Stealing $243 million live: how a teenage scam ended in jail

Three young men from the United States quickly went from ordinary life to fleeting financial “success” with supercars, branded things, and expensive watches. And it ended with a lawsuit and jail time. GetBlock AML Research publishes details of a high-profile cryptocurrency fraud case.

Easy money

In 2024, on one of the usual August nights, three young people: Veer Chetal, Malone Lam, and Jeandiel Serrano became rich by $243 million. The enrichment occurred through fraud, and to be more precise, through the theft of more than 4000 bitcoins from their gullible owner (transaction theft). The details of the scam were revealed by the famous crypto investigator ZachXBT, who took part in the identification of the criminals.

The group of scammers carefully thought out all the details and implemented a high-quality legend:

1. The victim received a call allegedly from Google support to gain access to their email account and other services;
2. Next, the scammers called the Gemini crypto exchange support service (where the bitcoins were stored) on behalf of the victim and claimed that the account had been compromised;
3. After that, the victim was persuaded to reset two-factor authentication (2FA) and transfer the cryptocurrency to another wallet;
4. The victim broadcast the entire process of transferring the bitcoins to the scammers via the AnyDesc program. Thus, the attackers gained access to the private key of the new wallet to which the BTC were transferred.

The whole scheme was realized by the three guys mentioned above. Veer Chetal introduced himself as a Google support employee and gained access to the victim’s email account. Malone Lam studied the victim’s emails to gather more data about the victim. Jeandiel Serrano convinced Gemini Support that he was an account holder who lost access to his cryptocurrency due to the hack.

Veer Chetal after being detained, veer_chetal1.

After the successful robbery, the bitcoins received were divided among the accomplices and then sent to 15 crypto exchanges for sale.

Scheme collapse

The attackers made a number of mistakes at the stage of the scam, which made it possible to identify them as soon as possible. All the actions of the scammers were recorded via a live broadcast of the computer screen. At one point, the real name of one of the scammers — Veer Chetal — appears on the recording. His name also appeared in several chats related to the organization of the crime. The attackers were not very concerned about privacy, so they called each other by their real names.

Veer Chetal’s name on screen recording during the asset theft, veer_chetal

After stealing the cryptocurrency, the criminals began to lead a luxurious lifestyle: buying sports cars, luxury watches, and branded items. About this, they regularly notified their followers on Instagram and accompanied publications with geometrics.

Instagram post of one of the scammers, instagram

The very next month, September 2024, all three scammers were detained and arrested. But the story did not end there.

An interesting fact: a week after the theft of $243 million worth of cryptocurrency, Veer Chetal’s parents were attempted to be kidnapped by a group of masked gunmen. The police arrived in time to help and saved the parents of the fraudster from being kidnapped.

According to the plan

After being taken into custody, everything turned out to be most successful for Veer Chetal: he did not hesitate to make a deal with the investigation, gave up his accomplices, revealed the entire scheme and details of the asset theft and even contributed to the return of the stolen funds (or rather, what was left of them). For his assistance, Chatel’s sentence was significantly reduced, and he was released on bail on October 21, 2024.

Once free, Chetal did not learn his lesson, as he immediately began a new fraudulent scam. He again pulled off the same scheme for which he went to jail to swindle the victim out of about $2 million in cryptocurrency. One of the $200 000 transactions led to a gambling platform. The account on the platform was accessed from six different IP addresses. One of them turned out to be Chetal’s real IP address, which linked him to the crime. Investigators believe this was due to the failure of the VPN service the fraudster was using.

As a result, Chetal was back in the dock and pleaded guilty. In his defense, he said that he sees nothing wrong with his act, because the amount was so insignificant that he lost all $200 000 on the gambling platform in a few minutes.