The U.S. Department of Justice is moving to seize millions of dollars in Bitcoin that a teenage hacker had stolen from crypto executives four years ago. Prosecutors are also making sure they recover the sports car he bought with the stolen Bitcoin back, too.
Last week, a federal judge signed off on an order demanding that Ahmad Wagaafe Hared turn over $5.2 million in Bitcoin that he stole back in 2016, according to a report in The San Francisco Standard. The Bitcoin and the car were stolen as part of a SIM-swapping scheme hatched by Hared and two co-conspirators between 2016 and 2018.
SIM-swapping is when a hacker deceives a cell phone carrier into handing over control of a target’s cell phone by pretending to be the phone’s owner. The tactic is a classic social engineering tactic used by hackers to get access to personal data to steal from their targets—or to bypass text-message based second-factor authentication measures.
In 2016, Harred—then 18 and living in Tucson, Arizona—worked in concert with named co-conspirator Matthew Gene Ditman of Nevada to trick customer support representatives of cell phone providers into disclosing details about the SIM cards assigned to the accounts of cryptocurrency executives in northern California.
Though the executives are not unnamed, the region is home to Silicon Valley and an entire ecosystem of cryptocurrency companies and start-ups alike. Coinbase, the biggest exchange in the United States, once counted San Francisco as its home, but has since moved to being an entirely remote company.
Harred was already a known denizen of the so-called darknet, where he went by the username ‘winblo,’ according to independent cybersecurity journalist Brian Krebs. Using this identity, Harred was said to be "extremely active" and "revered" on an online marketplace where highly prized social media accounts were sold to buyers.
With some of these stolen funds, Harred purchased a BMW i8 that Krebs reported had a cost of approximately $150,000 at the time. Prosecutors said in their indictment that the two called some of their victims after seizing control of their accounts in a bid to further extort them.
The scheme came to an end in 2019 after an investigation by the FBI identified Harred and Ditman and arrested the two. The pair have yet to be sentenced.