$250 Million Cryptocurrency Heist: Uncovering the Truth of the Heist of the Century in One Month

Editor's Note: This article tells the story of a crime caused by cryptocurrency theft. ZachXBT tracked down the luxurious life of the suspect Lam through social media and assisted law enforcement in the investigation. Lam and other accomplices used complex money laundering methods, but were eventually arrested by the police. At the same time, another kidnapping case was also related to the criminal group, involving several Florida men. The case revealed that cybercrime has gradually evolved into a more violent real crime. In the end, the police successfully recovered the stolen Bitcoin and related evidence.

The following is the original content (the original content has been reorganized for easier reading and understanding):

On the sultry afternoon of August 25, 2024, Sushil and Radhika Chetal were looking at houses in an upscale community in Danbury, Connecticut. The lawns were neatly manicured and the swimming pool was equipped with a heated system. Sushil, a vice president of Morgan Stanley's New York branch, was driving a newly purchased matte gray Lamborghini Urus, an SUV starting at about $240,000.

Just as they turned an intersection, a white Honda Civic suddenly hit the Lamborghini from behind. At the same time, a white Ram ProMaster truck also cut in from the front, blocking the Chetals' way. According to a criminal complaint filed later, a group of six men dressed in black and wearing masks got out of the car, dragged the Chetals out and pushed them toward the side door of the van.

When Sushil resisted, the attackers hit him with a baseball bat and threatened to kill him. The men bound the couple's hands and feet with duct tape, forced Radhika to the ground, and warned her not to look at them, even as she pleaded and breathed hard due to asthma. They also wrapped duct tape around Sushil's face and beat him again with a baseball bat as the van sped away.

Multiple witnesses saw the attack and called 911. One of them was an off-duty FBI agent who lived nearby and happened to be at the scene. He tracked the van and the Honda Civic and notified police of the vehicles' movements in real time. The FBI agent also managed to record a partial license plate number.

Soon enough, Danbury police found the van. A patrol car flashed its lights and tried to stop it, but the driver of the van sped away, weaving through traffic. About a mile into the chase, the driver ran off the road and hit a curb. Four suspects abandoned the vehicle and fled. Police found one of them under a bridge and arrested him after a brief pursuit. The other three were found and arrested in nearby woods over the next few hours. Meanwhile, police found the Chetals, still bound and terrified, in the back of the van.

Danbury Police Detective Sergeant Steve Castrovinci was on leave that day when his shift commander called to inform him of the incident. He recalled the commander telling him, "We have a kidnapping, a real kidnapping." Castrovinci gathered several detectives to get a feel for the situation, stopped by the crime scene, and then rushed to the station to interview the suspects. Based on information provided by one of the arrested suspects, the next morning, two more suspects were found and arrested at an Airbnb in Roxbury, a 30-minute drive from Danbury, and the white Honda Civic was also found.

For Castrovinci, this was an unusual and dramatic case. Danbury is a wealthy and quiet place. Although the police occasionally deal with kidnapping cases, they almost always involve disputes over child custody. Violent kidnappings in broad daylight are unheard of. What's even stranger is that law enforcement discovered that these suspects—ages between 18 and 26—had traveled all the way to Connecticut from Miami.

They also rented trucks on the Turo app. "A police officer may encounter one or two cases in his lifetime," Castrovinci, who has 20 years of law enforcement experience and five years with the New York Police Department, told me. “Especially in a place like ours, this is not something that happens very often.”

Police said little in the weeks that followed. Castrovinci and his team worked to piece together a motive. It was hard to believe that the Chetals were targeted because of Sushil’s senior position at the investment bank. As a vice president at Morgan Stanley, his salary, while enviable, was not unusual in Danbury. If the kidnappers were motivated by money, it was odd that they would abandon the Chetals’ Lamborghini, which was later found abandoned in the woods. None of the clues seemed to add up.

A few days after the attempted kidnapping, however, Castrovinci said his team received a tip from the FBI that offered an unexpected twist: It might be linked to a massive cryptocurrency theft that had taken place just a week before the attack.

The suspected theft of $250 million from an unsuspecting victim by a group of young men, some of whom met on a Minecraft server, set off an incredible chain of events involving a gang of teenage cybercriminals, independent cybersleuths who tracked their movements, and multiple law enforcement agencies. It now appears that it all culminated in the kidnapping of the Chetals — the first time the rampant disorder of the digital dark world and the culture surrounding it has seeped into the real world in such a realistic and brutal way.

The chain of events began a few weeks ago, when a man living in Washington, D.C., began receiving unusual login notifications to his Google account that appeared to be coming from overseas. Then, on August 18, he received a call from someone claiming to be from Google's security team. The caller said his email account had been compromised. The call sounded very real — the caller had the D.C. resident's personal information. The caller asked him to verify some of his personal information over the phone or his account would be closed, which the resident did.

Soon after speaking with the alleged Google employee, the Washington, D.C., resident (whose identity is hidden in federal court documents) received another call from someone claiming to be a security representative for the prominent cryptocurrency exchange Gemini.

The caller, who likewise had his personal information, told him that his account at Gemini (which held about $4.5 million in cryptocurrency) had been hacked and that he had to immediately reset two-factor authentication and move his Bitcoin to another wallet to keep his funds safe.

The person on the phone then suggested that the account holder download a program that would “enhance security.” The man agreed, not knowing that he was downloading a remote desktop application that would give the caller remote control of his computer—and thus access to another of his cryptocurrency accounts, exposing his assets to an even more alarming risk of theft.

It turns out that the Washington, D.C., resident was an early investor in cryptocurrency, holding more than 4,100 Bitcoins in total. Ten years ago, those bitcoins would have been worth about $1 million; on that day, they were worth more than $243 million.

There’s a core paradox in the world of cryptocurrency: While the holders of the coins are usually anonymous, all transactions are publicly recorded on a ledger called the blockchain. That means that once the money is moved, anyone can see it. This paradox has given rise to a new breed of investigators who specialize in tracking suspicious transactions on the blockchain. One of the most famous is ZachXBT, an independent crypto crime investigator.

In the crypto world, ZachXBT is a well-known but secretive figure. He often posts long investigative posts on X (formerly Twitter) to expose people suspected of wrongdoing, sometimes even naming them directly. He has about 850,000 followers on the platform. He also often shares his findings with law enforcement agencies. Wired magazine called him "the most active independent crypto crime investigator in the world." He has never revealed his real identity online.

Just minutes after the crypto assets of Washington, D.C. residents were emptied, ZachXBT was at the airport to catch a flight when he received an unusual transaction alert on his phone. Crypto investigators often use tools to monitor the flow of cryptocurrencies around the world and set alerts for specific situations, such as when a transaction amount exceeds $100,000 and passes through certain exchanges with extremely lax security measures.

The initial alert was a mid-six-digit transaction, and then the amount continued to climb, reaching a maximum of $2 million. After passing through security, ZachXBT found a seat, opened his laptop and began to track the transaction, eventually tracing it back to a wallet holding about $240 million in cryptocurrencies. Some bitcoins can even be traced back to 2012. “That’s when I thought, ‘This is not right,’ ” he told me. “Why would someone who’s held bitcoin for years use this shady service that’s been flooded with illicit money?” He then added the wallet addresses associated with the transactions to his tracking list and boarded the plane. Once connected to the cabin Wi-Fi, more transaction alerts kept coming. Throughout the day, the bitcoins from the huge wallet were cashed out through more than 15 high-fee crypto services. After the plane landed, ZachXBT contacted several colleagues who specialize in investigating cryptocurrency thefts. One of them was Josh Cooper-Duckett, the director of investigations at Cryptoforensic Investigators. The company is one of a growing number of independent organizations focused on tracking cryptocurrency theft and fraud and helping law enforcement recover funds for victims. Cooper-Duckett, 26, is from London and became interested in cryptocurrency at an early age. After three and a half years as a security consultant at Deloitte, he began to focus on investigating cryptocurrency thefts, especially those involving losses of at least $100,000—which are now common.

ZachXBT told Cooper-Duckett and other investigators what he had found, and they all agreed that the act of emptying a wallet worth nearly $250 million in one go was extremely suspicious. "Someone with that much money doesn't wake up one weekend and decide, 'I'm going to transfer it to a bunch of exchanges and convert it into Monero and Ethereum.' That's not what a normal person would do."

The crypto investigators then contacted the exchanges and service platforms involved, telling them that the funds were stolen and hoping they would freeze the funds and cooperate with the police investigation. Some platforms cooperated, but some did not. "This was a bit of a game of whack-a-mole," Cooper-Duckett said. "They keep trying to transfer the money to various exchanges and service platforms to see which one can successfully launder it. After all, they have to launder $240 million, which is an astronomical figure." At the same time, ZachXBT also issued a warning to his fans on X: "About seven hours ago, a suspicious transaction occurred, and 4,064 bitcoins (about $238 million) were transferred out of the possible victim's account." He wrote. The funds then flowed to crypto platforms such as THORChain, eXch, KuCoin, ChangeNOW, RAILGUN and Avalanche Bridge. ZachXBT also noted that the victims had previously received bankruptcy compensation from Genesis, a lending platform that filed for bankruptcy in 2023 due to the collapse of Sam Bankman-Fried's FTX.

Through his network of contacts, ZachXBT eventually managed to contact the victim via email. The shocked Washington, D.C., resident then hired ZachXBT, Cryptoforensic Investigators, and another crypto investigation firm to help track his stolen assets.

On the same day, he also filed a police report with the F.B.I.’s Internet Crime Complaint Center, and ZachXBT immediately contacted his contacts in law enforcement. (Both the F.B.I. and the Justice Department declined to be interviewed for this story.)

Crypto thefts are growing so fast that federal investigators are overwhelmed. According to the latest report, the Internet Crime Complaint Center (IC3) received more than 69,000 complaints involving cryptocurrency financial fraud in 2023, with total losses exceeding $5.6 billion, a 45% increase from 2022.

Although cryptocurrency-related complaints account for only 10% of all financial fraud cases, the losses caused by these cases account for nearly half of the total. The report pointed out that the decentralized nature of cryptocurrency, the irreversibility of transactions, and the fact that funds can be freely transferred around the world make it extremely attractive to criminals and make it difficult for the Federal Bureau of Investigation (F.B.I.) to recover funds. To this end, the F.B.I. established the Virtual Assets Unit (V.A.U.) in 2022 to specifically combat cryptocurrency theft.

Due to the large scale of the cases and the extremely high difficulty of detection, experts say that government agencies - including the F.B.I., the Department of Homeland Security, the Secret Service, and even the Internal Revenue Service - have to rely on private companies and individual investigators who have a deep understanding of the digital criminal underground world. "Josh and Zach, they are really fast and accurate in tracking," said Nick Bax, founder of the cryptocurrency analysis company Five I's.

Bax has worked with ZachXBT on multiple cases but has never seen him in person. In their early calls, ZachXBT used voice-changing software to make himself sound like Mickey Mouse. "To be honest, I'm pretty good, but I'll never be as good as them," Bax said. "And I think their brains are really modified because they've been doing this since they were very young."

Crypto investigators often use fake accounts to infiltrate forums such as Telegram and Discord where hackers and scammers gather, observing their communications, planning and showing off. They find that these criminals are often young and act quite recklessly, often leaving clues inadvertently.

After ZachXBT posted about the theft on X, a source contacted him through a temporary account and provided some clues that might point to the identity of the thief. The informant sent ZachXBT several screen recordings that one of the scammers allegedly recorded while live-streaming the theft to friends. The videos, which run about an hour and a half in total, include phone calls with the victims. In one video, the scammers can be heard exclaiming in excitement after learning that they had successfully stolen $243 million worth of Bitcoin: "Oh my god! Oh my god! 243 million! That's great! Oh my god! Oh my god! Bro!"

In private chats, the scammers used aliases such as Swag, $$$, and Meech, but they made a fatal mistake: One of them accidentally exposed his Windows desktop during the live broadcast, and the icon that popped up on the bottom of the Start menu showed his real name - Veer Chetal, an 18-year-old from Danbury - the son of the kidnapped couple mentioned earlier. Veer Chetal was a quiet, overachieving student who recently graduated from Immaculate High School in Danbury and was heading to Rutgers University in New Jersey. In 2022, he completed a Future Lawyers program, and a photo of him was posted on the school's website that year - a boy wearing glasses, a Tommy Hilfiger windbreaker, a red polo shirt and a big smile. Classmates recalled that Chetal had always been shy and loved cars. "He was basically a loner," said Marco Dias, who befriended Chetal during his junior year. Another classmate, Nick Paris, also said that Chetal had been keeping a low profile until one day midway through his junior year, when he suddenly drove up to school in a Corvette sports car. "He just parked in the parking lot at 7:30 in the morning, and everyone was stunned," Paris said.

Soon, Chetal switched to a BMW, then a Lamborghini Urus. He began wearing Louis Vuitton shirts and Gucci shoes. On Senior Skip Day, while Paris and other classmates simply wandered the nearby mall, Chetal took some friends, including Dias, to New York, rented a yacht and had a party, taking pictures on the deck with bundles of cash.

Chetal claimed he made the money by trading in cryptocurrencies; Dias said that one morning during study time, Chetal pulled out his phone and showed him his transaction records as proof. At one point, Chetal rented a large house in Stamford, Connecticut, and invited friends to a three-day party. “I was hanging out with my friends in the basement, and I saw him lying on the couch, on his phone, basically avoiding everybody,” Dias recalls. “I thought, this is weird.” Paris remembers when police stopped Chetal’s Lamborghini Urus for a traffic violation during a school parade. “He called his lawyer right away, before they could even talk to him. People were like, wow, this guy is really something, this guy has real money.”

Independent investigators have revealed that Chetal was a member of a secret group called Com (also known as Comm or Community), which originated in the 1980s hacker underground and has evolved into a social network for cybercriminals and aspiring individuals.

In an F.B.I. affidavit in an unrelated case, an agent described Com as “a geographically dispersed coalition of subgroups that collaborate through online messaging apps such as Discord and Telegram to engage in a variety of criminal activities.”

The subgroups’ activities have included swatting (false alerts to police or institutions such as schools to trigger police response); SIM swapping (stolen phone numbers, often by tricking customer service representatives); ransomware attacks (the use of malicious programs to prevent users or organizations from accessing their computer files); cryptocurrency theft; and penetration attacks on corporate systems, according to the affidavit and experts who have studied Com.

Allison Nixon, chief research officer at Unit 221B, a group of cybersecurity experts, has been following this expanding corner of the Internet since 2011 and is now widely considered one of the top experts on Com. Com members are mostly young men from Western countries, she said. In group chats, many talk about college life and the cybersecurity courses they are taking, which helps them carry out their criminal activities. Nixon pointed out that many people's initial entry into this circle is through video games such as RuneScape, Roblox and Grand Theft Auto. By the mid-2010s, a darker world was quietly emerging in Minecraft, a game centered on creative construction, and this shift was largely due to the emergence of online servers. These servers are owned and operated by users and allow players to team up to fight each other, also known as "factions." On these servers, Minecraft has evolved into a fiercely competitive battlefield, and with it comes opportunities for profit and fraud.

Soon, servers began to introduce in-game purchases, allowing players to spend money to buy upgrades, such as the ability to fly, stronger weapons, and armor. Some in-game purchases also unlocked fashionable character costumes, which became a way for players to show off their status online.

As players became more and more inclined to participate in these competitive servers, a large black market emerged on Discord, specializing in trading in-game props and rare usernames. Since most of Minecraft's players are teenagers, this black market quickly became a hotbed for fraud.

Users often agreed to pay real money via PayPal in exchange for in-game props, but after receiving the money, the scammers would block the other party's account. This behavior became so rampant that people began to provide "intermediary services" to solve the trust problem - these intermediaries would charge a certain fee, keep the money and items on behalf of the transaction, and then transfer them to the two parties separately.

In this circle, some high-value usernames have become hot collectibles, usually no more than four letters, such as Tree, OK, Mark, YOLO or G, and the price can even be as high as more than $10,000.

As Minecraft's "faction" servers and black markets flourished, virtual currencies also became popular in these communities and eventually replaced PayPal as the mainstream transaction method. This unpunished competition, gambling and fraud training ground, coupled with players' increasing familiarity with cryptocurrency, has gradually turned Minecraft servers into a "hotbed" for new cybercriminals.

By 2017, the price of Bitcoin soared rapidly, and Com members also seamlessly transformed from Minecraft fraud to cryptocurrency theft. One of Com's most popular forums is called "OGUsers", which was originally a platform for discussing and purchasing social media accounts and usernames, but later evolved into a hotbed of cybercrime involving SIM card hijacking, Twitter account hacking and other behaviors.

Nixon explained: "These antisocial communities quickly became a group of overnight "hacker millionaires" and spread this culture because people saw others suddenly become millionaires and wanted to know how they did it." This led to the rapid expansion of Com.

Com's most common method of cryptocurrency theft is called "social engineering", which refers to the manipulation of people's minds to induce users to disclose sensitive information. Com members will compile a large list of potential victims obtained through data breaches, and then target them one by one - as was the case with the victims in Washington, D.C. Sometimes, they will post "wanted ads" online to recruit people willing to help them carry out fraud.

Crypto investigator Nick Bax once shared a job posting posted on Telegram, promising "5f a week" (a five-figure salary) - "as long as you are not slow" - to call potential targets. The notice also requires that "the voice of the customer service must be American-style professional." After completing the theft, Com members sometimes return to the Minecraft black market and use the stolen cryptocurrency to buy rare game props, and then sell these props through PayPal for real cash to "launder money."

When ZachXBT found out Veer Chetal's true identity, he and other investigators quickly locked in more people involved in the case. In the recordings obtained by ZachXBT, the thieves called each other by Com code names, and sometimes directly said each other's real names. One name that was mentioned repeatedly was Malone, that is, Malone Lam.

Malone Lam is a 20-year-old Singaporean who is a notorious member of the Com circle. His online names include Greavys and Anne Hathaway. He is also a veteran Minecraft player with side-cut bangs. He is often banned from the server, but always manages to return. In the spring of 2023, he lost some game items after a conflict with administrators on the Minecadia server, so he "human-searched" the administrators, published their addresses and social security numbers online, and at least once called emergency services to harass them.

According to multiple users and Discord chat records at the time, Chetal and Lam met in Minecraft and played the game as a team in a "faction" led by Lam.

In October 2023, Lam entered the United States on a 90-day visa. He had basically stopped playing Minecraft. According to court documents, he then relied on other cryptocurrency-related frauds to support his lifestyle.

After the August 2024 cryptocurrency theft, ZachXBT tracked Lam through so-called OSINT (open source intelligence), that is, through social media. Com chat groups were full of rumors that Lam was on a spending spree, and no one knew where his money was coming from, but they mentioned his lavish lifestyle in Los Angeles nightclubs.

ZachXBT investigated the city's most popular nightclubs and looked at Instagram feeds from partygoers and the clubs themselves. In one post, Malone, wearing a white Moncler jacket and what appeared to be a diamond ring and diamond-encrusted sunglasses, stood on a table and began to sprinkle $100 bills into the crowd.

As the money rained down, waiters carried $1,500 bottles of champagne with sparklers stuck in the tops and held up signs that read "@Malone." He spent $569,528 that night at the club alone. At another nightclub, Lam and his team also pranked ZachXBT, directing clubgoers to hold signs that read "TOLD U WE'D WIN" and another that read "[expletive] ZACHXBT."

In the following weeks, Lam bought 31 cars, including customized Lamborghinis, Ferraris and Porsches, some worth up to $3 million. On August 24, he apparently texted a model a photo of a pink Lamborghini. "I got you a present, we're doing it as an early birthday present," he texted. She replied, "I have a boyfriend again." He replied, "idc" (I don't care).

On September 10, after 23 days of partying in Los Angeles, Lam and a group of friends flew to Miami on a private jet. There, he rented multiple properties, including a $7.5 million, 10-bedroom estate. Within days, Lam had filled the driveway with more luxury cars, including several Lamborghinis, one of which had the name "Malone" emblazoned on the side.

Every few days, ZachXBT sent the intelligence he gathered to law enforcement. Information generally flowed one way, but federal authorities were conducting their own investigations at the same time. According to court documents, the suspects in the conspiracy used sophisticated money-laundering methods to hide funds and mask their identities, trading through cryptocurrency exchanges like eXch that did not request personal customer information and using virtual private networks, or VPNs, to mask their true location.

But in at least one case, according to authorities, a suspect forgot to use a VPN when registering an account with TradeOgre, a digital currency exchange, and the IP address he connected to was pointed to a $47,500-a-month property in Encino, California. The property was rented by Jeandiel Serrano, 21, who used aliases such as VersaceGod, @SkidStar and Box online. By the time authorities identified Serrano, he was vacationing in the Maldives with his girlfriend.

On September 18, Serrano flew back from the Maldives to Los Angeles International Airport, where law enforcement officers were waiting for him. He was wearing a watch worth $500,000. When he was arrested, Serrano initially denied knowledge of the theft and agreed to speak to law enforcement without an attorney. But according to court reports, he soon admitted his involvement, especially his impersonation of a Gemini employee.

Serrano admitted that he owned five vehicles, two of which were gifts from his co-conspirators, who had received funds from previous scams. He also admitted that he had about $20 million in victims’ cryptocurrency on his phone and agreed to return the funds to the FBI.

Meanwhile, agents in Miami were preparing to raid one of Lam’s rented mansions. Lam knew the raid was coming: Serrano’s girlfriend called to warn Lam’s co-conspirators immediately after his arrest. They then deleted their Telegram accounts and other evidence from their phones.

Later that day, a team of FBI agents working with Miami police raided a mansion near the coast of Miami. Agents used explosive devices to open the metal gates in the front, while another team entered by boat through a small saltwater canal in the back. As the agents entered the house, the sound of flashbang bangs echoed through the neighborhood.

Soon after, an agent led Lam out of the house in handcuffs, wearing a long-sleeved white top, crimson basketball shorts and sneakers, as smoke filled the air, followed by at least five other people who had been inside with him. Serrano and Lam are charged with money laundering and conspiracy to commit wire fraud. Each charge carries a possible maximum sentence of 20 years in prison.

To the day, exactly one month after the robbery, the party was over.

In the days and weeks after the Chetals were kidnapped in Danbury, Castrovinci and police worked with federal investigators to build a case against a gang from Florida. They scrambled to gain access to the suspects’ phones, from which they reviewed group chats and documented the movements of gang members.

They learned that the trip was financed and organized in part by Angel Borrero, a 23-year-old Miami native who goes by the nickname Chi Chi. In the group chat, Borrero wrote to others, “If this goes well, we’ll go to California next.” Federal investigators speculated that this meant the gang planned other operations in California. That same day, Josue Alberto Romero, known as Sway, sent the gang a message: “Chi Chi, we are more prepared than ever.” The chats show that the gang began coordinating operations as early as 7 a.m. and spent part of the afternoon stalking the Chetals.

By then, police had a motive: They believed the men were targeting the Chetals to extort money from their sons through kidnapping. Independent investigators believe that at least one member of the gang, Reynaldo (Rey) Diaz, who used the alias Pantic, may have been a member of the Com.

ZachXBT speculated that the thieves may have made themselves targets by showing off their stories of spending money to other Com members. “You would think that after a crime you would keep quiet and not talk about it again,” he said. "But they have to make up for it by showing off to people they thought were friends. These people may not be real friends."

On August 27, Danbury police filed charges against six suspects in the case: multiple counts of first-degree assault, first-degree kidnapping and reckless endangerment. Federal charges followed. On September 24, a grand jury indictment filed in federal district court in Connecticut charged six Florida men with kidnapping, carjacking and conspiracy.

The six Florida men represent a growing faction of Com that is no longer focused solely on online scams and is more inclined to use violence. Diaz himself was shot in Florida two years ago during an attempted robbery.

In an FBI affidavit, an agent said Com members often carried out "brick-throwing, shooting and arson attacks." According to independent investigative journalist Brian Krebs, in 2022, a young man named Foreshadow was kidnapped and beaten by a competing SIM swapping gang for a ransom of $200,000.

In October 2023, Patrick McGovern-Allen, a 22-year-old from Egg Harbor Township, New Jersey, was sentenced to 13 years in prison for participating in violent work for hire after being hired by a group of cybercriminals. Last November, it was reported that the CEO of a Toronto-based cryptocurrency company was kidnapped and demanded a $1 million ransom.

A few weeks later, a 13-year-old was exposed in the cryptocurrency community for creating cryptocurrency and inflating its value, and his dog was rumored to be kidnapped. In January of this year, the founder of French cryptocurrency company Ledger was kidnapped with his wife, his hands were mutilated, and a ransom of millions of dollars in cryptocurrency was demanded.

However, more and more people not associated with Com are being targeted, said Nixon, the researcher. Some of the alleged Com members are involved in so-called “harm groups,” whose members pressure young women and girls to commit self-harm and violence. Seven years ago, Nixon said, there were probably only a few dozen members of Com worth noting; today, there are thousands. “Right now,” she said, “we’re seeing the evolution from disorganized crime to organized crime, and we’re in the middle of that transition.”

The two incidents — the cryptocurrency heist and the kidnapping — suggest that the sheer lawlessness of Com members in the online world has given them the illusion that they can continue to commit similar crimes in the real world. “I don’t think they’ve learned anything at all,” said ZachXBT. “I’ve seen a lot of people, after they’ve been arrested or had their assets seized — a lot of them end up going back to their old lives.”

Five of the six Florida men pleaded guilty this year to federal kidnapping and conspiracy charges, and they could face up to 15 years in prison. In January, Michael Rivas, 19, apologized in a Hartford courtroom for his actions, calling them “stupid” and saying he was helping another man carry out a “revenge plan,” though he didn’t elaborate.

In February, James Schwab, 22, of Georgia, was indicted for his alleged role in the kidnapping plot. According to the federal criminal complaint, Schwab had a run-in with Veer Chetal at a Miami nightclub a month before the kidnapping, and that he helped finance the plan, arranging transportation and lodging for the attacker. He has pleaded not guilty.

On March 25, ZachXBT updated the X website with the latest progress in his investigation into tracking stolen cryptocurrency: "Update: Wiz (Vil Chetal) was arrested," he wrote, "Here is his photo." The attached photo shows a young man in a white T-shirt, with shaggy hair and a thick beard, a droopy mouth and tired eyes. He is a far cry from the child in the photo on the Immaculate High School website. The charge listed in the jail record is a federal misdemeanor, but the charge is not specified.

According to ZachXBT, the stolen Bitcoin he tracked has been transferred to a wallet controlled by law enforcement. The matte gray Lamborghini Urus that Sushil and Radhika Chetal drove during the kidnapping that day is still parked as evidence in a secure police parking lot in Danbury. This Lamborghini was once the car their son drove to school.