The bizarre Bitcoin heist

Even the CEO was a victim of the scam involving transferring money to a Bitcoin wallet, causing the company to lose over $200,000.

The 10,000 euro envelope marked the beginning of a chain of events leading to a bizarre Bitcoin theft in the tech world. Photo: Wired .

In the bathroom of the Rosewood Hotel in central Amsterdam (Netherlands), Kent Halliburton held an envelope containing 10,000 euros, his mind filled with strange thoughts.

Halliburton is the co-founder and CEO of Sazmining, a company that provides Bitcoin mining services on behalf of its clients, using a "mining-as-a-service" model. Halliburton lives in Peru, while Sazmining leases third-party infrastructure across Norway, Paraguay, Ethiopia, and the United States.

Halliburton arrived in Amsterdam on August 5th to meet with Even and Maxim, representatives of a wealthy Mexican family. This family offered to buy hundreds of Bitcoin mining rigs from Sazmining, worth approximately $4 million . This marked the beginning of a sophisticated, bizarre, and audacious Bitcoin scam.

A strange request.

Upon arriving at the hotel, Halliburton found Even and Maxim waiting. Both were dressed lavishly, in a playful, extravagant style. Maxim, in particular, wore a brown three-piece suit, meticulously groomed, with his black hair parted and a Rolex watch visible from his sleeve.

During a lavish lunch, the three discussed the details of the agreement and shared more about themselves. According to Wired , Even was talkative and cheerful, while Maxim was more reserved, often looking at Halliburton with a judgmental gaze.

To build a relationship, Even suggested that Halliburton sell approximately $3,000 worth of Bitcoin to the family office. After some hesitation, Halliburton agreed, though he still felt uneasy. One of the two men handed Halliburton an envelope of money, asking him to go to the restroom to count it; it contained 10,000 euros.

“It felt like stepping out of a James Bond movie. Everything felt so strange to me,” Halliburton recounted. Despite his initial confusion, he was hopeful of closing the deal. For a small company like Sazmining, with around 15 members, $4 million was a significant sum.

Bitcoin thefts often occur using various methods. (Illustration: Bloomberg )

Immediately after lunch with Even and Maxim, Halliburton flew to Latvia to attend a Bitcoin conference, and then traveled to Ethiopia to inspect the construction of a data center.

In Ethiopia, Halliburton received a message from Even on WhatsApp. Even added a condition to reach an agreement, requesting Sazmining to continue selling a larger amount of Bitcoin to his family. The two agreed on a figure of $400,000 , equivalent to one-tenth of the deal.

Even requested that Halliburton return to Amsterdam to sign the final agreement. However, Halliburton refused, having been away from his family for several weeks. Even, for his part, firmly stated that "working remotely is not suitable at this time."

Lost everything in one night.

Halliburton returned to Amsterdam on the afternoon of August 16th and met Maxim at a restaurant in the Okura Hotel. While waiting for a table, Maxim asked Halliburton to prove that Sazmining held sufficient Bitcoin for the transaction that Even had requested. Even wanted Halliburton to transfer $220,000 into a family Bitcoin wallet.

On his phone, Halliburton downloaded the Atomic Wallet app and created a new wallet as requested by Maxim, all the thoughts of the $4 million deal still running through his head.

The dinner went smoothly, with Maxim openly discussing his passion for watches and his frequent search for contracts for the family office. Due to ill health, Halliburton managed to end the meal. The documents were signed, and Maxim promised to bring the contract back to the family.

Back at the hotel, Halliburton tried making a small transaction using the new wallet address. After the security enhancement process, Halliburton called a colleague to transfer the equivalent of $220,000 worth of Bitcoin to the new wallet, and sent Even a screenshot of the balance.

Atomic Wallet icon. Photo: Shutterstock .

After thanking Even, Halliburton inquired about the contract status but received no reply. Upon checking his Atomic Wallet app, he was shocked to find all his Bitcoin gone.

"I was truly shocked and couldn't believe it," Halliburton recounted.

While trying to recall what had happened, Halliburton continued to text Even. Even denied everything and disappeared without a trace. According to documents provided by the victim to Wired , Even's Telegram account had been inactive since the money was withdrawn.

Within hours, Halliburton's withdrawn funds were split, transferred through a network of multiple addresses, and sent to third-party platforms for withdrawal into conventional currency, according to analysis from blockchain company Chainalysis and CertiK.

A portion of Bitcoin is distributed through instant exchanges, allowing for immediate conversion to other cryptocurrencies. The majority, however, is transferred to an address specifically designated to receive funds from fraudulent transactions, according to Chainalysis data.

Researchers say some Bitcoin likely converted into conventional currency, while the rest converted into stablecoins and passed through the Tron network. These split transactions make tracing their origin difficult.

Sophisticated tactics

Based on the transaction data, it's impossible to know exactly why the scammer was able to withdraw funds from Halliburton's wallet without permission. However, the victim's interactions with the scammer may provide some clues.

Speaking to Wired , security researchers suggested that Halliburton was the victim of a targeted surveillance attack.

"CEOs who are believed to hold large amounts of cryptocurrency are attractive targets," said Guanxing Wen, head of security research at CertiK.

Researchers hypothesize that lavish dinners, expensive clothing, cash envelopes, and other forms of ostentatious displays of wealth made Halliburton feel comfortable.

"This is a familiar relationship-building tactic in high-value scams. The more time victims spend with the scammer in a comfortable environment, the less cautious they are about subsequent requests," Wen emphasized.

To complete the theft, the scammer could steal the “seed phrase” in the wallet address that Halliburton created on Atomic Wallet. With this phrase, anyone would have access to the Bitcoin stored inside.

The stolen Bitcoin was quickly divided into smaller amounts and transferred to multiple wallets. (Illustration: Bloomberg )

According to Wen, the most likely scenario is that the scammer had the help of an accomplice nearby, or installed a hidden camera in the hotel room to record the seed phrase that Halliburton entered on his phone.

Before Halliburton transferred $220,000 worth of Bitcoin to the newly created wallet, the scammer could have prepared code to automatically withdraw the funds upon detecting a large balance change.

The people Halliburton contacted, such as Even and Maxim, were most likely actors hired by the scam organization. According to researcher Adrian Cheek from cybersecurity firm Coeus, they were recruited through dark web forums and chat groups.

Immediately after being defrauded, the Sazmining board of directors filed complaints with legal authorities in the Netherlands, the United Kingdom, and the United States. However, Action Fraud (UK) and Cyber ​​Fraud Task Force (USA) only responded acknowledging receipt of the information.

After the initial shock, Halliburton said Sazmining was able to stay afloat by requesting payment deferrals and extensions of repayment deadlines. The lost funds amounted to the startup's revenue for six weeks.

According to cybersecurity expert Margaux Eckle from Chainalysis, the best way to recover the money is for law enforcement to dismantle the entire scam operation. Until then, Halliburton will still have to accept the loss of the money.

Source: https://znews.vn/vu-cuop-bitcoin-ky-la-post1604430.html