Second and third rounds on the dossier pipeline, reviewed locally before commit. Retrieval - wayback_pass.py: retries every BLOCKED/DEAD/THIN/ERROR linked source through the Wayback Machine; blocks carry the snapshot date, archive URL and the live verdict. 143 slots retried: 93 fetched, 37 no snapshot, 12 script shells, 1 PDF. - fetch_sources.py: fetch_wayback() helper. - add_extra_sources.py: files staged extra_* finds (web search, not on the DB record) into the store with a provenance note. - Cases re-sourced by web search: 248 (Oslo: Document.no, Avisa Oslo, NRK; the linked Le Parisien piece is case 242 and is marked OFF-CASE), 258 Kharkiv, 260 Singapore, 358 Bangkok, 365 Las Vegas, 388 Verneuil-sur-Seine, 390 Zoersel, 430 Homestead. 341 of 364 cases now hold a fetched article; 11, 66 and 399 have no public text source (podcast, police video, direct victim report). Trimming - auto_trim.py: case-anchored furniture cut for UNTRIMMED blocks. Finds the body run that mentions the case, merges across subheadings and short furniture gaps, drops teasers, share bars, date/URL/caption lines and subscription pitches; refuses pages with no record term or almost no body. 302 blocks trimmed; 16 left on auto-trim-review.md (7 OFF-CASE suspects). Every cut is labelled AUTO-TRIMMED, UNREVIEWED in the dossier; the full extract stays in staging/. Decisions with anchors in trim-decisions-auto.json. - build_cases.py / verify_all.py: banners for auto-trimmed and archived blocks, staged-file check extended to Wayback blocks, flag legend under the record. Detention rule - README "Definitions": the DB field `kidnappings` is the DETENTION violence type (victim, guard, staff or relative held to force submission or execute the theft), distinct from the Kidnapping scenario (taken away and held). - detention-flag-review.md / detention-flag-corrections.json: 40 records reviewed with evidence; 30 set-to-1 proposals accepted by the owner on 2026-09-06 (listed in corrections-approved.md), 10 still open. - apply_detention_wording.py: "Violence Used" in the 70 reviewed summaries now names detention explicitly (62 of 70 labelled), supported by the summary's own text; idempotent; supersedes the batch scripts' wording. Worklist and docs - sofia-worklist.md: 248 decisions, detention rule item replacing the old "no abduction" item, fresh-search section for the textless cases. - README-START-HERE.md: progress notes, run commands, next steps. - Bug fixed in passing: Wayback blocks stored in-memory text with carriage returns; now stored as read back from disk. verify_all.py PASSES (2321 checks). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt
485 lines
46 KiB
Plaintext
485 lines
46 KiB
Plaintext
================================================================================================
|
||
CASE 188 | Radhika & Suchil Chetal | August 25, 2024 | USA
|
||
================================================================================================
|
||
|
||
DATABASE RECORD
|
||
id 188
|
||
date August 25, 2024
|
||
original_date August 25, 2024
|
||
year 2024
|
||
month 8
|
||
quarter 2024-Q3
|
||
victim Radhika & Suchil Chetal
|
||
location Danbury, Connecticut
|
||
country USA
|
||
scenario Kidnapping
|
||
description Parents of $243M heist thieves get carjacked & kidnapped in botched ransom plot.
|
||
kidnappings 1
|
||
violence_torture 0
|
||
drugs_alcohol 0
|
||
weapons 0
|
||
theft 0
|
||
life_taken 0
|
||
money_wanted (null)
|
||
coin_type (null)
|
||
reports KrebsOnSec
|
||
notes crypto scammers kidnapped by read-parking a car, put to van, because the victim allegedly scammed of $342M in crypto, kidnappers caught shortly after by police
|
||
has_processed_date 1
|
||
created_at 2025-11-13 05:44:45
|
||
(flag legend: 'kidnappings' is the DETENTION flag — 1 when the victim was held against
|
||
their will at any point, tied, locked in, held at gunpoint or taken away; it is NOT the
|
||
same as the 'Kidnapping' scenario, which means taken away and held. See README, Definitions.)
|
||
|
||
AI SUMMARY [generated at bulk import, NOT verified against sources]
|
||
**Victim:** Radhika & Suchil Chetal
|
||
|
||
**Attackers:** 6 men, and the 19 y/o son was involved too.
|
||
|
||
**Attack Method:** Kidnapping for ransom
|
||
|
||
**Violence Used:** Threats/intimidation. They were found with hands and feet bound in duct tape, the man visibly bruised after being assaulted with a baseball bat.
|
||
|
||
**Crypto Stolen:** No theft completed
|
||
|
||
**Status:** Investigation ongoing
|
||
|
||
LINKED SOURCES
|
||
[url] https://krebsonsecurity.com/2024/10/lamborghini-carjackers-lured-by-243m-cyberheist/
|
||
[url_2] https://www.newstimes.com/news/article/chetal-bitcoin-crypto-theft-danbury-kidnapping-20387392.php
|
||
[url_3] https://www.newstimes.com/news/article/police-danbury-florida-kidnapping-19724606.php
|
||
|
||
NOTES ON THIS FILE
|
||
* matched to sheet row 189: exact match on victim + year, unique on both sides
|
||
|
||
------------------------------------------------------------------------------------------------
|
||
ARTICLE 1
|
||
Source KrebsOnSec
|
||
URL https://krebsonsecurity.com/2024/10/lamborghini-carjackers-lured-by-243m-cyberheist/
|
||
Origin reported_K&R sheet, row 189, column "Articles"
|
||
Length 11,702 chars
|
||
------------------------------------------------------------------------------------------------
|
||
Lamborghini Carjackers Lured by $243M Cyberheist
|
||
October 9, 202436 Comments
|
||
The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later — while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom.
|
||
|
||
|
||
Image: ABC7NY. youtube.com/watch?v=xoiaGzwrunY
|
||
|
||
Late in the afternoon of Aug. 25, 2024 in Danbury, Ct., a married couple in their 50s pulled up to a gated community in a new Lamborghini Urus (investigators say the sports car still had temporary tags) when they were intentionally rear-ended by a Honda Civic.
|
||
|
||
A witness told police they saw three men exit a van that was following the Honda, and said the men began assaulting the couple and forcing them into the van. Local police officers spotted the van speeding from the scene and pursued it, only to find the vehicle crashed and abandoned a short distance away.
|
||
|
||
Inside the disabled van the police found the couple with their hands and feet bound in duct tape, the man visibly bruised after being assaulted with a baseball bat. Danbury police soon reported arresting six suspects in the kidnapping, all men aged 18-26 from Florida. They also recovered the abandoned Lamborghini from a wooded area.
|
||
|
||
A criminal complaint (PDF) filed on Sept. 24 against the six men does not name the victims, referring to them only as a married couple from Danbury with the initials R.C. and S.C. But prosecutors in Connecticut said they were targeted “because the co-conspirators believed the victims’ son had access to significant amounts of digital currency.”
|
||
|
||
What made the Miami men so convinced R.C. and S.C.’s son was loaded with cryptocurrency? Approximately one week earlier, on Aug. 19, a group of cybercriminals that allegedly included the couple’s son executed a sophisticated phone-based social engineering attack in which they stole $243 million worth of cryptocurrency from a victim in Washington, D.C.
|
||
|
||
That’s according to ZachXBT, a frequently cited crypto crime investigator who published a lengthy thread that broke down how the theft was carried out and ultimately exposed by the perpetrators themselves.
|
||
|
||
ZachXBT’s post included a screen recording of a Discord chat session made by one of the participants to the $243 million robbery, noting that two of the people involved managed to leak the username of the Microsoft Windows PCs they were using to participate in the chat.
|
||
|
||
One of the usernames leaked during the chat was Veer Chetal. According to ZachXBT, that name corresponds to a 19-year-old from Danbury who allegedly goes by the nickname “Wiz,” although in the leaked video footage he allegedly used the handle “Swag.” Swag was reportedly involved in executing the early stages of the crypto heist — gaining access to the victim’s Gmail and iCloud accounts.
|
||
|
||
|
||
A still shot from a video screenshare in which one of the participants on the Discord voice chat used the Windows username Veer Chetal. Image: x.com/zachxbt
|
||
|
||
The same day ZachXBT published his findings, a criminal indictment was issued in Washington D.C. charging two of the men he named as involved in the heist. Prosecutors allege Malone “Greavys” Lam, 20, of Miami and Los Angeles, and Jeandiel “Box” Serrano, 21, of Los Angeles conspired to steal and launder over $230 million in cryptocurrency from a victim in Washington, D.C. The indictment alleges Lam and Serrano were helped by other unnamed co-conspirators.
|
||
|
||
“Lam and Serrano then allegedly spent the laundered cryptocurrency proceeds on international travel, nightclubs, luxury automobiles, watches, jewelry, designer handbags, and rental homes in Los Angeles and Miami,” reads a press release from the U.S. Department of Justice.
|
||
|
||
By tracing the flow of funds stolen in the heist, ZachXBT concluded that Wiz received a large percentage from the theft, noting that “additional comfort [in naming him as involved] was gained as throughout multiple recordings accomplices refer to him as ‘Veer’ on audio and in chats.”
|
||
|
||
“A cluster of [cryptocurrency] addresses tied to both Box/Wiz received $41M+ from two exchanges over the past few weeks primarily flowing to luxury goods brokers to purchase cars, watches, jewelry, and designer clothes,” ZachXBT wrote.
|
||
|
||
KrebsOnSecurity sought comment from Veer Chetal, and from his parents — Radhika Chetal and Suchil Chetal. This story will be updated in the event that anyone representing the Chetal family responds. Veer Chetal has not been publicly charged with any crime.
|
||
|
||
According to a news brief published by a private Catholic high school in Danbury that Veer Chetal attended, in 2022 he successfully completed Harvard’s Future Lawyers Program, a “unique pre-professional program where students, guided by qualified Harvard undergraduate instructors, learn how to read and build a case, how to write position papers, and how to navigate a path to law school.” A November 2022 story at patch.com quoted Veer Chetal (class of 2024) crediting the Harvard program with his decision to pursue a career in law.
|
||
|
||
It remains unclear which Chetal family member acquired the 2023 Lamborghini Urus, which has a starting price of around $233,000. Sushil Chetal’s LinkedIn profile says he is a vice president at the investment bank Morgan Stanley.
|
||
|
||
It is clear that other alleged co-conspirators to the $243 million heist displayed a conspicuous consumption of wealth following the date of the heist. ZachXBT’s post chronicled Malone’s flashy lifestyle, in which he allegedly used the stolen money to purchase more than 10 vehicles, rent palatial properties, travel with friends on chartered jets, and spend between $250,000 and $500,000 a night at clubs in Los Angeles and Miami.
|
||
|
||
|
||
In the photo on the bottom right, Greavys/Lam is the individual on the left wearing shades. They are pictured leaving a luxury goods store. Image: x.com/zachxbt
|
||
|
||
WSVN-TV in Miami covered an FBI raid of a large rented waterfront home around the time Malone and Serrano were arrested. The news station interviewed a neighbor of the home’s occupants, who reported a recent large party at the residence wherein the street was lined with high-end luxury vehicles — all of them with temporary paper tags.
|
||
|
||
ZachXBT unearthed a video showing a person identified as Wiz at a Miami nightclub earlier this year, wherein they could be seen dancing to the crowd’s chants while holding an illuminated sign with the message, “I win it all.”
|
||
|
||
|
||
It appears that all of the suspects in the cyber heist (and at least some of the alleged carjackers) are members of The Com, an archipelago of crime-focused chat communities which collectively functions as a kind of distributed cybercriminal social network that facilitates instant collaboration.
|
||
|
||
As documented in last month’s deep dive on top Com members, The Com is also a place where cybercriminals go to boast about their exploits and standing within the community, or to knock others down a peg or two. Prominent Com members are endlessly sniping over who pulled off the most impressive heists, or who has accumulated the biggest pile of stolen virtual currencies.
|
||
|
||
And as often as they extort and rob victims for financial gain, members of The Com are trying to wrest stolen money from their cybercriminal rivals — often in ways that spill over into physical violence in the real world.
|
||
|
||
One of the six Miami-area men arrested in the carjacking and extortion plot gone awry — Reynaldo “Rey” Diaz — was shot twice while parked in his bright yellow Corvette in Miami’s design district in 2022. In an interview with a local NBC television station, Diaz said he was probably targeted for the jewelry he was wearing, which he described as “pretty expensive.”
|
||
|
||
KrebsOnSecurity has learned Diaz also went by the alias “Pantic” on Telegram chat channels dedicated to stealing cryptocurrencies. Pantic was known for participating in several much smaller cyber heists in the past, and spending most of his cut on designer clothes and jewelry.
|
||
|
||
|
||
The Corvette that Diaz was sitting in when he was shot in 2022. Image: NBC 6, South Florida.
|
||
|
||
Earlier this year, Diaz was “doxed,” or publicly outed as Pantic, with his personal and family information posted on a harassment and extortion channel frequented by members of The Com. The reason cited for Pantic’s doxing was widely corroborated by multiple Com members: Pantic had inexplicably robbed two close friends at gunpoint, one of whom recently died of a drug overdose.
|
||
|
||
Government prosecutors say the brazen daylight carjacking was paid for and organized by 23-year-old Miami resident Angel “Chi Chi” Borrero. In 2022, Borrero was arrested in Miami for aggravated assault with a deadly weapon.
|
||
|
||
The six Miami men face charges including first-degree assault, kidnapping and reckless endangerment, and five of them are being held on a $1 million bond. One suspect is also charged with reckless driving, engaging police in pursuit and evading responsibility; his bond was set at $2 million. Lam and Serrano are each charged with conspiracy to commit wire fraud and conspiracy to launder money.
|
||
|
||
Cybercriminals hail from all walks of life and income levels, but some of the more accomplished cryptocurrency thieves also tend to be among the more privileged, and from relatively well-off families. In other words, these individuals aren’t stealing to put food on the table: They’re doing it so they can amass all the trappings of instant wealth, and so they can boast about their crimes to others on The Com.
|
||
|
||
There is also a penchant among this crowd to call attention to their activities in conspicuous ways that hasten their arrest and criminal charging. In many ways, the story arc of the young men allegedly involved in the $243 million heist tracks closely to that of Joel Ortiz, a valedictorian who was sentenced in 2019 to 10 years in prison for stealing more than $5 million in cryptocurrencies.
|
||
|
||
Ortiz famously posted videos of himself and co-conspirators chartering flights and partying it up at LA nightclubs, with scantily clad women waving giant placards bearing their “OG” usernames — highly-prized, single-letter social media accounts that they’d stolen or purchased stolen from others.
|
||
|
||
|
||
Ortiz earned the distinction of being the first person convicted of SIM-swapping, a crime that involves using mobile phone company insiders or compromised employee accounts to transfer a target’s phone number to a mobile device controlled by the attackers. From there, the attacker can intercept any password reset links, and any one-time passcodes sent via SMS or automated voice calls.
|
||
|
||
But as the mobile carriers seek to make their networks less hospitable to SIM-swappers, and as more financial platforms seek to harden user account security, today’s crypto thieves are finding they don’t need SIM-swaps to steal obscene amounts of cryptocurrency. Not when tricking people over the phone remains such an effective approach.
|
||
|
||
According to ZachXBT, the crooks responsible for the $243 million theft initially compromised the target’s personal accounts after calling them as Google Support and using a spoofed number. The attackers also spoofed a call from account support representatives at the cryptocurrency exchange Gemini, claiming the target’s account had been hacked.
|
||
|
||
From there the target was social engineered over the phone into resetting multi-factor authentication and sending Gemini funds to a compromised wallet. ZachXBT says the attackers also convinced the victim to use AnyDesk to share their screen, and in doing so the victim leaked their private keys.
|
||
|
||
|
||
------------------------------------------------------------------------------------------------
|
||
FETCHED ARTICLE 1 [AUTO-TRIMMED — UNREVIEWED]
|
||
!! Furniture was cut by a script keyed on this case's record, not by a person.
|
||
!! It may still carry passages about OTHER cases from a round-up article.
|
||
!! The full page extract is kept in staging/ if a cut needs revisiting.
|
||
Source krebsonsecurity.com
|
||
URL https://krebsonsecurity.com/2024/10/lamborghini-carjackers-lured-by-243m-cyberheist/
|
||
Field url
|
||
Retrieved 2026-09-05T12:50:03+00:00 via raw HTTP retrieval, deterministic extraction (HTTP 200)
|
||
Language unknown
|
||
Kept paragraphs headline [0] + 1-76 excl [2, 45] of 91
|
||
Length 16,615 chars
|
||
Integrity sha256 c65c37a3525707d30e4b11c4d0feced2692b8039edc554dca3554c88cb3335b3
|
||
Trimmed AUTO-TRIMMED, unreviewed: kept paragraphs 1-76 plus headline [0]; dropped 0 leading and 14 trailing paragraphs and 2 interior furniture line(s). Case-term hits on page: 32.
|
||
Caveat retrieved from a live page on the date above. Unlike text copied
|
||
from the spreadsheet, there is no second copy to hash it against.
|
||
------------------------------------------------------------------------------------------------
|
||
|
||
ORIGINAL (unknown, verbatim as retrieved)
|
||
|
||
Lamborghini Carjackers Lured by $243M Cyberheist – Krebs on Security
|
||
|
||
The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later — while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom.
|
||
|
||
Late in the afternoon of Aug. 25, 2024 in Danbury, Ct., a married couple in their 50s pulled up to a gated community in a new Lamborghini Urus (investigators say the sports car still had temporary tags) when they were intentionally rear-ended by a Honda Civic.
|
||
|
||
A witness told police they saw three men exit a van that was following the Honda, and said the men began assaulting the couple and forcing them into the van. Local police officers spotted the van speeding from the scene and pursued it, only to find the vehicle crashed and abandoned a short distance away.
|
||
|
||
Inside the disabled van the police found the couple with their hands and feet bound in duct tape, the man visibly bruised after being assaulted with a baseball bat. Danbury police soon reported arresting six suspects in the kidnapping, all men aged 18-26 from Florida. They also recovered the abandoned Lamborghini from a wooded area.
|
||
|
||
A criminal complaint (PDF) filed on Sept. 24 against the six men does not name the victims, referring to them only as a married couple from Danbury with the initials R.C. and S.C. But prosecutors in Connecticut said they were targeted “because the co-conspirators believed the victims’ son had access to significant amounts of digital currency.”
|
||
|
||
What made the Miami men so convinced R.C. and S.C.’s son was loaded with cryptocurrency? Approximately one week earlier, on Aug. 19, a group of cybercriminals that allegedly included the couple’s son executed a sophisticated phone-based social engineering attack in which they stole $243 million worth of cryptocurrency from a victim in Washington, D.C.
|
||
|
||
That’s according to ZachXBT, a frequently cited crypto crime investigator who published a lengthy thread that broke down how the theft was carried out and ultimately exposed by the perpetrators themselves.
|
||
|
||
ZachXBT’s post included a screen recording of a Discord chat session made by one of the participants to the $243 million robbery, noting that two of the people involved managed to leak the username of the Microsoft Windows PCs they were using to participate in the chat.
|
||
|
||
One of the usernames leaked during the chat was Veer Chetal. According to ZachXBT, that name corresponds to a 19-year-old from Danbury who allegedly goes by the nickname “Wiz,” although in the leaked video footage he allegedly used the handle “Swag.” Swag was reportedly involved in executing the early stages of the crypto heist — gaining access to the victim’s Gmail and iCloud accounts.
|
||
|
||
A still shot from a video screenshare in which one of the participants on the Discord voice chat used the Windows username Veer Chetal. Image: x.com/zachxbt
|
||
|
||
The same day ZachXBT published his findings, a criminal indictment was issued in Washington D.C. charging two of the men he named as involved in the heist. Prosecutors allege Malone “Greavys” Lam, 20, of Miami and Los Angeles, and Jeandiel “Box” Serrano, 21, of Los Angeles conspired to steal and launder over $230 million in cryptocurrency from a victim in Washington, D.C. The indictment alleges Lam and Serrano were helped by other unnamed co-conspirators.
|
||
|
||
“Lam and Serrano then allegedly spent the laundered cryptocurrency proceeds on international travel, nightclubs, luxury automobiles, watches, jewelry, designer handbags, and rental homes in Los Angeles and Miami,” reads a press release from the U.S. Department of Justice.
|
||
|
||
By tracing the flow of funds stolen in the heist, ZachXBT concluded that Wiz received a large percentage from the theft, noting that “additional comfort [in naming him as involved] was gained as throughout multiple recordings accomplices refer to him as ‘Veer’ on audio and in chats.”
|
||
|
||
“A cluster of [cryptocurrency] addresses tied to both Box/Wiz received $41M+ from two exchanges over the past few weeks primarily flowing to luxury goods brokers to purchase cars, watches, jewelry, and designer clothes,” ZachXBT wrote.
|
||
|
||
KrebsOnSecurity sought comment from Veer Chetal, and from his parents — Radhika Chetal and Suchil Chetal. This story will be updated in the event that anyone representing the Chetal family responds. Veer Chetal has not been publicly charged with any crime.
|
||
|
||
According to a news brief published by a private Catholic high school in Danbury that Veer Chetal attended, in 2022 he successfully completed Harvard’s Future Lawyers Program, a “unique pre-professional program where students, guided by qualified Harvard undergraduate instructors, learn how to read and build a case, how to write position papers, and how to navigate a path to law school.” A November 2022 story at patch.com quoted Veer Chetal (class of 2024) crediting the Harvard program with his decision to pursue a career in law.
|
||
|
||
It remains unclear which Chetal family member acquired the 2023 Lamborghini Urus, which has a starting price of around $233,000. Sushil Chetal’s LinkedIn profile says he is a vice president at the investment bank Morgan Stanley.
|
||
|
||
It is clear that other alleged co-conspirators to the $243 million heist displayed a conspicuous consumption of wealth following the date of the heist. ZachXBT’s post chronicled Malone’s flashy lifestyle, in which he allegedly used the stolen money to purchase more than 10 vehicles, rent palatial properties, travel with friends on chartered jets, and spend between $250,000 and $500,000 a night at clubs in Los Angeles and Miami.
|
||
|
||
In the photo on the bottom right, Greavys/Lam is the individual on the left wearing shades. They are pictured leaving a luxury goods store. Image: x.com/zachxbt
|
||
|
||
WSVN-TV in Miami covered an FBI raid of a large rented waterfront home around the time Malone and Serrano were arrested. The news station interviewed a neighbor of the home’s occupants, who reported a recent large party at the residence wherein the street was lined with high-end luxury vehicles — all of them with temporary paper tags.
|
||
|
||
ZachXBT unearthed a video showing a person identified as Wiz at a Miami nightclub earlier this year, wherein they could be seen dancing to the crowd’s chants while holding an illuminated sign with the message, “I win it all.”
|
||
|
||
It appears that all of the suspects in the cyber heist (and at least some of the alleged carjackers) are members of The Com, an archipelago of crime-focused chat communities which collectively functions as a kind of distributed cybercriminal social network that facilitates instant collaboration.
|
||
|
||
As documented in last month’s deep dive on top Com members, The Com is also a place where cybercriminals go to boast about their exploits and standing within the community, or to knock others down a peg or two. Prominent Com members are endlessly sniping over who pulled off the most impressive heists, or who has accumulated the biggest pile of stolen virtual currencies.
|
||
|
||
And as often as they extort and rob victims for financial gain, members of The Com are trying to wrest stolen money from their cybercriminal rivals — often in ways that spill over into physical violence in the real world.
|
||
|
||
One of the six Miami-area men arrested in the carjacking and extortion plot gone awry — Reynaldo “Rey” Diaz — was shot twice while parked in his bright yellow Corvette in Miami’s design district in 2022. In an interview with a local NBC television station, Diaz said he was probably targeted for the jewelry he was wearing, which he described as “pretty expensive.”
|
||
|
||
KrebsOnSecurity has learned Diaz also went by the alias “Pantic” on Telegram chat channels dedicated to stealing cryptocurrencies. Pantic was known for participating in several much smaller cyber heists in the past, and spending most of his cut on designer clothes and jewelry.
|
||
|
||
The Corvette that Diaz was sitting in when he was shot in 2022. Image: NBC 6, South Florida.
|
||
|
||
Earlier this year, Diaz was “doxed,” or publicly outed as Pantic, with his personal and family information posted on a harassment and extortion channel frequented by members of The Com. The reason cited for Pantic’s doxing was widely corroborated by multiple Com members: Pantic had inexplicably robbed two close friends at gunpoint, one of whom recently died of a drug overdose.
|
||
|
||
Government prosecutors say the brazen daylight carjacking was paid for and organized by 23-year-old Miami resident Angel “Chi Chi” Borrero. In 2022, Borrero was arrested in Miami for aggravated assault with a deadly weapon.
|
||
|
||
The six Miami men face charges including first-degree assault, kidnapping and reckless endangerment, and five of them are being held on a $1 million bond. One suspect is also charged with reckless driving, engaging police in pursuit and evading responsibility; his bond was set at $2 million. Lam and Serrano are each charged with conspiracy to commit wire fraud and conspiracy to launder money.
|
||
|
||
Cybercriminals hail from all walks of life and income levels, but some of the more accomplished cryptocurrency thieves also tend to be among the more privileged, and from relatively well-off families. In other words, these individuals aren’t stealing to put food on the table: They’re doing it so they can amass all the trappings of instant wealth, and so they can boast about their crimes to others on The Com.
|
||
|
||
There is also a penchant among this crowd to call attention to their activities in conspicuous ways that hasten their arrest and criminal charging. In many ways, the story arc of the young men allegedly involved in the $243 million heist tracks closely to that of Joel Ortiz, a valedictorian who was sentenced in 2019 to 10 years in prison for stealing more than $5 million in cryptocurrencies.
|
||
|
||
Ortiz famously posted videos of himself and co-conspirators chartering flights and partying it up at LA nightclubs, with scantily clad women waving giant placards bearing their “OG” usernames — highly-prized, single-letter social media accounts that they’d stolen or purchased stolen from others.
|
||
|
||
Ortiz earned the distinction of being the first person convicted of SIM-swapping, a crime that involves using mobile phone company insiders or compromised employee accounts to transfer a target’s phone number to a mobile device controlled by the attackers. From there, the attacker can intercept any password reset links, and any one-time passcodes sent via SMS or automated voice calls.
|
||
|
||
But as the mobile carriers seek to make their networks less hospitable to SIM-swappers, and as more financial platforms seek to harden user account security, today’s crypto thieves are finding they don’t need SIM-swaps to steal obscene amounts of cryptocurrency. Not when tricking people over the phone remains such an effective approach.
|
||
|
||
According to ZachXBT, the crooks responsible for the $243 million theft initially compromised the target’s personal accounts after calling them as Google Support and using a spoofed number. The attackers also spoofed a call from account support representatives at the cryptocurrency exchange Gemini, claiming the target’s account had been hacked.
|
||
|
||
From there the target was social engineered over the phone into resetting multi-factor authentication and sending Gemini funds to a compromised wallet. ZachXBT says the attackers also convinced the victim to use AnyDesk to share their screen, and in doing so the victim leaked their private keys.
|
||
|
||
36 thoughts on “Lamborghini Carjackers Lured by $243M Cyberheist”
|
||
|
||
My crypto presence is nonexistent and will remain so. LOL
|
||
|
||
It’s a financial system based on “the greater fool theory” 🙂
|
||
|
||
Brian I don’t know how you keep all these characters straight enough to write a coherent report
|
||
|
||
He probably has a pegboard, with strings and pictures.
|
||
|
||
I totally use mind maps for all these investigations. I’ve published a lot of them.
|
||
|
||
Krebs, I’m having trouble following your recent articles. Your writing quality seems to have gone down quite a bit in the past few weeks. It’s very disappointing to say the least.
|
||
|
||
You should try writing some. It’s hard work, and it’s not all AI prompts. Medium is a great place to start your writing career, where you can grow as a budding author to great critique. Maybe you can even share some of your work here. Hopefully it won’t be, um, disappointing, LOL.
|
||
|
||
I gotta disagree, recently the articles feel like a disturbing action movie to me. He’s always showing me a different part of the cybercrime world and I love it. Keep doing you, Brian. Legend in my eyes.
|
||
|
||
huh… couldn’t disagree more. keep ’em coming, brian…
|
||
|
||
I disagree, they have changed a bit, but now read like a good cyber crime podcast. More storytelling in how the facts are laid out. I appreciate it, and definitely keep it up!
|
||
|
||
Any specifics to share, or just a general sentiment happy hour? Which articles, what specifically is “bad”?
|
||
|
||
Thanks for your opinion Mr Chetal.
|
||
|
||
An amazing tale of how to be technically brilliant and amazingly stupid at the same time. Apparently the cybercriminals were all too young to remember the catchphrase from All the President’s Men -“Follow the money.”
|
||
|
||
Yes, this is odd. Discord calls, seriously? Not matrix, not Briar, not even signal ffs, Discord? And flashing money like that? If you do something like this you lay low and silent and relocate, period.
|
||
|
||
That is my take on this also. It’s the obscene conspicuous consumption that doxes them in the first place. And the bragging… Everybody has to prove the have the longest schl**ng, LOL.
|
||
|
||
I am kind of appalled at the shallowness of the “lifestyle” these individuals are trying to pull off / show off. I mean, is it so hard to think even a few inches beyond your immediate line of sight?
|
||
|
||
But then again, as Brian points out in the article, it seems to be exactly this shallowness that allows law enforcement agencies to locate and identify these people relatively easily, so there’s apparently a good side to what otherwise looks like cultural decline…
|
||
|
||
Dad works at Morgan Stanley, pretty sure going to be worked….. And totally unhireable at any other bank either, or any place where they handle cash or do brokering or investing, or handle cards at all, because of the association with the son, because the name is unique, and the word will spread rapidly.
|
||
|
||
But again, stole large, lived large, and then wonder how they were found out, and why their fellow crooks were so terrible as to steal from them.
|
||
|
||
It seems opsec is a dying art.
|
||
|
||
Who has millions in crypto and yet is simple enough to be tricked into using AnyDesk?
|
||
|
||
Dumbest criminals vs dumbest victims.
|
||
|
||
Sometimes it do be like that, the less you think the better…. Goes both ways, oh well.
|
||
|
||
>They also recovered the abandoned Lamborghini from a wooded area.
|
||
|
||
It’s not about the money, it’s about sending a message!
|
||
|
||
Honestly, rich spoiled kids doing this is a bit unexpected to say the least. I assumed everyone who was into this stuff was living paycheque to paycheque with a bad upbringing. If or when Mr. Veer gets busted, I’m sure he’ll have top lawyers with daddy’s banker money and be out sooner than it took for the feds to bust him in the first place, with the added bonus that he’s PROBABLY already a informant considering the video is recorded from his POV.
|
||
|
||
BTW, your SEO is amazing, already this article is showing up as the third result for looking up his dad’s name. Not a good look.
|
||
|
||
People living paycheck to paycheck do this and spend the money on necessities. Food, shelter and future for kids. Rich people do this to fit in. They are surrounded by “success” and feel they have to prove themselves. They fail though because they don’t know long hard work, only short silver spoons.
|
||
|
||
Perps have no empathy, and or like to make others suffer. They don’t need the money, they just want to hurt others. Which is why they are bad people to begin with. Doesn’t matter if they are poor or wealthy, they are just bad people.
|
||
|
||
Excellent reporting Brian.
|
||
|
||
How can the parents not be involved in this mess: house hunting
|
||
|
||
in a brand new Lamborghini for Christ sakes. No doubt the victim
|
||
|
||
of the $243M heist was a client of Morgan Stanley.
|
||
|
||
“Veer Chetal has not been publicly charged with any crime.”
|
||
|
||
Is the saddest take away from this for me. This lil skid should be locked up ASAP and given a decade or two in jail.
|
||
|
||
I assume its coming soon though as the feds obviously have enough evidence to raid and arrest him.
|
||
|
||
------------------------------------------------------------------------------------------------
|
||
FETCHED ARTICLE 2 [AUTO-TRIMMED — UNREVIEWED]
|
||
!! Furniture was cut by a script keyed on this case's record, not by a person.
|
||
!! It may still carry passages about OTHER cases from a round-up article.
|
||
!! The full page extract is kept in staging/ if a cut needs revisiting.
|
||
Source newstimes.com
|
||
URL https://www.newstimes.com/news/article/chetal-bitcoin-crypto-theft-danbury-kidnapping-20387392.php
|
||
Field url_2
|
||
Retrieved 2026-09-05T13:29:02+00:00 via Wayback Machine snapshot 20260806012432, deterministic extraction (HTTP None)
|
||
Language unknown
|
||
Kept paragraphs headline [0] + 2-35 of 79
|
||
Length 6,918 chars
|
||
Integrity sha256 58079e176410284379267b82d99ba4c192363d59c901f3ffd9e6db17cb9ce828
|
||
Trimmed AUTO-TRIMMED, unreviewed: kept paragraphs 2-35 plus headline [0]; dropped 1 leading and 43 trailing paragraphs. Case-term hits on page: 48.
|
||
Note live URL was THIN on the first pass; text comes from an archived copy dated 2026-08-06
|
||
Archive http://web.archive.org/web/20260806012432/https://www.newstimes.com/news/article/chetal-bitcoin-crypto-theft-danbury-kidnapping-20387392.php
|
||
Caveat retrieved from a Wayback Machine snapshot, not the live page. The
|
||
snapshot date is in the method line; the live URL was unreadable.
|
||
------------------------------------------------------------------------------------------------
|
||
|
||
ORIGINAL (unknown, verbatim as retrieved)
|
||
|
||
CT resident guilty in crypto heist that led to parents' kidnapping
|
||
|
||
By Lisa Backus, Kendra Baker, Staff WritersUpdated June 21, 2025 12:35 p.m.
|
||
|
||
A Connecticut man whose parents were kidnapped in Danbury after he played a role in a $245 million Bitcoin theft pleaded guilty to fraud and money laundering conspiracy charges and has agreed to testify against his codefendants even though he will likely be deported, according to recently unsealed federal court documents.
|
||
|
||
Veer Chetal, 19, from Danbury, Connecticut, was one of three men charged with stealing 4,100 Bitcoins from a victim in Washington, D.C., known as "RW" in court papers as part of an online scam that involved the men pretending to be trusted employees of well-known firms last August, documents said. The trio lived large after the heist, spending millions of dollars on cars, jewelry, rental mansions and nightclub parties, according to the Associated Press.
|
||
|
||
A week after the theft, Chetal’s parents were assaulted and kidnapped for a short period in Danbury in a failed ransom plot aimed at Chetal, who the assailants believed had a large amount of cryptocurrency, previous reports indicate.
|
||
|
||
3 more charged in alleged crypto kidnapping plot targeting Danbury family: Feds
|
||
|
||
32-year-old Sedric Louis, 34-year-old John Davis and 27-year-old Martel Williams, all from St. Louis, were charged.
|
||
|
||
Danbury residents receive support to rebuild after losing homes in condo fire
|
||
|
||
Local residents are offering support to the tenants displaced from their homes at a Danbury condo complex by a recent fire.
|
||
|
||
Violent crime in Danbury down about 50% through first half of 2026
|
||
|
||
Data shows the number of all criminal offenses reported to the Danbury Police Department during the first half of 2026 was down 25 percent from the same period last year.
|
||
|
||
Opponents get another chance to fight Brookfield compressor station expansion
|
||
|
||
Reopening the process allows opponents to submit concerns about the environmental impacts — and work to push for denial — of the expansion.
|
||
|
||
Fire damages Newtown strip mall, leaving several businesses affected: Officials
|
||
|
||
There were no injuries reported, fire officials said.
|
||
|
||
Chetal was not charged by federal authorities in the kidnapping plot. He pleaded guilty in November to fraud and money laundering charges but the case was sealed until last week, the documents show.
|
||
|
||
A newly released plea agreement indicates he will cooperate with federal authorities, including testifying against the other men. He will also be required to provide restitution toward the nearly $250 million theft and was told that since he was not a citizen of the United States, he will likely be deported, the documents said.
|
||
|
||
Want more News Times?
|
||
|
||
Make us a Preferred Source on Google to see more of us when you search.
|
||
|
||
He is also required to forfeit $548,000 in cash and a long list of items including several Rolex watches, 21 pairs of pants, seven jackets, shirts, boxes of high-end clothing, designer suitcases and other items seized during searches of a home he rented in New Jersey and his home in Danbury, federal documents said.
|
||
|
||
He was involved in about 50 similar thefts and usually called potential victims pretending to be with security or technical support for a large company, in some cases Google or Yahoo! gaining the victim's trust and personal information so that one of the other men could access and steal their virtual currency, a separate plea agreement document said.
|
||
|
||
Chetal, Malone Lam and Jeandiel Serrano met while playing "Minecraft" online and they agreed to participate in a scheme to steal virtual currency from unwitting victims from November 2023 and September 2024, federal documents said.
|
||
|
||
The cases against the other two men are continuing, federal documents show.
|
||
|
||
Initially, little information on Chetal's arrest and charges were made available by federal authorities. But allegations against Chetal and others were believed to stem from the ongoing federal investigation into a $230 million cryptocurrency theft, to which investigators linked an August 2024 carjacking and attempted kidnapping of a Danbury couple.
|
||
|
||
Authorities said the Aug. 25 kidnapping attempt was part of an intended ransom demand connected with the couple’s son’s alleged involvement in the crypto heist, which involved the theft and laundering of more than 4,000 Bitcoin from a man in Washington, D.C.
|
||
|
||
Up until this week, authorities had declined to comment on Chetal's arrest or confirm his possible relation to the Danbury couple.
|
||
|
||
The target of the theft was described in federal court documents as “a high-net-worth crypto investor from the early days of cryptocurrency,” and authorities said the stolen Bitcoin was valued at more than $230 million at the time of the theft.
|
||
|
||
The couple targeted in the Aug. 25 attempted kidnapping — which resulted in the arrest of six Florida men on state and federal charges — were hospitalized following the attack near Damia Drive and told police they initially thought they were targeted because of their high-end SUV.
|
||
|
||
The attempted kidnappers — who police say rammed the couple’s Lamborghini and threw them into a waiting van to be tied up and driven away — were identified as Angel Borrero, 23, Reynaldo Diaz, 22, Anthony Pena, 23, Josue Romero, 26, Ricardo Estrada, 21, and Michael Rivas, 18.
|
||
|
||
Borrero, Pena, Romero, Estrada and Rivas have pleaded guilty to conspiracy and kidnapping charges, according to federal court records, which show the five defendants scheduled for sentencing in May and June.
|
||
|
||
Diaz, the only one of the group to not accept a plea agreement, has a trial date set for Sept. 23. He’s also the only one of the six who hasn’t entered pleas in his state criminal case, according to court records, which show Borrero, Pena, Romero, Estrada and Rivas have all pleaded not guilty to felony and misdemeanor charges in state Superior Court in Danbury.
|
||
|
||
The U.S. Attorney’s Office for the District of Connecticut recently announced that James Schwab, a 22-year-old from Peachtree, Ga., was federally charged with conspiracy to commit kidnapping after an ongoing FBI investigation revealed his connection to the case.
|
||
|
||
Schwab is accused of “planning and facilitating” the Aug. 25 attempted kidnapping as a way to extort money from the couple’s son, who’s referred to as “V.C.” in a federal criminal complaint filed in U.S. District Court in Bridgeport in January.
|
||
|
||
The complaint says Schwab and V.C. got into a verbal and physical altercation at a Miami nightclub in July 2024, after which Schwab and another individual devised a plan to have V.C.’s parents kidnapped for ransom.
|
||
|
||
In addition to V.C., the criminal complaint in Schwab’s case includes the initials of the couple targeted in the Aug. 25 kidnapping plot — which match those of the parents of a Danbury resident whose name and age align with that of the Veer Chetal who is being held by U.S. Marshals in Virginia.
|
||
|
||
------------------------------------------------------------------------------------------------
|
||
FETCHED ARTICLE 3 [AUTO-TRIMMED — UNREVIEWED]
|
||
!! Furniture was cut by a script keyed on this case's record, not by a person.
|
||
!! It may still carry passages about OTHER cases from a round-up article.
|
||
!! The full page extract is kept in staging/ if a cut needs revisiting.
|
||
Source newstimes.com
|
||
URL https://www.newstimes.com/news/article/police-danbury-florida-kidnapping-19724606.php
|
||
Field url_3
|
||
Retrieved 2026-09-05T13:29:07+00:00 via Wayback Machine snapshot 20260809162100, deterministic extraction (HTTP None)
|
||
Language unknown
|
||
Kept paragraphs headline [0] + 3-27 of 55
|
||
Length 3,518 chars
|
||
Integrity sha256 f2ad5af2a2047d0b25d26f05ca0d80b51a06436386926e32427e4809598a8995
|
||
Trimmed AUTO-TRIMMED, unreviewed: kept paragraphs 3-27 plus headline [0]; dropped 2 leading and 27 trailing paragraphs. Case-term hits on page: 14.
|
||
Note live URL was THIN on the first pass; text comes from an archived copy dated 2026-08-09
|
||
Archive http://web.archive.org/web/20260809162100/https://www.newstimes.com/news/article/police-danbury-florida-kidnapping-19724606.php
|
||
Caveat retrieved from a Wayback Machine snapshot, not the live page. The
|
||
snapshot date is in the method line; the live URL was unreadable.
|
||
------------------------------------------------------------------------------------------------
|
||
|
||
ORIGINAL (unknown, verbatim as retrieved)
|
||
|
||
Police: 6 Florida men arrested after 'targeted' kidnapping in Danbury
|
||
|
||
DANBURY — Six men from Florida were arrested after police say they rescued two victims of what appeared to be a targeted kidnapping Sunday.
|
||
|
||
Police received a call for a disturbance near Clapboard Ridge Road Sunday at approximately 5:40 p.m., according to a news release from the Danbury Police Department. Upon arrival, police said a witness reported seing three males exit a van, begin assaulting another man, then pushing him into the van before the van fled.
|
||
|
||
Officers spotted the van on Clapboard Ridge Road and attempted to stop it, police said, but the driver sped away. The vehicle was then located not far away on Cowperthwaite Street, police said.
|
||
|
||
The two victims "bound with duct tape" were found inside the van, police said, and one had been hit with a baseball bat. Both were transported to the hospital for treatment, police said, but neither faced life-threatening injuries.
|
||
|
||
Newtown council wants Flock camera moratorium amid surveillance concerns
|
||
|
||
“I don’t want to live in a surveillance state,” one member said.
|
||
|
||
Connecticut mother turns son's death into call for mental health awareness
|
||
|
||
“What we’ve gone through, we hope nobody would have to go through this,” Carolyn Greene said.
|
||
|
||
Feds: Missouri men stalked Connecticut family before crypto kidnapping plot
|
||
|
||
Both suspects have long criminal histories and face substantial sentences if convicted, prosecutors said in their motions to detain.
|
||
|
||
Ex-Danbury school employee accused of stalking former student, warrant says
|
||
|
||
A warrant says the former Danbury High School employee left the girl several voicemail messages after she blocked his number and then went to her house.
|
||
|
||
3 more charged in alleged crypto kidnapping plot targeting Danbury family: Feds
|
||
|
||
32-year-old Sedric Louis, 34-year-old John Davis and 27-year-old Martel Williams, all from St. Louis, were charged.
|
||
|
||
Police said witnesses told them six suspects left the Cowperthwaite Street area on foot, and they immediately began a search. Four suspects were "quickly" taken into custody, they said, noting that three officers suffered injuries during the search and apprehensions.
|
||
|
||
Want more News Times?
|
||
|
||
Make us a Preferred Source on Google to see more of us when you search.
|
||
|
||
After what police called "further investigation," two additional suspects were arrested at a "short-term rental home" in nearby Roxbury.
|
||
|
||
Angel Borrero, 23, Reynaldo Diaz, 22, Anthony Pena, 23, Josue Romero, 26, Ricardo Estrada, 21, and Michael Rivas, 18 — all of whom are from Florida — were all been arrested and charged with first-degree assault, first-degree kidnapping and reckless endangerment.
|
||
|
||
Borrero also faces charges of reckless driving, engaging police in pursuit and evading responsibility. His bond is set at $2,000,000, while each of the other men are being held in lieu of $1,000,000 bonds.
|
||
|
||
Police said the kidnapping was "specifically targeted" but that the "exact motive is not known."
|
||
|
||
Danbury Police are asking anyone with information to call detectives at 203-797-4662 or the anonymous tips line 203-790- 8477.
|
||
|
||
Hana Ikramuddin is a Hearst Fellow in Connecticut. She spent the first part of her fellowship at the Houston Chronicle.
|
||
|
||
Raised in the Twin Cities, Hana majored in journalism and political science at the University of Minnesota in Minneapolis.
|
||
|
||
She has held internships with the Star Tribune, APM Reports and Sahan Journal. In her free time, she loves to cook, make chai and take care of her houseplants.
|
||
|
||
================================================================================================
|
||
generated from attacks-export-Gart-website.json + reported_K&R | case 188
|
||
================================================================================================
|