两亿四千五百万美元，一分钱都不是抢来的：一个二十二岁的人打了两年电话，每一笔都是对方自己交出去的

This episode is about a case that just ended in a guilty plea, and about a conclusion I think matters more than the case: in cryptocurrency, what gets breached is usually not the system. It is a person.

The facts first.

Last week, a twenty-two-year-old man pleaded guilty in the United States to participating in a criminal enterprise.

Over roughly two years, the group he belonged to stole and laundered more than two hundred and forty-five million dollars in cryptocurrency.

By value, it is one of the largest cryptocurrency thefts on record in the United States.

The asset needs describing first, or the method makes no sense.

Cryptocurrency does not sit in a bank account. It is recorded on-chain, and control of it is determined by a private key.

A private key is a string of characters; holding the key is equivalent to holding the asset.

There is no lost-key process, no reversing a transaction, no deposit insurance.

The strength and the weakness of that design are the same fact: no institution can freeze your assets, and therefore no institution can recover them for you.

Once you understand that, you understand why crime aimed at cryptocurrency rarely goes down the route of breaking things.

The cryptography itself is hard; a frontal attack is prohibitively expensive with a negligible success rate.

So the attack surface has shifted wholesale to the other side: get the holder to surrender the private key or the verification information themselves.

The collective name for these methods is social engineering.

The name sounds highly technical. In practice it is usually a phone call.

This group's operation breaks into four steps.

Step one is target selection.

Blockchain transaction records are publicly queryable, so how much sits at which address and whether it has moved recently are all out in the open.

Which means an attacker can rank a list of targets without ever contacting any of them.

Step two is establishing an identity.

They impersonated customer support staff at large technology companies and cryptocurrency exchanges and called targets directly.

In one specific case, the victim received calls purporting to come from a search company and from a trading platform.

Step three is manufacturing two psychological states at once: trust and urgency.

Trust comes from the identity — they name a company you know and already use.

Urgency comes from the script — there has been an unusual login on your account, we are dealing with it, we need you to act now.

The two together compress the target's thinking time considerably.

One thing needs stating plainly here: being deceived has nothing to do with intelligence.

The mechanism of urgency is to move cognitive resources from "who is this person" to "what should I do".

In that state, a person's tendency to execute instructions rises noticeably, and the step of verifying who they are talking to gets skipped.

Step four is extraction.

They ask the target to read out a verification code received on their phone, or to open a page and read out what it contains.

The instant the target reads it, control transfers.

In one of these cases, a victim lost over four thousand bitcoin in this process.

The group occasionally used physical methods, including breaking into homes, but by value the overwhelming majority came through communications.

What follows has no technical content at all — only spending.

The ringleader acquired more than thirty cars, several of them custom sports cars.

He bought a watch worth about two million dollars.

Beyond that: mansions, chartered aircraft, and enormous nightclub bills.

This also formed one of the threads in the investigation — the gap between a young man's spending and his lack of any legitimate income cannot be made internally consistent.

Law enforcement traced him and made the arrest; he now faces a maximum of twenty years.

Back to the conclusion at the top.

Two hundred and forty-five million dollars, and not one cent of it was obtained by breaking a password.

Every last transfer was made by a holder acting voluntarily.

These victims were not technically naive — anyone holding crypto assets on that scale usually understands the system far better than average.

What was breached, every time, was one person's judgement about identity over thirty seconds; the mathematical strength of the private key was never tested.

The scope of this extends well beyond cryptocurrency.

Any system that hands final control to a judgement someone makes on the spot has a security ceiling set not by its technology, but by that judgement.

Two questions to leave you with.

The first is concrete: someone calls claiming to be support at a company you currently use, saying there is an anomaly on your account and they need your cooperation.

In those thirty seconds, what can you actually use to determine who they are?

The second is bigger: when a system treats irreversibility as a design virtue, who has it moved the risk onto?