in part, “[I]
got the earnings reports. Mail me back so we can discuss it.”

d. On July 10, 2017, the UC-1 responded to The Bull,

in substance and in part, by proposing an in-person meeting in
Los Angeles, California. Less than an hour later, The Bull
responded, in part, “Regarding the earnings reports, the
information is sensitive and more importantly illegal to use or
share. Therefore [I] am not keen on meeting in person or reveal
our identities for safety reasons. What [I] can do is share the
information for bitcoins.” In a subsequent message, on or about
July 11, 2017, The Bull wrote “I’m selling the report with an
expected -40% move for $5000[.]” And when pressed by UC-1 about
the nature of the tips, The Bull wrote, on or about July 12,
2017, “There are 10/10 regarding confidence, returning a high
percentage(~40%) profit as [I] said. I can sell you one for
$5000 and give another one upfront, which you send me a
percentage of profit after the trades are done. What is the
approximate amount you are about to invest? I'll send you my
bitcoin address for the payment[.]”

e. On or about July 13, 2017, The Bull wrote, in

part, “The current earnings reports are going live at 21 and 24
July.”

f. On or about August 1, 2017, at approximately 4:43

a.m., The Bull wrote, in part, the following:

Hello [UC-1], [I]’m sending you an unpublished

earnings report so you can check it out.

Ticker : ILMN (NASDAQ)

Expected release date : August 1 , 2017 after

market

2nd quarter 2017

Total revenue was $662M,and EPS was $0.82

8
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 9 of 20

Full year 2017 outlook

Expected 12% revenue growth

GAAP earning per diluted share is expected to

be $5.36~$5.46

Non-GAAP EPS is expected to be $3.60~$3.70

12. Based on a review of a quarterly financial statement

and accompanying press statement released by Illumina, Inc. at
approximately 4:05 p.m. on August 1, 2017, I have learned that
Illumina announced (a) total revenue of $662 million, (b) non-
GAAP earnings per diluted share of $0.82, (c) forecasted 2017
revenue growth of 12%, and (d) expected non-GAAP earnings per
diluted share attributable to Illumina stockholders of $3.60 to
$3.70.

13. Based on a comparison between The Bull’s August 1,

2017 message and the published Illumina financial information, I
believe that The Bull had pre-release access to Illumina’s
financial information. Based on my review of Illumina’s Insider
Trading Policy, I know that the company considered its non-
public information be confidential and forbid any persons in
possession of nonpublic information from disclosing this
information to others. Based on these facts, I believe that The
Bull misappropriated Illumina’s confidential pre-release
earnings information and converted it to his own use by selling
it to UC-1 with the intention that UC-1 would trade based on the
information.

14. Following the Illumina tip, The Bull continued to

provide confidential information belonging to various securities
issuers to UC-1.

a. For example, on or about August 23, 2017, The

Bull wrote the following to UC-1:

Hello [UC-1],

Just came back from a vacation as well, taking

some time off and now [I] am back to business.
It's alright [I] have more reports coming. I
can either trade your capital or hand you the
reports so you can trade yourself, [I] am
already managing some people's money

9
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 10 of 20

Are you already have the capital deposited

with a broker?

Message me with how you want to proceed so we

can discuss it.

Cheers

Based on my training and experience, The Bull’s message conveyed

that he expected to obtain additional Inside Information (“more
reports coming”) and that The Bull would be willing to place trades
for UC-1 based on that Inside Information or UC-1 could do it (“I
can either trade your capital or hand you the reports so you can
trade yourself.”).

b. On or about September 18, 2017, The Bull wrote

the following to UC-1:

Hey [UC-1], here it is

Ticker : ALOG (NASDAQ)
Expected release date : September 19 , 2017
after market
Fiscal year 2017
Total revenue was $538.083M, up 6% from the
same period in the prior year.
GAAP Net income was $12.452, up 2.6% from the
same period in the the prior year.
4th quarter 2017
Revenue for the 4th quarter of 2017 was
$163.3M, compare with revenue of $138.1M in
the 4th quarter of
fiscal 2016.
The report is bullish. Let me know if you have
any questions

c. The following day, on or about September 19,

2017, Analogic Corporation announced its Q4 2017 financial
results. When those results did not appear to match what The
Bull had sent to the UC-1, UC-1 wrote The Bull to complain,
noting, in part, “We invested some good amount of money on ALOG
today and we took a huge loss.”

d. On September 20, 2017, The Bull responded, “I am

sorry, they screwed me with the ticker. The numbers are actually
for the HB Fuller FUL (NYSE) and they are coming up short.”
After UC-1 questioned whether that was correct, because HB
Fuller had not announced earnings yet, the Bull explained: “The

10
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 11 of 20

tip was actually for ALOG but the number 12,452 was for
‘Consolidate statement of operations’ and 583,083 for ‘Condensed
consolidated balance sheets’. Had to look in the balance sheets
to find it. Not only that but the source told me it’s for FUL
which is not. I am trying to figure out this mess with him.”

15. Based on a review of Analogic Corporations Q4 2017

financial statements, I have learned that The Bull was correct:
that is, the figures provided in The Bull’s September 18, 2017
tip for net income corresponded to the figure provided in
Analogic’s Q4 2017 Consolidated Statement of Operations for
outstanding weighted-average shares and the figures provided in
The Bull’s September 18, 2017 tip for total revenue corresponded
to the figure in Analogic’s Q4 2017 unaudited consolidated
balance sheet for total assets.

16. Because The Bull’s tip contained two figures (“12,452”

and “583,083”) that appeared in Analogic’s quarterly financials
before those financials were published, I believe that The Bull
had access to non-public business information regarding
Analogic. Based on Analogic Corporation’s “Insider Trading
Policy,” I have learned that Analogic Corporation prohibits
individuals with non-public information about the company from
transmitting that information to others who may trade on it.
Accordingly, I believe The Bull misappropriated, confidential
business information belonging to Analogic and converted it to
his own by selling it to UC-1 with the intention that UC-1 would
trade based on the information.

17. Soon after The Bull provided the Analogic tip, The
Bull ceased responding to communications from UC-1.

The Bull Sells Insider Tips to UC-2

18. In or about August 2017, an undercover agent with the

FBI (“UC-2”) encountered a post by “TheBull” on Dream Market,
which could only be accessed by users on the Tor network, 1

1 Based on my training and experience, conversations with other

law enforcement agents, and review of publicly available
information, I know that Tor is short for “The Onion Router,”
and allows users to access websites without revealing their
actual Internet protocol (“IP”) address, geographic location, or
other identifying information. To access the Tor network, a user
must first download and install the Tor software. See
www.torproject.org. The Tor software protects users’ privacy

11
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 12 of 20

entitled “Hedge Fund Insider | Stock Trading Tips $ Promo Pr[.]”

Based on the screenname “TheBull,” the details of the scheme
described below, I believe “TheBull” to be the same user as the
individual who used the screenname “TheBull” on AlphaBay—that
is, The Bull. In the post, The Bull offered to supply:

Inside trading tips coming from an actual

office clerk working in a trading branch. I am
offering information on certain NYSE, NASDAQ
and OTC (over the counter) stocks
Buying my service will [give] you an edge by
knowing what the big boys are buying or
selling

19. On or about April 25, 2018, UC-2 responded to that

post by email, writing, in part: “What exactly are you offering?
Are they tips being put together from seeing a big boys books?
Are there any other services you are offering? Lay it all on
me.”

20. On or about April 28, 2018, The Bull responded, in

part, by writing the following:

You are correct, the tips I am offering are

coming from institutional order books and pre-
planned buys/sells. The tips are being sent
daily before the market opens for the day
(between 8-9 AM EST) with an indication to
buy/sell at the opening. I am also getting
leaked earnings reports occasionally.

Based on my training and experience, I believe “institutional

order book” refers to an electronic list of buy and sell orders
maintained by a market maker or trading firm. Accordingly, and
in light of additional communications between UC-2 and The Bull,
I believe this message reflects The Bull explaining that his
stock “tips” from “pre-planned buys/sells” are based on
information taken from a market making entity’s confidential
list of customer orders submitted before the opening of the
trading day. Further, I believe this message also reflects that
The Bull sometimes had non-public company earnings information

online by routing their communications through a series of relay

computers (called “nodes”) run by volunteers around the world.
When a Tor user visits a website, the IP address visible to that
site is that of a Tor “exit node,” not the user’s actual IP
address, which could otherwise be used to identify a user.
12
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 13 of 20

for sale (“I am also getting leaked earning reports

occasionally”).

21. On or about April 30, 2018, in an email to UC-2, The

Bull, in part, clarified his services:

Monthly plan is $320 and the tips are being

sent daily. Earning’s reports price varies and
it depends on how strong/weak are the actual
numbers compared to the previous ones and
analyst’s estimations. We can start with the
daily tips and [I]’ll let you know as soon [as
I] have a report.
I’m accepting payments in [Bitcoin] either in
the market or directly.

Based on my training, experience, and review of other

communications between UC-2 and The Bull, I believe this message
reflects The Bull explaining that he offers confidential pre-
release earnings for sale but the price depends on how much the
earnings diverge from past performance (“it depends on how
strong/weak are the actual numbers”), that is, how significant
the information would be to a stock trader.

22. UC-2 then subscribed to The Bull’s stock tip service.

UC-2 paid for the service by transmitting Bitcoin to a
particular Bitcoin wallet identified by The Bull. Thereafter,
between in or about May 2018 and March 2020, UC-2 received more
than approximately 200 stock tips from The Bull in exchange for
monthly Bitcoin payments, with payments being transmitted to
particular Bitcoin addresses supplied by The Bull. Numerous tips
were received by UC-2 while UC-2 was in the Southern District of
New York.

a. For example, on or about May 2, 2018, The Bull

wrote:

Hello there, tip for today is

Ticker: QNSD (NASDAQ) BUY AFTER THE OPENING.
CONFIDENCE LEVEL 8.

Confidence level is a 1-10 scale [I] provide

alongside each time. The higher it is, the
higher the expected return from the tip might
be

b. For further example, on or about May 15, 2018,

13
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 14 of 20

The Bull wrote:

TICKER: IOTS (NASDAQ) LONG. BUY AFTER OPENING.

CONFIDENCE LEVEL 9. EXPECTED TAKE PROFIT AT -
$10
I’ll probably have a report that [I] can send
you for next week. I’ll update you

c. For further example, on or about March 5, 2019,

The Bull, using a Wickr account under the name “thebulldm,”
wrote, in part, the following:

Hello there, tip for today is

Ticker: DAVE (NASDAQ) LONG. BUY AFTER THE
OPENING

d. For further example, on or about September 23,

2019, The Bull sent a Wickr message to UC-2:

Hey JC, tip for today is:

Ticker: HMY (NASDAQ) | LONG | BUY AFTER THE
OPENING

e. For further example, on or about March 5, 2020,

The Bull wrote, in part, the following:

“Ticker: BLDP (NASDAQ) SHORT | SELL AFTER THE

OPENING”

23. On occasion, UC-2 contacted The Bull regarding the

pre-release earnings reports The Bull had advertised. On one
occasion, The Bull attempted to demonstrate to UC-2 that The
Bull had access to valuable confidential information concerning
securities issuers by providing advance confirmation of a
corporate acquisition:

a. On or about March 6, 2019, The Bull, in substance

and in part, alerted UC-2 that he expected to have a report for
sale shortly. The Bull and UC-2 agreed that The Bull would send
UC-2 a password-protected pre-release earnings report before a
particular earnings announcement, but would not send the
password until after the announcement. The Bull and UC-2 reached
this agreement as a means of allowing The Bull to prove to UC-2
that The Bull had access to reports before they became public,
and thus that they would be valuable to UC-2.

b. On or about May 10, 2019, The Bull informed UC-2,

14
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 15 of 20

“I got the file with report earlier[.]” Shortly thereafter, The

Bull sent UC-2 a hyperlink to a password protected file (the
“Tip File”) stored on a cloud-based storage platform.

c. On or about May 25, 2019, The Bull wrote to UC-2:

“Hey [UC-2], I got an update. The info is for an acquisition
deal which expected to close next week[.]”

d. On or about June 12, 2019, The Bull wrote, in

part, “Hope everything is alright. Just letting you know that
the deal is on.” The Bull also provided UC-2 the password to the
Tip File.

24. Based on a review of the Tip File, which was

downloaded and saved by UC-2, I know that the Tip File contained
the following text: “Dassault is acquiring MDSO (NASDAQ).
Acquisition price is 105. Date of announcement is set to 20th of
May[.]” Based on a review of a June 12, 2019 press release and
subsequent news articles, I have learned that on or about June
12, 2019, Medidata Solutions, a company listed on NASDAQ under
ticker symbol “MDSO,” announced that it would be acquired by
French technology firm Dassault Systemes in an all cash
transaction for $92.25 per MDSO share. Based on a review of
publicly available news sources, I learned that on April 21,
2019, Bloomberg had reported that Dassault Systemes was
“considering” acquisitions, including Medidata. Accordingly, and
while the Tip File contained an inaccurate share price, I
believe the Tip File to contain advanced confirmation of the
fact of a rumored business deal.

The Bull Begins to Build an Auction Site for Misappropriated

Inside Information

25. In or about February 2020, The Bull shared with UC-2

his plans to build a website to facilitate the purchase and sale
of material, non-public information for use in stock trading:

Btw, I am working together with an IT guy on

building a tor website which might allow us to
get info like earning’s reports and etc

26. In correspondence with The Bull, UC-2 offered to

assist The Bull with his plans. Among other things, UC-2 further
offered to enlist the help of another individual, whom UC-2
described as a fund manager, but who was, in truth, another FBI
agent acting in an undercover capacity (“UC-3”).

15
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 16 of 20

27. On or about June 17, 2020, The Bull sent an instant

message to UC-2 stating that he (The Bull) and his associate had
the following aim with the website:

Yes, our main goal is to increase the

compensation for the insiders—to motivate them
to provide info—while keeping the leaks to a
minimum. I believe its more sustainable this
way.

28. On or about June 19, 2020, The Bull, UC-2, and UC-3
spoke by an encrypted voice call, which was recorded by UC-2.
During that call, the following occurred, among other things:

a. The Bull stated, in substance, that he intended

for individuals to pay approximately $500 to $1,000 per month
for a membership to the website, which would permit members
access to bid on Inside Information, for which the bidders would
then pay a commission.

b. The Bull explained that even if there were to be

a leak about the activity on the website, it would be almost
impossible to trace.

c. The Bull further explained that he had a strategy

for identifying personal email addresses of company insiders to
approach to obtain Inside Information to begin to build the
reputation of the website.

29. On or about June 25, 2020, The Bull, UC-2, and UC-3
spoke by an encrypted voice call, which was recorded by UC-2,
and discussed further plans for the website, including, among
other things, plans to verify the legitimacy of buyers and
sellers of Inside Information. During that phone call, The Bull
sent to UC-2 and UC-3 a link to the web address of a draft
website, which could be accessed via TOR and which The Bull had
labeled “DeepGreenChain.” UC-2 took screenshots of some of the
pages of the website. Based on a review of those screenshots, I
know the website included the following image:

16
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 17 of 20

30. On or about July 23, 2020, The Bull sent an instant

message to UC-2 stating, in part, the following: “I am looking
to move forward and push some advertising since the earning’s
season is here. I compiled a list with all the possible places
to advertise on the DW. Should we all talk maybe early next
week?” Based on my training, experience, and review of the
messages between The Bull, UC-2, and UC-3, I believe that this
message reflects (a) The Bull’s commitment to pursuing the
website on which he would sell misappropriated Inside
Information (“I am looking to move forward”), (b) his interest
in taking advantage of the period in which companies have
assembled, but have not publicly disclosed, quarterly earnings
information (“since the earning’s season is here’), and (c) that
he intended to solicit tips through posting on the Dark Web (“I
compiled a list with all the possible places to advertise on the
DW”).

31. On or about July 31, 2020, The Bull, UC-2, and UC-3
spoke by an encrypted voice call, which was recorded by UC-2.
During that call, the following occurred, among other things:

a. The Bull stated, in substance, that the most

important part of their efforts was to recruit “insiders.”

b. The Bull explained that he had spoken to an

individual who could potentially provide Inside Information, but
that The Bull believed that the Inside Information could not be
verified and was not sufficiently accurate to use this
individual as a provider of Inside Information.

c. In response to a question from UC-2 regarding

obtaining additional Inside Information from the individual who

17
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 18 of 20

provided the information set forth above regarding the

acquisition of Medidata by Dassault Systemes, The Bull explained
that, although that individual had accurately disclosed that
Dassault Systemes would acquire Medidata, that individual’s
information arrived too late because (a) information regarding
the potential acquisition had already leaked into the
marketplace, causing Medidata’s stock price to rise (though not
to the acquisition price), and (b) the individual’s information
regarding the acquisition price was inaccurate. Furthermore, The
Bull stated, in substance, that he had not received further
Inside Information from that individual. Accordingly, The Bull
concluded that that individual was not suitable to use as an
initial insider for the auction of Inside Information on the
DeepGreenChain.

32. On or about September 15, 2020, The Bull, UC-2, and

UC-3 spoke by an encrypted voice call, which was recorded by UC-
2. During that call, the following occurred, among other things:

a. The Bull stated, in substance, that he had

traders ready to bid on Inside Information, who had provided The
Bull with information regarding the amounts they were prepared
to spend to trade on Inside Information, but had not yet
identified an insider to provide Inside Information.

b. The Bull explained that he had been receiving

assistance from an individual in the information technology
field who had charged The Bull $5,000 upfront for assistance and
would charge The Bull an additional $5,000 for each insider this
individual provided for DeepGreenChain, but that this individual
had not yet succeeded in identifying a suitable person with
Inside Information.

Apostolos Trovias Is “The Bull”

33. An FBI management and program analyst specializing in

cryptocurrency tracing has reviewed transaction data for
approximately one payment sent by UC-1 to The Bull and
approximately seventeen payments sent by UC-2 to The Bull
(collectively, the “UC Payments”). Based on the analyst’s
evaluation of the UC Payments, as well as a review of account
records for various Bitcoin management and currency conversions
services, such as Wirex Ltd., Coins.PH, and Shapeshift, I have
learned, in part the following:

a. On May 11, 2018, UC-2 transmitted bitcoin to a

bitcoin address specified by The Bull. That payment was

18
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 19 of 20

transferred directly to an account associated with Shapeshift.

Based on Shapeshift’s IP log on, log off records, I learned that
the Shapeshift account that received the UC Payment was accessed
from a particular IP address ending in 211 (the “211 IP
Address”). Further, based on records produced by Vodafone Greece
in response to a request from the SEC, I have learned that the
211 IP Address was, between April 9, 2018, and May 12, 2018,
assigned to customer APOSOTOLOS TROVIAS, a/k/a “The Bull,” the
defendant.

b. At least four of the UC Payments sent by UC-2 to

addresses specified by The Bull were then directly transferred
to a Bitcoin address corresponding to a wallet managed by Wirex.
Based on Wirex account opening records, the receiving account
was opened in the name of “Apostolos Trovias” (the “Trovias
Wirex Account”). The account opening materials included a photo
of TROVIAS and a scanned image of a Greek identity card in
TROVIAS’s name.

c. All or part of four other UC Payments sent by UC-

2 terminated in the Trovias Wirex Account after first passing
through at least two other Bitcoin addresses.

d. At least five of the UC Payments, were sent to

bitcoin addresses specified by The Bull and were then
transferred directly to a Bitcoin address corresponding to an
account at Coins.co.th, a subsidiary of Coins.PH. Based on
Coins.PH account opening records, the receiving account was
opened in the name of “Apostolos Trovias” (the “Trovias Coins.PH
Account”). The account opening materials included a photo of
TROVIAS and a Greek passport in TROVIAS’s name.

e. All or part of three other UC Payments sent by

UC-2 terminated in the Trovias Coins.PH Account after first
passing through at least two other Bitcoin addresses.

34. In light of the foregoing, I respectfully submit there

is probable cause to believe APOSTOLOS TROVIAS, a/k/a “The
Bull,” the defendant, is engaged in a scheme defraud and attempt
to defraud securities issuers through misappropriating
confidential business information and converting it to his own
use by selling that information over the Dark Web with the
intention that purchasers of the information would trade on it.

19
 Case 1:21-cr-00378-JFK Document 1 Filed 02/25/21 Page 20 of 20

WHEREFORE, I respectfully request that an arrest warrant be

issued for APOSTOLOS TROVIAS, a/k/a “The Bull,” the defendant,
and that he be arrested and imprisoned or bailed, as the case
may be.

/s authorized electronic signature

________________________________
Special Agent Robert Hupcher
Federal Bureau of Investigation

Sworn to me through the transmission

of this Complaint by reliable electronic
means, pursuant to Fed. R. Crim. P. 41(d)(3),
this 25th day of February, 2021

_______________________________
HONORABLE SARAH NETBURN
UNITED STATES MAGISTRATE JUDGE
SOUTHERN DISTRICT OF NEW YORK

20