Individual Genesis creditor (4,064 BTC) hack — August 2024

On 18–19 August 2024 a group of young men took more than 4,100 bitcoin from a single holder in Washington, D.C. Court filings describe a staged voice-phishing operation. A co-conspirator first caused a fake 'unauthorised Google account access' notification to be sent to the victim, made to look as though the attempts came from abroad. Callers then phoned him claiming to be Google's security team and, through what prosecutors called a series of prompts and misrepresentations, obtained enough access to read his Google Drive, where they found the location of his holdings at the exchange Gemini. A second caller posed as a member of Gemini's support team and persuaded him to install a program presented as protection for those holdings; it gave the group real-time view of his desktop. While the caller kept him talking, he was manipulated into opening files containing the private keys to over 4,100 bitcoin, and a co-conspirator emptied the wallets.

The figures differ. The Justice Department states 'over 4,100 Bitcoin (worth over $230 million at the time)'. The on-chain reconstruction published by investigator ZachXBT, reported by The Block and Vice, puts it at 4,064 BTC worth about $243.7 million, moved at 04:05 UTC on 19 August, and describes the victim as a creditor of the collapsed lender Genesis. The DOJ describes the victim only as a D.C. resident identified as a high-net-worth investor from crypto's early days.

Proceeds were split five ways and laundered through mixers, peel chains, pass-through wallets and multiple exchanges, with conversions into monero, ether and litecoin. Malone Lam and Jeandiel Serrano were arrested in September 2024; prosecutors said both admitted their roles. In October 2024 prosecutors said at least $100 million remained unaccounted for.