$250 million cryptocurrency theft: Deciphering the truth about the century-old theft case within one month

Original title: They Stole a Quarter-Billion in Crypto and Got Caught Within a Month
Original author: Mitch Moxley
Original translation: zhouzhou, BlockBeats

Editor 's Note: This article tells a crime caused by cryptocurrency theft. ZachXBT tracks the luxurious life of suspect Lam through social media and assists law enforcement in the investigation. Lam and other accomplices used complex money laundering methods but were eventually arrested under police tracing. Meanwhile, another kidnapping case is also linked to the criminal group, involving several Florida men. The case revealed that cybercrime gradually evolved into a more violent real crime, and eventually, the police successfully recovered the stolen Bitcoin and related evidence.

The following is the original content (to facilitate reading comprehension, the original content has been compiled):

On August 25, 2024, on a hot afternoon, Sushil and Radhika Chetal were viewing a house in an upscale community in Danbury, Connecticut. The lawns are neatly manicured and the pool is equipped with a heating system. Sushil, vice president of Morgan Stanley's New York division, drove a newly purchased matte grey Lamborghini Urus that starts at about $240,000.

Just as they turned an intersection, a white Honda Civic suddenly bumped into a Lamborghini from behind. Meanwhile, a white Ram ProMaster truck cut in from the front, blocking the Chetal couple's way. According to a subsequent criminal indictment, a group of six men in black and masks got out of the car, forcibly dragged the Chetals and the others out of the car and pushed them towards the side door of the truck.

As Sushil resists, the attacker hits him with a baseball bat and threatens to kill him. The men tied the couple's hands and feet with tape, forcing Radhika to lie on the ground, warning her not to look at them, even if she had difficulty breathing due to asthma, begging. They also tangled Sushil's face with tape and beat him with a baseball bat again as the van ran away.

Several witnesses saw the attack and called 911 to call the police. One of them was an off-duty FBI agent living nearby, who happened to be at the scene. He followed the van and Honda Civic and informed the police in real time of the vehicle. The FBI agent also managed to record some license plate numbers.

Soon, Danbury police found the van. A patrol car lights up and tried to intercept it, but the truck driver accelerated to escape and walked wildly through the traffic. After the chase began about a mile, the driver rushed out of the road and hit the curb. Four suspects abandoned their cars and fled. Police found one of them under a bridge and arrested him after a brief pursuit. Within the next few hours, the remaining three were also found and arrested in the nearby woods. Meanwhile, police found the still-bound and terrified Chetal couple in the back of the van.

Danbury Police Detective Sergeant Steve Castrovinci was on leave that day and received a call from the shift commander notifying him of the matter. He recalled that the commander told him, "We encountered a kidnapping case, which was a real kidnapping." Castrovinci summoned several detectives to learn about the situation, went to the scene of the crime, and rushed to the police station to interrogate the suspect. According to information provided by an arrested suspect, the next morning, two other suspects were found and arrested at an Airbnb B&B in Roxbury, a 30-minute drive from Danbury, while the white Honda Civic was found.

For Castrovinci, this is an unusual and dramatic case. Danbury is a wealthy and quiet place, and although the police occasionally deal with kidnapping, it is almost always a dispute involving custody of children. Such violent kidnapping in broad daylight is simply unheard of. And even more strangely, law enforcement discovered that the suspects — between the ages of 18 and 26 — had made a special trip from Miami to Connecticut.

They also rented vans on the Turo app. "A policeman may only encounter one or two cases in his life," Castrovinci, who has 20 years of law enforcement experience and has worked for the New York Police Department for five years, told me. "Especially in places like us, this kind of thing is not common at all."

Police have hardly disclosed any information to the public in the next few weeks. Castrovinci and his team have been working hard to piece together the motives for the crime. It's hard to believe that the Chetal couple was targeted because of Sushil's executive position at investment bank. As vice president of Morgan Stanley, his salary is enviable, but it is not unusual in Danbury. If the kidnappers’ motive was money, it was very strange that they had abandoned the Chetal couple’s Lamborghini (later found abandoned in the woods). All the clues don't seem to make sense.

However, a few days after the attempted kidnapping, Castrovinci said their team received a tip from the FBI, giving the entire case an unexpected twist: the case could be linked to a huge cryptocurrency theft, just a week before the attack.

Several young people, some of whom knew on Minecraft servers, allegedly stole $250 million from an unprepared victim, triggering an incredible string of incidents involving a gang of teenagers, some independent cyber detectives tracking their operations, and multiple law enforcement agencies. It now seems that all this eventually turned into the Kidnapping of the Chetal couple—the rampant disorder of the digital dark world and its surrounding culture, permeating the real world in such a real and cruel way for the first time.

The series of events began a few weeks ago when a person living in Washington, D.C. began receiving abnormal login notifications from Google accounts that showed that the logins appeared to be from overseas. Then, on August 18, he received a call from the Google Security Team. The caller said his email account had been hacked. The phone call sounds very real - the other party has the personal information of the SAR resident. The caller asked him to verify some of his personal information through the phone, otherwise the account would be closed, and the resident did as he did.

Shortly after speaking with the so-called Google staff, the Washington, D.C. resident (hidden in federal court documents) received another call, claiming to be a security representative of the famous cryptocurrency exchange Gemini.

Similarly, the caller also had his personal information and told him that his account at Gemini (with about $4.5 million in cryptocurrency) had been hacked and had to reset two-factor authentication immediately and transfer the bitcoin in the account to another wallet to ensure the funds were secure.

The person on the phone then advises the account holder to download a program that can "enhance security." The man agreed, unaware that he was downloading a remote desktop app that would allow the caller to remotely control his computer—and thus access his other cryptocurrency account, exposing his assets to even more astonishing risks of theft. The Washington, D.C. resident proved to be an early investor in cryptocurrencies, holding over 4,100 bitcoins in total. Ten years ago, these Bitcoins were worth about $1 million; on that day, their market capitalization exceeded $243 million.

There is a core paradox in the cryptocurrency field: Although the holders of coins are usually anonymous, all transaction records are publicly recorded on an ledger called blockchain. This means that once the funds are transferred, anyone can see it. This paradox has spawned a new group of investigators who specialize in tracking suspicious transactions on the blockchain. One of the most famous ones is ZachXBT, an independent crypto crime investigator.

In the crypto world, ZachXBT is a well-known but secret person. He often posts long investigations on X (formerly Twitter), revealing people suspected of illegal acts, and sometimes even directly name them. He has about 850,000 followers on the platform. He also often shares his investigation results with law enforcement agencies. Wired magazine called him "the world's most active independent crypto crime investigator." He has never revealed his true identity online.

Just minutes after Washington, DC residents' crypto assets were cleared, ZachXBT was catching a plane at the airport when it suddenly received an abnormal transaction alert pushed on its phone. Crypto investigators often use tools to monitor the flow of cryptocurrencies around the world and set alerts for specific situations, such as when there are exchanges with transactions exceeding $100,000 and extremely loosely passed certain security measures.

The initial alarm was a six-digit deal, and the amount continued to climb to a maximum of $2 million. After passing security, ZachXBT found a seat, turned on the laptop and started tracking the transaction, eventually traced back to a wallet holding about $240 million in cryptocurrency. Some bitcoins even date back to 2012. "I felt something was wrong at the time," he told me. "Why would a person who has held Bitcoin for so many years use this kind of suspicious service that often flows into illegal funds?"

He then added wallet addresses related to these transactions to his tracking list and boarded the plane. Once connected to the cabin Wi-Fi, more transaction alerts kept coming. Over the whole day, the Bitcoin from a huge wallet was continuously cashed out through more than 15 high-handheld crypto service platforms.

After the plane landed, ZachXBT contacted several colleagues who specialized in investigating cryptocurrency theft cases. One of them is Josh Cooper-Duckett, the director of investigations from Cryptoforensic Investigators. The company is one of the increasingly independent agencies focusing on tracking cryptocurrency theft and fraud and assisting law enforcement in recovering funds for victims. Cooper-Duckett, 26, is from London and has developed an interest in cryptocurrencies in his early years. After three and a half years as a security consultant, Deloitte has focused on investigating cryptocurrency theft cases, especially those that have lost at least $100,000 – and these are very common today.

ZachXBT told Cooper-Duckett and other investigators what he found, and everyone agreed that it was extremely suspicious to clear the wallet worth nearly $250 million at once. "A person with so much money cannot suddenly wake up one weekend and decide, 'I want to transfer the money to a bunch of exchanges in batches and then exchange it for Monero and Ethereum' - normal people won't do that."

The group of crypto investigators immediately contacted the relevant exchanges and service platforms to inform them that the funds were stolen and hoped that they could freeze the funds and cooperate with the police investigation. Some platforms cooperated, but some did not. "This time, the situation is a bit like a gopher game," Cooper-Duckett said. "They keep trying to transfer their money to various exchanges and service platforms to see which side can be successfully washed out. After all, what they want to wash is $240 million, which is an astronomical figure."

Meanwhile, ZachXBT also warned his fans on X: "About seven hours ago, a suspicious transaction occurred and the possible victim's account transferred 4,064 bitcoins (about $238 million)," he wrote. The funds then flowed to crypto platforms such as THORChain, eXch, KuCoin, ChangeNOW, RAILGUN and Avalanche Bridge.

ZachXBT also noted that the victim had previously received bankruptcy compensation from Genesis. Genesis is a lending platform that filed for bankruptcy in 2023 due to the FTX crash of Sam Bankman-Fried.

Through his own network, ZachXBT eventually managed to reach the victim via email. The shocked Washington, D.C. resident then hired ZachXBT, Cryptoforensic Investigators and another crypto-investigators to help track his stolen assets.

On the same day, he also filed a police report to the FBI's Internet Crime Complaint Center, and ZachXBT immediately contacted his acquaintance in law enforcement. (Both the FBI and the Justice Department declined to be interviewed on the matter.)

The rapid growth of cryptocurrency theft cases have left federal investigators overwhelmed. According to the latest report, the Internet Crime Complaints Center (IC3) received more than 69,000 complaints involving cryptocurrency financial fraud in 2023, with a total loss of more than $5.6 billion, a 45% increase over 2022.

Although cryptocurrency-related complaints account for only 10% of all financial fraud cases, the losses caused by these cases account for nearly half of the total. The report pointed out that the decentralization of cryptocurrencies, the irreversibility of transactions and the ability to transfer funds freely around the world make it attractive to criminals and also makes it difficult for the FBI to recover funds. To this end, the FBI specially established a Virtual Assets Unit (VAU) in 2022 to specifically combat cryptocurrency theft.

Because of the large scale and extremely difficult to solve, experts say government agencies — including the FBI, the Department of Homeland Security, the Secret Service, and even the IRS — have to rely on private companies and individual investigators who have in-depth knowledge of the digital crime underworld. "Josh and Zach, they're really fast and accurate in tracking," said Nick Bax, founder of cryptocurrency analysis company Five I's.

Bax has worked with ZachXBT on several cases, but has never seen his true face. During their early calls, ZachXBT also used voice change software to make itself sound like Mickey Mouse. "To be honest, I'm very good, but compared to them, I can never catch up," Bax said. "And I think their brains have been really modified because they've been doing this since they were a kid."

Crypto Investigators usually use fake accounts to sneak into forums where hackers and scams gather together, such as Telegram and Discord, to observe their communication, planning and showing off. They found that these criminals were often young and acted quite rashly, often leaving clues inadvertently.

After ZachXBT posted a post about the theft on X, a source contacted him through a temporary account, providing some clues that might point to the thief’s identity. The informant sent several screen-recorded videos to ZachXBT, allegedly recorded when one of the scammers broadcasts the theft to friends. The video, which has a total duration of about one and a half hours, includes the call screen with the victim. In one of the videos, you can hear the scammers shouting excitedly after learning that they had successfully stole $243 million worth of Bitcoin: "Oh my god! Oh my god! 243 million! So cool! Oh my god! Oh my god! Oh my god! Brother!"

During a private chat, the scammers used pseudonyms such as Swag, $$$ and Meech, but they made a fatal mistake: One of them accidentally exposed his Windows desktop during the live broadcast, and the icon on the start menu at the bottom showed his real name - Veer Chetal, an 18-year-old from Danbury -the son of the kidnapped couple mentioned earlier.

Veer Chetal is a quiet top student who recently graduated from Immaculate High School in Danbury and is about to attend Rutgers University in New Jersey. In 2022, he completed a "Future Lawyer" project, and a photo of him was also published on the school website that year - a boy wearing glasses, a Tommy Hilfiger windproof jacket and a red Polo shirt and a bright smile.

The classmates recalled that Chetal had always been shy and loved cars. "He's basically always alone," said Marco Dias, who became friends with Chetal in his senior year. Another classmate named Nick Paris also said that Chetal was very low-key until one day in his senior year when he suddenly drove a Corvette sports car to school. "He just parked in the parking lot like that, and at 7:30 in the morning, everyone was stupid," Paris said.

Soon, Chetal was replaced by BMW (BMW) and then Lamborghini Urus. He started wearing Louis Vuitton's shirt, Gucci's shoes. On Senior Skip Day, when Paris and other classmates were just hanging out at the nearby mall, Chetal took some friends, including Dias, to New York, rented a yacht to party, and everyone took photos with bundles of cash on the deck.

Chetal claimed that he made the money by speculating on coins; Dias said that one morning during self-study class, Chetal took out his mobile phone and showed him the transaction records as proof. Once, Chetal also rented a large house in Stamford, Connecticut, and invited friends to have a three-day party. "Once I was playing with friends in the basement, I suddenly saw him lying on the sofa playing with his phone, basically avoiding everyone throughout the journey," Dias recalled. "I thought to myself, it was so strange." Paris still remembered that during a school parade, the police stopped Chetal's Lamborghini Urus for traffic violations. "He called his lawyer on the spot, and before the police could ask questions. Everyone thought: Wow, this guy is really a bit of stuff, he is really rich."

Independent investigators pointed out that Chetal is actually a secret member of an organization called Com (also known as Comm or Community). The organization originated in the hacker underground circle in the 1980s and has now evolved into a social network of cyber criminals and aspiring people.

According to the FBI affidavit in an unrelated case, an agent described Com as "a coalition of subgroups that are geographically distributed, collaborated through online communication software such as Discord and Telegram, and engaged in various criminal activities."

According to the affidavit and experts studying Com, the activities of these subgroups include: prank-style alarms (swatting, falsely calling police or schools and other institutions, causing police force to be dispatched); SIM card hijacking (SIM swapping, usually stealing target mobile phone numbers by deceiving customer service representatives); ransomware attacks (ransomware attacks) using malicious programs to prevent users or organizations from accessing their own computer files); cryptocurrency theft, and infiltration attacks on corporate systems.

Allison Nixon is the chief research officer of Unit 221B, a group of cybersecurity experts, and has been focusing on this expanding cyber corner since 2011 and is now widely regarded as one of the top experts in the field of Com organizational research.

She said that most of Com members are young men from Western countries. In group chats, many people talk about college life and the cybersecurity courses they are taking, and this knowledge has also become a helping for their criminal activities. Nixon noted that many people initially touched the entrance to this circle through video games like RuneScape, Roblox, and Grand Theft Auto.

By the mid-2010s, a darker world also quietly emerged in Minecraft—a game centered on creative construction—and this shift was largely due to the emergence of online servers. These servers are owned and operated by the user themselves, allowing players to form teams to fight, also known as "factions". On these servers, Minecraft has evolved into a highly competitive battlefield, with opportunities for profit and fraud.

Soon, the server began to introduce in-game purchase mechanisms, where players can spend money to purchase upgrade functions, such as flying ability, stronger weapons and armor. Some in-app purchases can also unlock fashionable character outfits, becoming a way for players to show off their identity and status online.

As players increasingly tend to participate in such competitive servers, a huge black market has also emerged on Discord, specializing in trading game props and rare user names. Since Minecraft players are mostly teenagers, this black market quickly became a breeding ground for fraud.

Users often agree to exchange PayPal for real money for game props, but after receiving the money, the scammer will block the other party's account. This behavior is so rampant that people begin to provide "intermediary services" to solve the trust problem - these intermediaries will charge a certain fee, keep the money and goods on their behalf, and then hand it over to both parties to the transaction.

In this circle, some high-value usernames have become popular collections, usually no more than four letters, such as Tree, OK, Mark, YOLO or G, and the prices can even be as high as more than $10,000.

As Minecraft's "faction" servers and black markets flourished, virtual currencies also became popular in these communities and eventually replaced PayPal as the mainstream trading method. This training ground for competition, gambling and fraud without a punishment mechanism, coupled with players becoming more familiar with cryptocurrencies, has gradually become a "hotbed" for breeding new cybercrime newcomers.

By 2017, Bitcoin prices soared rapidly, and Com members also took advantage of the trend to seamlessly transforming from Minecraft scams to cryptocurrency theft. One of Com's most popular forums is "OGUsers". It was originally a platform for discussing and purchasing social media accounts and user names, but later evolved into a hotbed of cyber crimes, involving SIM card hijacking, Twitter account intrusion and other activities.

"These anti-social communities have become very quickly a group of 'hacker rich people' who get rich overnight," Nixon explained. "It also causes Com to expand rapidly.

Com is the most commonly used cryptocurrency theft method now called "social engineering", which refers to inducing users to leak sensitive information by manipulating people's hearts. Com members will put together a list of potential victims obtained through data breaches and then strike them one by one – exactly what is the case of victims in Washington DC. Sometimes, they also post "job ads" online to recruit people who are willing to assist them in committing fraud.

Cryptocurrency investigator Nick Bax once shared a recruitment notice posted on Telegram, promising “5f a week” (the five-digit compensation per week) – “as long as you are not slow” – to call potential targets. The notice also required that "it must be American-style professional customer service voice." After completing the theft, Com members sometimes return to the Minecraft black market, using the stolen cryptocurrency to purchase rare game props, and then selling these props through PayPal for real money in order to "launder money".

When ZachXBT found Veer Chetal's true identity, he and other investigators quickly locked in more people involved. In the recordings obtained by ZachXBT, the thieves used Com code names to name each other and sometimes directly said each other's real names. One of the names mentioned repeatedly is Malone, which is Malone Lam.

Malone Lam is a Singaporean, 20 years old and is a notorious member of the Com circle, with web names including Greavys and Anne Hathaway. He is also a veteran Minecraft player, with slanted bangs cut, often blocked by the server, and always managed to return. In the spring of 2023, he had a conflict with the administrator in the Minecadia server and lost some game props, so he conducted a "human search" of the administrator, published their address and social security numbers online, and at least once, he called emergency service personnel to harass him.

According to multiple users and Discord chat records at the time, Chetal and Lam met in Minecraft, and they once teamed up to play games in a "fact" led by Lam.

In October 2023, Lam entered the United States with a 90-day visa. He basically stopped playing Minecraft anymore. According to court documents, he later relied on other cryptocurrencies-related fraudulent means to maintain his lifestyle.

After the cryptocurrency theft in August 2024, ZachXBT tracked Lam through so-called OSINT (Open Source Intelligence). In the Com chat group, it was rumored that Lam was squandering wildly and no one knew where his money came from, but they mentioned his luxurious life in a nightclub in Los Angeles.

ZachXBT surveyed the city’s most popular nightclubs and checked Instagram updates from party participants and the club itself. In one post, Malone wore a white Moncler jacket, wearing a diamond ring and diamond-set sunglasses. He stood on the table and began to sprinkle hundreds of dollars at the crowd.

As the money was spilling like rain, the waiters held champagne bottles worth $1,500, with fireworks stuck at the bottle, and held up placards that said "@Malone". He spent $569,528 on this nightclub alone that night. In another nightclub, Lam and his team also schemingly challenged ZachXBT, instructing the nightclub guests to hold a placard with the words "TOLD U WE" D WIN" (tell you we'll win), while the other one reads "[swear words] ZACHXBT".

Over the next few weeks, Lam bought 31 cars, including custom Lamborghini, Ferrari and Porsche, some of which were worth up to $3 million. On August 24, he apparently sent a pink Lamborghini photo to a model. He texted, "I bought you a gift, and we treat it as an early birthday gift." She replied, "I have a boyfriend again." He replied, "idc" (I don't care).

Lam took a private jet to Miami with a group of friends on September 10 after a 23-day party breeze in Los Angeles. There, he rented several properties, including a $7.5 million 10-bedroom estate. Within a few days, Lam parked the driveway with more luxury cars, including several Lamborghini, with the name "Malone" printed on the side of one.

Every few days, ZachXBT sends the intelligence he has collected to law enforcement. Information is generally flowing one-way, but federal authorities are also conducting their own investigations at the same time. According to court documents, suspects suspected of co-conspiracy use sophisticated money laundering methods to hide funds and cover up their identities, trading through cryptocurrency exchanges like eXch, which do not require personal customer information and use virtual private networks (VPNs) to cover up their real location.

But at least once, according to authorities, they made a mistake when a suspect was registering an account with TradeOgre, a digital currency exchange, forgot to use a VPN, resulting in the IP address he connected to point to a $47,500 monthly property in Encino, California. The property was leased by 21-year-old Jeandiel Serrano, who has used aliases such as VersaceGod, @SkidStar and Box online. By the time the authorities identified Serrano, he was on vacation with his girlfriend in the Maldives.

On September 18, when Serrano flew back to Los Angeles International Airport from the Maldives, law enforcement officers were already waiting for him at the airport. He wore a $500,000 watch at the time. At the time of arrest, Serrano initially denied being aware of the theft and agreed to speak with law enforcement without an attorney. But according to the court report, he quickly admitted his involvement, especially his posing as a Gemini employee.

Serrano admits he owns five cars, two of which were gifts from his co-conspirators, and the funds for the gifts were derived from previous scams. He also admitted that he had about $20 million in victim cryptocurrency on his phone and agreed to return the funds to the FBI.

Meanwhile, Miami agents are preparing to raid one of the mansions that Lam rents. Lam knows the attack is coming: After Serrano is arrested, Serrano's girlfriend immediately calls to warn Lam's co-conspirators. Afterward, they deleted their Telegram accounts and other evidence from their phones.

Later that day, a team of FBI agents working with Miami police raided a mansion near the Miami coast. The agents used a blasting device to open the metal door in front, while another group of agents entered by boat through the small saltwater canal in the rear. As agents entered the house, the explosion of flash bombs echoed around the neighborhood.

Shortly after, an agent walked out of the house with handcuffed Lam, wearing a long-sleeved white top, crimson basketball shorts and sneakers, with smoke in the air, followed by at least five others who were with him in the house. Serrano and Lam are charged with money laundering and co-conspiracy to commit telecommunications fraud. Each charge may face up to 20 years in prison.

Just one full month after the robbery, the party ended.

In Danbury, the days and weeks after the Chetal family was kidnapped, Castrovinci and police worked with federal investigators to establish cases against gangs from Florida. They urgently obtained access to the suspect's mobile phone, viewed the group chat records and recorded the actions of the gang members.

They learned that the trip was partially funded and organized by 23-year-old Miami native Angel Borrero, who was nicknamed Chi Chi. In the group chat, Borrero wrote to others: "If this goes well, we'll go to California." Federal investigators speculated that this means the gang plans to conduct other operations in California. On the same day, Josue Alberto Romero (nickname Sway) sent a message to the gang: "Chi Chi, we are more prepared than ever." These chat records show that the gang started coordinating operations as early as 7 a.m. and monitored the Chetal family for part of the afternoon.

By then, police had found the motive: they believed the men were targeting the Chetal family in order to blackmail the money their son had by kidnapping. Independent investigators believe that at least one member of the gang, Reynaldo (Rey) Diaz, using the alias Pantic, may be a Com member.

ZachXBT speculated that the thieves might have made themselves a target by showing off their spending stories to other Com members. "You would think that after the crime you would remain silent and not mention it again," he said. "But they have to make up for anything by showing off to people they think are friends. These people may not be true friends."

On August 27, Danbury police filed charges against six suspects in the case: multiple counts of first-degree assault, first-degree kidnapping and reckless and dangerous crimes. Then, federal charges followed. On September 24, a grand jury indictment filed in the federal district court of Connecticut alleges six Florida men committed kidnapping, carjacking and conspiracy.

These six Florida men represent a growing faction in Com, who no longer focus on online scams simply but prefer to use violence. Diaz himself was shot in Florida two years ago for an attempted robbery.

In the FBI affidavit, an agent said Com members often carried out "brick smashes, gunshots and arson attacks." In 2022, a young man named Foreshadow was kidnapped and beaten by a competing SIM exchange gang, demanding a ransom of $200,000, according to independent investigative journalist Brian Krebs.

In October 2023, Patrick McGovern-Allen, a 22-year-old man from Egg Harbor, New Jersey, was sentenced to 13 years in prison after being hired by a gang of cybercriminals for his involvement in violent employment. Last November, it was reported that the CEO of a Toronto-based cryptocurrency company was kidnapped and asked for a $1 million ransom.

A few weeks later, a 13-year-old boy was exposed in the cryptocurrency community for creating cryptocurrencies and boosting its value, and rumored his dog was kidnapped. In January, the founder of French cryptocurrency company Ledger was kidnapped with his wife and kidnappers mutilated his hand and demanded millions of dollars in ransom in cryptocurrency.

However, more and more people who are not related to Com are targeted, Nixon, the researcher said. Some of the so-called Com members are involved in so-called “harm groups” that force young women and girls to self-harm and commit violence. Seven years ago, there were probably only a few dozen members worth watching in Com; and today, there are thousands. "Now," she said, "we are witnessing the evolution from unorganized crime to organized crime, and we are in the middle of this transition."

These two incidents—cryptocurrency robbery and kidnapping—indicate that Com members’ total lawlessness in the online world gave them the illusion that they thought they could continue to commit similar crimes in the real world. "I don't think they learned anything at all," ZachXBT said. "I've seen a lot of people, after being arrested or having their assets seized - many of them end up returning to their original lives."

Five of six Florida men have pleaded guilty to federal kidnapping and conspiracy charges this year, and they may face 15 years in prison. In January, 19-year-old Michael Rivas apologized for his actions in Hartford court, calling them "stupid" and saying he was helping another person with a "revenge plan" even though he did not elaborate on it.

In February, 22-year-old Georgia man James Schwab was charged for allegedly related to the kidnapping program. Schwab clashed with Veer Chetal in a Miami nightclub a month before the abduction, and he helped fund the program to arrange transportation and accommodation for the attackers, according to the federal criminal indictment. He pleaded not guilty to this.

On March 25, ZachXBT updated on X's website the latest progress in tracking the stolen cryptocurrency investigation: "Update: Wiz (Ville Chetal) was arrested," he wrote, "This is his picture." The attached photo shows a young man wearing a white T-shirt, fluffy hair and thick beard, with drooping corners of his mouth and exhausted eyes. He is far from the kids in the photos on the Immaculate High School website. The charge listed in the prison record is a federal misdemeanor, but the offence is not specified.

According to ZachXBT, the stolen Bitcoin he tracked has been transferred to a wallet controlled by law enforcement. The matte grey Lamborghini Urus driving during the kidnapping of Sushil and Radhika Chetal were still parked as evidence in a security police parking lot in Danbury. This Lamborghini was once the car their son drove when he was in school.