$250 million cryptocurrency theft: Unraveling the truth behind the century's heist in a month

Original Title: They Stole a Quarter-Billion in Crypto and Got Caught Within a Month Original Author: Mitch Moxley Original Translator: zhouzhou, BlockBeats

Editor's Note: This article tells the story of a crime incident triggered by cryptocurrency theft. ZachXBT tracked the luxurious lifestyle of suspect Lam through social media and assisted law enforcement in the investigation. Lam and other accomplices used complex money laundering methods but were ultimately caught by the police. Meanwhile, another kidnapping case was also linked to this criminal group, involving several men from Florida. The case reveals how cybercrime is gradually evolving into a more violent form of real-world crime, and in the end, the police successfully recovered the stolen Bitcoin and related evidence.

The following is the original content (reorganized for easier reading):

On August 25, 2024, on a hot afternoon, Sushil and Radhika Chetal were looking at houses in an upscale neighborhood in Danbury, Connecticut. The lawns were neatly trimmed, and the pool had a heating system. Sushil was a vice president at Morgan Stanley's New York office, driving a newly purchased matte gray Lamborghini Urus, which starts at about $240,000.

As they turned a corner, a white Honda Civic suddenly crashed into the back of the Lamborghini. At the same time, a white Ram ProMaster van cut in from the front, blocking the Chetals' way. According to a criminal complaint filed later, a group of six men dressed in black and wearing masks got out of the vehicle, forcibly dragged the Chetals out of their car, and pushed them into the side door of the van.

When Sushil resisted, the attackers hit him with a baseball bat and threatened to kill him. They bound the couple's hands and feet with tape, forced Radhika to lie on the ground, and warned her not to look at them, even as she gasped for breath due to asthma. They also taped Sushil's face and beat him again with the baseball bat as the van sped away.

Multiple witnesses saw the attack and called 911. One of them was an off-duty FBI agent who happened to be nearby; he followed the van and Honda Civic, relaying their movements to the police in real-time. This FBI agent also managed to record part of the license plate numbers.

Soon, Danbury police located the van. A patrol car activated its lights to attempt a stop, but the van driver accelerated and weaved through traffic. About a mile into the chase, the driver crashed off the road into a curb. Four suspects abandoned the vehicle and fled. Police found one of them under a bridge and arrested him after a brief chase. Within the next few hours, the remaining three were also found and apprehended in nearby woods. Meanwhile, police discovered the Chetal couple still bound and shaken in the back of the van.

Danbury Police Detective Sergeant Steve Castrovinci was on vacation that day when he received a call from the shift commander informing him of the incident. He recalled the commander saying, "We have a kidnapping case, a real kidnapping." Castrovinci gathered several detectives to understand the situation, stopped by the crime scene, and then headed to the police station to interrogate the suspects. Based on information provided by one of the arrested suspects, two more suspects were found and arrested the next morning at an Airbnb in Roxbury, about 30 minutes from Danbury, along with the white Honda Civic.

For Castrovinci, this was an unusual and dramatic case. Danbury is a wealthy and quiet place; while the police occasionally handle kidnapping cases, they almost always involve custody disputes. A violent kidnapping in broad daylight was unheard of. Even stranger, law enforcement discovered that the suspects—aged between 18 and 26—had traveled from Miami specifically to Connecticut.

They had also rented the van on Turo. "In a case like this, a police officer might encounter one or two in a lifetime," Castrovinci, who has 20 years of law enforcement experience and worked for five years in the New York police department, told me. "Especially in places like ours, this kind of thing is just not common."

In the following weeks, police revealed almost no information to the public. Castrovinci and his team were working hard to piece together the motive. It was hard to believe that the Chetal couple was targeted because Sushil held a high executive position in investment banking. As a vice president at Morgan Stanley, his salary was enviable but not unusual in Danbury. If the kidnappers' motive was money, it was very strange that they abandoned the Chetal couple's Lamborghini (which was later found discarded in the woods). All the clues seemed nonsensical.

However, a few days after the attempted kidnapping, Castrovinci stated that their team received a tip from the FBI, which turned the entire case on its head: the case might be related to a massive cryptocurrency theft that occurred just a week before the attack.

Several young individuals (some of whom met on a Minecraft server) were suspected of stealing $250 million from an unsuspecting victim, triggering a series of incredible events involving a network of teenage cybercriminals, independent cyber detectives tracking their movements, and multiple law enforcement agencies. It now appeared that all of this ultimately evolved into the kidnapping of the Chetal couple—the rampant chaos of the digital underworld and its surrounding culture had seeped into the real world in such a brutally real way for the first time.

The series of events began weeks earlier when a resident of Washington, D.C., started receiving unusual login notifications for his Google account, indicating that these logins appeared to be coming from overseas. Then, on August 18, he received a call from someone claiming to be from Google's security team. The caller stated that his email account had been compromised. The call sounded very legitimate—the caller had personal information about the D.C. resident. The caller asked him to verify some personal information over the phone, or else the account would be closed, and the resident complied.

Shortly after speaking with the so-called Google employee, the Washington, D.C. resident (whose identity is hidden in federal court documents) received another call from someone claiming to be a representative from the security department of the well-known cryptocurrency exchange Gemini.

Similarly, the caller had his personal information and told him that his account at Gemini (which contained about $4.5 million in cryptocurrency) had been hacked and that he needed to reset two-factor authentication immediately and transfer the Bitcoin in his account to another wallet to ensure the safety of his funds.

The person on the phone then suggested that the account holder download a program that could "enhance security." The man agreed, unaware that he was downloading a remote desktop application that would allow the caller to take control of his computer—thus gaining access to his other cryptocurrency accounts and exposing his assets to even more astonishing theft risks. It turned out that this Washington, D.C. resident was an early investor in cryptocurrency, holding over 4,100 Bitcoins in total. Ten years ago, these Bitcoins were worth about $1 million; on that day, their market value exceeded $243 million.

There is a core paradox in the cryptocurrency space: while holders of coins are often anonymous, all transaction records are publicly recorded on a ledger called the blockchain. This means that once funds are transferred, anyone can see it. This paradox has given rise to a new breed of investigators who specialize in tracking suspicious transactions on the blockchain. One of the most well-known is ZachXBT, an independent cryptocurrency crime investigator.

In the crypto world, ZachXBT is a well-known but elusive figure. He frequently posts long investigative threads on X (formerly Twitter), exposing individuals suspected of wrongdoing, sometimes even naming them directly. He has about 850,000 followers on the platform. He often shares his findings with law enforcement. Wired magazine called him "the world's most active independent cryptocurrency crime investigator." He has never revealed his true identity online.

Just minutes after the Washington, D.C. resident's crypto assets were drained, ZachXBT was at the airport catching a flight when he suddenly received a push notification on his phone about an unusual transaction. Cryptocurrency investigators typically use tools to monitor the flow of cryptocurrencies globally and set alerts for specific situations, such as transactions exceeding $100,000 and involving exchanges with extremely loose security measures.

The initial alert was for a six-figure transaction, which then escalated, peaking at $2 million. After passing through security, ZachXBT found a seat, opened his laptop, and began tracking the transaction, ultimately tracing it back to a wallet holding about $240 million in cryptocurrency. Some of the Bitcoins could even be traced back to 2012. "At that moment, I felt something was off," he told me, "Why would someone who has held Bitcoin for so many years suddenly use a suspicious service that often receives illegal funds?"

He then added the wallet addresses associated with these transactions to his tracking list and boarded the plane. Once connected to the cabin Wi-Fi, more transaction alerts kept coming in. Throughout the day, the Bitcoin from the massive wallet was continuously cashed out through more than 15 high-fee crypto service platforms.

After landing, ZachXBT contacted several colleagues who specialize in investigating cryptocurrency theft cases. One of them was Josh Cooper-Duckett, the investigation director at Cryptoforensic Investigators. This company is one of the growing number of independent agencies focused on tracking cryptocurrency theft and fraud and assisting law enforcement in recovering funds for victims. The 26-year-old Cooper-Duckett, from London, developed an interest in cryptocurrency at an early age. After working as a security consultant at Deloitte for three and a half years, he began focusing on investigating cryptocurrency theft cases, particularly those with losses of at least $100,000—which are now very common.

ZachXBT shared his findings with Cooper-Duckett and other investigators, and they all agreed that draining a wallet worth nearly $250 million was extremely suspicious. "Someone with that much money wouldn't just wake up one weekend and decide, 'I'm going to transfer the money in batches to a bunch of exchanges and convert it to Monero and Ethereum'—normal people don't do that."

This group of crypto investigators then contacted the relevant exchanges and service platforms, informing them that the funds were stolen and hoping they could freeze the assets and cooperate with the police investigation. Some platforms complied, but others did not. "This situation was a bit like a whack-a-mole game," Cooper-Duckett said. "They kept trying to transfer the money to various exchanges and service platforms to see where they could successfully launder it. After all, they were laundering $240 million, which is an astronomical figure."

Meanwhile, ZachXBT also warned his followers on X: "About seven hours ago, a suspicious transaction occurred, and a possible victim's account transferred out 4,064 Bitcoins (approximately $238 million)." He wrote. The funds then flowed to crypto platforms like THORChain, eXch, KuCoin, ChangeNOW, RAILGUN, and Avalanche Bridge.

ZachXBT also noted that the victim had previously received bankruptcy compensation from Genesis. Genesis was a lending platform that filed for bankruptcy in 2023 due to the collapse of Sam Bankman-Fried's FTX.

Through his network, ZachXBT eventually managed to contact the victim via email. The shocked Washington, D.C. resident then hired ZachXBT, Cryptoforensic Investigators, and another crypto investigation company to help track his stolen assets.

On the same day, he also filed a police report with the FBI's Internet Crime Complaint Center, and ZachXBT immediately contacted his acquaintances in law enforcement. (The FBI and the Department of Justice declined to comment on the matter.)

The rapid growth of cryptocurrency theft cases has overwhelmed federal investigators. According to the latest report, the Internet Crime Complaint Center (IC3) received over 69,000 complaints related to cryptocurrency financial fraud in 2023, with total losses exceeding $5.6 billion, a 45% increase from 2022.

Although cryptocurrency-related complaints account for only 10% of all financial fraud cases, the losses from these cases account for nearly half of the total. The report noted that the decentralized nature of cryptocurrency, the irreversibility of transactions, and the ability to transfer funds freely across the globe make it highly attractive to criminals, complicating the FBI's efforts to recover funds. In response, the FBI established the Virtual Assets Unit (VAU) in 2022 to specifically combat cryptocurrency theft.

Due to the large scale of the case and the high difficulty of solving it, experts say that government agencies—including the FBI, the Department of Homeland Security, the Secret Service, and even the IRS—have had to rely on private companies and individual investigators who have deep knowledge of the digital crime underworld. "Josh and Zach, they are really fast and accurate in tracking," said Nick Bax, founder of the cryptocurrency analysis company Five I's.

Bax has collaborated with ZachXBT on multiple cases but has never seen his true face. In their early conversations, ZachXBT even used voice-changing software to make himself sound like Mickey Mouse. "To be honest, I'm pretty good myself, but compared to them, I'll never catch up," Bax said, "And I think their brains have been really rewired because they've been doing this since they were very young."

Cryptocurrency investigators often use fake accounts to infiltrate forums like Telegram and Discord, where hackers and scammers gather, observing their communications, planning, and boasting. They find that these criminals are often very young and act quite recklessly, frequently leaving clues inadvertently.

After ZachXBT posted about this theft case on X, a source contacted him through a temporary account, providing some clues that might point to the identity of the thieves. This informant sent ZachXBT several screen recordings, allegedly recorded during one of the scammers' live streams of the theft to their friends. The total length of the video, about an hour and a half, included footage of calls with the victim. In one segment, the scammers could be heard excitedly shouting, "Oh my God! Oh my God! $243 million! So awesome! Oh my God! Oh my God! Bro!"

In private chats, this group of scammers used aliases like Swag, $$$, and Meech, but they made a fatal mistake: one of them inadvertently exposed his Windows desktop during the live stream, revealing his real name—Veer Chetal, an 18-year-old from Danbury—who was the son of the previously mentioned kidnapped couple.

Veer Chetal was a quiet honor student who had just graduated from Immaculate High School in Danbury and was about to attend Rutgers University in New Jersey. In 2022, he completed a "Future Lawyer" program, and that year the school's website featured a photo of him—a boy wearing glasses, a Tommy Hilfiger windbreaker, and a red polo shirt, smiling brightly.

Classmates recalled that Chetal had always been shy and loved cars. "He was basically always a loner," said Marco Dias, who became friends with Chetal in his senior year. Another classmate, Nick Paris, also said that Chetal had been low-key until one day in the middle of senior year when he suddenly showed up at school driving a Corvette. "He just parked there in the lot at 7:30 in the morning, and everyone was stunned," Paris said.

Soon, Chetal switched to a BMW, then to a Lamborghini Urus. He began wearing Louis Vuitton shirts and Gucci shoes. On Senior Skip Day, when Paris and other classmates were just hanging out at a nearby mall, Chetal took some friends, including Dias, to New York, rented a yacht for a party, and posed for photos on the deck with bundles of cash.

Chetal claimed he made this money by trading cryptocurrencies; Dias said that one morning in study hall, Chetal even showed him his trading records as proof. Once, Chetal rented a large house in Stamford, Connecticut, and invited friends for a three-day party. "I was playing around in the basement with friends when I suddenly saw him lying on the couch alone, playing on his phone, basically avoiding everyone the whole time," Dias recalled, "I thought to myself, this is so strange." Paris remembered that during a school parade, the police pulled over Chetal driving the Lamborghini Urus for a traffic violation, "He immediately called his lawyer before the police even asked him anything. Everyone thought: wow, this guy is really something, he’s really rich."

Independent investigators pointed out that Chetal was actually a secret member of an organization called Com (also known as Comm or Community). This organization originated from the hacker underground in the 1980s and has now evolved into a social network for cybercriminals and aspiring individuals.

According to an FBI affidavit in an unrelated case, an agent described Com as "a geographically dispersed alliance of subgroups that collaborate through online communication tools like Discord and Telegram to engage in various criminal activities."

According to this affidavit and experts studying Com, the activities of these subgroups include: swatting (making false reports to police or institutions to provoke a response); SIM card hijacking (SIM swapping, usually by deceiving customer service representatives to steal target phone numbers); ransomware attacks (using malicious software to prevent users or organizations from accessing their computer files); cryptocurrency theft, and penetration attacks on corporate systems.

Allison Nixon is the chief researcher at the cybersecurity expert group Unit 221B, who has been focusing on this expanding corner of the internet since 2011 and is now widely regarded as one of the top experts in the field of Com research.

She stated that most members of Com are young men from Western countries. In group chats, many discuss college life and the cybersecurity courses they are taking, and this knowledge has also aided them in their criminal activities. Nixon pointed out that many people initially entered this circle through video games like RuneScape, Roblox, and Grand Theft Auto.

By the mid-2010s, a darker world was quietly emerging within Minecraft—a game centered around creative building—and this shift was largely facilitated by the emergence of online servers. These servers are owned and operated by users, allowing players to team up for battles, also known as "factions." Within these servers, Minecraft evolved into a competitive battlefield, bringing opportunities for profit and scams.

Soon, servers began introducing in-game purchase mechanisms, allowing players to spend money on upgrades, such as flying abilities, stronger weapons, and armor. Some in-game purchases could also unlock stylish character outfits, becoming a way for players to flaunt their status online.

As players increasingly leaned towards participating in these competitive servers, a large black market emerged on Discord, specifically trading game items and rare usernames. Since most Minecraft players are teenagers, this black market quickly became a breeding ground for scams.

Users often agreed to pay real money via PayPal in exchange for game items, but after receiving the money, scammers would block the other party's account. This behavior became so rampant that people began offering "escrow services" to resolve trust issues—these intermediaries would charge a fee to hold the money and items, then pass them on to both parties.

In this circle, some high-value usernames became hot collectibles, usually no more than four letters long, such as Tree, OK, Mark, YOLO, or G, with prices even reaching over $10,000.

As Minecraft's "faction" servers and black markets flourished, virtual currencies began to gain popularity within these communities, eventually replacing PayPal as the mainstream transaction method. This unpunished arena of competition, gambling, and scams, combined with players' increasing familiarity with cryptocurrencies, gradually turned Minecraft servers into a "breeding ground" for new cybercriminals.

By 2017, as Bitcoin prices soared, Com members seamlessly transitioned from Minecraft scams to cryptocurrency theft. One of Com's most popular forums called "OGUsers" initially served as a platform for discussing and purchasing social media accounts and usernames but later evolved into a hub for cybercrime, involving SIM card hijacking, Twitter account hacking, and more.

Nixon explained, "These antisocial communities quickly transformed into a group of 'hacker millionaires' who became overnight successes and spread this culture because people saw others suddenly becoming millionaires and wanted to know how they did it." This also led to the rapid expansion of Com.

One of the most commonly used methods for cryptocurrency theft within Com is called "social engineering," which involves manipulating individuals to disclose sensitive information. Com members compile extensive lists of potential victims obtained through data breaches and then target them one by one—the case of the Washington, D.C. victim was just such an example. Sometimes, they even post "job ads" online, recruiting individuals willing to assist them in executing scams.

Cryptocurrency investigator Nick Bax once shared a job ad posted on Telegram, promising "5f a week" (i.e., five-figure weekly pay)—"as long as you act quickly"—to call potential targets. The ad also required "must have an American professional customer service voice." After completing the theft, Com members sometimes returned to the Minecraft black market to use the stolen cryptocurrency to purchase rare game items, then sold these items through PayPal for real cash, effectively "laundering" the money.

When ZachXBT discovered Veer Chetal's true identity, he and other investigators quickly identified more individuals involved in the case. In recordings obtained by ZachXBT, the thieves referred to each other using Com's codenames and sometimes even mentioned each other's real names. One name that came up repeatedly was Malone, also known as Malone Lam.

Malone Lam is a 20-year-old Singaporean and a notorious member of Com, with online aliases including Greavys and Anne Hathaway. He is also an experienced Minecraft player, often getting banned from servers but always managing to return. In the spring of 2023, he had a conflict with an administrator on the Minecadia server, resulting in the loss of some game items, so he doxxed the administrator, publicly revealing their addresses and social security numbers, and at least once, he called emergency services to harass them.

According to multiple users and Discord chat records from that time, Chetal and Lam met in Minecraft, where they teamed up in a "faction" led by Lam.

In October 2023, Lam entered the United States on a 90-day visa. He had basically stopped playing Minecraft. According to court documents, he later maintained his lifestyle through other cryptocurrency-related fraudulent means.

After the cryptocurrency theft in August 2024, ZachXBT tracked down Lam through so-called OSINT (Open Source Intelligence)—specifically through social media. In Com's chat groups, everyone was sharing that Lam was spending wildly, and no one knew the source of his money, but they mentioned his lavish lifestyle in Los Angeles nightclubs.

ZachXBT investigated the city's most popular nightclubs and checked Instagram posts from partygoers and the clubs themselves. In one post, Malone was seen wearing a white Moncler jacket, seemingly adorned with diamond rings and diamond-studded sunglasses. He stood on a table, showering the crowd with hundred-dollar bills.

As the money rained down, waiters brought bottles of champagne worth $1,500, with fireworks sticking out of the tops, and held up signs reading "@Malone." That night, he spent $569,528 at that nightclub. In another club, Lam and his crew playfully challenged ZachXBT, instructing nightclub patrons to hold up signs that read "TOLD U WE'D WIN" (told you we'd win), while another sign said "[expletive] ZACHXBT."

In the following weeks, Lam bought 31 cars, including custom Lamborghinis, Ferraris, and Porsches, some worth up to $3 million. On August 24, he apparently sent a photo of a pink Lamborghini to a model. He texted, "I bought you a gift; let's consider it an early birthday present." She replied, "I have a boyfriend now." He responded, "idc" (I don't care).

On September 10, after 23 days of partying in Los Angeles, Lam and a group of friends took a private jet to Miami. There, he rented multiple properties, including a $7.5 million mansion with ten bedrooms. Within days, Lam filled the driveway with more luxury cars, including several Lamborghinis, one of which had the name "Malone" printed on the side.

Every few days, ZachXBT sent the intelligence he collected to law enforcement. The information generally flowed one way, but federal authorities were also conducting their own investigation. According to court documents, the suspects involved in the conspiracy used complex money laundering methods to hide their funds and conceal their identities, trading through exchanges like eXch that did not require personal customer information and using virtual private networks (VPNs) to mask their true locations.

But according to authorities, at least once, they made a mistake: one suspect registered an account with the digital currency exchange TradeOgre without using a VPN, resulting in their connected IP address pointing to a $47,500/month rental property in Encino, California. This property was leased by 21-year-old Jeandiel Serrano, who had used aliases online such as VersaceGod, @SkidStar, and Box. By the time authorities identified Serrano, he was on vacation with his girlfriend in the Maldives.

On September 18, when Serrano flew back to Los Angeles International Airport from the Maldives, law enforcement was waiting for him at the airport. At the time, he was wearing a watch worth $500,000. Upon arrest, Serrano initially denied knowledge of the theft and agreed to speak with law enforcement without a lawyer. However, according to court reports, he quickly admitted his involvement, particularly in impersonating a Gemini employee.

Serrano confessed to owning five cars, two of which were gifts from his co-conspirators, and the funds for these two cars came from previous scams. He also admitted that his phone contained about $20 million in stolen cryptocurrency and agreed to return the funds to the FBI.

Meanwhile, Miami agents were preparing to raid one of the mansions rented by Lam. Lam knew an attack was imminent: after Serrano's arrest, Serrano's girlfriend immediately called to warn Lam's accomplices. They then deleted their Telegram accounts and other evidence from their phones.

Later that day, a team of FBI agents working with Miami police raided a mansion near Miami Beach. The agents used explosives to open the front metal gate, while another group of agents entered by boat through a back saltwater canal. As the agents entered the house, the sound of flashbang explosions echoed through the neighborhood.

Soon after, an agent escorted a handcuffed Lam out of the house; he was wearing a long-sleeved white top, deep red basketball shorts, and sneakers, with smoke filling the air, followed by at least five others who had been in the house with him. Serrano and Lam were charged with money laundering and conspiracy to commit wire fraud. Each charge could carry a maximum sentence of 20 years in prison.

Exactly one month after the robbery, the party was over.

In Danbury, in the days and weeks following the Chetal family's kidnapping, Castrovinci and the police collaborated with federal investigators to build a case against the gang from Florida. They urgently obtained access to the suspects' phones, reviewing group chat records and documenting the gang members' movements.

They learned that the trip was partially funded and organized by 23-year-old Angel Borrero from Miami, whose nickname is Chi Chi. In the group chat, Borrero wrote to others, "If this goes smoothly, we're heading to California next." Federal investigators speculated that this meant the gang planned to conduct further operations in California. That day, Josue Alberto Romero (nickname Sway) messaged the gang, "Chi Chi, we're more prepared than ever." These chat records indicated that the gang began coordinating actions as early as 7 a.m. and monitored the Chetal family for part of the afternoon.

By then, police had found the motive: they believed these individuals targeted the Chetal family to extort money from their son through kidnapping. Independent investigators believed that at least one member of the gang, Reynaldo (Rey) Diaz, using the alias Pantic, might be a member of Com.

ZachXBT speculated that these thieves might have made themselves targets by boasting about their spending stories to other Com members. "You would think that after committing a crime, you would keep quiet and not bring it up again," he said. "But they had to boast to people they thought were friends to make up for something. These people might not be real friends."

On August 27, Danbury police charged six suspects in the case with multiple counts of first-degree assault, first-degree kidnapping, and reckless endangerment. Federal charges soon followed. On September 24, a grand jury indictment filed in the U.S. District Court for Connecticut charged six Florida men with kidnapping, carjacking, and conspiracy.

These six Florida men represented an increasingly powerful faction within Com, shifting their focus from online scams to a greater inclination toward violence. Diaz himself had been shot two years earlier in Florida for attempted robbery.

In an FBI affidavit, an agent stated that Com members frequently engage in "brick-throwing, shootings, and arson attacks." According to independent investigative journalist Brian Krebs, in 2022, a young man named Foreshadow was kidnapped and beaten by a competing SIM swapping gang, demanding a $200,000 ransom.

In October 2023, a 22-year-old man from Egg Harbor Township, New Jersey, Patrick McGovern-Allen, was sentenced to 13 years for participating in violent hired work after being employed by a group of cybercriminals. Last November, it was reported that the CEO of a cryptocurrency company in Toronto was kidnapped and demanded a $1 million ransom.

Weeks later, a 13-year-old boy was exposed in the cryptocurrency community for creating a cryptocurrency and inflating its value, with rumors that his dog was also kidnapped. In January of this year, the founder of the French cryptocurrency company Ledger and his wife were kidnapped, with the kidnappers mutilating his hand and demanding a multimillion-dollar ransom in cryptocurrency.

However, more and more individuals unrelated to Com are being targeted, Nixon, the researcher, stated. Some so-called Com members are involved in so-called "harm groups," whose members force young women and girls to self-harm and commit violence. Nixon noted that seven years ago, there were only a few dozen noteworthy members in Com; now, there are thousands. "Now," she said, "we are witnessing the evolution from unorganized crime to organized crime, and we are in the middle of this transition."

These two incidents—the cryptocurrency heist and the kidnapping—indicate that Com members' complete lawlessness in the cyber world has led them to believe they can continue to commit similar crimes in the real world. "I don't think they've learned anything at all," ZachXBT said. "I've seen many people, after being arrested or having their assets seized—many of them end up going back to their old lives."

This year, five of the six Florida men pleaded guilty to federal kidnapping and conspiracy charges, potentially facing 15 years in prison. In January, 19-year-old Michael Rivas apologized in Hartford court for his actions, calling them "stupid," and stated that he was helping another person execute a "revenge plan," although he did not elaborate.

In February, 22-year-old James Schwab from Georgia was charged in connection with the kidnapping scheme. According to the federal criminal indictment, Schwab had a confrontation with Veer Chetal at a nightclub in Miami a month before the kidnapping and helped fund the plan, arranging transportation and accommodations for the attackers. He pleaded not guilty.

On March 25, ZachXBT updated his followers on X about the latest developments in tracking the stolen cryptocurrency investigation: "Update: Wiz (Veer Chetal) has been arrested," he wrote, "Here’s his photo." The attached photo showed a young man wearing a white T-shirt, with fluffy hair and a thick beard, looking downcast and tired. He looked far from the boy in the photo on the Immaculate High School website. The charges listed in the prison records were federal misdemeanors, but did not specify the charges.

According to ZachXBT, the stolen Bitcoins he tracked had been transferred to a wallet controlled by law enforcement. That day, the matte gray Lamborghini Urus that Sushil and Radhika Chetal were driving during the kidnapping remained parked as evidence in a secure police lot in Danbury. This Lamborghini had been the car their son drove to school.