On the sultry afternoon of August 25, 2024 , Sushil and Radhika Chetal were looking at houses in an upscale community in Danbury, Connecticut. The lawns are neatly manicured and the pool is heated. Sushil, a vice president at Morgan Stanley in New York, was driving a newly purchased matte gray Lamborghini Urus, an SUV that starts at around $240,000.
Just as they turned an intersection, a white Honda Civic suddenly hit the Lamborghini from behind. At the same time, a white Ram ProMaster truck cut in from the front, blocking the Chetals’ path. According to a criminal complaint filed later, a group of six men dressed in black and wearing masks got out of the car, forcibly dragged the Chetals out of the car and pushed them toward the side door of the truck.
When Sushil resisted, the attackers hit him with a baseball bat and threatened to kill him. The men tied the couple's hands and feet with duct tape and forced Radhika to lie on the ground, warning her not to look at them even as she pleaded as she was struggling to breathe due to asthma. They also wrapped duct tape around Sushil's face and beat him again with a baseball bat as the van sped away.
Multiple witnesses saw the attack and called 911. One of them was an off-duty FBI agent who lived nearby and happened to be at the scene. He tracked the van and Honda Civic and notified police of the vehicles' whereabouts. The FBI agent also managed to record a portion of the license plate number.
Soon, Danbury police found the truck. A patrol car turned on its lights and tried to intercept the truck, but the truck driver sped away, weaving madly through traffic. About a mile into the chase, the driver ran off the road and hit a curb. The four suspects abandoned the vehicle and fled. Police found one of the men under a bridge and arrested him after a brief pursuit. Over the next few hours, the remaining three were found and arrested in nearby woods. Meanwhile, police found the Chetals, still tied up and in shock, in the back of the van.
Danbury Police Detective Sergeant Steve Castrovinci was on leave that day when he received a call from his shift commander informing him of the incident. “We have a kidnapping, a real kidnapping,” he recalled his commander telling him. Castrovinci gathered a few detectives to get a feel for the situation, dropped by the crime scene, and then headed to the station to question the suspect. Based on information provided by one of the arrested suspects, two more suspects were found and arrested the next morning at an Airbnb in Roxbury, a 30-minute drive from Danbury, and the white Honda Civic was also found.
For Castrovinci, this was an unusual and dramatic case. Danbury is a wealthy and quiet place, and although the police occasionally deal with kidnapping cases, they almost always involve disputes over child custody. Such a violent kidnapping in broad daylight is simply unheard of. Even stranger, law enforcement discovered that the suspects — ranging in age from 18 to 26 — had traveled to Connecticut from Miami.
They also rented a van on the Turo app. “This is the kind of case a police officer might encounter once or twice in his lifetime,” Castrovinci, who has 20 years of law enforcement experience and five years with the New York Police Department, told me. "Especially in a place like ours, this kind of thing doesn't happen very often."
Police released almost no information to the public in the following weeks. Castrovinci and his team have been working to piece together a motive. It is hard to believe that the Chetals were targeted because of Sushil’s senior position in the investment bank. As a vice president at Morgan Stanley, his salary, while enviable, was not unusual in Danbury. If the kidnappers were motivated by money, it is odd that they would have abandoned the Chetals' Lamborghini, which was later found abandoned in the woods. None of the clues seem to make sense.
However, a few days after the kidnapping attempt, Castrovinci said their team received a tip from the FBI that gave the case an unexpected turn: the case might be related to a huge cryptocurrency theft that took place just a week before the attack.
A group of young people, some of whom met on a Minecraft server, allegedly stole $250 million from an unsuspecting victim, setting off an incredible chain of events involving a cybercrime ring of teenagers, independent cyber detectives tracking their movements, and multiple law enforcement agencies. Now it seems that all of this has culminated in the kidnapping of the Chetals - the rampant disorder of the digital dark world and its surrounding culture has for the first time infiltrated the real world in such a real and cruel way.
The chain of events began a few weeks ago when a person living in Washington, D.C., began receiving notifications of unusual logins to his Google account that appeared to be coming from overseas. Then, on August 18, he received a call from someone claiming to be from Google's security team. The caller stated that his email account had been hacked. The call sounded very real - the other party had the personal information of this Special Administrative Region resident. The caller asked him to verify some personal information over the phone, otherwise his account would be closed, which the resident did.
Shortly after speaking with the alleged Google employee, the Washington, D.C., resident (whose identity is hidden in federal court filings) received another call from someone claiming to be a representative from the security department of Gemini, a well-known cryptocurrency exchange.
Likewise, the caller had his personal information and told him that his account at Gemini (which contained approximately $4.5 million in cryptocurrency) had been hacked and that he had to immediately reset two-factor authentication and transfer the Bitcoin in his account to another wallet to ensure the safety of his funds.
The person on the phone then suggested the account holder download a program that would "enhance security." The man agreed, unaware that he was downloading a remote desktop application that would allow the caller to remotely control his computer — and therefore gain access to another of his cryptocurrency accounts, exposing his assets to an even more alarming risk of theft. It turns out that the Washington, D.C. resident was an early investor in the cryptocurrency and holds a total of over 4,100 Bitcoins. Ten years ago, those bitcoins were worth about $1 million; on that day, their market value exceeded $243 million.
There is a core paradox in the cryptocurrency space: although coin holders are generally anonymous, all transactions are recorded publicly on a ledger called a blockchain. This means that once funds are transferred, anyone can see them. This paradox has given rise to a new breed of investigators who specialize in tracking suspicious transactions on blockchains. One of the most notable is ZachXBT, an independent crypto crime investigator.
In the crypto world, ZachXBT is a well-known but secretive figure. He often releases long investigative posts on X (formerly Twitter) to expose people suspected of illegal activities, sometimes even naming them directly. He has around 850,000 followers on the platform. He also often shares his findings with law enforcement agencies. Wired magazine called him "the world's most active independent crypto crime investigator." He has never revealed his real identity online.
Just minutes after the crypto assets of Washington, D.C. residents were wiped out, ZachXBT was at the airport catching a flight when he received an unusual transaction alert on his phone. Crypto investigators typically use tools to monitor the flow of cryptocurrencies around the world and set alerts for specific situations, such as when a transaction of more than $100,000 passes through certain exchanges with extremely lax security measures.
The initial alert was a six-figure transaction, which then continued to rise, reaching a peak of $2 million. After passing through security, ZachXBT found a seat, turned on his laptop and began tracking the transaction, eventually tracing it back to a wallet holding approximately $240 million in cryptocurrency. Some bitcoins can even be traced back to 2012. “I thought it was wrong,” he told me. “Why would someone who has held Bitcoin for so many years use such a shady service that often receives illegal funds?”
He then added the wallet addresses associated with the transactions to his tracking list and boarded the plane. Once connected to the cabin Wi-Fi, more transaction alerts kept coming. Throughout the day, the Bitcoin from the huge wallet was continuously cashed out through more than 15 high-fee encryption service platforms.
After the plane landed, ZachXBT contacted several colleagues who specialize in investigating cryptocurrency theft cases. One of them is Josh Cooper-Duckett, director of investigations at Cryptoforensic Investigators. The firm is one of a growing number of independent organizations focused on tracking cryptocurrency theft and fraud and assisting law enforcement in recovering funds for victims. Cooper-Duckett, 26, from London, became interested in cryptocurrencies at an early age. After three and a half years as a security consultant at Deloitte, he began focusing on investigating cryptocurrency thefts, particularly those involving losses of at least $100,000 — which are now all too common.
ZachXBT told Cooper-Duckett and other investigators what he had discovered, and they all agreed that emptying a wallet worth nearly $250 million in one go was extremely suspicious. “Someone with that much money doesn’t wake up one weekend and decide, ‘I’m going to transfer my money to a bunch of exchanges and convert it into Monero and Ethereum.’ That’s not what a normal person would do.”
The group of crypto investigators immediately contacted the relevant exchanges and service platforms, informing them that the funds were stolen and hoping that they could freeze the funds and cooperate with the police investigation. Some platforms cooperated, but some did not. “This situation is a bit like a game of whack-a-mole,” Cooper-Duckett said. "They kept trying to transfer the money to various exchanges and service platforms to see which one could successfully launder it. After all, they were trying to launder $240 million, which is an astronomical figure."
At the same time, ZachXBT also issued a warning to his fans on X: "About seven hours ago, a suspicious transaction occurred, and 4,064 bitcoins (about $238 million) were transferred out of the possible victim's account," he wrote. Funds subsequently flowed to crypto platforms such as THORChain, eXch, KuCoin, ChangeNOW, RAILGUN, and Avalanche Bridge.
ZachXBT also noted that the victim had previously received bankruptcy settlements from Genesis. Genesis is a lending platform that filed for bankruptcy in 2023 following the collapse of Sam Bankman-Fried’s FTX.
Through his own network of contacts, ZachXBT eventually managed to contact the victim via email. The shocked Washington, D.C. resident then hired ZachXBT, Cryptoforensic Investigators, and another crypto investigation firm to help track down his stolen assets.
On the same day, he also filed a police report with the FBI's Internet Crime Complaint Center, and ZachXBT immediately contacted his contacts in law enforcement. (Both the FBI and the Justice Department declined to be interviewed for this story.)
Cryptocurrency thefts are growing at such a rapid rate that federal investigators are overwhelmed. According to the latest report, the Internet Crime Complaint Center (IC3) received more than 69,000 complaints involving cryptocurrency financial fraud in 2023, with total losses exceeding US$5.6 billion, an increase of 45% from 2022.
While cryptocurrency-related complaints account for only 10% of all financial fraud cases, the losses caused by these cases account for nearly half of the total. The report pointed out that the decentralized nature of cryptocurrencies, the irreversibility of transactions, and the ability to transfer funds freely around the world make them extremely attractive to criminals and make it difficult for the Federal Bureau of Investigation (FBI) to recover funds. To this end, the FBI established the Virtual Assets Unit (VAU) in 2022 to specifically combat cryptocurrency theft.
Because of the scale of the cases and the difficulty of solving them, experts say government agencies — including the FBI, the Department of Homeland Security, the Secret Service and even the IRS — have been forced to rely on private companies and individual investigators who have deep knowledge of the digital criminal underworld. “Josh and Zach, they’re really fast and accurate in tracking,” said Nick Bax, founder of cryptocurrency analysis firm Five I’s.
Bax had worked with ZachXBT on several cases but had never met him in person. In their early calls, ZachXBT also used voice-changing software to make himself sound like Mickey Mouse. “Honestly, I’m pretty good at this, but I’ll never be as good as them,” Bax said. “And I think their brains are really wired because they’ve been doing this since they were very young.”
Crypto investigators often use fake accounts to infiltrate forums where hackers and scammers gather, such as Telegram and Discord, to observe their communications, planning, and showing off. They found that these criminals are often young and act quite recklessly, often leaving clues inadvertently.
After ZachXBT posted about the theft on X, a source contacted him from a makeshift account and provided some possible clues to the identity of the thief. The tipster sent ZachXBT several screen recordings that were allegedly recorded when one of the scammers live-streamed the theft to his friends. The video, which lasted about an hour and a half in total, included a phone call with the victim. In one of the videos, the scammers can be heard shouting excitedly after learning that they had successfully stolen $243 million worth of Bitcoin: "Oh my God! Oh my God! 243 million! That's great! Oh my God! Oh my God! Bro!"
In private chats, the scammers used aliases such as Swag, $$$ and Meech, but they made a fatal mistake: one of them accidentally exposed his Windows desktop during the live broadcast, and the icon that popped up in the start menu at the bottom showed his real name - Veer Chetal, an 18-year-old boy from Danbury - the son of the kidnapped couple mentioned earlier.
Veer Chetal was a quiet overachiever who had recently graduated from Immaculate High School in Danbury and was heading to Rutgers University in New Jersey. In 2022, he completed a "Future Lawyer" project, and a photo of him was published on the school website that year - a boy wearing glasses, a Tommy Hilfiger windbreaker and a red polo shirt, with a bright smile.
Classmates recall that Chetal had always been shy and loved cars. “He pretty much always kept to himself,” said Marco Dias, who befriended Chetal during his junior year of high school. Another classmate named Nick Paris also said that Chetal was very low-key until one day in the middle of his senior year, when he suddenly drove a Corvette sports car to school. “He was just sitting there in the parking lot at 7:30 in the morning, and everybody was stunned,” Paris said.
Soon, Chetal switched to a BMW, then a Lamborghini Urus. He started wearing Louis Vuitton shirts and Gucci shoes. On Senior Skip Day, while Paris and other classmates simply went to a nearby mall to hang out, Chetal took some friends, including Dias, to New York, rented a yacht and had a party, with everyone taking pictures on the deck with bundles of cash.
Chetal claimed that he made the money by trading cryptocurrencies; Dias said that one morning during a study session, Chetal pulled out his phone and showed him his transaction records as proof. At one point, Chetal even rented a large house in Stamford, Connecticut, and invited friends to a three-day party. “I was hanging out with my friends in the basement, and I saw him lying on the couch, on his phone, basically avoiding everyone,” Dias recalled. “I thought, this is weird.” Paris also remembers when police stopped Chetal’s Lamborghini Urus for a traffic violation during a school parade. “He called his lawyer right away before the police could even question him. People were like, wow, this guy is really something, he’s really rich.”
Independent investigators pointed out that Chetal was actually a secret member of a group called Com (also known as Comm or Community). The group originated from the underground hacker circles in the 1980s and has now evolved into a social network for cyber criminals and aspiring individuals.
According to an FBI affidavit in an unrelated case, an agent described Com as "a coalition of geographically dispersed subgroups that collaborate through online messaging apps such as Discord and Telegram to engage in a variety of criminal activities."
According to the affidavit and experts who study Com, the subgroups' activities include swatting (making a false alarm to police or institutions such as schools to trigger a police response); SIM swapping (stealing a target's phone number, usually by tricking a customer service representative); ransomware attacks (using malicious programs to prevent users or organizations from accessing their computer files); cryptocurrency theft; and penetration attacks on corporate systems.
Allison Nixon, chief research officer for Unit 221B, a group of cybersecurity experts, has been keeping an eye on this expanding corner of the web since 2011 and is now widely considered one of the top experts in the field of Com organization research.
She said Com's members are mostly young men from Western countries. In group chats, many people would talk about college life and the cybersecurity courses they were taking, which helped them carry out their criminal activities. Nixon noted that many people’s initial entry into the community was through video games like RuneScape, Roblox and Grand Theft Auto.
By the mid-2010s, a darker world was quietly emerging in Minecraft—a game centered on creative building—thanks in large part to the advent of online servers. These servers are owned and operated by users themselves, allowing players to team up and battle against each other in teams, also called "factions". On these servers, Minecraft has evolved into a competitive battlefield, and with it come opportunities for profit and scams.
Soon, the servers began to introduce in-game purchases, allowing players to spend money to buy upgrades such as the ability to fly, stronger weapons, and armor. Some in-app purchases can also unlock fashionable character costumes, which become a way for players to show off their status online.
As players have become more and more interested in participating in these competitive servers, a large black market has emerged on Discord, specializing in trading game props and rare usernames. Since most Minecraft players are teenagers, this black market quickly became a hotbed for fraud.
Users often agree to pay real money via PayPal in exchange for game items, but after receiving the money, the scammers will block the other party's account. This behavior became so rampant that people began to provide "intermediary services" to solve the trust problem - these intermediaries would charge a certain fee, keep the money and goods on behalf of the parties, and then transfer them to the two parties of the transaction respectively.
In this circle, some high-value user names have become hot collectibles, usually no more than four letters, such as Tree, OK, Mark, YOLO or G, and the price can even be as high as more than $10,000.
As Minecraft's "faction" servers and black markets flourished, virtual currencies became popular in these communities and eventually replaced PayPal as the mainstream transaction method. This unpunished training ground for competition, gambling and fraud, coupled with players' growing familiarity with cryptocurrency, has turned Minecraft servers into a breeding ground for new cybercriminals.
By 2017, the price of Bitcoin was soaring, and Com members seamlessly transitioned from Minecraft scams to cryptocurrency theft. Com's most popular forum is called "OGUsers", which was originally a platform for discussing and purchasing social media accounts and usernames, but later evolved into a hotbed of cybercrime involving SIM card hijacking, Twitter account hacking and other activities.
“These antisocial communities very quickly became a group of ‘hacker rich’ people who got rich overnight and spread the culture because people saw other people suddenly become millionaires and wanted to know how they did it,” Nixon explained. This also led to the rapid expansion of Com.
Com The most commonly used method of cryptocurrency theft is called "social engineering", which refers to manipulating people's minds to induce users to disclose sensitive information. Com members will compile a large list of potential victims obtained through data leaks, and then strike them one by one - this is exactly the case with the victims in Washington DC. Sometimes, they will post "recruitment ads" online to recruit people who are willing to help them commit fraud.
Cryptocurrency investigator Nick Bax once shared a job posting posted on Telegram that promised "5f a week" (a five-figure salary) - "as long as you move fast" - to call potential targets. The notice also requires that "the customer service voice must be American-style professional." After completing the theft, Com members sometimes return to the Minecraft black market and use the stolen cryptocurrency to purchase rare in-game items, which they then sell through PayPal for real cash in order to launder the proceeds.
When ZachXBT found out Veer Chetal’s real identity, he and other investigators quickly identified more people involved in the case. In the recordings obtained by ZachXBT, the thieves call each other by the code name Com, and sometimes they directly say each other's real names. One of the names that was mentioned repeatedly was Malone, also known as Malone Lam.
Malone Lam is a 20-year-old Singaporean who is a notorious figure in the COM community, with screen names including Greavys and Anne Hathaway. He is also a veteran Minecraft player with side bangs. He is often banned from the server, but always manages to return. In the spring of 2023, he clashed with administrators on the Minecadia server and lost some game props, so he conducted a "human search" on the administrators, published their addresses and social security numbers online, and at least once called emergency services to harass them.
According to multiple users and Discord chat logs from the time, Chetal and Lam met in Minecraft, where they played the game as a team in a "faction" led by Lam.
In October 2023, Lam entered the United States on a 90-day visa. He has basically stopped playing Minecraft. He then supported his lifestyle with other cryptocurrency-related scams, according to court documents.
After the August 2024 cryptocurrency theft, ZachXBT tracked Lam through so-called OSINT (open source intelligence), or social media. In Com's chat group, everyone was talking about Lam's spending spree. No one knew where his money came from, but they mentioned his lavish lifestyle in Los Angeles nightclubs.
ZachXBT looked into the city's most popular nightclubs and looked at Instagram feeds from partygoers and the clubs themselves. In one post, Malone wore a white Moncler coat and what appeared to be a diamond ring and diamond-encrusted sunglasses. He stood on the table and began to throw hundred-dollar bills into the crowd.
As money rained down, waiters carried $1,500 bottles of champagne with sparklers stuck in the tops and held up signs that read "@Malone." He spent $569,528 at the club alone that night. At another nightclub, Lam and his team also pranked ZachXBT by instructing nightclub patrons to hold up signs that read "TOLD U WE'D WIN" and another that read "[EXPLETIVE] ZACHXBT."
In the weeks that followed, Lam bought 31 cars, including custom Lamborghinis, Ferraris and Porsches, some valued at up to $3 million. On August 24, he apparently sent a photo of a pink Lamborghini to a model. He texted, "I bought you a present, let's consider it an early birthday present." She replied, "I have a boyfriend again." He replied, "idc" (I don't care).
On September 10, after 23 days of partying in Los Angeles, Lam and a group of friends flew to Miami on a private jet. There, he rented several properties, including a 10-bedroom estate worth $7.5 million. Within days, Lam had filled the driveway with more luxury cars, including several Lamborghinis, one of which had the name "Malone" printed on its side.
Every few days, ZachXBT passed on the intelligence he gathered to law enforcement. Information generally flows one way, but federal authorities are conducting their own investigations simultaneously. According to court documents, the suspects in the conspiracy used sophisticated money-laundering methods to hide funds and obscure their identities, trading through cryptocurrency exchanges like eXch that do not request personal customer information and using virtual private networks (VPNs) to mask their true locations.
But in at least one case, according to authorities, a suspect forgot to use a VPN when signing up for an account with TradeOgre, a digital currency exchange, and his connection was directed to an IP address that pointed to a $47,500-a-month property in Encino, California. The property was rented by 21-year-old Jeandiel Serrano, who used aliases such as VersaceGod, @SkidStar and Box online. By the time authorities identified Serrano, he was vacationing in the Maldives with his girlfriend.
On September 18, when Serrano flew back to Los Angeles International Airport from the Maldives, law enforcement officers were waiting for him at the airport. He was wearing a watch worth $500,000 at the time. When arrested, Serrano initially denied knowledge of the theft and agreed to speak with law enforcement without an attorney. But he quickly admitted his involvement, particularly his impersonation of a Gemini employee, according to court reports.
Serrano admitted that he owned five vehicles, two of which were gifts from his co-conspirators, with funds from previous frauds. He also admitted that he had approximately $20 million in victims’ cryptocurrency on his phone and agreed to return the funds to the FBI.
Meanwhile, agents in Miami were preparing to raid one of Lam's rented mansions. Lam knew the attack was coming: After Serrano was arrested, Serrano’s girlfriend immediately called to warn Lam’s co-conspirators. Afterwards, they deleted their Telegram accounts and other evidence from their phones.
Later that day, a team of FBI agents working with Miami police raided a mansion near the coast of Miami. The agents used a demolition device to open the metal gate in the front, while another team of agents entered by boat through a small saltwater canal in the rear. As agents entered the house, the sound of flashbang grenades exploding echoed through the neighborhood.
Soon after, an agent led a handcuffed Lam, wearing a long-sleeved white shirt, crimson basketball shorts and sneakers, out of the house, with smoke filling the air, followed by at least five other people who were in the house with him. Serrano and Lam were charged with money laundering and conspiracy to commit wire fraud. Each charge carries a maximum possible prison sentence of 20 years.
Exactly one month to the day after the robbery, the party was over.
In the days and weeks after the Chetals were kidnapped in Danbury, Castrovinci and police worked with federal investigators to build a case against a gang from Florida. They urgently gained access to the suspect's mobile phone, from which they viewed group chat records and recorded the movements of gang members.
They learned that the trip was financed and organized in part by Angel Borrero, a 23-year-old Miami native who goes by the nickname Chi Chi. In the group chat, Borrero wrote to others: "If this goes well, we will go to California next." Federal investigators speculated that this meant the gang planned to carry out other operations in California. That day, Josue Alberto Romero, nicknamed Sway, sent a message to the gang: "Chi Chi, we are more prepared than ever." The chat records show that the gang began coordinating the operation as early as 7 a.m. and monitored the Chetal family for part of the afternoon.
By then, police had discovered a motive: They believed the men had targeted the Chetal family to extort money owned by their son through kidnapping. Independent investigators believe that at least one member of the gang, Reynaldo (Rey) Diaz, who uses the alias Pantic, may be a member of Com.
ZachXBT speculates that these thieves may have made themselves targets by showing off their money-spending stories to other Com members. “You would think that after you commit a crime you would keep quiet about it and never talk about it again,” he said. “But they have to compensate by showing off to people they think are their friends. These people may not really be their friends.”
On August 27, Danbury police filed charges against six suspects in the case: multiple counts of first-degree assault, first-degree kidnapping and reckless endangerment. Federal charges followed. A grand jury indictment filed Sept. 24 in federal district court in Connecticut charged six Florida men with kidnapping, carjacking and conspiracy.
The six Florida men represent a growing faction of COM that is no longer focused solely on online scams but is more inclined toward violence. Diaz himself was shot during an attempted robbery in Florida two years ago.
In an FBI affidavit, an agent said Com members frequently carried out "brick-bashing, shooting and arson attacks." According to independent investigative journalist Brian Krebs, in 2022, a young man named Foreshadow was kidnapped and beaten by a competing SIM swapping gang and demanded a $200,000 ransom.
In October 2023, Patrick McGovern-Allen, a 22-year-old man from Egg Harbor Township, New Jersey, was sentenced to 13 years in prison for participating in violent work for hire after being hired by a group of cyber criminals. Last November, it was reported that the CEO of a Toronto-based cryptocurrency company was kidnapped and held for a $1 million ransom.
Weeks later, a 13-year-old boy was outed in the cryptocurrency community for creating a cryptocurrency and inflating its value, and his dog was reportedly kidnapped. In January this year, the founder of the French cryptocurrency company Ledger and his wife were kidnapped. The kidnappers mutilated his hands and demanded a ransom of millions of dollars in cryptocurrency.
However, more and more people not associated with Com are being targeted, said Nixon, the researcher. Some of the so-called Com members were involved in so-called "harm groups" whose members forced young women and girls to commit self-harm and violence. Seven years ago, Nixon said, there were probably only a few dozen members of Com worth noting; today, there are thousands. “Right now,” she said, “we are witnessing an evolution from disorganized crime to organized crime, and we are in the middle of that transition.”
These two incidents — a cryptocurrency heist and a kidnapping — show that Com members’ complete lawlessness in the online world gave them the delusion that they could continue to commit similar crimes in the real world. “I don’t think they learned anything,” ZachXBT said. “I’ve met a lot of people who, after they were arrested or their assets were seized — a lot of them ended up going back to their old lives.”
This year, five of the six Florida men pleaded guilty to federal kidnapping and conspiracy charges, and they could face up to 15 years in prison. In January, Michael Rivas, 19, apologized in a Hartford courtroom for his actions, calling them "stupid" and saying he was helping another man carry out a "revenge plan," though he did not elaborate.
In February, 22-year-old Georgia man James Schwab was indicted in connection with the kidnapping plot. According to the federal criminal complaint, Schwab had a confrontation with Veer Chetal at a Miami nightclub a month before the kidnapping, and that he helped finance the plan, arranging transportation and lodging for the attackers. He has pleaded not guilty.
On March 25, ZachXBT updated the X website with the latest progress in his investigation into stolen cryptocurrency: “Update: Wiz (Vil Chetal) was arrested,” he wrote, “Here is his photo.” The attached photo shows a young man wearing a white T-shirt, with shaggy hair and a thick beard, droopy mouth and tired eyes. He is a far cry from the kid in the photo on the Immaculate High School website. The charge listed in jail records is a federal misdemeanor, but the charge is not specified.
According to ZachXBT, the stolen Bitcoin he tracked was transferred to wallets controlled by law enforcement. The matte grey Lamborghini Urus that Sushil and Radhika Chetal were driving at the time of the kidnapping remains parked as evidence in a secure police parking lot in Danbury that day. This Lamborghini was the car their son drove to school.
