6 ms·

Twelve sentenced for violent home invasion robberies to steal cryptocurrency

138 points by aa_is_op 2y ago

j-bos 2y ago
Crypto aside, quite surprising to see home invasions, kidnapping, and torture in middle class american neighborhoods. What I'd like to know, which wasn't in the release is how did the criminals identify or decide to target these specific victims.
- xrd 2y ago
  Yes, none of the victims, at least from the sentencing report, sound like they were vocal crypto bros. They sounded more like regular families. If they weren't public figures, I also would really like to know why they were targeted. That's scary.
  - deleted 2y ago
    [deleted]
  - macNchz 2y ago
    From the “Dirty Comms” episode of Darknet Diaries, a SIM swapper being interviewed describes how attackers will use breach information from other crypto-related sites to credential-stuff Coinbase. That doesn’t necessarily get you very far because of MFA, but there was seemingly a brief window when Coinbase had a vulnerability for checking account balances without triggering MFA, so attackers were able to identify tons of email addresses associated with large crypto holdings. I imagine this information is available if one were to seek it out. > DREW: I don’t even know if you’re gonna believe me whenever I tell you this, but there was an exploit in Coinbase for about one month where you could check the balance of any valid password and username. You could – no matter what. You didn’t need to have any sort of access except username and password. So, you didn’t need to SIM them to see their balance. So, people just ran millions upon millions of combos, combo list through Coinbase, and just found the millionaires of Coinbase. There’s obviously millions of those. https://darknetdiaries.com/transcript/112/ https://darknetdiaries.com/transcript/112/
    - 65j65j56j 2y ago
      If those transactions associated with the account leaks, the funds can be followed. This will often means transactions flowing to off-chain wallets of KYC'd owners.
- Dalewyn 2y ago
  >how did the criminals identify or decide to target these specific victims. They used SIM swapping, which is done by fooling customer service agents using stolen, partial personal information. The victims were also cryptobros, so I am guessing the answer is actually as mundane as it gets: Victims put up their names and addresses on social media and bragged/discussed about their cryptowealth.
  - xrd 2y ago
    From my reading I couldn't tell they were crypto bros. That was obvious to you from reading it, or did you know about them prior?
    - Dalewyn 2y ago
      I have no reason to presume someone holding crypto isn't a cryptobro. Either way it's irrelevant, the criminals got a hold of their personal information somehow and the most likely cause in this day and age is the victims divulging it themselves.
- bnralt 2y ago
  One of the reasons why this happens is because repeat violent offenders get away with a surprising amount. For instance, the lead criminal in this case had been charged with attempted murder in a separate case just a couple years before starting the crypto thefts, but the charges were eventually dropped. The crypto thefts seem extremely violent as well[2]: > An elderly North Carolina couple was held hostage in their home by armed men who threatened to "cut off (the) husband’s toes and genitalia, to shoot him, and to rape his wife," before they were robbed of more than $156,000 in cryptocurrency, federal prosecutors said. [1] https://www.palmbeachpost.com/story/news/crime/2018/08/22/update-state-drops-attempted-murder/7796115007/ https://www.palmbeachpost.com/story/news/crime/2018/08/22/up... [2] https://www.nbcnews.com/news/crime-courts/elderly-nc-couple-was-held-hostage-home-robbed-156000-cryptocurrency-rcna97056 https://www.nbcnews.com/news/crime-courts/elderly-nc-couple-...
  - deleted 2y ago
    [deleted]
  - devilbunny 2y ago
    Violent crime seems to get far too much of a pass. Not every shoplifter needs to be punished to the ground, but violent crime should be punished harshly.
- dmoy 2y ago
  Home invasion isn't exactly surprising, it's about 1 million home invasions per year in the US. And violent assault of some sort during home invasion isn't super surprising, that's like O(250k) per year. But the kidnapping and torture, yea that's pretty rare as far as I know.
  - WillPostForFood 2y ago
    That data seems wrong, though I have seen it reported on blogs and such. FBI data on total burglaries is under 1,000,000 since 2019 (857k in 2022, the last reported year) Home invasion should be a somewhat smaller subset of that. https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crime/property-crime https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crim...
    - secabeen 2y ago
      > In 2022, there were 150,107 robbery incidents ... reported ... by 13,621 law enforcement agencies ... cover(ing) 76% of the total population https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crime/crime-trend https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crim... That includes all robberies, and home invasion would similarly be a subset of that, so the OP is off at least of by a factor of 10.
      - dmoy 2y ago
        So a few things I'm using Bureau of Justice Statistics data, not FBI. E.g. https://bjs.ojp.gov/library/publications/victimization-during-household-burglary https://bjs.ojp.gov/library/publications/victimization-durin... FBI / UCR covers only reported crimes at police agencies that forward data, and is a subset. BJS tend to be better at getting realistic numbers. (E.g. a majority of burglaries aren't reported to the police, and thus don't show up in UCR*) Also robbery is not a superset of home invasion, due to the difference in definition from burglary. Burglary isn't actually about stealing stuff, it's just breaking in with the intent to commit some crime (which is often theft, but not always). Robbery implies theft, but doesn't require it to be in someone's abode. So there's some overlap, but there's robberies that aren't burglaries (because no breaking in is involved), and there's burglaries (even some of the <10% subset of burglaries that are violent) that aren't robberies, because a theft isn't occurring. * For things like homicide, UCR tends to be a lot better, because the reporting rate is quite high.
- sfmz 2y ago
  Somewhat reminicient of Indian-Americans being targeted due to cultural emphasis on possessing gold https://www.nytimes.com/2011/09/30/us/bay-area-thieves-seeking-gold-target-indian-americans.html https://www.nytimes.com/2011/09/30/us/bay-area-thieves-seeki...
mikehearn 2y ago
As someone with the same name as a somewhat well-known former Bitcoin developer, this is sort of a latent fear I have. I would expect that someone dumb enough to think a home invasion is a good idea is also dumb enough to not double-check whether they've got the right guy.
- __s 2y ago
  A real life The Big Lebowski
- ghaff 2y ago
  Many years ago, I went to school with someone who shared their name with someone who got in a very public spat with George Steinbrenner who was the owner of the New York Yankees at the time. They got literal death threats on their phone. ADDED: Since then I've often thought the worst case scenario is to share a somewhat unusual name with someone who is hated/notorious in some manner given it invites crazies to do crazy things.
smeej 2y ago
It's a surprisingly hard threat to model against. For example, sure, don't store your funds on an exchange and they can't get in with a SIM swap, but when they're in your house, that doesn't help you. You could store your funds with a multisig wallet and make sure you don't have access to enough keys at home to move the funds, but how do you make them believe you? You can have one or more decoy wallets you can "cave" and give them access to if you think it might buy your freedom, but once you start, again, why would they believe you? Do you just acknowledge that they won't believe you,that they are going torture you regardless? And at least make sure you or your heirs have the money if any of you survive? There really isn't a good way out of this.
- spencerchubb 2y ago
  Multisig wallet where you and your spouse both have to sign. In case one dies, the multisig can expire after a certain amount of time and let you access with just one key Of course this assumes you have a spouse
  - KMnO4 2y ago
    Don’t you live with your spouse? Now the intruder has a gun pointed at both of you.
    - coolspot 2y ago
      You need to diversify your spouses. One lives with you, others are living away.
  - deleted 2y ago
    [deleted]
- lmz 2y ago
  Maybe if the exchanges didn't require KYC or phone, there would be no way of knowing where they live just from the exchange account.
- koolba 2y ago
  > There really isn't a good way out of this. The answer is to live anonymously. Don’t flash the cash.
phil21 2y ago
This was a large consideration in me offloading the vast majority of my cryptocurrency during the peak run up. The financial and digital hacking risk I was okay with, the physical risk to my family was too much. Even if I kept it off-site and in a safe deposit box somewhere no criminal would actually know that. Decoy systems and complicated multisig setups are all vulnerable to the ball peen hammer attack. Had I known Bitcoin would turn into what it had I would have done far more to create a pseudonymous persona when participating in the early scene vs. my well known and easily linked handle to my real identity. It was a fun ride, but the risk just got to be too much.
- tptacek 2y ago
  I mean, the premise is more or less the same as that of keeping your money in gold bars under your bed, except without the physical labor. So yeah, seems like a bad idea.
  - ajb 2y ago
    When I was in high school, the computing teacher remarked that some people still don't believe that computers have benefited society. His answer to this was that they have nearly eliminated armed robbery, because when people were paid in cash, the payroll was an enormous target. Such heists used to be a commonplace risk, but a couple of generations have grown up without them.
    - xelamonster 2y ago
      Wouldn't this have been addressed by paper checks long before direct deposit came into play?
      - ajb 2y ago
        Hmm, it's years since I properly thought about this anecdote Yes, in theory you could have done everything with checks. It didn't completely happen though, until after computerisation. In the UK, it turns out that employees had the right to receive pay in cash as late as 1986! And taking it away was controversial.So it may be that you are right that computerisation wasn't essential, but most likely the reduction in cost of banking spread it to enough people that armed robbery became less of a risk.
hindsightbias 2y ago
I’ve always wondered if that gold coin company sells marketing info. Were names of Mt. Gox claimants published?
- bdcravens 2y ago
  Many leaks have happened over the years. While a leaked email address isn't always an identifiable target, correlating various leaks along with the various other identity resources out there isn't very challenging.
- jarsin 2y ago
  If you are in the US and had or have a Coinbase account anyone that wants to know if you ever dabbled in crypto knows at this point.
bag_boy 2y ago
Relevant to discussion: “A list of known attacks against Bitcoin / crypto asset owning entities that occurred in meatspace.” https://github.com/jlopp/physical-bitcoin-attacks https://github.com/jlopp/physical-bitcoin-attacks
s5300 2y ago
[dead]
nanomonkey 2y ago
A Florida man...
hamandcheese 2y ago
If you torture a person in their own home, I'm surprised that you don't go to prison for life.
etc-hosts 2y ago
so which country is the foreign country? The man who got 40 years was arrested in 2018 for shooting at a high school student. https://www.palmbeachpost.com/story/news/crime/2018/08/22/update-state-drops-attempted-murder/7796115007/ https://www.palmbeachpost.com/story/news/crime/2018/08/22/up...
ChoHag 2y ago
[dead]

138 points by aa_is_op 2y ago

Crypto aside, quite surprising to see home invasions, kidnapping, and torture in middle class american neighborhoods. What I'd like to know, which wasn't in the release is how did the criminals identify or decide to target these specific victims.

xrd 2y ago
Yes, none of the victims, at least from the sentencing report, sound like they were vocal crypto bros. They sounded more like regular families. If they weren't public figures, I also would really like to know why they were targeted. That's scary.
- deleted 2y ago
  [deleted]
- macNchz 2y ago
  From the “Dirty Comms” episode of Darknet Diaries, a SIM swapper being interviewed describes how attackers will use breach information from other crypto-related sites to credential-stuff Coinbase. That doesn’t necessarily get you very far because of MFA, but there was seemingly a brief window when Coinbase had a vulnerability for checking account balances without triggering MFA, so attackers were able to identify tons of email addresses associated with large crypto holdings. I imagine this information is available if one were to seek it out. > DREW: I don’t even know if you’re gonna believe me whenever I tell you this, but there was an exploit in Coinbase for about one month where you could check the balance of any valid password and username. You could – no matter what. You didn’t need to have any sort of access except username and password. So, you didn’t need to SIM them to see their balance. So, people just ran millions upon millions of combos, combo list through Coinbase, and just found the millionaires of Coinbase. There’s obviously millions of those. https://darknetdiaries.com/transcript/112/ https://darknetdiaries.com/transcript/112/
  - 65j65j56j 2y ago
    If those transactions associated with the account leaks, the funds can be followed. This will often means transactions flowing to off-chain wallets of KYC'd owners.
Dalewyn 2y ago
>how did the criminals identify or decide to target these specific victims. They used SIM swapping, which is done by fooling customer service agents using stolen, partial personal information. The victims were also cryptobros, so I am guessing the answer is actually as mundane as it gets: Victims put up their names and addresses on social media and bragged/discussed about their cryptowealth.
- xrd 2y ago
  From my reading I couldn't tell they were crypto bros. That was obvious to you from reading it, or did you know about them prior?
  - Dalewyn 2y ago
    I have no reason to presume someone holding crypto isn't a cryptobro. Either way it's irrelevant, the criminals got a hold of their personal information somehow and the most likely cause in this day and age is the victims divulging it themselves.
bnralt 2y ago
One of the reasons why this happens is because repeat violent offenders get away with a surprising amount. For instance, the lead criminal in this case had been charged with attempted murder in a separate case just a couple years before starting the crypto thefts, but the charges were eventually dropped. The crypto thefts seem extremely violent as well[2]: > An elderly North Carolina couple was held hostage in their home by armed men who threatened to "cut off (the) husband’s toes and genitalia, to shoot him, and to rape his wife," before they were robbed of more than $156,000 in cryptocurrency, federal prosecutors said. [1] https://www.palmbeachpost.com/story/news/crime/2018/08/22/update-state-drops-attempted-murder/7796115007/ https://www.palmbeachpost.com/story/news/crime/2018/08/22/up... [2] https://www.nbcnews.com/news/crime-courts/elderly-nc-couple-was-held-hostage-home-robbed-156000-cryptocurrency-rcna97056 https://www.nbcnews.com/news/crime-courts/elderly-nc-couple-...
- deleted 2y ago
  [deleted]
- devilbunny 2y ago
  Violent crime seems to get far too much of a pass. Not every shoplifter needs to be punished to the ground, but violent crime should be punished harshly.
dmoy 2y ago
Home invasion isn't exactly surprising, it's about 1 million home invasions per year in the US. And violent assault of some sort during home invasion isn't super surprising, that's like O(250k) per year. But the kidnapping and torture, yea that's pretty rare as far as I know.
- WillPostForFood 2y ago
  That data seems wrong, though I have seen it reported on blogs and such. FBI data on total burglaries is under 1,000,000 since 2019 (857k in 2022, the last reported year) Home invasion should be a somewhat smaller subset of that. https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crime/property-crime https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crim...
  - secabeen 2y ago
    > In 2022, there were 150,107 robbery incidents ... reported ... by 13,621 law enforcement agencies ... cover(ing) 76% of the total population https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crime/crime-trend https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crim... That includes all robberies, and home invasion would similarly be a subset of that, so the OP is off at least of by a factor of 10.
    - dmoy 2y ago
      So a few things I'm using Bureau of Justice Statistics data, not FBI. E.g. https://bjs.ojp.gov/library/publications/victimization-during-household-burglary https://bjs.ojp.gov/library/publications/victimization-durin... FBI / UCR covers only reported crimes at police agencies that forward data, and is a subset. BJS tend to be better at getting realistic numbers. (E.g. a majority of burglaries aren't reported to the police, and thus don't show up in UCR*) Also robbery is not a superset of home invasion, due to the difference in definition from burglary. Burglary isn't actually about stealing stuff, it's just breaking in with the intent to commit some crime (which is often theft, but not always). Robbery implies theft, but doesn't require it to be in someone's abode. So there's some overlap, but there's robberies that aren't burglaries (because no breaking in is involved), and there's burglaries (even some of the <10% subset of burglaries that are violent) that aren't robberies, because a theft isn't occurring. * For things like homicide, UCR tends to be a lot better, because the reporting rate is quite high.
sfmz 2y ago
Somewhat reminicient of Indian-Americans being targeted due to cultural emphasis on possessing gold https://www.nytimes.com/2011/09/30/us/bay-area-thieves-seeking-gold-target-indian-americans.html https://www.nytimes.com/2011/09/30/us/bay-area-thieves-seeki...

mikehearn 2y ago

As someone with the same name as a somewhat well-known former Bitcoin developer, this is sort of a latent fear I have. I would expect that someone dumb enough to think a home invasion is a good idea is also dumb enough to not double-check whether they've got the right guy.

__s 2y ago
A real life The Big Lebowski
ghaff 2y ago
Many years ago, I went to school with someone who shared their name with someone who got in a very public spat with George Steinbrenner who was the owner of the New York Yankees at the time. They got literal death threats on their phone. ADDED: Since then I've often thought the worst case scenario is to share a somewhat unusual name with someone who is hated/notorious in some manner given it invites crazies to do crazy things.

smeej 2y ago

It's a surprisingly hard threat to model against. For example, sure, don't store your funds on an exchange and they can't get in with a SIM swap, but when they're in your house, that doesn't help you. You could store your funds with a multisig wallet and make sure you don't have access to enough keys at home to move the funds, but how do you make them believe you? You can have one or more decoy wallets you can "cave" and give them access to if you think it might buy your freedom, but once you start, again, why would they believe you? Do you just acknowledge that they won't believe you,that they are going torture you regardless? And at least make sure you or your heirs have the money if any of you survive? There really isn't a good way out of this.

spencerchubb 2y ago
Multisig wallet where you and your spouse both have to sign. In case one dies, the multisig can expire after a certain amount of time and let you access with just one key Of course this assumes you have a spouse
- KMnO4 2y ago
  Don’t you live with your spouse? Now the intruder has a gun pointed at both of you.
  - coolspot 2y ago
    You need to diversify your spouses. One lives with you, others are living away.
- deleted 2y ago
  [deleted]
lmz 2y ago
Maybe if the exchanges didn't require KYC or phone, there would be no way of knowing where they live just from the exchange account.
koolba 2y ago
> There really isn't a good way out of this. The answer is to live anonymously. Don’t flash the cash.

phil21 2y ago

This was a large consideration in me offloading the vast majority of my cryptocurrency during the peak run up. The financial and digital hacking risk I was okay with, the physical risk to my family was too much. Even if I kept it off-site and in a safe deposit box somewhere no criminal would actually know that. Decoy systems and complicated multisig setups are all vulnerable to the ball peen hammer attack. Had I known Bitcoin would turn into what it had I would have done far more to create a pseudonymous persona when participating in the early scene vs. my well known and easily linked handle to my real identity. It was a fun ride, but the risk just got to be too much.

tptacek 2y ago
I mean, the premise is more or less the same as that of keeping your money in gold bars under your bed, except without the physical labor. So yeah, seems like a bad idea.
- ajb 2y ago
  When I was in high school, the computing teacher remarked that some people still don't believe that computers have benefited society. His answer to this was that they have nearly eliminated armed robbery, because when people were paid in cash, the payroll was an enormous target. Such heists used to be a commonplace risk, but a couple of generations have grown up without them.
  - xelamonster 2y ago
    Wouldn't this have been addressed by paper checks long before direct deposit came into play?
    - ajb 2y ago
      Hmm, it's years since I properly thought about this anecdote Yes, in theory you could have done everything with checks. It didn't completely happen though, until after computerisation. In the UK, it turns out that employees had the right to receive pay in cash as late as 1986! And taking it away was controversial.So it may be that you are right that computerisation wasn't essential, but most likely the reduction in cost of banking spread it to enough people that armed robbery became less of a risk.

hindsightbias 2y ago

I’ve always wondered if that gold coin company sells marketing info. Were names of Mt. Gox claimants published?

bdcravens 2y ago
Many leaks have happened over the years. While a leaked email address isn't always an identifiable target, correlating various leaks along with the various other identity resources out there isn't very challenging.
jarsin 2y ago
If you are in the US and had or have a Coinbase account anyone that wants to know if you ever dabbled in crypto knows at this point.

bag_boy 2y ago

Relevant to discussion: “A list of known attacks against Bitcoin / crypto asset owning entities that occurred in meatspace.” https://github.com/jlopp/physical-bitcoin-attacks https://github.com/jlopp/physical-bitcoin-attacks

s5300 2y ago

[dead]

nanomonkey 2y ago

A Florida man...

hamandcheese 2y ago

If you torture a person in their own home, I'm surprised that you don't go to prison for life.

etc-hosts 2y ago

so which country is the foreign country? The man who got 40 years was arrested in 2018 for shooting at a high school student. https://www.palmbeachpost.com/story/news/crime/2018/08/22/update-state-drops-attempted-murder/7796115007/ https://www.palmbeachpost.com/story/news/crime/2018/08/22/up...

ChoHag 2y ago

[dead]