Advanced Search

How OSINT Exposed a $243M Bitcoin Scam.



Fixxx

Moderator
Judge
Elite
Ultimate
Legend
Joined
31.10.19
Messages
752
Reaction score
1,683
Points
93
The story of the investigation into how Greavys (Malone Iam), Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243 Million on August, 2024, using a social engineering attack and the efforts of ZachXBT that helped lead to numerous arrests and the freezing of those millions of dollars...

1744990030569.png

So, a brief introduction to the incident: On August 19, 2024, threatening individuals attacked a creditor of Genesis by:
  • Making calls impersonating Google support from a spoofed number to compromise personal accounts;
  • Calling as Gemini support, claiming that the account had been hacked;
  • Using deception (various social engineering techniques) to trick the victim into resetting 2FA and sending funds to a hacked wallet;
  • Forcing the victim to use AnyDesk to provide screen access, which led to the loss of private keys to Bitcoin core.
Transaction Hash Links:
1744990056736.png
1744990072620.png

Here is a private video recording showing the live reactions of several participants upon receiving $238 million:


Transaction Hash Link:
Initial tracking stages showed that $243 million was distributed among each of the parties, after which the funds quickly moved to over 15 exchanges, instantly swapping between Bitcoin, Litecoin, Ethereum and Monero.

1744990126571.png

Wiz (Veer) received a large percentage of the theft and slipped during a screenshot, revealing his full name during the heist.

1744990142271.png

Additional comfort in the investigation was achieved because, during numerous recordings, accomplices referred to him as Veer in audio and chats (with $35.5 million of his funds located here). Wiz's friend Light/Dark (Aakaash) helped launder money for him using eXch and Thorswap. Like Wiz, he also slipped his name during the screen exchanges. The destination address was also confirmed in the video:


Greavys (Malone) leads a lavish lifestyle, purchasing over 10 cars with the stolen funds, partying with friends in clubs in Los Angeles and Miami, spending $250K-500K per night and gifting Birkin bags to women.

1744990157955.png

By the way, in the central screenshot, our Greavys a/k/a Malone gifted his beloved a Lamborghini Urus worth approximately $241,843 and three Birkin bags worth about $63,000. But she was not impressed and didn’t even say thank you - she merely wrote that she was kidnapped again for romantic escapades... Greavys was located through OSINT in Los Angeles/Miami, as friends/girlfriends reported his whereabouts on social media every night. He also has an Instagram account where he posted his photos under his name earlier this year (malone.lv). Box (Jeandiel Serrano) played his part by calling the victim as a representative of the Gemini exchange. On Discord, Telegram and other platforms, Box uses the same profile picture.

1744990206972.png

Currently, $19.5M linked to Box is located here. Danny Trauma (a Dane) was active in the internal Telegram chat as Meech, although his exact role is unclear, although it is known that he has access to several databases. However, his ex-girlfriend leaked all his photos on social media, so information about him became public. The group of eth addresses associated with Box/Wiz received $41M+ from two exchanges, primarily directing them to luxury item brokers for purchasing cars, watches, jewelry and designer clothing.

1744990230873.png

This is also confirmed by what was said in the chats about spending the funds. Although most of the funds were converted to XMR, both Box and Wiz accidentally linked the laundered funds to dirty funds in several cases. Wiz showed the address during the screenshot to which he sent funds for purchasing designer clothing, which had million-dollar connections with the aforementioned cluster (this address).

1744991236860.png
1744990378809.png

With the assistance of CFInvestigators & zeroshadow_io and the Binance security team, over $9M+ was frozen and $500K+ has already been returned after the investigation of the incident in close collaboration with the victim. Box and Greavys were arrested on September 18 in Miami and Los Angeles.

 
Top Bottom