This is the true story of the largest single cryptocurrency theft in American history — carried out in eleven minutes, over a phone call, by a group of young men who met as children on a Minecraft server and never broke a single piece of encryption in their lives.

August 18th, 2024. A Pentagon contractor in suburban Washington DC — identified in federal court documents only as Lucky7 — has been buying Bitcoin since 2012, when it cost eleven dollars a coin. He stores it in a Bitcoin Core cold wallet, the most secure setup available to a private individual: hardware wallet, full multi-factor authentication, cold storage. By every conventional measure, he is impossible to rob.

At 12:33 Eastern, his phone starts vibrating. Over four minutes it receives roughly eighty authentication push notifications. Then a polite voice calls to help him with the problem.

Eleven minutes later, $240 million had moved.

It started in 2014 on a hardcore-factions Minecraft server called Cosmic PvP — around fifty thousand concurrent players on a Saturday night, almost all boys aged eleven to fifteen, no adults in the chat, an in-game economy built entirely on stolen items. One of them was a twelve-year-old in a Singapore suburb named Malone Lam. Another was a ten-year-old in Newtown, Connecticut named Veer Chetal, son of a Morgan Stanley executive. Neither was poor. Neither was desperate. They were bored teenagers with broadband and parents who didn’t check what they did at night.

By thirteen, Lam had worked out that accounts holding rare in-game items were tied to email addresses that could be talked away from their owners. His first theft was a virtual sword worth three hundred dollars.

When Cosmic PvP declined, its veterans migrated to private Discord and Telegram channels and called themselves the Com. By 2023 the FBI’s Cyber Division estimated it had around a thousand active members worldwide, almost all under twenty-five. It operated like a startup: researchers who built target profiles from LinkedIn, leaked databases and public records; drainers who emptied wallets in under a minute; cashers who moved funds through mixers. And at the top of the status hierarchy sat the callers — the ones who actually picked up the phone and impersonated bank support, corporate IT, mobile carriers. There were training scripts. There were A/B tests on tone and pacing. Veterans coached juniors through live calls in real time. The best operators claimed one to three million dollars a month.

What a generation of teenage boys had proven, from their parents’ houses, was the thing the security industry had been saying for fifteen years and nobody wanted to hear: the weakest point in any system is the human being who answers the phone.

Then came the part that destroyed them. Three days after the theft, Lam moved into a $62,000-a-month mansion on Hibiscus Island. Over four weeks: a Lamborghini Aventador SVJ with a licence plate reading MALONE, a Ferrari Roma, a McLaren 765LT, a Rolls-Royce Cullinan. A $60,000 bottle of champagne tipped to a nightclub DJ. Hermès Birkin bags handed to women he’d never met, filmed on the venue’s own Instagram. Cash on the table between $250,000 and $500,000 a night. In Singapore, his grandmother — who he still called every Tuesday — believed he was a software engineer at a Miami fintech startup.

The Com had perfected the most invisible attack in cybercrime history. Then they documented their own indictment, in real time, on social media.

This video also covers what happened to Veer Chetal’s father, and how an independent blockchain investigator with no badge and no subpoena power unravelled the entire chain in six hours on a plane.

━━━━━━━━━━━━━━━━━━━━━━━━

CHAPTERS

00:00 — Quarter of a Bill
01:39 — The Server
04:10 — The Com
06:11 — The Method
07:26 — The Target
08:51 — The Call
12:47 — The Lifestyle
15:10 — The Kidnapping
17:46 — The Fall

━━━━━━━━━━━━━━━━━━━━━━━━

SOURCES & FURTHER READING

https://docs.google.com/document/d/1ddVHeS30VjKFfsAVBMrEp1yCZNt2J0OMo1Cr6DafJrE/edit?usp=sharing

━━━━━━━━━━━━━━━━━━━━━━━━