The Minecraft Kid Who Stole $240 Million Without Writing a Line of Code transcript

A nightclub in Miami, August 23rd, 2024. A 20-year-old in a $30,000 watch tips the DJ with a $60,000 bottle of champagne. On the banket beside him sits a Hermes handbag he is about to give to a woman he has never met. He is paying in cash. He has approximately $500,000 [music] of it on the table. 5 days earlier, in a Miami bedroom, the same young man screamed a single line into a Discord call. A line that would eventually become legend in the encrypted corners of the internet. >> Quarter of a bill.

We're done. I'm spazzing out. >> He had been looking at a Bitcoin wallet balance of $240 million that 11 minutes earlier had belonged to someone else. This is Malone Lamb, 20 years old, Singapore born, Miami based. no university degree, no tech industry job, no formal cyber security training of any kind. He has never written a line of code. He has never broken a single piece of encryption. He has never exploited a single software vulnerability.

The wallet he had just emptied belonged to a Pentagon contractor in suburban Washington DC. He and his friends had simply talked the man on the phone for 11 minutes. They met on a Minecraft server. So, how does a group of teenagers from three different countries, none of whom has ever held a normal job, talk a single American investor out of a quarter of a billion dollars in 11 minutes on the phone? And how, in the four weeks that followed, [music] would they outspend every billionaire on the Miami waterfront?

In the spring of 2014, a Minecraft server called Cosmic PvP opened to public registration. It was a hardcore factions server. Players grouped into clans, raided [music] each other's bases, stole each other's inventory, and respawned. There were no penalties for cruelty. There were no adults in the chat. By the summer of 2016, Cosmic PvP had approximately 50,000 concurrent players on a Saturday night. Almost all boys between 11 and 15 from the English-speaking world, the US, the UK, Canada, Australia, and Singapore.

One of them in 2016 was a 12-year-old in a Singapore suburb named Malone Lamb. Another in New Town, Connecticut was a 10-year-old named Ver Chatal, son of a senior executive at Morgan Stanley. Neither was poor. Neither was abused. Neither was desperate. Malone Lamb's grandmother sent him spring rolls in the post for Lunar New Year. Ver Chatal's father drove him to violin lessons on Saturday mornings. They were bored teenage boys with broadband internet and parents who did not check what they did at night.

The economy of cosmic PvP was based on the trading of stolen items. By 13, Malone Lamb had figured out something subtler. The accounts that owned the rarest in-game items were registered to email addresses that could, with sufficient social engineering, be taken over. His first theft was a fellow player's rare cosmetic, a virtual sword worth $300 on the gray market. By 14, he had stolen his first SIM card from a real human being.

The Bitcoin in the resulting wallet was worth in late 2018 approximately 2,000 American. He was 16 when he stole his first $300 inside a video game. Nobody noticed. This channel finds those people, the ones who quietly beat a system everyone else trusted. A new story every week. Subscribe so you don't miss the next one. He looked at the balance and understood at 14, sitting in his bedroom in Singapore that something had been opened that was never going to close.

The community that would 8 years later steal a quarter of a billion dollars in a single phone call had formed entirely inside a video game. No adult had been watching. In the autumn of 2018, Cosmic PvP began to decline. The active core of its veteran players migrated over the next 18 months to a constellation of private Telegram [music] channels and Discord servers. The community they built called itself the comm, short for community.

By 2023, the FBI's cyber division estimated the comm had approximately 1,000 active members worldwide, almost all under the age of 25, almost all English speakaking. What the comm did was simple. They stole rare Discord usernames. They stole cryptocurrency wallets. They stole corporate access. They stole identities. How they did it was the thing that made them different. The comm had specialists. Researchers built target profiles from LinkedIn, leaked password databases, public records, and Instagram.

Drainers operated wallet stripping software that emptied a crypto account in under a minute. Cashers moved stolen funds through mixers and no KYC exchanges. But the most respected members of the comm were the callers. The callers did the actual phone work. They impersonated bank customer service agents. They impersonated corporate IT support. They impersonated mobile carrier representatives. Onecom member in a telegram message later entered into evidence [music] wrote, "If you want to make seven figures, you got to call.

Callers eat. Researchers eat scraps." By the spring of 2023, 1,000 teenagers had organized themselves into a global criminal community that operated like a Silicon Valley startup with specialist mentorship, status hierarchies, and onboarding, and that had no boss, no office, and no legal jurisdiction. The comm had perfected on the largest scale in the history of fraud the simplest possible weapon, talking. Inside the comm, the calling skill was treated as a profession.

There were training scripts, AB tests on [music] tone, pacing, and word choice. Veterans coached younger members through live calls in real time over a separate Discord channel. The reconnaissance was industrial. A skilled researcher could, given an hour and the target's full name, build a profile that included date of birth, mother's maiden name, names of pets, employer, employer's help desk number, home address, current vehicle, last four vacation destinations, and the dog the target had owned in childhood.

The information lived in publicly leaked databases, LinkedIn, Instagram, public record search engines. By summer 2024, the best comm operators were making by their own telegram posts between$1 and $3 million per month. What an entire generation of teenage boys had figured out sitting in their parents' houses with broadband internet was something the cyber security industry had been telling banks for 15 years and had never quite been able to convince anyone to take seriously.

The weakest point in any digital security system is the human being who answers the phone. The target the comm would on the night of August 18th, 2024 choose for what would become the largest single cryptocurrency theft in American history is identified in federal court documents only as Lucky 7. His real name is sealed. By the reporting of Bloomberg, Lucky 7 was a man in his late30s living in suburban Washington DC, employed by a Pentagon contractor.

He had begun buying Bitcoin in 2012 when the price was $11 a coin. By August 2024, his holdings were worth approximately $240 million. He stored them in a Bitcoin core cold wallet. Technically the most secure cryptocurrency storage available to a private individual. He was by every conventional measure the kind of target it was supposed to be impossible to rob. He had appeared on the leaked client list of Genesis Trading, a major cryptocurrency brokerage breached in May 2024.

The comm researchers found him in the leaked database. They spent the next weeks building his profile. The most securityconscious investor in cryptocurrency, cold storage, hardware wallet, full multiffactor authentication, was as vulnerable as anyone else to the one weapon his security software could not deflect, a polite voice on the phone. At 12:33 Eastern time on Sunday, August 18th, 2024, the phone in Lucky 7's pocket began to vibrate.

It vibrated again and again and again. For the next 4 minutes, his phone received approximately 80 multiffactor authentication push notifications requesting approval for signins on his Google account. The locations attached to the requests were Moscow, Tran, and Pyongyang. By the end of minute 5, Lucky 7 had stopped reading the locations. He had stopped breathing normally. He was, by his later testimony, in something close to a panic [music] attack.

This was the technique, MFA fatigue. A bot [music] operated from a bedroom 4,000 mi away generated a continuous flood of authentication [music] requests designed to remove the target's capacity to think. The bot did its work. The phone rang. The caller introduced himself as a member of Google's trust and safety team. His voice was calm. His American accent was by Lucky 7's later description perfectly normal like a guy from California.

The voice belonged to Vir Chhatal, 18 years old, calling from a bedroom in his parents house in New Town, Connecticut. His comm handle was whiz. He said, >> "Sir, we're seeing massive unauthorized login attempts from Russia and North Korea. Your Google account is under active attack. We need to verify your identity using your recovery codes. Please read them to me one at a time. >> Lucky 7 read [music] the 10 recovery codes aloud.

Within 90 seconds, Vir Chhatal was logged into Lucky 7's Google Drive. Within 3 minutes, he was inside Lucky 7's One Drive. A second voice came on the line. American accent, slightly older, professional. It belonged to John Serrano, 21 years old, command box tops, calling from a bedroom in Los Angeles. >> Sir, your Google compromise means your Gemini cryptocurrency holdings are at risk. We need to transfer your assets to a secure transit account immediately. >> $3 million in cryptocurrency was transferred on Lucky 7's own authorization to a wallet controlled by the comm.

Then Serrano made the request that would by itself finish the job. >> Sir, install Anyesk on your computer so we can secure your remaining holdings. >> Anyesk is a legitimate remote desktop application used by millions of IT support teams around the world. Lucky 7 downloaded it. He clicked allow. The com drainers now had live remote access to his desktop. on the screen. In the next 30 seconds, they saw the icon they had been looking for, Bitcoin Core, the cold wallet 4,64.43 BTC.

In the Discord channel where the operation was being coordinated, one of the boys had by accident left a screen share running into a wider sub channel. The audio was being recorded by another comm member in a bedroom in Northern England, 4,000 mi from Miami. That 90minute recording would 6 months later become the single most cited piece of evidence in the federal indictment. Malone Lamb screamed into his microphone. >> Quarter of a bill.

We're done. I'm spazzing out. >> 40 minutes after the first push notification had hit Lucky 7's phone. The largest single theft of cryptocurrency in the history of the United States had been completed. The transfer was made in three transactions to three wallets. None of the boys had opened before that night. The total time on the phone was 11 minutes and 48 seconds. By Wednesday, August 21st, 3 days after the theft, Malone Lamb had moved into a $62,000 a month rental mansion on Hibiscus Island, Biscane Bay, Miami.

Nine bedrooms, pool, tennis court, private dock. Over the next four weeks, the property recorded these deliveries. A Lamborghini Aventador SVJ with a custom [music] license plate reading Malone. A Ferrari Roma. A McLaren 765LT. A Rolls-Royce Cullinin. Total value approximately $2 million. The cash spending began on Friday at W1 Miami, a nightclub that does not officially close. Malone Lamb was filmed on the venue's promotional Instagram handing out Hermes Birkin bags worth approximately $30,000 each to women he had never met.

The recipients included Sky Brie, an Only Fans creator with three and a half million Instagram followers. Sky Brie posted a Tik Tok describing the gift the next morning. She did not know when she posted it that the bag she had just been handed was material evidence in the largest cryptocurrency theft in the history of the United States. She deleted the Tik Tok the day Malone Lamb was arrested. Inside the same week, Malone Lamb tipped the resident DJ a $60,000 bottle of Ace of Spades Brute Gold.

Cash drops at the table averaged by the venue's later subpoenaed records between $250,000 and $500,000 per [music] night. In his share department in suburban Singapore, his grandmother, who he still called on Skype every Tuesday, believed her grandson was working as a software engineer at a Miami fintech startup. She did not, in 2024, own a smartphone capable of viewing Tik Tok. Every bottle, every car, every birkin, every docside photograph was in the language of the federal indictment that would arrive 5 weeks later, public conspicuous expenditure of funds traceable to the proceeds of wire fraud.

The comm generation had perfected the most invisible attack in cyber crime history, and then they had documented their own indictment in real time on Instagram. On the morning of Sunday, August 25th, 2024, 6 days after the theft, Sumat Chhatal, the father of Vir Chhatal, walked out of his [music] house in New Town, Connecticut. He was driving a Lamborghini Urus. The car had been a gift from his son 5 weeks earlier. He had not asked [music] where the money had come from.

His wife was in the passenger seat. They were going to brunch. A white Ford Transit van and a black Honda Civic pulled across the road in front of the Urus and forced it to a stop. Six masked men got out of the van. They carried aluminum baseball bats. They broke the windows. >> They dragged Sumat Chita and his wife from the car. They beat them with the bats. They wrapped their wrists in duct tape. They threw them into the back of the van.

The demand communicated by encrypted message to Ver Chhatal's telegram 30 seconds later was $30 million in Bitcoin within 4 hours or the parents would be killed. Robert Cab, a special agent of the Federal Bureau of Investigation, was walking his dog one street over. It was his day off. He saw the van. He saw the smashed Lamborghini. He saw through the back window of the van as it accelerated past him what appeared to be a woman in duct tape.

He called 911 from his personal cell phone. He got into his own car, a 2019 Toyota Camry, and followed the van onto Interstate 84. Connecticut State Police units intercepted the van at the Danbury exit 47 minutes later. The six attackers were arrested at gunpoint on the shoulder of the interstate. Sumat Chhatal and his wife were freed. They were taken to Danbury Hospital with two broken ribs, severe bruising, and a concussion between them.

At the hospital, when Vir Chhatal arrived in the waiting room, his mother, still on a stretcher, turned her face to the wall. Sumat Chhatal and later sworn testimony given to [music] a federal grand jury said, >> "I knew my son had become successful. I did not know what he had become successful at." The Lamborghini that Vir Chhatal had bought his father as a public statement of his own wealth [music] had become within five weeks the bait that brought masked men with baseball bats to his parents' door.

The six kidnappers were by the records later released all residents of Miami. They had been hired through a single Telegram post by another comm member 2 days after Sky Breeze Birkin [music] Tik Tok. At approximately 300 p.m. Pacific time on Sunday, August 18th, 6 hours after the theft, a man who calls himself Zack XBT boarded a flight at JFK. His real name has never been publicly confirmed. He operates a single Twitter account on which he publishes blockchain forensics investigations for no salary.

Somewhere over Kansas on a $6 inflight Wi-Fi connection, Zack [music] XBT noticed an unusual movement of 4,064 Bitcoin. He spent the next 6 hours following the money. The trail went through a Monero conversion designed to be untraceable, through a Litecoin laundering layer, through 15 no KYC exchange accounts registered with stolen identities, then back to wallets registered 6 months earlier under the email addresses of Malone Lamb and Vir Chhatal.

When the plane landed in Los Angeles, Zack XBT published a 40 tweet thread naming all three callers. The FBI received the full forensic chain inside 24 hours. Zack XBT in a tweet posted four months later wrote, "6 hours of plain Wi-Fi did more in this case than 3 years of federal investigation." On the 27th of August, 2 days after the Connecticut kidnapping, Vir Chhatal turned himself in to the FBI field office in New Haven.

Bell was set at $500,000. His parents still bandaged from the beating that had been ordered indirectly because of him paid it. Within 6 weeks, Virchal was back inside a new comalling operation, a separate scheme, $2 million in stolen funds. He had not, since the day his mother came home from the hospital, been able to look his father in the eye. He took his $200,000 share directly to an offshore cryptocurrency casino called Bust It and started gambling.

He lost everything in 40 minutes. At some point in the last 7 minutes of his session, his VPN dropped. The FBI, which had been monitoring his wallet activity continuously since the bail hearing, captured his real residential IP address from a Connecticut Comcast modem. His bail was revoked the following morning. On the 19th of September, 2024, Malone Lamb was arrested in his bedroom at the Hibiscus Island mansion. Federal agents recovered $500,000 in cash, 11 luxury watches, 16 Hermes handbags, and the keys to four sports cars.

On the 26th of September, the United States Department of Justice unsealed indictments against five defendants, Malone Lamb, Vir Chhatal, John Serrano, Hamza Duce, and Joel Cortez on charges of wire fraud, money laundering, and aggravated identity theft. The maximum sentence on the federal indictment alone is approximately 50 years. Vir Chhatal was 18 years old. Malone Lamb was 20. John Serrano was 21. A solo internet investigator working from an aircraft seat had identified [music] in 6 hours what the FBI's organized crime division had been chasing for 3 years.