"Since we can't hack in, let's just rob it."
Written by: Austin Carr
Compiled by: Luffy, Foresight News
As the myth of cryptocurrency wealth creation spreads, a bloody plunder targeting ordinary people in the crypto has quietly begun. From online SIM card hijacking and wallet theft to offline home invasions and torture, criminals are twisting the control of decentralized finance assets into a deadly vulnerability for precise hunting. This article, by reconstructing the true modus operandi of the most widespread cryptocurrency violent crime gang in US history, reveals a cruel reality: those now being forced to reveal their wallet passwords at gunpoint and knifepoint are no longer industry tycoons with billions in assets, but rather retired elderly people, teachers, and firefighters driving ordinary cars and guarding their retirement savings.
Misfortunes never come singly
As midnight approached, a knocking sound on the sliding glass door startled Julia Goodwin awake. She and her husband, Glenn, were retired in their sixties, living in a one-bedroom apartment with a stucco exterior in Delray Beach, Florida. At first, they thought it was a bird that had fallen from the palm tree outside their window, perhaps like their pet parrot Kiwi, who was peacefully napping in its cage nearby. The noise was so unusual that they got up half-asleep; Julia, without even bothering to put on her clothes, stumbled towards the source of the sound in the living room. Glenn turned on the overhead light, and the knocking stopped abruptly. Julia stared at the glass door; outside was only impenetrable darkness, but she instinctively felt that the person on the other side could see her clearly.
Immediately afterward, another loud crash came from the glass, like bones breaking. In an instant, the entire pane of glass shattered into countless triangular fragments, crashing onto the tiled floor. Three masked figures burst in. Julia screamed and ran back to the bedroom, while Glenn wrestled with one of the intruders, knocking over the dining table and chairs, as well as the decorative macaw figurine. According to the victim's testimony and subsequent criminal trial records, the other two assailants rushed into the bedroom and forced Julia to her knees beside Kiwi's birdcage. A pistol was pressed against her forehead, and an AK assault rifle against her neck. The assailants demanded to know where her phone and computer were, and how to log into her cryptocurrency wallet. "Give it to me or I'll kill you," one of the masked men said menacingly. "What's the password?"
In the chaos, Julia's mind flashed images of Jesus, the solitary cross hanging on the wall, and Glenn's excruciating pain—he was already in the late stages of Parkinson's disease and his body was frail. But what she found most unbearable was an absurd sense of disorientation: how could this nightmare befall her a second time?
Julia first encountered decentralized finance (DeFi) on YouTube. Obsessed with cryptocurrency technology and drawn to its promised transparency, she sold several rental properties she managed and invested the money in the cryptocurrency market. Within months, her net worth soared to over $3 million. She attributed this windfall to good fortune and a sound trading strategy. However, a premeditated hack struck unexpectedly: in just four minutes, 19 suspicious transfers wiped out 90% of her life savings. This 2021 hack shattered the high-quality care Glenn could have enjoyed after his condition worsened and destroyed Julia's hopes for her later years. She sought compensation from the cryptocurrency exchange holding her assets and even took legal action, but all to no avail.
Now, with a gun pressed against her throat and temple, Julia wanted to scream at the robbers who were trying to steal the last of her coins from her separate account on another exchange. A masked thug ransacked the place, searching for paper documents containing backup verification codes, but Julia was determined not to reveal them. "Shoot!" she yelled. "Go ahead and kill me! Kill me!"
Julia never imagined her investment strategy would place her in such a perilous situation. Like many ordinary people, she thought buying cryptocurrency was no different from investing in stocks or setting up a 401(k) retirement fund, and that cryptocurrency would give her greater control over her assets and allow for real-time, irreversible transfers on the blockchain. She consistently chose only seemingly reputable platforms and cryptocurrencies, never touching Dark Web exchanges or dubious "air coins." She also believed that the requirement for physical device verification for account login, this supposedly more secure verification system, would give her peace of mind.
The Sinful Path of "Cyberboy"
It is precisely this pursuit of new assets that exposes Julia and countless others to risks never before seen in traditional finance. From the outset, blockchain proponents have touted "decentralization" as a core advantage, claiming it prevents manipulation by financial institutions or governments. However, cryptocurrency companies often lack withdrawal limits and the various customer protection mechanisms standard in traditional banks. The reason for this is that restricting the free flow of assets inherently contradicts the very principles of cryptocurrency. Julia's absolute control over her account became the very bait that led to her downfall.
Unbeknownst to Julia, the robbers had anticipated her potential resistance and made preparations in advance. Evidence presented at the trial showed that they had specifically researched methods of torture, not only daring to beat victims with gun butts but even inserting knives and forks under their fingernails. They had been secretly monitoring Julia's residence for several days, learning about Glenn's weakened state and knowing that the highly soundproof windows would completely block out any cries for help from the neighbors. Two lookout cars were parked at the corners of two streets in the residential area; a bright blue BMW sports car was also hidden nearby, with the gang leader, Meow, inside, directing the perpetrators inside the house and his technical accomplices overseas via Telegram.
However, just before the torture was about to begin, Glenn, who had been beaten and dragged into the garage, broke free from his restraints when his assailants were off guard. Barefoot, he stepped over the shattered glass and slammed down the emergency button on the home security alarm. The robbers panicked, hastily grabbing everything of value they could find—an iPhone, a laptop, cash, jewelry, and a beautifully crafted electronic storage box (which they later discovered contained parts of Glenn's deep brain stimulation device)—before fleeing. Julia rushed to her neighbor's house for help, and the neighbor called the police. "We were both crying our hearts out, our voices were hoarse, and we couldn't speak for days," Julia recalled. "But no one heard us."
This attempted home invasion robbery in September 2022 marked the beginning of a series of suburban home invasions and kidnappings by this criminal gang. Their targets spanned at least eight states across the U.S., ultimately resulting in attacks in four. This is likely the largest cryptocurrency-related violent crime case in U.S. history, orchestrated by a single criminal gang. Court testimony revealed that a member of the gang once told their leader, Meow, "If we can't hack in, we'll just rob them." The hackers who once hid behind screens have now taken to the streets.
Since 2020, over 215 cryptocurrency-related violent attacks have been recorded globally, and the number is projected to nearly double by 2025. Jameson Lopp, an industry security consultant who has long tracked this data, suggests the actual number is likely far higher. He explains that many victims choose to remain silent, either fearing retaliation for reporting or simply distrusting law enforcement. Media reports often focus on high-profile heists, such as those targeting cryptocurrency executives or short-video influencers. These stories read more like bizarre crime tales, easily eliciting schadenfreude rather than sympathy for the victims.
However, Bloomberg Businessweek, through sifting through numerous court records and interviewing victims and associates of those involved, reconstructed the details of the Meow gang's crimes, revealing a more heartbreaking reality: the targets of harm or persecution are no longer newly rich individuals, but ordinary people—children, teachers, construction workers, and firefighters. Julia Goodwin is a typical example: she drives a Toyota, and her most prominent Facebook photos are adorable pictures of her pet parrot, Kiwi. The night of the attack made her realize the harsh reality: no cryptocurrency company, regulatory agency, police officer, or lawyer can prevent this type of crime from happening again. All she could do was pray and protect herself. That night, after sweeping up the broken glass, she stood by the alarm, huddled beside the shattered sliding glass door, clutching a knife. "Looking back now, it was really stupid," Julia said. "What could I do if those bastards really came back?"
Shortly after the Delraybridge attack, Meow urgently needed to recruit new members to prepare for his next operation. The criminal gang had a clear division of labor: a tech team was responsible for targeting cryptocurrency holders and laundering money digitally; the "thug team" was responsible for raiding homes. Recruiting thugs was consistently difficult. Court records show that Meow and other tech personnel would send video tutorials to the thugs, teaching them how to tie victims to chairs and how to beat and interrogate them until they handed over their login credentials. But these recruited thugs often didn't follow the script—the failed attack on the Goodwins was a prime example. After the operation failed, the gang leader angrily berated one thug in a Telegram group, saying he couldn't even keep an eye on that "Parkinson's old man," and then fired him.
Meow's recruitment BTC are clearly documented in court records: the market is full of "retired fat sheep"—elderly people who are easy targets; as long as they work for him, everyone can quickly become rich. "Work for me, and I guarantee you'll never have to worry about food or clothing." At a recruitment meeting, Meow, driving his 600-horsepower BMW, boasted to a thug who came to apply, "This is wealth that can be passed down to your descendants."
Meow's real name is Jarod Seemungal. He wasn't born into wealth, but he never experienced financial hardship growing up. After his parents divorced, he grew up with his mother, Maricel, and lived in nice houses in Orlando and West Palm Beach. Family travel gave him early exposure to a life of luxury. His grandmother worked for some wealthy "migratory" Florida residents, whose employers would kindly arrange private jets to take Jarod and Maricel to their Cape Cod estate in Massachusetts for vacations. Maricel recalls that Jarod would travel the world with his father every summer. She revealed that Jarod's father always boasted about making a fortune in casinos and gold mining, and constantly pressured his son to plan his future and forge a path to wealth. “His father was always telling him, ‘You have to do this, you have to do that,’ constantly instilling in him the power of money,” Maricel said. “If Jarod showed the slightest reluctance, his father would belittle him: ‘You’ll end up like your mother, a complete failure.’” (Jarod’s father denied this, stating that he had never belittled his son and that his expectations for him were “no different from those of other first-generation American immigrants.”)
In 2015, 14-year-old Jarod was as thin as a bamboo pole, wore braces, and his closet was crammed with Tommy Hilfiger polo shirts. He had already shifted his focus from the magical world of Harry Potter to his obsession with computers. He spent his days immersed in massively multiplayer online games like Minecraft and even took a part-time job programming for an overseas game company, paid in Bitcoin. Soon, he became a fervent believer in cryptocurrency and actively persuaded his relatives to use all the money they could to buy Bitcoin.
Years later, he and several European friends he met in Minecraft (nicknamed Aabis and Neb) started a SIM card hijacking scam. This scam was highly covert: illegally gaining control of someone else's phone number, intercepting their calls and text messages; sometimes they would even bribe insiders at mobile phone service providers to transfer the number without the victim's knowledge. Once the phone number was transferred to the scammers' devices, they would receive password reset links and verification codes, allowing them to hack into the victim's email and cryptocurrency accounts.
Jarod later confessed in court that he, along with Aabis and Neb, three self-proclaimed "cyber geeks," successfully hacked into over 100 mobile phone accounts and associated cryptocurrency wallets using hacking and social engineering techniques. He admitted that they earned an average of $10,000 per SIM card hijacking. However, their biggest windfall occurred in March 2021. Jarod's testimony and court records show that he and his accomplices targeted a T-Mobile number belonging to Julia Goodwin, a retired woman living in Del Rebic. At the time, Julia was visiting her sister in Costa Rica and had temporarily lost contact with them. They took advantage of this opportunity to transfer 28 Bitcoins and 1,108 Ethereums from her account on the cryptocurrency exchange BlockFi. The stolen funds were transferred in batches to a series of blockchain wallets and exchanges (including Binance and Coinbase), and then transferred multiple times to deliberately obscure the flow of funds. As of press time, BlockFi had not responded to requests for comment.
This successful heist netted Jarod approximately $1.5 million. Before he was even 21, he spent $150,000 on a BMW M8 sports car, moved out of his mother's house, and into a luxury apartment in downtown Miami. This windfall came at a perfect time, as telecom companies like T-Mobile had begun patching vulnerabilities, making SIM card hijacking increasingly difficult. "It's getting harder and harder to hack into telecom companies' systems," Jarod later testified in court. "And the truly wealthy have extra security measures in place for their accounts, requiring physical verification devices to log in."
These security measures, such as authenticator applications and hardware keys, all require the user's physical device to unlock the wallet. Jarod and his ilk quickly realized that since online attacks were becoming increasingly difficult, they might as well take matters into their own hands. Robbery was the simplest and most direct method. Another reason that prompted this shift in thinking was that just months after remotely stealing Julia's assets, he himself became a victim of a violent robbery. Maricel recalled that one night, two thugs kicked down the door of Jarod's apartment on Biscayne Avenue and forced him at gunpoint to transfer most of his cryptocurrency. Jarod stated in court that after this attack, he decided to assemble his own gang of thugs, but his initial attempts were disastrous: he first contacted a group through a childhood friend (who later became a drug dealer), but they absconded with his prepayment; later, he encountered a conman posing as a corrupt FBI agent who also swindled him out of his money. It wasn't until a friend introduced him to Remy Ra St Felix that Jarod finally found a true accomplice. Remy was 21 years old at the time, a young man with dreams of becoming a rapper, who had just been released from prison for a shooting offense.
Remy's rap songs and music videos on SoundCloud, Spotify, and YouTube constantly flaunt his glamorous Florida lifestyle. Like many "internet kids," he also exudes a childish nihilism, such as posting sexually suggestive memes on Twitter and having an Instagram account with the username "@WhoActuallyCaresDude" and a profile picture of a parody of Biden holding a gun.
Judging from his lyrics, which are filled with violence and gore, Remy was absolutely the perfect candidate to lead the henchmen. Court records show that Remy, Jarod, and several mutual acquaintances in the area planned multiple robberies. They purchased firearms, window-breaking tools, and disguises, and also paid TransUnion to buy background information on their targets, obtaining their home addresses and information on their roommates. Jarod and his European tech team built a system that cross-referenced personal information leaked during cyber breaches with user registration information from major cryptocurrency exchanges to pinpoint targets.
From this perspective, the raid on the Goodwins' home was more like a "warm-up." They suspected that Julia likely still had at least $200,000 in cryptocurrency hidden in her separate account at Gemini, the cryptocurrency exchange founded by the Winklevoss brothers. Three days later, they ambushed a 20-year-old hacker. They suspected this young man was connected to the robbery of Jarod a year earlier. Court records show that the thugs subdued the hacker at his doorstep, dragged him inside, pointed guns at his father and sister, and forced him to open his Coinbase account, only to find it empty in anger. They tied the hacker up, stole his phone and computer, and roughly shoved him into the trunk of a Cadillac. Along the way, they punched and kicked him, and even hit him with the butt of a gun. They even sent videos of him kneeling and begging for mercy to the hacker's Telegram contacts, demanding a ransom, but his friends didn't take it seriously. Jarod later recalled that one of his friends even jokingly transferred $10. The thugs drove around for hours before finally stopping in a deserted area beside Interstate 95, where they apparently abandoned the young man. He took the opportunity to break free and disappear into the night.
Afterward, the group's robberies continued to cause trouble. In November of the same year, Remy and three thugs were driving an orange Dodge Charger when a police car behind them suddenly flashed its lights. They sped away, but the car went out of control and overturned. All of them were arrested and charged with multiple offenses, including illegal possession of weapons. Jarod paid for their bail, and the group then continued to look for their next victim. According to prosecutors' indictments and trial testimony, in Little Elm, Texas, several accomplices used a red-hot iron to brand the victim's skin and stuck a fork and a dagger under the victim's mother's fingernails. The victim was forced to admit that his cryptocurrency was hidden in the backyard. But when the robbers forced him out of his parents' house to dig up a hardware wallet hidden in the ground, he suddenly broke free, jumped over the fence, and fled, leaving behind his beaten and bound mother, stepfather, and autistic brother. The robbers found some cash and jewelry in the house and then left. The mother who suffered torture later tearfully recounted in court that her family has lived in endless fear ever since, dreading that the perpetrators would return and commit violence again.
In early 2023, court records showed that Remy, posing as a DoorDash delivery driver, broke into a house he thought held his targets, only to find it was an empty short-term rental apartment. The address they had purchased from TransUnion had long expired. In addition, the gang plotted multiple robberies, targeting victims across Connecticut, Georgia, Nevada, and Tennessee, with a total value of approximately $1.3 million; in Canada, they also targeted a $4 million heist.
However, the promised generations of wealth remained elusive. Ruben Matias Nicolopulos Silva (nicknamed Matt)'s father had helped him buy a food truck to start a business. About a year after joining the group, Matt admitted in court that he had only received $4,000 in total. This amount was even less than his stable monthly income when he sold tortilla chips on the streets of West Palm Beach.
Target: Ordinary investors
The criminal gang had been unable to target what Jarod referred to as "real investors"—middle-class individuals with substantial cryptocurrency assets but not wealthy enough to hire additional security personnel. Later, a new member nicknamed Galaxy joined the tech team. He reportedly used a leaked database from CoinTracker, a cryptocurrency portfolio management and tax accounting platform, to pinpoint a perfect target. Galaxy used this database to pinpoint Walter Moss, a retired high school physics teacher in North Carolina. Walter's account contained a significant amount of cryptocurrency, and the account data was continuously being updated. A CoinTracker spokesperson responded that the leak was caused by a former third-party service provider and only contained a list of user email addresses; further hacking would be necessary to obtain users' cryptocurrency holdings.
In the early morning of April 12, 2023, Walter Moss, still half asleep, answered the door. Two men in reflective safety vests stood outside. They claimed to be employees of the municipal utility company and said a nearby water pipe had burst and they wanted to check the backyard for leaks. Walter agreed and went back to the bedroom. A few minutes later, there was another knock. This time, his wife, Carolyn, went to answer the door. The two "repairmen" immediately attacked, grabbing her and dragging her screaming through the potted plants and piles of books, past a portrait of Obama on the wall, and throwing her into the sunlit kitchen. They shoved Carolyn to the ground, her head hitting the tile floor hard, and the assailants punched and kicked her, fracturing three of her ribs.
Hearing his wife's screams, Walter rushed into the kitchen. Remy suddenly sprang from the shadows and punched him in the face. "I'm here to get the money in your Coinbase account," Remy said menacingly, according to witness testimonies. "If you don't cooperate, I'll kill you. Before I do, I'll chop off your toes, your fingers, and cut off your genitals."
Another thug, cursing, bound Carolyn's wrists and ankles with cable ties. Remy then forced Walter, whose face was covered in blood, upstairs to his home office. The couple later described the scene in detail in court. Walter recalled that he tried to log into the Coinbase app on his iPhone, but his face was so badly disfigured that facial recognition failed. He then tried to log in with his Mac, but couldn't remember his password. Remy held a gun to him, spewing out what Walter later described as "HBO-level profanity." Walter frantically searched through folders piled high with files for several minutes before finally unlocking his account. Remy shoved him aside and sat down at the keyboard himself. As part of the group's pre-arranged plan, Remy called the tech team to help them establish a remote connection. Jarod, in Florida, remotely controlled the Mac while on the phone with Remy. Walter watched as Remy jumped up, walked to the whiteboard next to his desk, and began to write and draw, just like the students in the advanced placement courses he used to teach.
At 8:23 AM, a batch of Ethereum was transferred out of Walter's Coinbase account; at 8:40 AM, $140,000 worth of Bitcoin was transferred out; then, another Ethereum transfer, and another… The criminals' eyes then turned to Walter's accounts on other platforms, which contained some lesser-known cryptocurrencies. But by this time, Walter was drenched in sweat, his body beginning to tremble uncontrollably, appearing as if he were having a stroke. Worse still, Remy and his accomplices noticed that gardeners were approaching outside, potentially seeing what was happening inside through the large windows. They hurriedly tied Walter up with cable ties, glanced at a seemingly expensive Carl Jung book next to the desk, hesitated for a moment whether to take it, and then quickly fled the scene.
The loot was divided among the gang members. Jarod later testified in court that half of the money went to Galaxy, who provided the lead on the target; he took 20%, which he shared with Aabis and Neb as payment for their remote assistance; and Remy received 15%. After Jarod laundered the money, Remy ultimately received only $22,267.65. Telegram chat logs presented in court showed that the tech team even severely reprimanded Remy for the failed Durham robbery, blaming him for damaging Walter's mouth and causing Apple's facial recognition to malfunction. "Tell your men," Neb complained, "don't hit someone in the face unless absolutely necessary. The face is the only part of your body that needs to be intact."
Soon, Jarod and his European tech buddies targeted their next group of "real investors," preparing for their heist. However, the henchmen were increasingly dissatisfied with the gang's profit-sharing arrangement. They had originally planned to take the Easter weekend before the North Carolina operation to spend time with their families, and then another three weeks off afterward. Remy repeatedly asked the tech team to reimburse his men for their commuting gas expenses and also requested a 5% increase in their share. But in June of that year, the tech team flatly refused his request, stating bluntly, "Either accept the current profit-sharing, or you quit."
Remy reluctantly accepted the offer and began looking for new robbery targets a few days later. Court records show that in July of the same year, the thugs began secretly monitoring a retired New York firefighter. The firefighter lived on Long Island with his wife and children, and it was alleged that he had $200,000 in cryptocurrency in his Coinbase account and Ledger hardware wallet. However, they ultimately failed. On July 27, Remy was sitting alone in his rented SUV, scrolling through his phone, at a McDonald's restaurant near the firefighter's home on the side of the highway, when he was suddenly surrounded by several cars full of FBI agents and task force officers and arrested on the spot. The agents opened the SUV's trunk and found a bag of cable ties and a Green Bay Packers-branded duffel bag containing a loaded AK assault rifle.
Who are the beneficiaries?
As it turned out, the criminal gang's trail was not as stealthy as they had imagined. A neighbor of Carolyn and Walter provided police with footage from their home security camera, clearly showing Remy's rented SUV loitering in the neighborhood on the morning of the incident. Investigators, by accessing cell tower records and data from Apple and Google accounts, finally confirmed the identities of Remy and his gang members. The following July, when federal agents arrested Remy, they found a staggering amount of incriminating evidence on his iPhone: including undeleted Telegram chat logs with his tech team, and a selfie of him holding a gun and wearing a robbery disguise. Prosecutors had enough evidence to link the gang to multiple home invasion robberies from Del Reybridge to Little Elm.
Soon, all 14 members of the gang within the United States, including Jarod, were arrested and indicted. Some of them quickly pleaded guilty and reached plea bargains with the prosecution. This was perhaps not surprising, given that the gang was based online, and the relationships between members were inherently fragile. During the trial in 2024, the victims of the gang's violent crimes tearfully recounted the trauma they suffered. Carolyn, who was 76 years old at the time of the attack, described the horrific changes in her husband, Walter, after the attack: "He started having frequent flashbacks to the incident, and he would jump at the slightest sound. The vicious threats from those criminals played on a loop in his mind like a tape." She said, "He became extremely irritable when watching the news or when we watched TV together; he was a completely different person."
In a North Carolina courtroom, Jarod's mother, Maricel, sat in the gallery, listening to another victim's testimony, overwhelmed with shame. Later, she had the opportunity to speak with her son, and she recalled saying, "My God, how could you do this? I want to strangle you. Seriously, how could you do this?" Jarod, however, remained expressionless and argued that he had only given the target list to the thugs, had no idea the victims were all elderly, and never imagined they would be so brutal. But Jarod's communication records directly contradicted his claims. As of press time, Jarod and his lawyer had not responded to requests for comment.
Matt's father couldn't believe that the heinous acts described in the trial could have been committed by his "well-behaved and sensible son." Not long ago, he had been cheering Matt on at a youth karate competition; he had even funded his son's business, selling corn chips. Now, this young man, who called himself a "starving ghost" in a Telegram group, had become a lookout for a robbery gang. "Our family has a clean record for generations, and we're well-off," Matt's father wrote in a text message. "This is a wound that will forever remain in our family's heart."
During the sentencing phase of the trial, Remy's defense attorney attempted to shift blame to the "nihilistic culture that is destroying Generation Z." He told the judge that today's children are constantly immersed in screens and the online world, playing Minecraft and first-person shooter games for 12 hours a day, and endlessly watching TV shows, social media, and watching pornography, their senses already numb. No wonder Remy referred to his new cryptocurrency heist as "the next mission," as if he were playing Grand Theft Auto. "If this kind of internet addiction is left unchecked, people's conscience will be completely eroded," the defense attorney argued. "People become numb, even callous. It's all YouTube's fault."
But the judge was unconvinced. He argued that social problems of the internet age should not be used as an excuse for the defendants' violence. Ultimately, Remy Ra St Felix was convicted on nine counts, including conspiracy to kidnap and wire fraud, and sentenced to 47 years in prison. He has appealed, and his new lawyer did not respond to requests for comment.
Those gang members who acted as lookouts or committed the crimes from behind keyboards received relatively lighter sentences: Matt was sentenced to 12 years in prison; Jarod will not be released until 2040. A relative of Matt revealed that the FBI's Behavioral Analysis Unit is very interested in this criminal gang and plans to conduct psychological profiling of its members to try to understand why more and more teenagers and young adults in their early twenties are getting involved in these cryptocurrency-related violent crimes. "These young punks pretending to be gangsters only care about shortcuts to quick money and have no desire to work hard," the relative analyzed. "They see their peers flaunting their wealth on TikTok and get envious, single-mindedly thinking, 'How can I get rich quickly?'"
While the focus of this trial was on the perpetrators, it also exposed the extremely weak consumer protection mechanisms in the decentralized finance (DeFi) industry. Legal documents show that Walter and Carolyn were ultimately able to recover their stolen cryptocurrency because Walter had been paying a monthly fee of $29.99 for what he called "Coinbase insurance." This paid service is similar to a private version of traditional fiat currency bank FDIC insurance. As of December 2024, Coinbase's premium paid plans had over 600,000 subscribers, becoming a major revenue stream for the exchange.
However, the reason the couple ultimately received compensation is puzzling. Coinbase does offer platform-wide crime insurance, but this type of insurance primarily covers losses caused by hacking into company servers or employee theft. The company explicitly states that the premium protection plan Walter purchased is not strictly "insurance" because it "does not cover many types of losses that should be covered by insurance." In fact, the plan's terms explicitly state that it does not cover fraudulent transactions authorized by deception by a third party, such as common SIM card hijacking and phishing scams. Coinbase is also not responsible for losses caused by violent robbery. "Unfortunately, Coinbase's insurance does not cover losses caused by violent attacks or coercive attacks, i.e., situations where users authorize transfers under duress," a Coinbase customer service representative stated.
When asked about the specific types of violent attacks covered by the Advanced Protection Plan, a Coinbase spokesperson responded that the plan's coverage is outlined in publicly disclosed documents, and the company "does not guarantee compensation for all losses involving fraud." The spokesperson added, "Our policy is not to publicly comment on whether the Account Protection Guarantee applies to a particular customer's specific loss. Our priority is the safety of victims and cooperating with law enforcement; each claim is assessed individually according to the publicly disclosed terms."
During Remy's trial, Christine Spaeth, a senior investigator on Coinbase's global corporate intelligence team, testified. She stated that new users opening accounts on Coinbase are required to provide verifiable personal information, including name, address, phone number, driver's license or passport, and a selfie matching the identification—largely a mandatory requirement of KYC rules. Spaeth also stated that thanks to Coinbase's machine learning model, which promptly identified unusual activity on Walter's account, the final transfer was prevented.
Ironically, Coinbase's cybersecurity model only intercepted this fourth and final transfer, worth $9,145; while the previous three suspicious transactions, totaling $156,853, were all successfully transferred out.
Cryptocurrency companies, led by Coinbase, are lobbying the government to reform mandatory KYC policies. They claim the reforms will significantly improve account security by strengthening user privacy protections; however, this move will undoubtedly increase company profits, reducing compliance costs and simplifying the user account opening process, thus improving conversion rates. A Coinbase spokesperson stated that the company has been lobbying the government to ensure all cryptocurrency exchanges uniformly implement existing compliance rules, "especially those exchanges that, unlike Coinbase, circumvent US anti-money laundering and KYC requirements through offshore operations." The spokesperson added that the company is lobbying the government to revise relevant federal laws to introduce more secure identity verification tools while reducing the risk of unnecessary data breaches.
Security consultant Jameson Lopp, one of the earliest known offline victims of Bitcoin ransomware (the case occurred in 2017), also believes that such anti-money laundering regulations do more harm than good. "KYC is one of the biggest vulnerabilities in the cryptocurrency space; it's what leads to massive data breaches, making users targets for criminals," Lopp said.
However, some policymakers and academics argue that revoking such internationally accepted regulations would lead to a sharp increase in illicit financial flows. After all, it was precisely because Coinbase strictly enforced KYC compliance requirements that the FBI was able to connect the robbery in North Carolina with Remy, who opened an account on Coinbase using a Florida driver's license.
Marit Rødevand, founder of the tech startup Strise AS, which focuses on developing blockchain tools to combat money laundering, worries that the cryptocurrency industry will use the excuse of "increasing consumer attacks" to massively "undermine industry transparency." Rødevand stated that she fears these "cyberkids" will become even more secretive and rampant in their scams. "We are creating a society where 'don't trust your neighbor, don't trust anyone,'" she said. "When cyberattacks escalate into real-world kidnapping and extortion, people suddenly realize: 'Oh my god, are we going to live in fear forever?'"
Unprotected victims
In September of this year, on a humid and sweltering Florida afternoon, Julia Goodwin had just returned from a vacation in Switzerland. She travels whenever she has the chance, but now, the cost of travel is becoming increasingly unaffordable. Glenn's health is deteriorating, and she couldn't join the trip, staying home instead. "A 71-year-old woman, forced to stay in a hostel," Julia said, her voice filled with regret. "My life has been completely changed, and I'm still furious."
Julia felt a sliver of relief when the FBI informed her that her attackers had been arrested. A year later, at her trial, she was grateful for the prosecutors' diligence; the judge's permission for her to speak directly to Jarod, who had attacked her twice, during the victim impact statement phase also brought her considerable peace. "You destroyed everything I'd worked so hard for my entire life," she told Jarod. "I'm broken, I've cried all my tears, but I still have my faith."
Then and now, when Julia says she can never "go back to normal," it's clear she's referring to more than just financial compensation—though the financial loss is a significant part of her suffering. The court has ordered the convicted gang members to pay her millions of dollars in restitution. But Julia has no hope: she knows she can't possibly recover that much money from their future paychecks or from the proceeds of the government auctioning Jarod's confiscated BMW.
Her two separate lawsuits also yielded disappointing results. The first, filed before the attacker's identity was revealed, was against "John Doe," and she sought to compel third-party companies to provide records to determine their potential liability in the fraud. The second lawsuit, filed after the home invasion, was against a T-Mobile affiliate. She argued that T-Mobile bore indirect responsibility for the initial SIM card hijacking and also filed a claim against T-Mobile itself in private arbitration. Julia said that when she was initially hacked, the exchange BlockFi, which held her assets, refused to take any responsibility before its bankruptcy. Gemini, after the initial digital theft, only offered basic account protection measures, such as temporarily freezing withdrawals or adjusting device login procedures. After the home invasion, Julia said her lawyer eventually persuaded her to accept a small settlement from T-Mobile, a drop in the ocean compared to her total losses.
This crime also robbed her of her trust in humanity. Julia said that simply because she possessed cryptocurrency, or even just because she was thought to possess cryptocurrency, she had to be extremely careful in choosing who to associate with. Other victims seem to be trapped in the same predicament. A relative of Carolyn and Walter revealed that the ordeal made the whole family extremely distrustful of others. The retired New York firefighter who was targeted stated in court that his wife now trembles with fear whenever the doorbell rings. When a reporter later called him for an interview, he rudely denied possessing any cryptocurrency and then hung up the phone.
The hackers and social engineering scammers who fuel this fear are a persistent problem. After all, these perpetrators have allegedly relied on European tech workers like Aabis, Neb, and Galaxy to identify targets and launder the stolen money. These so-called digital thieves are far more difficult to track than offline criminals: while offline perpetrators leave evidence at crime scenes, these online hackers often hide behind online aliases and overseas VPNs. A publicly released indictment shows that the United States is seeking the extradition of two European tech workers, Samir Ahmed and Syed Ali Aabis Jafferi, from the UK for their alleged involvement in the crimes. Another suspect, Roope Kristian Karjalainen, from Finland, is currently under investigation there.
On December 16, a British judge ruled that the US extradition request was in accordance with the law and referred the case to the Home Secretary for a final decision. The lengthy legal document states that British police are conducting an investigation called "Operation Stellara," targeting an "international criminal syndicate operating between the UK, the US, and Finland." The document shows that Samir Ahmed (Galaxy) and Syed Ali Aabis Jafferi (Aabis) are both 25-year-old former university students. In his court statement, Samir Ahmed stated that he had worked at Tesco and had written a paper on how to prevent SIM card hijacking scams. When police arrested him, they seized his mobile phone, which appeared to contain a spreadsheet listing potential US burglary targets. During a search of Syed Ali Aabis Jafferi's residence, police stated that they had to take coercive measures to prevent him from turning off his laptop, ultimately seizing the device "while it was powered on and unlocked."
While these legal proceedings proceeded slowly, Remy, in prison, continued his antics. A recent legal document revealed that he admitted to assaulting a handcuffed federal witness while in custody. This witness was a former accomplice in cryptocurrency crimes who chose to testify in exchange for a reduced sentence. Unable to log into his X platform account from prison, Remy could only boast about his actions in recorded phone calls to his mother and girlfriend. "I beat that guy up," he said, laughing. "That guy was a traitor."
Currently, many cryptocurrency-related violent attacks still target industry executives and influencers, but an increasing number of unsuspecting ordinary investors are being drawn into this bloody storm. For example, on September 19, in a suburb of Grant, Minnesota, a man was attacked by two assailants while taking out the trash. The assailants, armed with shotguns and AR-15 rifles, forced him into his house, kidnapped his wife and son, and demanded his cryptocurrency account login information. The police criminal complaint shows that during this nine-hour hostage situation, the assailants also forced the homeowner to drive to his cabin in the woods to retrieve a hardware wallet hidden there; during this time, the assailants frequently made phone calls to an "unidentified third party," who continuously provided account information and instructions for transferring funds. (Soon after, two brothers from Texas were arrested on suspicion of kidnapping and robbery.)
The scope of "real investors" that Jarod refers to, or potential victims, is constantly expanding: Gallup's latest poll shows that among American adults who hold $10,000 or more in stocks, bonds, and mutual funds, the proportion investing in Bitcoin or other cryptocurrencies has nearly tripled in the past four years, reaching 17%.
Coinbase's Chief Security Officer, Philip Martin, pointed out that violent robberies are not a new phenomenon since the advent of cryptocurrencies. "Throughout history, whenever people possess valuables—whether it's cash, jewelry, or account access—criminals have tried to steal them. Every new asset class spawns new methods of crime, but essentially, it's all the same thing in a different guise," Martin said. "The real solution lies in education and raising awareness: helping people understand how to mitigate risk, strengthen personal security, and identify unusual situations. At the same time, responsible platforms have an obligation to step in and provide assistance when crime occurs."
Surprisingly, Julia remains a staunch believer in cryptocurrency. She says that cryptocurrency will become the mainstream of the future economy, and she still firmly believes in the power of blockchain technology and the democratization vision it embodies. But Julia also knows that upholding this belief requires her to take on enormous personal risks. Since the nightmarish home invasion three years ago, she has done everything she can to protect herself, Glenn, and their beloved parrot Kiwi. She remembers that terrifying night after the attack, rushing to the bedside and grabbing Kiwi's portable birdcage. "She was terrified, the poor little thing, trembling with fear," Julia said. "She knew something terrible had happened in the house. We were screaming so loudly, she knew everything. She's really smart."
After calming the parrot down, Julia put it back in its safe cage.
