One Phone Call to an ISP, Millions Gone

A technology entrepreneur with holdings in barcodes and crypto mining woke up locked out of his own life. His bank accounts, his merchant services, and his crypto wallets were all beyond his reach, and millions of dollars were gone. He had done the responsible things. He used multifactor authentication and other safeguards, and none of it had stopped the theft.

The breach did not start with a password

When strong security fails, the failure usually happens somewhere the account owner is not looking. We found that the client’s primary email had been compromised, and not through a cracked password. The attackers had made a phone call to his internet service provider and talked their way in. From there they quietly forwarded all of his email to an anonymous account, which let them intercept the very two-factor codes meant to protect him and delete the security alerts before he ever saw them. The safeguards were working. The attackers had simply gone around them.

The trail did not lead where it looked

The early signals pointed overseas, suggesting the people responsible were in Asia. That is often by design. Following the digital footprint carefully, we found that the web presence had been deliberately disguised to look foreign, when it was actually based in New York City. Location is one of the easiest things for an attacker to fake and one of the most important things to get right, because it is what makes an arrest possible.

From locked out to recovered

With the suspect located and connected to the theft, the FBI took over, recovered the stolen funds, and prosecuted the offender. Tracing stolen money and the people moving it, across accounts, wallets, and borders, is the work behind our crypto asset tracing practice.

If you have been locked out and drained despite doing everything right, talk to our team.

Your Examiner