Social engineering attacks work, particularly on non-technical users, and it is highly likely that the US Marshals didn't uniquely possess this gentleman's emai

Social engineering attacks work, particularly on non-technical users, and it is highly likely that the US Marshals didn't uniquely possess this gentleman's email address. The really terrifying thing is not losing 100 BTC. The attacker got DNS. That's not game over, that's "Your Nintendo just developed a circuit fault and burned your entire apartment down." Convincing an employee to disburse a small sum of money is almost the most boring thing one could do with that. P.S. Go into Google Apps as your domain administrator, check "Require 2 factor authentication for all users." If you've already got it on your personal email, check again that it is set on your work email. I mistakenly didn't have it on for my main email address and didn't notice for years.