Three individuals stole $243 million in Bitcoin using social engineering tactics on a Genesis creditor. The attack began by posing as Google and Gemini support.
Organizing the Bitcoin Theft
According to blockchain investigator ZachXBT, the attack occurred on August 19, 2024. The suspects, identified as Greavys (Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano), started the attack by impersonating Google support using a spoofed phone number. They then impersonated Gemini support and convinced the victim that his exchange account had been compromised, asking him to reset his two-factor authentication. After the victim complied, the attackers transferred 4,064 Bitcoins valued at $243 million to their wallets. They later convinced the victim to install the remote desktop tool AnyDesk to further exploit the situation, using their access to extract private keys from the Bitcoin Core wallet.
Investigation and Blockchain Data
Blockchain data indicated that the hack occurred at 4:05 A.M. UTC, when 4,064 Bitcoins were rapidly transferred to more than 15 exchanges. These funds were nearly immediately converted into other cryptocurrencies, including Litecoin, Ethereum, and Monero, to obfuscate the trail. A private video showing the attackers celebrating upon receiving $238 million provided crucial evidence for the investigation led by ZachXBT.
ZachXBT's Role in the Investigation
ZachXBT, a blockchain detective and analyst on the social network X, has experience exposing fraudsters in the crypto market and is often referred to as 'Conan' for his extraordinary skills and unique thinking. He has investigated and solved more than 200 fraud cases worth tens of millions of dollars.
The attack on the Genesis creditor highlighted the vulnerability of users to social engineering tactics. Thanks to ZachXBT's investigation, the details of the theft were uncovered and evidence was presented.
Comments