Employees forged signatures, stole assets in takeover of CipherBlade, lawsuit alleges

The founder of blockchain investigations firm CipherBlade said new management stole his company's assets, forged signatures and took items from his home, according to a complaint filed last week. 

Richard Sanders founded Pennsylvania-based CipherBlade in 2019. The firm helps federal government agencies, private companies and individuals in investigations of financial crimes, with a focus on cybercrime. After Sanders went to Ukraine in 2022 to volunteer with investigations involving crypto, trouble ensued, according to the lawsuit filed in an Alaska district court. 

"Specifically, knowing Mr. Sanders would be in Ukraine, prior to and just after his departure, Defendants made material misrepresentations to Mr. Sanders to gain access to his accounts, stole trade secrets in the form of confidential investigation information, customer leads, customer lists, and investigatory data and stole access to the CipherBlade PA business itself," the filing read. 

The defendants named in the lawsuit also allegedly redirected clients to an entity in Alaska and another in Singapore. 

Fake firing

One of the defendants, Manuel Kriz, began working for CipherBlade in 2021 and had limited authority and administrative access. Kriz and another defendant, Michael Krause, convinced Sanders to grant them access to an email address while he was in Ukraine. Sanders said he did not have access to that email and thought it would be used to "facilitate electronic signing of routine client engagements,” according to the complaint.

After Kriz and others kept allegedly asking Sanders for access to a separate email, he became concerned and asked that Kriz be fired. 

"Mr. Kriz's termination was a charade. In fact, Mr. Kriz had not been terminated as Mr. Sanders had directed. Mr. Kriz continued to be involved with CipherBlade PA and conspired with the other Defendants to engage in this scheme," according to the complaint. 

Later when Krause announced to CipherBlade PA that Kriz was fired, the team became concerned because they were not familiar with Krause, despite him making large changes, the filing read. 

"I didn't realize the situation was that bad," one employee wrote. 

Physical theft

Also while abroad in Ukraine, Sanders said he received alerts from his home security system that notified him of all his security cameras suddenly switching offline, according to the complaint.

"Upon returning home, Mr. Sanders observed that business registration-related documents, including LLC and business filings, were missing from his home. He found a U.S. Postal Service receipt for a package mailed by U.S. Mail from his home, fraudulently using his name and credit card information without permission, to an address in Cyprus," according to the filing. 

Sanders said on LinkedIn on Monday that he was left with no choice but to cut ties.

"For all of these reasons, I have no choice but to publicly sever ties and warn everyone that I am no longer in control of or associated with CipherBlade, and to share the lawsuit pleadings that enumerate the allegations of acts of misconduct, theft and fraud conducted by those who are controlling CipherBlade. I want to be clear that I now have zero involvement in CipherBlade and this has been the case for months now," Sanders said. 

CipherBlade disputed Sanders' allegations on Monday afternoon in a LinkedIn post. The firm said Sanders was never an owner and said he "withdrew from active participation in the operations of CipherBlade throughout 2022 and effectively ceased such participation altogether in early 2023, when he moved to Ukraine to pursue his personal pro-bono mission."

"We vigorously dispute Sanders’ allegations and believe that his claims are baseless, vexatious, and motivated by personal animosity. Our repeated efforts to bring about a more orderly and amicable separation have been consistently rebuffed. We will respond to his claims in due course, within the legal process, as we continue to provide our clients with world-class service." 

Updated at 5:15 pm. ET to add comments from CipherBlade