On a summer day of 2022, a lonely, troubled young man appeared in a courtroom in Hamilton and said he was “very sorry” after stealing $48 million in cryptocurrency. “I’m going to move forward positively,” he said.
His lawyer said the 19-year-old now wants to work in cybersecurity and “the right way for this case to go round.”
The judge sentenced the young man to one year of probation, taking into account the years he had already spent in detention and the fact that he was 17 when he committed the act. A young person not appointed by the Canadian Youth Criminal Justice Act was forbidden from dealing with codes during his probation – certainly not a major deprivation, but certainly caused damage to the careers of young cybercriminals.
The young man really said, “Do you want to take this time to look back at my actions and learn from my mistakes?”
(Suspicious) Anatomy of a $10 million robbery that shook Canadian music
Take this into consideration. Authorities have fixed the 2020 theft as the most cryptography stolen from an individual. It’s the question of how big a young man plays and how big a role he still has in the $48 million. However, police later said that the young man personally boasted about his robbery in the same month he was sentenced to prison, and he still holds US$15 million.
Moreover, the young man whom he promised to never do it again throughout that sentencing period was actually to do it again. He ran another famous code robber.
On July 29th this year, the young man, dubbed “sophisticated, successful, recurring cybercrimes” by prosecutors, was in front of the judge once more. This time in Alexandria, Virginia, he was sentenced to one year in prison.
A youth who is not appointed to Canada’s Youth Criminal Justice Act has been sentenced to one year in a court in Alexandria, Virginia, because they run another code robbery.Alex Wroblewski/Getty Images
This series of robbers had only reaped around US$800,000, but it attracted international attention and shaking the world of cryptography. The 2022 robbery targeted influential accounts for what was called Twitter, which NFT Digital Art dealt with.
The target included “Beeple,” known for selling a record US$69 million NFT (inappropriate token) photos based on Crypto’s blockchain technology. Compromising, these accounts scam followers from crypto and NFTS. No one knew that behind the robber was this young man from Hamilton.
This case applies not only to the young industry of crypto, but also to the increasing risks of cybersecurity as much as $4 trillion in cybersecurity as much of our lives move online. The court documents in this case, the recently unsealed insight into the dynamics between hackers and con artists, are almost always young men, highlighting the timeless truth. There is no honor among thieves.
The young man’s parents parted ways when he was 18 months old. He grew up at home with his absent father and under financial tension. During his school year, he was “socially isolated and bullied because of his weight,” the defense wrote in his sentence. Psychological assessments showed that the young man had “experienced emotional neglect, chronic instability, and trauma.”
However, the prosecutor had a different story. “The defendant was responsible for the ‘social engineering’ aspect of the fraud scheme. So it was his job to manipulate and deceive,” the prosecutor wrote. “He actually appears to be very skilled at interacting with and reading people.”
The previous $48 million robbery was a SIM swap. In the process, the perpetrator tricked the telecommunications company into porting it to a SIM card that controlled the victim’s mobile phone number. With that phone number, the fraudster violates other accounts of the owner, such as cryptography.
Opinion: Canada was once a global leader in cryptography. It can be one again
According to the defense, when the young man was on bail for a $48 million robbery, he “experimented a dangerous drug that was not monitored and introduced into him by another boy in a detention facility.” This was when he decided to use another fraudulent method: a Twitter breach now called X.
It is unclear how exactly the young man took preliminary steps. Neither the US lawyer nor the Canadian lawyer responded to requests for comment. However, the general idea is no secret.
In June, Globe and Mail reported on the black market for insiders, a social media company selling access, as these accounts become increasingly valuable. For some reason, young people have access to a special platform on Twitter called the “Partner Support Panel.” It targeted insiders and “entities related to large or critical customers” and allowed quick assistance on issues such as password resets.
The young man’s first target was artist Beeple and his real name Mike Winkelman. Court documents do not explicitly name Winkelmann, but did show what follows a fraudulent tweet. Winkelman has also been published by Zachxbt, the pseudonymous code detective who first appointed a Hamilton youth as the perpetrator.
Artist Beeple, whose real name is Mike Winkelman, has taken over his Twitter account to the young Hamiltonians.
After taking over Winkelmann’s Twitter account, in collaboration with fellow con artists, the young man posted a message containing a link to “raffle.” The user sent one ether. This is a cryptocurrency running on an Ethereum network that was then worth around 2,000 US dollars. The winner will receive a Louis Vuitton brand NFT.
Of course, there were no winners. When a user clicks on the link, they are brought to a fraudulent website, connecting their digital wallet to participate in the raffle. In fact, instead of sending one ether or receiving an NFT, the victim is giving the entire digital wallet a green light so that it is ejected.
Or at least that’s how the scam should go. The website “had a hard time stealing NFTs and cryptocurrency,” according to the prosecutors. The reason is unknown. There was probably a technical problem. Perhaps the fraudulent website led by the fraud link LED was poorly built and looked suspicious by the crypto crowd.
Ethan Lou: America is now the Buck Wild Cryptland. Canada needs to live with it
The young man knew how to take over people’s phone numbers and accounts. But he was not an expert in cryptography. But he quickly raised his game with the help of someone else.
The court file did not name the person, describing him as “just described him as “he showed that a better drainer would steal” from the victim’s digital wallet.
In the area, the ringer, who had more know-how than the younger guys in the field, would also build a replica of Mr Winkelman’s website with a similar address. Unless you pay too much attention to the address bar of your browser, when people visit fraud links and hand over digital assets, you’ll think they’re still on the artist’s legitimate site.
The robbery was relatively successful, winning 80 casualties and nearly 450,000 US dollars. However, the tech-savvy Ringer who built the replica website doesn’t split the booty as agreed. The young man was betrayed.
The young man then re-adjusted his methods. In the gold rush, the man selling shovels is guaranteed to earn more than the digger. In war, the safest side is the arms dealer.
Rather than relying on something like a non-dependent high-tech ringer, the young man will focus on the advantages he already had: the means to steal.
Young people have access to Twitter’s special platform targeted at insiders and “entities related to large or critical customers” and have given them quick assistance with password resets.Carlos Barrier/Reuters
In June 2022, he sold access to the Twitter panel to another young scammer. The price was 230 ether, worth more than 280,000 US$ at the time, 10% of the booty from future robbers. It was to be exclusive. This means that Hamilton youths don’t sell their access to others.
The deal was closed on June 27th, three days after a young man told an Ontario court how sorry he was for stealing a $48 million code.
Obviously, he wasn’t ready to leave his life of crime. Perhaps the young man from Hamilton who started scams when he was a minor saw himself a bit in the American minor. He became what the prosecution called minors “leaders.” The pair worked with other con artists to hit the ball four times. Targets can be traced back to Deekay, Zeneca, Nouns Dao, Jrny Club accounts, and all the well-known artists or groups in the NFT world.
For beginners, these names may not make much sense, highlighting the pure size and rapid growth of the crypto world. It started with Bitcoin alone in 2009 and has little value after that. Units over a decade are worth more than 100,000 USD, while the total value of thousands of other coins is worth more than 4 trillion USD. Banks and the government are dazzling with technology. When you think about assets, there is no denying that the money and work within it is authentic.
But the same is true of danger. If an object that can be moved irreversibly with just a click of a mouse is of great value, a whole new kind of criminal will evolve to take advantage of it. According to Chainalysis, approximately US$3 billion from blockchain data company Crypto was stolen by the end of June 2025, making it a record year.
Among the four new Crypto Heists, the dynamic duo of Hamilton and the American minor young man begins to unravel. At one point, he’s still shaking from the early betrayal of a presumably tech-savvy Ringer.
Details are unknown, but court records show that youths “force” American minors, indicating greater cuts. Police then attempted to sell access to the Twitter panel to others, despite his promise of minor exclusiveness.
But it turns out to be a meaningless move. The value of that Twitter panel had plummeted. The same scam can be repeated over and over before people catch up. Additional robbers have been increasingly unsuccessful, with one rogue tweet being deleted within minutes. In the end, the Twitter panel stopped working completely. X did not respond to requests for comment.
When the fraud was exhausted, the young man left the world behind, the defense said. “In 2023, he traveled to Portugal at the strong request of a friend,” the defense wrote. Post-Portuguese Portugal had introduced new visas for digital nomads that offered affordable rents, a lively social scene and a modest winter. It was where it should be. For the young man, “it was the first time he began to form a real face-to-face relationship and experience the world beyond computers.” So the young man “found a relationship and purpose,” enrolled in a computer programming course.
But paradise soon lost. First, the US Federal Bureau of Investigation chased people around young people. The American minor who was forced by a young man and lied to him would work with the FBI. A tech-savvy Ringer, who once burned the young man, re-fired him and informed the FBI in exchange for immunity.
In December 2024, a young man was arrested. He was handed over to the US in March where he signed a contract and pleaded guilty to conspiracy to commit fraud, wire fraud and aggravated identity theft.
It’s an unresolved question that awaits him when he is eventually deported to Canada. He was clearly violating the conditions of probation for the $48 million robbery when he carried out this new set of scams. It has risks to legal consequences.
The Attorney General, Ontario Department, introduced the questions to police. Hamilton Police, the unit that first arrested a young man in the $48 million incident, did not respond to a request for comment.
