Bitcoin exchange operator tied to hacks gets five-and-a-half years U.S. prison

A Florida man was sentenced on Tuesday to 5-1/2 years in prison after pleading guilty to operating an illegal bitcoin exchange suspected of laundering money for hackers and linked to a data breach at JPMorgan Chase & Co.

Anthony Murgio, 33, of Tampa, pleaded guilty on Jan. 9 to three conspiracy counts, including bank fraud and operating an unlicensed money transmitting business. The sentence was roughly half as long as prosecutors had sought.

Murgio and co-conspirators were accused of processing millions of dollars from 2013 to 2015 into the virtual currency bitcoin through the unlicensed exchange Coin.mx.

Prosecutors said many transactions were conducted by victims of ransomware, a malicious software that locks up data unless people pay "ransom" to unlock it. Cyber criminals often demand ransom paid in bitcoin.

The alleged schemes also involved the takeover of a since-liquidated New Jersey credit union to shield their activity.

"Mr. Murgio led an effort based on ambition and greed," and constructed on a "pyramid of lies," U.S. District Judge Alison Nathan in Manhattan said during the sentencing hearing.

Murgio unsuccessfully fought back tears and lost his composure several times in expressing "enormous regret" for his crimes, which the judge credited as genuine.

"I am wiser today than when the case began, and I am sorry for all the damage I caused to so many people," Murgio said. "Believing what I was doing was OK did not make it OK."

Nathan cited Murgio's generosity to friends and support to his family in imposing a term below the 10 to 12-1/2 years recommended by prosecutors and federal guidelines.

Murgio's lawyer Brian Klein said he was pleased with the reduction, after telling the judge that Murgio had taken responsibility for his "grievous decisionmaking."

In contrast, Assistant U.S. Attorney Eun Choi faulted Murgio's dealings with ransomware victims, saying: "He exploited their desperation to personally profit from them."

A hearing on restitution and forfeiture was set for Sept. 1.

Murgio's father, Michael, pleaded guilty last October to an obstruction charge tied to the credit union.

Nine people have been criminally charged following an investigation into the JPMorgan breach, which exposed more than 83 million accounts.

Prosecutors said Coin.mx was owned by Gery Shalon, who pleaded not guilty to U.S. charges after being extradited last June from Israel.

In March, a jury in Manhattan convicted Florida software engineer Yuri Lebedev and New Jersey pastor Trevon Gross of scheming to conceal Coin.mx's activities from banks and regulators. They have yet to be sentenced.

The case is U.S. v. Murgio et al, U.S. District Court, Southern District of New York, No. 15-cr-00769.

(By Jonathan Stempel)