In a shocking incident, cybercriminals executed a sophisticated social engineering attack that resulted in the theft of $243 million from a single individual. The sophisticated social engineering attack involved a series of carefully orchestrated steps, culminating in the theft of cryptocurrency funds from the victim’s wallet.
The attack unfolded on August 19, 2024, when a group of cybercriminals, including Greavys (Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano), targeted a Genesis creditor.
ZachXBT, posted a thread on the X that provides detailed information about the Hack. and revealed, that through a series of deceptive phone calls, they convinced the victim to reset their two-factor authentication (2FA) and share their private keys, granting them access to the victim’s cryptocurrency holdings.
Incident Details
The perpetrators used highly coordinated tactics to deceive the victim:
- The attackers gained access to the victim’s personal accounts by impersonating Google Support and using a fake phone number.
- They then claimed to have hacked the victim’s account when they phoned Gemini support, which resulted in the 2FA being reset and money being transferred to a compromised wallet.
- The attackers were able to obtain private keys from Bitcoin Core by using AnyDesk to see the victim’s screen.
Key transactions included:
- The first transaction of 59.34 BTC occurred at 1:48 AM UTC transfer with hash, “e747b963…” and the other transaction of 14.88 BTC occurred at 2:30 AM UTC with hash, “7c7ebed7…”
- The final transaction of 4064 BTC happened at 4:05 am UTC and is identified by the hash, “4b277ba2…”
Investigation and Findings
As per the ZachXBT, the investigation required the use of advanced blockchain analysis tools, social media monitoring, and OSINT (Open Source Intelligence). The investigation revealed key details about the attackers’ identities and locations.
Greavys, identified as Malone Iam, flaunted his ill-gotten wealth through a lavish lifestyle funded by the stolen $243 million. He reportedly purchased over 10 luxury cars and frequently spent between $250,000 to $500,000 per night at clubs in LA and Miami, where he and his friends would hand out Birkin bags to women.
He openly flaunted his riches on Discord, and his identity was confirmed through video clips, chats, and posts on his Instagram account. Investigators used open-source intelligence (OSINT) to track his location through posts by his friends and associates, eventually pinpointing him in LA and Miami.
The use of platforms like eXch and Thorswap to launder the stolen funds was uncovered, with Wiz and Light/Dark (Aakaash) slipping up and revealing their identities during screen share sessions.
Arrests and Recoveries:
As a result of the investigation, both Box and Greavys were arrested last evening in Miami and LA. Law enforcement likely seized additional funds during the arrests, as significant transfers were observed around the same time.
With the help of Cryptoforensic Investigators, zeroShadow, and the Binance Security Team, over $9 million of the stolen funds have been frozen, and more than $500,000 has already been returned to the victim following a thorough investigation.
Also Read: WazirX Hacker has moved over Rs 1400 crore in 2 months
