两亿四千五百万美元，一分钱都不是抢来的：一个二十二岁的人打了两年电话，每一笔都是对方自己交出去的

Start with a figure: two hundred and forty-five million dollars.

It is one of the largest cryptocurrency thefts in American legal history.

The case reached a resolution last week: the ringleader pleaded guilty.

He is twenty-two years old.

What I want to talk about next is not how bad he is, but how simple the method was.

Simple enough that when you hear it you think: that worked?

First, what they stole.

Not deposits in a bank account — cryptocurrency, mostly bitcoin.

Cryptocurrency sits in something called a wallet.

The wallet itself does not hold money. It holds a key.

That key is a string of characters, and whoever has it is the owner.

There is no reporting it lost, no customer service, nobody who can get your money back for you.

The upside of the design is that no institution can freeze your money.

The downside is the same fact: no institution can protect you either.

So crime aimed at cryptocurrency has almost never gone down the route of breaking the encryption.

The point is to get the holder to hand over the key themselves.

This approach has a name of its own: social engineering.

The name sounds sophisticated. In practice it is a phone call.

Their process ran roughly like this.

Step one: find a target.

On-chain transaction records are public, so who holds how much in which wallet is a matter of record.

Step two: phone them, posing as staff at a large company.

In one of the cases, they posed as customer support from a search company and from an exchange.

Step three: manufacture two emotions.

One is trust: I am official, I am here to help you.

The other is urgency: there is something wrong with your account right now, we need to deal with it immediately.

When those two arrive together, a person's judgement drops noticeably.

Not because they got stupider — their attention has been pulled over to handling the "emergency".

Step four: ask for the string.

They would say: you will receive a verification code on your phone, please read it out to me.

Or: please open a certain page and read out what is on it.

Read it out, and the wallet has a new owner.

In one case in this process, a single person lost over four thousand bitcoin.

Occasionally they used cruder methods, such as turning up at the door.

But the overwhelming majority of the money came in over the phone.

The part after they had the money involves no technical skill at all.

The ringleader bought over thirty cars, including several custom sports cars.

He bought a two-million-dollar watch.

Plus mansions, chartered flights and all-night bills at nightclubs.

This is also one of the reasons they were exposed — a young man with no income suddenly living like that is very hard to explain.

Investigators pursued it for some time and eventually arrested him.

He has now pleaded guilty to participating in a criminal enterprise, with a maximum sentence of twenty years.

Back to the point I opened with.

Two hundred and forty-five million dollars, and not one cent of it was taken by force.

Every last transaction was handed over by the holder.

And these people were not ignorant about technology — quite the opposite: anyone holding that much cryptocurrency usually understands it well.

What was actually breached was not the wallet. It was the judgement of the person on the other end of the phone, over thirty seconds.

Think about it:

Someone calls you claiming to be support at a company you use, says your account has a problem, and needs your cooperation.

In those thirty seconds, what do you actually use to judge who they are?