Joshua Nicholas might spend up to five years in jail after he and his colleagues stole $100 million in digital assets from investors.