$250 Million Cryptocurrency Heist: Uncovering the Truth of the Heist of the Century in One Month

By Mitch Moxley

Compiled by: zhouzhou, BlockBeats

Editor's note: This article tells the story of a crime caused by cryptocurrency theft. ZachXBT tracked down the lavish life of the suspect Lam through social media and assisted law enforcement in the investigation. Lam and other accomplices used complex money laundering methods, but were eventually arrested by the police. At the same time, another kidnapping case was also related to the criminal group, involving several Florida men. The case revealed that cybercrime gradually evolved into a more violent real-life crime. In the end, the police successfully recovered the stolen Bitcoin and related evidence.

The following is the original content (for easier reading and understanding, the original content has been reorganized):

On the muggy afternoon of August 25, 2024, Sushil and Radhika Chetal were looking at homes in an upscale neighborhood in Danbury, Connecticut. The lawns were manicured and the pool was heated. Sushil, a vice president at Morgan Stanley in New York, was driving a newly purchased matte gray Lamborghini Urus, an SUV that starts at about $240,000.

Just as they turned an intersection, a white Honda Civic suddenly hit the Lamborghini from behind. At the same time, a white Ram ProMaster truck cut in from the front, blocking the Chetals’ way. According to a criminal complaint filed later, a group of six men wearing black clothes and masks got out of the car, forcibly dragged the Chetals out of the car, and pushed them towards the side door of the truck.

When Sushil resisted, the attackers hit him with a baseball bat and threatened to kill him. The men bound the couple's hands and feet with duct tape, forced Radhika to the ground and warned her not to look at them even as she pleaded as she struggled to breathe due to asthma. They also taped Sushil's face and beat him again with a baseball bat as the van sped away.

Multiple witnesses saw the attack and called 911. One of them was an off-duty FBI agent who lived nearby and happened to be at the scene. He tracked the van and Honda Civic and notified police of the vehicles' movements in real time. The FBI agent also managed to record a portion of the license plate number.

Soon, Danbury police found the truck. A patrol car flashed its lights and tried to stop it, but the truck driver sped away, weaving through traffic. About a mile into the chase, the driver ran off the road and hit a curb. The four suspects abandoned the vehicle and fled. Police found one of them under a bridge and arrested him after a short chase. The other three were found and arrested in the woods nearby over the next few hours. Meanwhile, police found the Chetals, still tied up and in shock, in the back of the truck.

Danbury Police Department Detective Sergeant Steve Castrovinci was on leave that day when he received a call from his shift commander informing him of the incident. He recalled that the commander told him: "We have a kidnapping case, a real kidnapping." Castrovinci gathered several detectives to understand the situation, went to the crime scene on the way, and then rushed to the police station to question the suspect. Based on information provided by an arrested suspect, the next morning, two more suspects were found and arrested at an Airbnb homestay in Roxbury, a 30-minute drive from Danbury, and the white Honda Civic was also found.

For Castrovinci, the case was an unusual and dramatic one. Danbury is a wealthy, quiet place where police occasionally handle kidnappings, but they are almost always child custody disputes. A violent kidnapping in broad daylight was unheard of. And even stranger was the fact that law enforcement discovered that the suspects—ages 18 to 26—had traveled all the way to Connecticut from Miami.

They also rented a van on the Turo app. “This is something that a police officer might encounter once or twice in his lifetime,” Castrovinci, a 20-year law enforcement veteran who spent five years with the New York Police Department, told me. “Especially in a place like ours, this is not something that happens very often.”

Police revealed little in the weeks that followed. Castrovinci and his team struggled to piece together a motive. It was hard to believe that the Chetals were targeted because of Sushil’s senior position at the investment bank. As a vice president at Morgan Stanley, his salary was enviable but not unusual in Danbury. If the kidnappers were motivated by money, it was odd that they would abandon the Chetals’ Lamborghini, which was later found abandoned in the woods. None of the clues seemed to add up.

However, a few days after the kidnapping attempt, Castrovinci said their team received a tip from the FBI that gave the case an unexpected turn: the case might be related to a huge cryptocurrency theft that took place just a week before the attack.

A group of young people, some of whom met on a Minecraft server, allegedly stole $250 million from an unsuspecting victim, setting off an incredible chain of events involving a gang of teenage cybercriminals, independent cybersleuths tracking their movements, and multiple law enforcement agencies. Now it seems that it all culminated in the kidnapping of the Chetals — the first time the rampant disorder of the digital dark world and the culture surrounding it has seeped into the real world in such a realistic and brutal way.

The chain of events began a few weeks ago, when a man living in Washington, D.C., began receiving unusual login notifications to his Google account that appeared to be coming from overseas. Then, on August 18, he received a call from someone claiming to be from Google’s security team. The caller said his email account had been hacked. The call sounded very real—the caller had the D.C. resident’s personal information. The caller asked him to verify some of his personal information over the phone or his account would be closed, which the resident did.

Shortly after speaking with the alleged Google employee, the Washington, D.C., resident (whose identity is hidden in federal court documents) received another call from someone claiming to be a representative from the security department of Gemini, a well-known cryptocurrency exchange.

Likewise, the caller had his personal information and told him that his account at Gemini (which contained approximately $4.5 million in cryptocurrency) had been hacked and that he had to immediately reset two-factor authentication and transfer the Bitcoin in his account to another wallet to ensure the safety of his funds.

The man on the phone then suggested that the account holder download a program that would “enhance security.” The man agreed, not knowing that he was downloading a remote desktop application that would give the caller remote control of his computer—and therefore access to another of his cryptocurrency accounts, exposing his assets to an even more alarming risk of theft. It turns out that the Washington, D.C. resident was an early investor in cryptocurrency, holding more than 4,100 bitcoins in total. Ten years ago, those bitcoins were worth about $1 million; on that day, they were worth more than $243 million.

There is a core paradox in the cryptocurrency space: Although the holders of coins are usually anonymous, all transactions are publicly recorded on a ledger called the blockchain. This means that once funds are transferred, anyone can see it. This paradox has given rise to a new breed of investigators who specialize in tracking suspicious transactions on the blockchain. One of the most famous is ZachXBT, an independent crypto crime investigator.

ZachXBT is a well-known but secretive figure in the crypto world. He often posts long investigative posts on X (formerly Twitter) to expose people suspected of wrongdoing, sometimes even naming them directly. He has about 850,000 followers on the platform. He also often shares his findings with law enforcement agencies. Wired magazine called him "the most active independent crypto crime investigator in the world." He has never revealed his true identity online.

Just minutes after the crypto assets of Washington, D.C. residents were emptied, ZachXBT was at the airport catching a flight when he received an unusual transaction alert on his phone. Crypto investigators typically use tools to monitor the flow of cryptocurrencies around the world and set alerts for specific situations, such as when a transaction amount exceeds $100,000 and passes through certain exchanges with extremely lax security measures.

The initial alert was a mid-six-figure transaction, which then continued to climb, peaking at $2 million. After passing through security, ZachXBT found a seat, opened his laptop and began tracking the transaction, eventually tracing it back to a wallet holding about $240 million in cryptocurrency. Some of the bitcoins can even be traced back to 2012. "I felt something was wrong at the time," he told me, "Why would someone who has held Bitcoin for so many years use such a shady service that often flows with illegal funds?"

He then added the wallet addresses associated with these transactions to his tracking list and boarded the plane. Once connected to the cabin Wi-Fi, more transaction alerts kept pouring in. Throughout the day, the bitcoins from the huge wallet were continuously cashed out through more than 15 high-fee crypto service platforms.

After the plane landed, ZachXBT contacted several colleagues who specialize in investigating cryptocurrency thefts. One of them was Josh Cooper-Duckett, director of investigations at Cryptoforensic Investigators. The company is one of a growing number of independent organizations focused on tracking cryptocurrency theft and fraud and assisting law enforcement in recovering funds for victims. Cooper-Duckett, 26, is from London and became interested in cryptocurrencies at an early age. After working as a security consultant at Deloitte for three and a half years, he began to focus on investigating cryptocurrency thefts, especially those with losses of at least $100,000 - and these days, such cases are very common.

ZachXBT told Cooper-Duckett and other investigators what he had found, and they all agreed that emptying a wallet worth nearly $250 million at once was extremely suspicious. "It's impossible for someone with that much money to suddenly wake up one weekend and decide, 'I'm going to transfer my money to a bunch of exchanges and then convert it into Monero and Ethereum' - normal people don't do that."

The crypto investigators then contacted the relevant exchanges and service platforms, informing them that the funds were stolen, hoping that they would freeze the funds and cooperate with the police investigation. Some platforms cooperated, but some did not. "This situation is a bit like a whack-a-mole game," Cooper-Duckett said. "They keep trying to transfer the money to various exchanges and service platforms to see which one can successfully launder it. After all, they have to launder $240 million, which is an astronomical figure."

At the same time, ZachXBT also issued a warning to his fans on X: "About seven hours ago, a suspicious transaction occurred, and 4,064 bitcoins (about $238 million) were transferred out of the possible victim's account." He wrote. The funds then flowed to crypto platforms such as THORChain, eXch, KuCoin, ChangeNOW, RAILGUN and Avalanche Bridge.

ZachXBT also noted that victims had previously received bankruptcy payouts from Genesis, a lending platform that filed for bankruptcy in 2023 following the collapse of Sam Bankman-Fried’s FTX.

Through his network of contacts, ZachXBT eventually managed to contact the victim via email. The shocked Washington, D.C. resident then hired ZachXBT, Cryptoforensic Investigators, and another crypto investigation firm to help track down his stolen assets.

That same day, he filed a police report with the FBI’s Internet Crime Complaint Center, and ZachXBT immediately contacted his contacts in law enforcement. (Both the FBI and the Justice Department declined to be interviewed for this story.)

The rapid growth of cryptocurrency theft cases has overwhelmed federal investigators. According to the latest report, the Internet Crime Complaint Center (IC3) received more than 69,000 complaints involving cryptocurrency financial fraud in 2023, with total losses exceeding US$5.6 billion, an increase of 45% from 2022.

Although cryptocurrency-related complaints only account for 10% of all financial fraud cases, the losses caused by these cases account for nearly half of the total. The report pointed out that the decentralized nature of cryptocurrency, the irreversibility of transactions, and the ability to freely transfer funds around the world make it extremely attractive to criminals and make it difficult for the Federal Bureau of Investigation (FBI) to recover funds. To this end, the FBI established a virtual asset unit (Virtual Assets Unit, VAU) in 2022 to specifically combat cryptocurrency theft.

Because of the sheer scale of the cases and the difficulty of solving them, experts say government agencies — including the FBI, the Department of Homeland Security, the Secret Service and even the IRS — have had to rely on private companies and individual investigators who have deep knowledge of the digital criminal underworld. "Josh and Zach, they're really fast and accurate in their pursuit," said Nick Bax, founder of the cryptocurrency analysis firm Five I's.

Bax has worked with ZachXBT on multiple cases but has never seen him in person. In their early calls, ZachXBT used voice-changing software to make himself sound like Mickey Mouse. "To be honest, I'm pretty good at it, but I'll never be as good as them," Bax said. "And I think their brains are really modified because they've been doing this since they were very young."

Crypto investigators usually use fake accounts to sneak into forums where hackers and scammers gather, such as Telegram and Discord, to observe their communication, planning and showing off. They find that these criminals are often young and act quite recklessly, often leaving clues inadvertently.

After ZachXBT posted about the theft on X, a source contacted him through a temporary account and provided some clues that may point to the identity of the thieves. The informant sent ZachXBT several screen recordings that were allegedly recorded when one of the scammers live-streamed the theft to his friends. The videos, which are about an hour and a half in total, include phone calls with the victims. In one of the videos, the scammers can be heard shouting excitedly after learning that they had successfully stolen $243 million worth of Bitcoin: "Oh my god! Oh my god! 243 million! So cool! Oh my god! Oh my god! Brother!"

In private chats, the scammers used aliases such as Swag, $$$ and Meech, but they made a fatal mistake: one of them accidentally exposed his Windows desktop during the live broadcast, and the icon that popped up on the bottom of the Start menu showed his real name - Veer Chetal, an 18-year-old boy from Danbury - the son of the kidnapped couple mentioned earlier.

Veer Chetal is a quiet overachiever who recently graduated from Immaculate High School in Danbury and is heading to Rutgers University in New Jersey. In 2022, he completed a Future Lawyers program, and that year the school’s website published a photo of him—a boy with glasses, a Tommy Hilfiger windbreaker, a red polo shirt, and a big smile.

Classmates recalled that Chetal had always been shy and loved cars. "He was basically a loner," said Marco Dias, who became friends with Chetal during his junior year. Another classmate, Nick Paris, also said that Chetal had been very low-key until one day in the middle of his senior year, he suddenly drove a Corvette sports car to school. "He just parked in the parking lot at 7:30 in the morning, and everyone was stunned," Paris said.

Soon, Chetal switched to a BMW, then a Lamborghini Urus. He started wearing Louis Vuitton shirts and Gucci shoes. On Senior Skip Day, while Paris and other classmates just went to the nearby mall, Chetal took some friends, including Dias, to New York, rented a yacht and had a party, and everyone took pictures on the deck with bundles of cash.

Chetal claimed he made the money by trading cryptocurrencies; Dias said that one morning during self-study class, Chetal pulled out his phone and showed him his transaction records as proof. At one point, Chetal rented a large house in Stamford, Connecticut, and invited friends to a three-day party. "I was hanging out with my friends in the basement, and suddenly I saw him lying on the couch alone, playing with his phone, basically avoiding everyone the whole time," Dias recalled. "I thought to myself, this is too weird." Paris also remembered that during a school parade, the police stopped Chetal's Lamborghini Urus for a traffic violation. "He called his lawyer on the spot before the police asked him questions. Everyone was like: Wow, this guy is really something, this is really rich."

Independent investigators say Chetal was a covert member of a group called Com (also known as Comm or Community), which originated in the 1980s hacker underground and has evolved into a social network for cyber criminals and aspirants.

According to an FBI affidavit in an unrelated case, an agent described Com as "a coalition of geographically dispersed subgroups that collaborate through online messaging apps such as Discord and Telegram to engage in a variety of criminal activities."

According to the affidavit and experts who study Com, the subgroups’ activities include swatting (falsely reporting to police or institutions such as schools to trigger police response); SIM swapping (stealing a target’s phone number, usually by tricking a customer service representative); ransomware attacks (using malicious programs to prevent users or organizations from accessing their computer files); cryptocurrency theft; and penetration attacks on corporate systems.

Allison Nixon, chief research officer for Unit 221B, a group of cybersecurity experts, has been keeping an eye on this expanding corner of the web since 2011 and is now widely considered one of the top experts in Com organization research.

She said Com's members are mostly young men from Western countries. In group chats, many people talk about college life and the cybersecurity courses they are taking, which helps them carry out criminal activities. Nixon pointed out that many people's initial entry into this circle is through video games such as RuneScape, Roblox and Grand Theft Auto.

By the mid-2010s, a darker world was also emerging in Minecraft — a game centered around creative building — and much of this shift was made possible by the advent of online servers. These user-owned and operated servers allowed players to team up and battle against each other in groups, called “factions.” On these servers, Minecraft became a competitive battleground, with all the opportunities for profit and deception that came with it.

Soon, servers began to introduce in-game purchases, which allowed players to spend money to buy upgrades, such as the ability to fly, stronger weapons and armor. Some in-game purchases also unlocked fashionable character costumes, which became a way for players to show off their status online.

As players increasingly participated in these competitive servers, a large black market emerged on Discord, specializing in trading game props and rare usernames. Since most of the players in Minecraft are teenagers, this black market quickly became a hotbed for scams.

Users often agree to pay real money via PayPal in exchange for game props, but after receiving the money, the scammers will block the other party's account. This behavior has become so rampant that people have begun to provide "intermediary services" to solve the trust problem - these intermediaries will charge a certain fee, keep the money and items on behalf of the transaction, and then transfer them to the two parties separately.

In this circle, some high-value usernames have become hot collectibles, usually no more than four letters, such as Tree, OK, Mark, YOLO or G, and the prices can even be as high as more than $10,000.

As Minecraft's "faction" servers and black markets flourished, virtual currencies became popular in these communities and eventually replaced PayPal as the mainstream transaction method. This unpunished competition, gambling and fraud training ground, coupled with players' increasing familiarity with cryptocurrency, has gradually turned Minecraft servers into a "hotbed" for new cybercriminals.

By 2017, the price of Bitcoin was soaring, and Com members seamlessly transitioned from Minecraft scams to cryptocurrency theft. One of Com’s most popular forums was called “OGUsers,” which was originally a platform for discussing and purchasing social media accounts and usernames, but later evolved into a hotbed of cybercrime, involving SIM card hijacking, Twitter account hacking, and other behaviors.

Nixon explained: "These antisocial communities quickly turned into a group of overnight rich 'hacker millionaires' and spread this culture because people saw others suddenly become millionaires and wanted to know how they did it." This also led to the rapid expansion of Com.

Com's most common cryptocurrency theft method is called "social engineering," which refers to manipulating people's minds to induce users to disclose sensitive information. Com members will compile a large list of potential victims obtained through data leaks, and then target them one by one - this is exactly the case with the victims in Washington DC. Sometimes, they will post "recruitment ads" online to recruit people who are willing to help them commit fraud.

Cryptocurrency investigator Nick Bax once shared a job posting on Telegram that promised "5f a week" (a five-figure salary per week) - "as long as you move fast" - to call potential targets. The posting also required "must be an American-style professional customer service voice." After completing the theft, Com members sometimes return to the Minecraft black market and use the stolen cryptocurrency to buy rare game props, and then sell these props for real cash through PayPal to "launder money."

When ZachXBT found out Veer Chetal's real identity, he and other investigators quickly identified more suspects. In the recordings ZachXBT obtained, the thieves called each other by the code name Com, and sometimes they would directly say each other's real names. One name that was mentioned repeatedly was Malone, also known as Malone Lam.

Malone Lam is a 20-year-old Singaporean who is a notorious member of the COM community, with online nicknames such as Greavys and Anne Hathaway. He is also a veteran Minecraft player with side-swept bangs, who is often banned from servers but always manages to return. In the spring of 2023, he lost some game props after a conflict with the administrators on the Minecadia server, so he conducted a "human flesh search" on the administrators, published their addresses and social security numbers online, and at least once, he called emergency services to harass them.

According to multiple users and Discord chat records at the time, Chetal and Lam met in Minecraft, and they played the game as a team in a "faction" led by Lam.

In October 2023, Lam entered the United States on a 90-day visa. He had largely stopped playing Minecraft and, according to court documents, later relied on other cryptocurrency-related fraud to support his lifestyle.

After the August 2024 cryptocurrency theft, ZachXBT tracked Lam through so-called OSINT (open source intelligence), or social media. In Com’s chat group, everyone was saying that Lam was spending sprees, and no one knew where his money came from, but they mentioned his lavish life in Los Angeles nightclubs.

ZachXBT investigated the city's most popular nightclubs and looked at Instagram feeds from partygoers and the clubs themselves. In one post, Malone, wearing a white Moncler jacket and what appears to be a diamond ring and diamond-encrusted sunglasses, stands on a table and begins throwing $100 bills into the crowd.

As money rained down, waiters carried $1,500 bottles of champagne with sparklers stuck in the tops and held up signs that read "@Malone." He spent $569,528 that night at this club alone. At another nightclub, Lam and his team also pranked ZachXBT, instructing nightclub guests to hold signs that read "TOLD U WE'D WIN" and another that read "[EXPLETIVE] ZACHXBT."

In the weeks that followed, Lam bought 31 cars, including customized Lamborghinis, Ferraris, and Porsches, some valued at up to $3 million. On August 24, he apparently texted a model a photo of a pink Lamborghini. “I got you a present, let’s do it as an early birthday present,” he texted. She responded, “I have a boyfriend again.” He responded, “idc” (I don’t care).

On September 10, after 23 days of partying in Los Angeles, Lam and a group of friends boarded a private jet to Miami, where he rented several properties, including a $7.5 million, 10-bedroom estate. Within days, Lam had filled his driveway with more luxury cars, including several Lamborghinis, one of which had the name "Malone" printed on its side.

Every few days, ZachXBT sent the intelligence he gathered to law enforcement. Information generally flowed one way, but federal authorities were also conducting their own investigation at the same time. According to court documents, the suspects in the conspiracy used sophisticated money laundering methods to hide funds and conceal their identities, trading through cryptocurrency exchanges like eXch that do not request personal customer information and using virtual private networks (VPNs) to mask their true location.

But according to authorities, in at least one case, a suspect forgot to use a VPN when registering an account with TradeOgre, a digital currency exchange, and the IP address he connected to was pointed to a $47,500-a-month property in Encino, California. The property was rented by Jeandiel Serrano, 21, who used aliases such as VersaceGod, @SkidStar and Box online. By the time authorities identified Serrano, he was vacationing in the Maldives with his girlfriend.

On September 18, Serrano flew back from the Maldives to Los Angeles International Airport, where law enforcement was waiting for him. He was wearing a $500,000 watch. When arrested, Serrano initially denied any knowledge of the theft and agreed to speak to law enforcement without an attorney. But according to court reports, he quickly admitted his involvement, specifically impersonating a Gemini employee.

Serrano admitted that he owned five vehicles, two of which were gifts from his co-conspirators using funds from previous scams, and that he had approximately $20 million in victim cryptocurrency stored on his phone and agreed to return the funds to the FBI.

Meanwhile, agents in Miami were preparing to raid one of Lam’s rented mansions. Lam knew the raid was coming: Serrano’s girlfriend called to warn Lam’s co-conspirators immediately after Serrano’s arrest. They then deleted their Telegram accounts and other evidence from their phones.

Later that day, a team of FBI agents working with Miami police raided a mansion near the coast of Miami. Agents used explosive devices to open the metal gate in the front, and another team of agents entered by boat through the small saltwater canal in the back. As the agents entered the house, the sound of flashbangs exploding echoed through the neighborhood.

Soon after, an agent led Lam out of the house in handcuffs, wearing a long-sleeved white shirt, crimson basketball shorts and sneakers, as smoke filled the air, followed by at least five other people who had been in the house with him. Serrano and Lam are charged with money laundering and conspiracy to commit wire fraud. Each charge carries a maximum sentence of 20 years in prison.

Exactly one month to the day after the robbery, the party was over.

In the days and weeks after the Chetals were kidnapped in Danbury, Castrovinci and police worked with federal investigators to build a case against a gang from Florida. They scrambled to gain access to the suspects’ phones, from which they reviewed group chats and documented the movements of gang members.

They learned that the trip was financed and organized in part by Angel Borrero, a 23-year-old Miami native who goes by the nickname Chi Chi. In a group chat, Borrero wrote to others, “If this goes well, we’ll go to California next.” Federal investigators speculated that this meant the gang was planning other operations in California. That same day, Josue Alberto Romero, also known as Sway, sent a message to the gang, “Chi Chi, we are more prepared than ever.” The chats showed that the gang began coordinating operations as early as 7 a.m. and spent part of the afternoon surveilling the Chetal family.

By then, police had discovered a motive: They believed the men targeted the Chetal family to extort money owned by their son through kidnapping. Independent investigators believed that at least one member of the gang, Reynaldo (Rey) Diaz, who used the alias Pantic, might be a member of Com.

ZachXBT speculates that these thieves may have made themselves targets by bragging about their spending stories to other Com members. “You would think that after a crime you would keep quiet and not talk about it again,” he said. “But they have to make up for it by bragging to people they think are their friends. These people may not really be their friends.”

On August 27, Danbury police filed charges against six suspects in the case: multiple counts of first-degree assault, first-degree kidnapping and reckless endangerment. Federal charges followed. On September 24, a grand jury indictment filed in the U.S. District Court for the District of Connecticut charged six Florida men with kidnapping, carjacking and conspiracy.

The six Florida men represent a growing faction of COM that is moving beyond online scams and toward violence. Diaz himself was shot in a botched robbery attempt in Florida two years ago.

In an FBI affidavit, an agent said Com members frequently carried out "brick-bashing, shooting and arson attacks." According to independent investigative journalist Brian Krebs, in 2022, a young man named Foreshadow was kidnapped and beaten by a competing SIM swapping gang and demanded a $200,000 ransom.

In October 2023, Patrick McGovern-Allen, a 22-year-old man from Egg Harbor Township, New Jersey, was sentenced to 13 years in prison for participating in violent work for hire after being hired by a group of cybercriminals. Last November, it was reported that the CEO of a cryptocurrency company based in Toronto was kidnapped and demanded a ransom of $1 million.

A few weeks later, a 13-year-old boy was exposed in the cryptocurrency community for creating cryptocurrencies and inflating their value, and his dog was reportedly kidnapped. In January this year, the founder of French cryptocurrency company Ledger was kidnapped with his wife, and the kidnappers mutilated his hands and demanded a ransom of millions of dollars in cryptocurrency.

Yet increasingly, people not associated with Com are being targeted, says Nixon, the researcher. Some alleged Com members are part of so-called “harm groups,” whose members pressure young women and girls into self-harm and violence. Seven years ago, there were probably only a few dozen Com members of concern; today, there are thousands, Nixon says. “Right now,” she says, “we’re seeing an evolution from disorganized crime to organized crime, and we’re in the middle of that transition.”

These two incidents—the cryptocurrency heist and the kidnapping—show that the utter lawlessness of Com members in the online world has given them the illusion that they can continue to commit similar crimes in the real world. “I don’t think they’ve learned anything at all,” ZachXBT said. “I’ve seen a lot of people who, after being arrested or having their assets seized—a lot of them end up going back to their old lives.”

Five of the six Florida men pleaded guilty this year to federal kidnapping and conspiracy charges, and they could face up to 15 years in prison. In January, Michael Rivas, 19, apologized for his actions in a Hartford courtroom, calling them "stupid" and saying he was helping another man carry out a "revenge plan," though he did not elaborate.

In February, James Schwab, a 22-year-old Georgia man, was indicted for his alleged role in the kidnapping plot. According to a federal criminal complaint, Schwab had a run-in with Veer Chetal at a Miami nightclub a month before the kidnapping and that he helped finance the plot, arranging transportation and lodging for the attackers. He has pleaded not guilty.

On March 25, ZachXBT posted an update on the X website about his investigation into stolen cryptocurrency: “Update: Wiz (Vill Chettal) arrested,” he wrote, “Here’s his picture.” The attached photo shows a young man in a white T-shirt, with shaggy hair and a thick beard, a droopy mouth and tired eyes. He is a far cry from the kid in the photo on the Immaculate High School website. The charge listed in the jail record is a federal misdemeanor, but the charge is not specified.

According to ZachXBT, the stolen bitcoins he tracked have been transferred to wallets controlled by law enforcement. The matte grey Lamborghini Urus that Sushil and Radhika Chetal drove during the kidnapping remains as evidence in a secure police parking lot in Danbury. The Lamborghini was once the car their son drove to school.