$250 Million Cryptocurrency Theft: Uncovering the Truth Behind the Decade's Heist

Original Article Title: They Stole a Quarter-Billion in Crypto and Got Caught Within a Month
Original Article Author: Mitch Moxley
Original Article Translation: zhouzhou, BlockBeats

Editor's Note: This article tells the story of a crime incident triggered by cryptocurrency theft. ZachXBT tracked the suspect Lam's lavish lifestyle through social media and assisted law enforcement in the investigation. Lam and other accomplices used sophisticated money laundering methods but were ultimately caught under police surveillance. Meanwhile, another kidnapping case was also linked to this criminal group, involving multiple Florida men. The case revealed how cybercrime is gradually evolving into more violent real-world crime. In the end, the police successfully recovered the stolen Bitcoin and related evidence.

The following is the original content (slightly reorganized for better readability):

On August 25, 2024, a hot and humid afternoon, Sushil and Radhika Chetal were house-hunting in a upscale community in Danbury, Connecticut. The lawn was neatly manicured, and the pool was equipped with a heating system. Sushil was a Vice President at Morgan Stanley's New York branch, driving a newly purchased matte gray Lamborghini Urus, with this SUV starting at around $240,000.

As they turned a corner, a white Honda Civic suddenly rear-ended the Lamborghini. Simultaneously, a white Ram ProMaster van cut in from the front, blocking the Chetals' path. According to a subsequent criminal complaint, a group of six men dressed in black and wearing masks got out of the vehicles, forcibly dragged the Chetals out of their car, and pushed them into the side door of the van.

When Sushil resisted, the attackers beat him with a baseball bat and threatened to kill him. They bound the couple's hands and feet with duct tape, forced Radhika to lie on the ground, warning her not to look at them, even as she struggled to breathe due to asthma, pleading. They also taped Sushil's face and struck him again with the baseball bat as the van sped away.

Several witnesses saw the attack and called 911. One of them was an off-duty FBI agent living nearby who happened to be on the scene; he tracked the van and Honda Civic, providing real-time updates on their locations to the authorities. This FBI agent also managed to capture partial license plate numbers.

Soon, the Danbury police located the stolen truck. A patrol car with flashing lights attempted to intercept, but the truck driver accelerated, weaving wildly through traffic. The pursuit began and about a mile later, the driver veered off the road and crashed into the curb. Four suspects abandoned the vehicle and fled on foot. Police found one of them under a bridge and arrested him after a brief chase. Over the next few hours, the remaining three individuals were also located in a nearby wooded area and taken into custody. Meanwhile, at the rear of the truck, still bound and shaken but alive, were the Chetals.

Danbury Police Department Detective Sergeant Steve Castrovinci was off-duty that day when he received a call from the shift commander informing him of the situation. He recalled the commander telling him, "We have a kidnapping case, a real one." Castrovinci quickly gathered a few detectives to get briefed, stopped by the crime scene, and then proceeded to the station to interrogate the suspects. Based on information provided by one of the apprehended suspects, the following morning, at an Airbnb rental in Roxbury, a 30-minute drive from Danbury, two additional suspects were found and arrested, and the white Honda Civic was recovered.

For Castrovinci, it was an unusually intense and dramatic case. Danbury was an affluent and quiet place, and while the police occasionally dealt with kidnapping cases, they were mostly related to custody disputes involving children. An overt daylight violent kidnapping was unheard of. What was even more peculiar was that law enforcement discovered that these perpetrators—aged between 18 and 26—had traveled all the way from Miami to Connecticut.

They had also rented the truck through the Turo app. "A cop could go their whole life without encountering a case like this," Castrovinci, who has 20 years of law enforcement experience and had previously worked at the NYPD for 5 years, told me. "Especially in a place like ours, this kind of thing just doesn't happen."

Over the following weeks, the police were tight-lipped about releasing any information. Castrovinci and his team worked diligently to piece together the motive behind the crime. It was hard to believe that the Chetals were targeted due to Sushil's high-ranking position in an investment bank. As a vice president at Morgan Stanley, his salary was enviable but not exceptional in Danbury. If the motive of the kidnappers was money, then abandoning the Chetals' Lamborghini (later found abandoned in the woods) was extremely puzzling. None of the clues seemed to add up.

However, a few days after the failed kidnapping, Castrovinci mentioned that their team received a tip from the FBI, leading to an unexpected turn in the case: it might be connected to a large-scale cryptocurrency theft that occurred just a week before the attack.

Several young individuals (some of whom met on a Minecraft server) are suspected of stealing $250 million from an unsuspecting victim, triggering a series of unbelievable events involving a teenage cybercrime syndicate, some independent web sleuths tracking their actions, and multiple law enforcement agencies. It now appears that all of this has culminated in the kidnapping of the Chetal couple—rampant lawlessness of the digital dark world and its surrounding culture, permeating the real world in such a viscerally cruel manner for the first time.

This chain of events began a few weeks ago when a resident of Washington, D.C. started receiving unusual login alerts for their Google account, indicating logins seemingly from overseas. Then, on August 18, he received a call from someone claiming to be from the Google Security Team. The caller stated that his email account had been compromised. The call sounded very legitimate—the caller had personal information about this D.C. resident. The caller requested him to verify some personal information over the phone; otherwise, the account would be closed, and the resident complied.

Shortly after speaking with the supposed Google staff, the Washington, D.C. resident (whose identity is concealed in federal court documents) received another call, this time from an alleged representative of the security department of the well-known cryptocurrency exchange Gemini.

Similarly, the caller had his personal information and informed him that his account on Gemini (containing approximately $4.5 million in cryptocurrency) had been compromised by hackers and it was imperative to immediately reset the two-factor authentication and transfer the bitcoins in the account to another wallet for asset protection.

The person on the call then suggested the account holder download a program for "enhanced security." The man agreed, unaware that he was downloading a remote desktop application that would allow the caller to take control of his computer remotely—and thereby access his other cryptocurrency accounts, exposing his assets to even more astonishing theft risks. It turned out that this Washington, D.C. resident was an early investor in cryptocurrency, holding a total of over 4,100 bitcoins. A decade ago, these bitcoins were worth about $1 million; on that day, their value exceeded $243 million.

There is a core paradox in the cryptocurrency realm: while the holders of coins are typically anonymous, all transaction records are public and recorded on a ledger called the blockchain. This means that once funds are transferred, anyone can see it. This paradox has given rise to a new breed of investigators who specialize in tracking suspicious transactions on the blockchain. One of the most famous is ZachXBT, an independent crypto crime investigator.

In the world of crypto, ZachXBT is a well-known but elusive figure. He often posts lengthy investigations on X (formerly Twitter), exposing individuals suspected of wrongdoing, sometimes even calling them out directly. He has around 850,000 followers on the platform. He also frequently shares his investigation findings with law enforcement. WIRED magazine dubbed him the "world's most active independent crypto crime investigator." He has never revealed his true identity online.

Just minutes after a Washington, D.C. resident had their crypto assets wiped out, ZachXBT was at the airport rushing to catch a flight when he suddenly received a transaction alert on his phone. Crypto investigators typically use tools to monitor the global movement of cryptocurrencies and set alerts for specific scenarios, such as transactions over $100,000 through loosely regulated exchanges.

The initial alert was for a mid-six-figure transaction, which then kept increasing, peaking at $2 million. After passing through security, ZachXBT found a seat, opened his laptop, and began tracking the transaction, eventually tracing it back to a wallet holding around $240 million in crypto. Some bitcoins could even be traced back to 2012. "I just had a bad feeling at that moment," he told me, "Why would someone who has held Bitcoin for so many years use such suspicious services known for facilitating illicit funds?"

He then added the wallet addresses associated with these transactions to his tracking list and boarded the plane. Once connected to the in-flight Wi-Fi, more transaction alerts kept pouring in. Throughout the day, the Bitcoin from the large wallet continuously went through over 15 high-fee crypto mixing services to be gradually cashed out.

Upon landing, ZachXBT reached out to several peers specialized in investigating cryptocurrency theft cases. One of them was Josh Cooper-Duckett, the lead investigator at Cryptoforensic Investigators. This company is one of a growing number of independent organizations focusing on tracking cryptocurrency theft and fraud, assisting law enforcement in recovering funds for victims. 26-year-old Cooper-Duckett, originally from London, became interested in cryptocurrency at a young age. After working as a security consultant at Deloitte for three and a half years, he shifted his focus to investigating cryptocurrency theft cases, particularly those involving losses of at least $100,000—a type of case that is now all too common.

ZachXBT shared his findings with Cooper-Duckett and other investigators, and they unanimously agreed that suddenly emptying a wallet worth nearly $250 million was highly suspicious. "Someone with that much money can't just wake up one weekend and decide, 'I'm going to batch-transfer my funds to a bunch of exchanges, then convert to Monero and Ethereum'—a normal person wouldn't do that."

The group of crypto sleuths immediately contacted relevant exchanges and service platforms, informing them that this fund was stolen and requesting them to freeze the funds and cooperate with law enforcement investigations. Some platforms cooperated, but others did not. "This situation is a bit like a game of whack-a-mole," Cooper-Duckett said. "They kept trying to transfer the money to various exchanges and service platforms to see where they could successfully launder it. After all, they had to launder $240 million, which is a massive amount."

Meanwhile, ZachXBT also issued a warning to his followers on Twitter: "About seven hours ago, a suspicious transaction occurred, and the potential victim's account transferred out 4,064 bitcoins (approximately $238 million)." He wrote. The funds then flowed to various crypto platforms such as THORChain, eXch, KuCoin, ChangeNOW, RAILGUN, and Avalanche Bridge.

ZachXBT also noted that the victim had previously received bankruptcy compensation from Genesis. Genesis is a lending platform that filed for bankruptcy in 2023 following the collapse of Sam Bankman-Fried's FTX.

Through his network of contacts, ZachXBT eventually managed to reach out to the victim via email. The shocked Washington D.C. resident then hired ZachXBT, Cryptoforensic Investigators, and another crypto investigation company to help trace his stolen assets.

On the same day, he also filed a police report with the Federal Bureau of Investigation's Internet Crime Complaint Center, and ZachXBT immediately contacted his acquaintances in law enforcement. (Both the F.B.I. and the Department of Justice declined to comment on the matter.)

The rapid growth of cryptocurrency theft cases has overwhelmed federal investigators. According to a recent report, the Internet Crime Complaint Center (IC3) received over 69,000 complaints involving cryptocurrency financial fraud in 2023, with total losses exceeding $5.6 billion, a 45% increase from 2022.

Although cryptocurrency-related complaints accounted for only 10% of all financial fraud cases, the losses from these cases accounted for nearly half of the total amount. The report pointed out that the decentralized nature of cryptocurrency, the irreversibility of transactions, and the ability to freely move funds globally make it highly attractive to criminals, posing significant challenges for the Federal Bureau of Investigation (F.B.I.) in recovering funds. As a result, the F.B.I. established the Virtual Assets Unit (VAU) in 2022 to specifically combat cryptocurrency theft.

Due to the large scale of the case and its highly challenging nature, experts say that government agencies — including the F.B.I., Department of Homeland Security, Secret Service, and even the IRS — have had to rely on private companies and individual investigators who have a deep understanding of the digital criminal underworld. "Josh and Zach, they are really fast and accurate in tracking," said Nick Bax, founder of the cryptocurrency analysis company Five I's.

Bax has collaborated with ZachXBT on multiple cases but has never seen his true face. In their early conversations, ZachXBT even used voice-changing software to make himself sound like Mickey Mouse. "To be honest, I'm pretty good myself, but compared to them, I can never catch up," Bax said. "And I think their brains have really been rewired because they've been doing this since a very young age."

Crypto investigators often use fake accounts to infiltrate forums where hackers and scammers gather, such as Telegram and Discord, to observe their communication, planning, and bragging. They have found that these criminals are often very young, act quite recklessly, and frequently leave clues inadvertently.

After ZachXBT posted on X about this theft, a source contacted him through a temporary account, providing some clues that could lead to the identity of the thief. The informant sent ZachXBT several screen recording videos, allegedly capturing one of the scammers live-streaming this theft to his friends. In the approximately one-and-a-half-hour-long video, which includes footage of the scammers talking to the victim, in one segment, the scammers can be heard excitedly screaming upon learning that they successfully stole $2.43 billion worth of Bitcoin: "Oh my God! Oh my God! 2.43 billion! So awesome! Oh my God! Oh my God! Bro!"

In private chats, these scammers used aliases like Swag, $$$, and Meech, but they made a fatal mistake: one of them inadvertently exposed his real name during the live stream when the bottom Start menu icon on his Windows desktop showed his name — Veer Chetal, an 18-year-old from Danbury — who is the son of the kidnapped couple mentioned earlier.

Veer Chetal is a quiet honor student who recently graduated from Immaculate High School in Danbury and is about to attend Rutgers University in New Jersey. In 2022, he completed a "Future Lawyer" program, and that year, the school website even featured a photo of him — a boy with glasses, wearing a Tommy Hilfiger windbreaker and a red Polo shirt, smiling brightly.

Classmates recalled that Chetal had always been shy and had a strong passion for cars. "He was basically always a loner," said Marco Dias, who became friends with Chetal in senior year. Another student named Nick Paris also mentioned that Chetal was initially low-key until one day in the middle of senior year when he showed up to school in a Corvette. "He just parked in the parking lot, 7:30 in the morning, and everyone was shocked," Paris said.

Soon after, Chetal upgraded to a BMW, followed by a Lamborghini Urus. He started wearing Louis Vuitton shirts, Gucci shoes. On Senior Skip Day, while Paris and other classmates were just hanging out at a nearby mall, Chetal took some friends including Dias to New York, rented a yacht for a party, and everyone posed with bundles of cash on the deck for photos.

Chetal claimed he made all this money from trading crypto coins; Dias said that one morning during study hall, Chetal even showed him transaction records on his phone as proof. One time, Chetal even rented a big house in Stamford, Connecticut, and invited friends for a three-day party. "I remember one time we were fooling around in the basement with friends, and suddenly I saw him lying on the couch playing on his phone all by himself, basically avoiding everyone the whole time," Dias recalled, "I thought to myself, this is so strange." Paris also remembered that during a school parade, the police stopped Chetal driving the Lamborghini Urus for a traffic violation, "He immediately called his lawyer on the spot, even before the police could say anything. We all thought at that moment: Wow, this guy is really something, he's truly wealthy."

Independent investigators pointed out that Chetal was actually a secret member of an organization called Com (also known as Comm or Community). This organization originated in the hacker underground in the 1980s and has now evolved into a social network of cybercriminals and enthusiasts.

According to an unrelated FBI affidavit, a detective described Com as "a geographically dispersed, alliance of subgroups collaborating through online communication platforms like Discord and Telegram, engaging in various criminal activities."

Based on this affidavit and insights from experts who have studied Com, the activities of these subgroups include: prank-style swatting (making false reports to law enforcement or institutions to prompt a SWAT team response); SIM card swapping (typically stealing a target's phone number by deceiving customer service representatives); ransomware attacks (using malicious software to block access to one's computer files); cryptocurrency theft; and penetration attacks on enterprise systems, among others.

Allison Nixon is the Chief Research Officer of the cybersecurity expert group Unit 221B, and has been focusing on this expanding corner of the internet since 2011, now widely regarded as one of the top experts in the Com organization research field.

She stated that most Com members are young men from Western countries. In group chats, many discuss their college lives and the cybersecurity courses they are taking, with this knowledge also serving as an aid in their criminal activities. Nixon pointed out that many people initially enter this circle through games like "RuneScape," "Roblox," and "Grand Theft Auto."

By the mid-2010s, a darker world had quietly emerged in "Minecraft," a game centered around creative building, largely thanks to the emergence of online servers. These servers, owned and operated by users themselves, allowed players to team up for battles, also known as "factions." On these servers, Minecraft evolved into a competitive battlefield, followed by opportunities for profit and fraud.

Soon, servers began to introduce in-game purchases, where players could spend money to buy upgrade features such as flight abilities, stronger weapons, and armor. Some in-game items could even unlock fashionable character outfits, becoming a way for players to show off their status online.

As players increasingly gravitated towards these competitive servers, a large-scale black market also emerged on Discord, dedicated to trading game items and rare usernames. Since Minecraft players are mostly teenagers, this black market quickly became a breeding ground for scams.

Users would often agree to exchange real currency via PayPal for in-game items, but after receiving the money, scammers would block the other party's account. This behavior became so rampant that people began to offer "escrow services" to address trust issues—these escrow agents would charge a fee, hold the money and items in custody, and then distribute them to the trading parties.

In this circle, some high-value usernames have become hot collectibles, usually not exceeding four letters, such as Tree, OK, Mark, YOLO, or G, with prices sometimes exceeding ten thousand dollars.

As Minecraft's "factions" servers and black market flourished, virtual currencies also began to gain popularity in these communities, eventually replacing PayPal as the mainstream payment method. This competition, gambling, and fraud training ground without repercussions, along with players becoming increasingly familiar with cryptocurrencies, gradually turned Minecraft servers into a "breeding ground" for budding cybercriminals.

By 2017, as the price of Bitcoin rapidly surged, Com members seamlessly transitioned from Minecraft scams to cryptocurrency theft. One of Com's most popular forums was called "OGUsers," initially a platform for discussing and purchasing social media accounts and usernames, but later evolved into a hotbed of cybercrime involving activities such as SIM card hijacking and Twitter account breaches.

Nixon explained, "These antisocial communities quickly transformed into a group of overnight 'hacker millionaires,' spreading this culture because when people see others suddenly becoming millionaires, they also want to know how they did it." This also led to a rapid expansion of Com.

One of the most commonly used cryptocurrency theft methods by Com now is called "social engineering," referring to manipulating emotions to induce users to disclose sensitive information. Com members would compile a large list of potential victims obtained through data breaches and then individually target them with precision—such as in the case of victims in Washington D.C. Sometimes, they would even post "job ads" online to recruit individuals willing to assist them in carrying out scams.

Cryptocurrency investigator Nick Bax once shared a recruitment notice posted on Telegram, promising "5f a week" (meaning a five-figure weekly reward) — "as long as you act fast" — to make calls to potential targets. The ad also required a "must be American-style professional customer service voice." After completing the theft, Com members would sometimes return to the Minecraft black market, using the stolen cryptocurrency to purchase rare in-game items, then selling these items through PayPal for real cash, thus engaging in "money laundering."

When ZachXBT uncovered Veer Chetal's real identity, he and other investigators quickly identified more individuals involved in the case. In recordings obtained by ZachXBT, the thieves referred to each other by Com aliases and sometimes directly mentioned each other's real names. One name repeatedly mentioned was Malone, who is Malone Lam.

Malone Lam is a 20-year-old from Singapore and a notorious member of the Com community, using online aliases such as Greavys and Anne Hathaway. He is also a seasoned Minecraft player with a side-swept bang, frequently getting banned from servers but always finding a way back. In the spring of 2023, after conflicting with an administrator on the Minecadia server and losing some in-game items, he conducted a "doxxing" of the administrator, publicly disclosing their address and social security number online, and at least once, he called emergency services to harass them in person.

According to multiple users and Discord chat logs at the time, Chetal and Lam met in Minecraft, where they teamed up in a faction led by Lam.

In October 2023, Lam entered the United States on a 90-day visa. He was no longer actively playing Minecraft at that point. Court documents indicate that he later resorted to other fraudulent activities related to cryptocurrency to sustain his lifestyle.

Following a cryptocurrency heist in August 2024, ZachXBT tracked down Lam through what is known as OSINT (Open-Source Intelligence), primarily via social media. Within the Com chat group, there were discussions about Lam's extravagant spending habits with no clear source of funds, mentioning his lavish nightlife in Los Angeles.

ZachXBT investigated the city's most popular nightclubs, checking Instagram posts from partygoers and the clubs themselves. In one post, Malone was seen wearing a white Moncler jacket, sporting what appeared to be a diamond ring and diamond-studded sunglasses. Standing on a table, he began showering the crowd with one hundred dollar bills.

As money rained down, waitstaff paraded with champagne bottles valued at $1,500, fitted with sparklers, while holding up signs reading "@Malone." That night alone at this nightclub, he spent $569,528. At another nightclub, Lam and his entourage playfully challenged ZachXBT, instructing club patrons to hold up signs saying "TOLD U WE'D WIN" and another one reading "[Expletive] ZACHXBT."

Over the following weeks, Lam purchased 31 cars, including custom Lamborghinis, Ferraris, and Porsches, some valued at up to $3 million each. On August 24, he apparently sent a photo of a pink Lamborghini to a model. In a text message, he said, "I got you a gift, let's call it an early birthday present." She replied, "I have a boyfriend again." To which he responded, "idc" (I don't care).

On September 10, after 23 days of partying in Los Angeles, Lam flew to Miami with a group of friends on a private jet. There, he rented multiple properties, including a $7.5 million estate with 10 bedrooms. Within days, Lam filled the driveway with more luxury cars, including several Lamborghinis, one of which had the name "Malone" on the side.

Every few days, ZachXBT sends the intelligence he has gathered to law enforcement. The information generally flows only one way, but federal authorities are also conducting their own investigation concurrently. According to court documents, the suspected co-conspirators used sophisticated money laundering methods to conceal funds and identities, conducting transactions through cryptocurrency exchanges like eXch that do not require personal customer information and using virtual private networks (VPNs) to mask their true locations.

But according to authorities, at least once, they made a mistake. One suspect, when registering an account on the cryptocurrency exchange TradeOgre, forgot to use a VPN, revealing an IP address linked to a $47,500 per month property in Encino, California. The property was leased by 21-year-old Jeandiel Serrano, who has gone by aliases online such as VersaceGod, @SkidStar, and Box. By the time authorities identified Serrano, he was vacationing with his girlfriend in the Maldives.

On September 18, as Serrano flew back from the Maldives to Los Angeles International Airport, law enforcement was waiting for him at the airport. He was wearing a $500,000 watch at the time of his arrest. Upon arrest, Serrano initially denied knowledge of the scheme and agreed to speak with law enforcement without an attorney present. However, according to court reports, he quickly admitted his involvement, particularly in impersonating a Gemini employee.

Serrano admitted to owning five cars, two of which were gifts from his co-conspirators, funded by proceeds from prior frauds. He also admitted to holding approximately $20 million in victim cryptocurrency on his phone and agreed to return the funds to the FBI.

Meanwhile, agents in Miami were preparing to raid one of the mansions leased by Lam. Lam was aware of the impending raid: after Serrano's arrest, Serrano's girlfriend immediately called Lam's co-conspirators to warn them. Subsequently, they deleted their Telegram accounts and other evidence from their phones.

Later that day, a squad of FBI agents collaborating with Miami law enforcement raided a mansion near the Miami coast. Agents used explosives to breach the front metal gate, while another team entered by boat through a small saltwater canal at the back. As agents entered the house, the sound of flash-bangs reverberated through the neighborhood.

Soon after, an agent escorted Lam, handcuffed, out of the house. He was wearing a long-sleeve white shirt, deep red basketball shorts, and sneakers, with smoke lingering in the air, followed by at least five other individuals who were inside the house with him. Serrano and Lam were charged with money laundering and conspiracy to commit wire fraud. Each charge carries a maximum sentence of 20 years in prison.

Exactly one month after the heist took place, the party came to an end.

In Danbury, in the days and weeks following the kidnapping of the Chetal family, Castrovinci worked with law enforcement and federal investigators to build a case against a gang from Florida. They urgently obtained access to the suspects' phones, reviewed group chat records, and documented the members' actions.

They learned that this trip was partially funded and organized by 23-year-old Angel Borrero from Miami, who went by the alias Chi Chi. In the group chat, Borrero wrote to others, "If this goes smoothly, we'll head to California next." Federal investigators speculated that this meant the gang planned to carry out further operations in California. That day, Josue Alberto Romero (nickname Sway) sent a message to the gang, saying, "Chi Chi, we are more prepared than ever." These chat logs indicated that the gang had started coordinating their actions as early as 7 a.m. that day and were monitoring the Chetal family during part of the afternoon.

By then, law enforcement had identified a motive: they believed these individuals had targeted the Chetal family to ransom their son's wealth through kidnapping. Independent investigators believed that at least one member of the gang, Reynaldo (Rey) Diaz, using the alias Pantic, might be a Com member.

ZachXBT speculated that these thieves may have made themselves a target by bragging about their spending stories to other Com members. "You would think that after committing a crime, you would stay silent, not bring it up again," he said. "But they have to compensate for something by boasting to people they think are friends. These people may not be true friends."

On August 27, Danbury police charged six suspects in the case with multiple counts of first-degree assault, first-degree kidnapping, and reckless endangerment. Subsequently, federal charges followed suit. On September 24, a grand jury indictment filed in the Federal District Court of Connecticut charged six Florida men with kidnapping, carjacking, and conspiracy crimes.

These six Florida men represented a growing faction within the Com that was no longer focused solely on online scams but leaned more towards the use of violence. Diaz himself had been shot two years prior in Florida during an attempted robbery.

In an FBI affidavit, an agent stated that Com members often carry out "brickings, shootings, and arson attacks." According to independent investigative journalist Brian Krebs's report, in 2022, a young man named Foreshadow was kidnapped and beaten by a rival SIM swapping gang, demanding a $200,000 ransom.

In October 2023, 22-year-old Patrick McGovern-Allen from Egg Harbor Township, New Jersey, was sentenced to 13 years in prison for his involvement in violent contract work. In November of last year, reports surfaced of a Toronto-based cryptocurrency company CEO being kidnapped and demanded a $1 million ransom.

Several weeks later, a 13-year-old teenager, for creating a cryptocurrency and inflating its value, was exposed in the cryptocurrency community, with rumors swirling that even his dog was kidnapped. In January of this year, the founder of the French cryptocurrency company Ledger and his wife were kidnapped, with the kidnappers mutilating his hand and demanding payment of several million dollars worth of cryptocurrency as ransom.

However, more and more individuals unrelated to Com are being targeted, researcher Nixon explained. Some supposed Com members are involved in so-called "harm groups," where members force young women and girls into self-harm and violence. Nixon indicated that seven years ago, noteworthy Com members may have only numbered in the dozens; whereas today, there are already thousands. "Now," she said, "we are witnessing a shift from disorganized crime to organized crime, and we are currently in the midst of this transition."

These two incidents — the cryptocurrency heist and kidnappings — illustrate the complete lawlessness of Com members in the online world, leading them to believe they can continue to commit similar crimes in the real world. "I don't think they've learned anything at all," ZachXBT remarked. "I've seen many people, after being arrested or having their assets confiscated — many of them eventually went back to their old ways."

This year, five out of six Florida men pleaded guilty to federal kidnapping and conspiracy charges, facing up to 15 years in prison. In January of this year, 19-year-old Michael Revas apologized in a Hartford court for his actions, calling them "stupid," and stating he was aiding another individual in executing a "revenge plan," although he did not elaborate.

In February, 22-year-old Georgia man James Schwab was indicted for his alleged involvement in a kidnapping scheme. According to the federal criminal complaint, Schwab had a dispute with Veer Chetal at a Miami nightclub a month before the kidnapping and assisted in funding the plan, arranging transportation and accommodation for the attackers. He pleaded not guilty to the charges.

On March 25th, ZachXBT updated the latest developments of his stolen cryptocurrency investigation on X website: "Update: Wiz (Veer Chetal) has been arrested," he wrote, "Here's his photo." The attached photo showed a young man in a white t-shirt, with fluffy hair and a thick beard, looking worn out with drooping corners of his mouth and tired eyes. He looked nothing like the child in the photos on the Immaculate High School website. The charges listed in his prison record were for federal misdemeanors, but the specific charge was not detailed.

According to ZachXBT, the stolen Bitcoin he tracked has been moved to a wallet controlled by law enforcement. On that day, Sushil and Radhika Chetal's matte gray Lamborghini Urus, which was driven during the kidnapping, remains parked as evidence in a secure police impound in Danbury. The Lamborghini was once the car their son drove to school.

Source:「Original Article Link」

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia