Files
DB-cleanup/merge-output/sources/403_Male-cryptocurrency-holder.txt
T
StellarCrowandClaude Fable 5.1 499fd61f79 feat(sources): fetch linked URLs for the 252 spreadsheet-only cases
Until now only cases 357+ (plus a few older ones) had their linked URLs
fetched; the other 252 dossiers held just the text pasted into the
spreadsheet, often only the lede. This pass fetches every linked URL for
those cases so the full text is on file before link rot takes it.

- stage_all.py: new --include-sheet-cases flag that lifts the skip on
  cases holding spreadsheet articles. Resumable as before.
- staging/: raw extracts and index.json for the 252 cases.
- sourced-articles.json, case-files-manifest.json: 188 new UNTRIMMED
  blocks. 179 cases gained at least one fetched article; 73 got none
  (49 BLOCKED, 18 THIN, 9 DEAD, 4 video/social, 3 ERROR).
- sources/*.txt: rebuilt with build_cases.py --all. Sheet pastes are
  kept; fetched blocks sit beside them under the NOT YET TRIMMED banner.
  Files previously committed with CRLF are now LF.
- wayback-availability.json: Wayback snapshots exist for 73 of the 98
  failed URL slots; input for an archive-fetch pass.
- README-START-HERE.md: progress note and next step.

verify_all.py PASSES (1836 checks).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GZZENdTLzNGsbNy4DyF1yt
2026-09-05 15:02:39 +02:00

115 lines
9.0 KiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
================================================================================================
CASE 403 | Male cryptocurrency holder | June 17, 2024 | UK
================================================================================================
DATABASE RECORD
id 403
date June 17, 2024
original_date June 17, 2024
year 2024
month 6
quarter 2024-Q3
victim Male cryptocurrency holder
location Hoxton, East London
country UK
scenario Authority Misuse
description Three teenagers from Sheffield traveled to London June 17, 2024, posed as delivery drivers to invade Hoxton flat, threatened victim with large knives demanding cryptocurrency.
kidnappings 1
violence_torture (null)
drugs_alcohol (null)
weapons 1
theft 1
life_taken 0
money_wanted $4.3 million in Crypto and a BMW X3
coin_type Crypto
reports Decrypt
notes They were caught in under three hours, undone by their own social media posts and Britain's surveillance infrastructure.
has_processed_date 0
created_at 2026-02-10 14:45:48
AI SUMMARY [generated at bulk import, NOT verified against sources]
**Victim:** Male cryptocurrency holder, Hoxton flat, East London. Identity never publicly disclosed by Metropolitan Police. Forced to transfer crypto from two Ethereum addresses. Linked to crypto data breach that exposed wallet holdings and physical address.
**Attackers:** Three teenagers from Sheffield, England. (1) Faris Hassan (also known as "Faris Ali," "Zay," "Tommy"), age 17 at time of attack, now 18. (2) Mikyle Bethune, age 17 at attack, now 18. (3) Unnamed male, age 16 at attack, now 17 (identity protected—minor laws). Blockchain investigator ZachXBT identified ringleader via chat logs showing pre-robbery planning; suspect inadvertently shared bail documentation photo on Telegram weeks before robbery. ENS domain "farisali.eth" registered post-robbery; on-chain accusation message embedded in Ethereum ledger.
**Attack Method:** Monday, June 17, 2024. Traveled from Sheffield to London (approximately 170 miles). Posed as delivery drivers to gain entry. Ring doorbell footage captured one teen at front door holding parcel while hooded accomplice ran through back gate. Once inside, threatened victim with large knives at knifepoint. One attacker filmed victim during forced cryptocurrency transfers. Stole victim's blue BMW X3. Left scene recording celebratory Snapchat videos while vaping in stolen car. One declared: "New whip and that, yeah" and "Everyone that doubted us, fam."
**Violence Used:** Threatened at knifepoint with large knives. Forced transfers under death threats. No physical injuries reported to victim.
**Crypto Stolen:** $4.3 million (approximately £3.1 million) in cryptocurrency. Also stole victim's BMW X3.
**Status:** Less than 3 hours after burglary, stolen BMW triggered Automatic Number Plate Recognition (ANPR) camera on M1 motorway in Northamptonshire. Multiple police forces coordinated pursuit. All three arrested same day. Stolen cryptocurrency traced and recovered within 72 hours with specialist assistance from Metropolitan Police Economic Crime Command. Returned to victim two weeks later. All three pleaded guilty at Sheffield Crown Court. Sentenced Friday, November 7, 2025
LINKED SOURCES
[url] https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video
[url_2] https://www.youtube.com/watch?v=MhL8q_HJilI
OTHER LINKED SOURCES
[NOT AN ARTICLE] url_2 None — video or social post; recorded as a source reference, not transcribed
https://www.youtube.com/watch?v=MhL8q_HJilI
------------------------------------------------------------------------------------------------
FETCHED ARTICLE 1
Source decrypt.co
URL https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video
Field url
Retrieved 2026-08-06T13:43:06+00:00 via raw HTTP retrieval, deterministic extraction (HTTP 200)
Language unknown
Kept paragraphs headline [0] + 1-21 of 23
Length 4,162 chars
Integrity sha256 18a3be1c424eb176200f7ae2b65aabaa04681b4c0691482158ee586717a2522e
Trimmed trimmed on read-through
Caveat retrieved from a live page on the date above. Unlike text copied
from the spreadsheet, there is no second copy to hash it against.
------------------------------------------------------------------------------------------------
ORIGINAL (unknown, verbatim as retrieved)
UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video - Decrypt
Three UK teenagers have been jailed after carrying out a "wrench attack" robbery in which $4.3 million in crypto was stolen.
Metropolitan Police said the suspects forced a victim to hand over crypto and car keys in a Hoxton burglary.
The stolen cryptocurrency was recovered within 72 hours and returned two weeks later, police told Decrypt.
Three teenagers have been jailed following a "wrench attack" in which $4.3 million worth of cryptocurrency was stolen at knife point.
In a video released by the Metropolitan Police on Thursday, the trio were shown posing as delivery drivers to gain entry to a flat, where they threatened the occupant with knives and demanded his cryptocurrency holdings.
Police said the suspects travelled from Sheffield to London on June 17, 2024, before carrying out the burglary, which was later linked to them through social media footage and vehicle tracking following the theft of the victims car.
The suspects, who were aged 16 and 17 at the time, recorded themselves on Snapchat leaving the scene in the victims BMW, footage police later used to help identify and link them to the burglary.
Officers were alerted when the stolen vehicle triggered an automatic number plate recognition camera on the M1 in Northamptonshire less than three hours later, before the car was eventually stopped on the M6 in Warwickshire following a brief pursuit.
The victims crypto was “recovered within 72 hours and returned two weeks later,” a representative from the Metropolitan Police told Decrypt.
The three defendants were sentenced to a total of 16 years in youth detention after pleading guilty to charges linked to the burglary and car theft. Individual sentences ranged from 46 to 80 months, authorities confirmed with Decrypt.
A minor who police said cannot be named for legal reasons “pleaded guilty to aggravated burglary, possession of criminal property and theft of a motor vehicle.” The minor received 80 months in custody.
The case was "a clear example of how the suspects thought posting their criminal exploits on social media would build them a following, however all it built was the case against them,” Detective Constable Jonathan Leung said in a statement.
Security researchers in the crypto industry say the case reflects a well-established pattern in which attackers bypass technical safeguards by targeting individuals directly, often after identifying victims through leaked or publicly exposed personal information.
These so-called “wrench attacks” have resulted in more than $41 million in losses in 2025, marking a 75% year-on-year incidence growth rate, with France being at the center of the crime wave.
“This isnt a new tactic. Law enforcement, including the FBI, has documented “wrench attacks” for years, where cases where criminals physically target crypto holders instead of hacking wallets,” Andy Zhou, co-founder of blockchain security firm BlockSec, told Decrypt.
The core idea, Zhou explained, is that “its often easier to coerce a person than to break cryptography.”
Most cases begin with information exposure instead of outright violence, he said.
“Data leaks, breached customer records, or publicly available online information can be combined to identify who likely holds crypto and where they live,” he noted.
The most common mistake is overexposure, Zhou said, noting that, “People unintentionally link their real identity, location, and crypto holdings through data breaches, social media, reused phone numbers, or public wallet activity.”
Common risks include single-point custody, where one device or person can move funds immediately, increasing exposure to coercion, Zhou said. He added that warning signs include targeted phishing, unexpected account recovery attempts, SIM-swap symptoms, and unusual contact with individuals or internal systems.
“The practical takeaway is simple,” Zhou said, explaining that, “we need to assume attackers may target humans. Reducing personal exposure and adding friction to fund movements often matters more than adding another layer of cryptography.”
================================================================================================
generated from attacks-export-Gart-website.json + reported_K&R | case 403
================================================================================================