Jakub Porzycki | NurPhoto via Getty Images
Two young men accused of committing one of the largest person-to-person crypto thefts in U.S. history went on a brazen spending spree that included buying exotic cars and a $2 million wristwatch, renting mansions and running up nightclub tabs of hundreds of thousands of dollars apiece, new court records reveal.
The Aug. 18 cyber heist swindled a Washington, D.C., resident out of $230 million in cryptocurrency. To date, at least $100 million in bitcoin stolen from the victim remains unaccounted for, prosecutors said in a recent court filing in District of Columbia federal court.
Police now say that another crime, the mysterious Aug. 25 kidnapping of a Connecticut couple in broad daylight while they were house hunting, may be connected to the Washington crypto theft.
The couple was driving a Lamborghini they said was rented by their son at the time they were carjacked and abducted.
The accused kidnappers “targeted” the couple “because the co-conspirators believed the victims’ son had access to significant amounts of digital currency,” an indictment against the six defendants in that case says.
Those men, all from Florida, “planned to kidnap the victims … and hold the victims against their will at a house rented” by one of the men “and then demand payment in the form of digital currency from the son of [the couple] in return for the safety,” the indictment in Connecticut federal court says.
In addition to federal conspiracy and carjacking charges, the six men also face state criminal charges related to the kidnapping, which occurred a week after the heist of 4,100 bitcoins from the victim in Washington, D.C.
“I’ve never seen anything like this in 20 years,” Detective Sgt. Steven Castrovinci of the Danbury Police Department in Connecticut told CNBC.
The six Florida men charged in the kidnapping have not been charged in connection with the cryptocurrency theft. Nor has the unidentified son of the couple who was abducted.
“It’s amazing to see how this thing has grown legs,” Castrovinci said.
Danbury, Conn., police booking photos of suspects in Aug. 25, 2024, carjacking and kidnapping of local couple.
Source: Danbury Police Department
On Sept. 19, just a month after the crypto heist, the U.S. Attorney’s Office for the District of Columbia announced that the FBI had arrested two men — Malone Lam, 20, and Jeandiel Serrano, 21 — on conspiracy charges related to the alleged theft and subsequent laundering of the stolen bitcoin.
Serrano, who uses the online monikers “VersaceGod” and “@SkidStar,” was wearing a $500,000 watch at the time of his arrest in Los Angeles, where he lives, according to prosecutors.
Both men, who are being held without bail, admitted their role in the heist, prosecutors have said in court filings.
Serrano’s lawyer, Paulette Pagan, had no immediate comment on his case. CNBC has requested comment from a lawyer for Lam, a Singapore resident who had been living in L.A. and Miami after overstaying by months a visa waiver that allowed him to visit the U.S. as a tourist for just 90 days.
The scheme at the center of the bizarre case is “one of the largest cryptocurrency thefts from a private individual … in the history of the United States,” according to a federal court filing.
A month before they were arrested, Serrano, Lam and other, unnamed, co-conspirators targeted a man in Washington “because they believed he held a considerable amount of virtual currency” after they “identified him as a high net-worth investor from the early days of cryptocurrency,” court filings say.
In early August, one co-conspirator caused an “unauthorized Google account access” notification to be sent to the victim, making it appear that the purported access attempts had occurred overseas, a court filing said.
“In reality, this was just the conspirators laying the groundwork for their imminent theft through sophisticated social engineering,” prosecutors wrote in a filing.
On Aug. 18, members of the conspiracy called the man, claiming they were from Google’s security team, and asking him about the recent unauthorized access attempts.
“Through a series of prompts and misrepresentations,” the co-conspirators managed to manipulate the man into giving them enough information to access his Google drive, “where they quickly located personal financial information, including the location of his virtual currency holdings with Gemini,” a crypto exchange, a filing said.
Serrano and other scheme participants then called the man back and Serrano posed as a member of Gemini’s support team,
