A Hamilton teen who stole millions in a historical cryptocurrency theft says he’s learned from his mistakes and wants to put his skills to good use working in cybersecurity.
The 19-year-old, who was 17 at the time of the 2020 theft and cannot be named under the Youth Criminal Justice Act, admitted in court to stealing $48-million worth of cryptocurrency from California-based entrepreneur and Bitcoin pioneer Josh Jones.
“I’m very sorry for everything that happened,” the 19-year-old told a Hamilton court Friday. “Especially Josh (Jones) and his family of him.”
He said he’s learned from his mistakes and wants to move forward in a “positive direction.”
The teen pleaded guilty to theft over $5,000. In a joint submission between the Crown and defence, he was sentenced to time served and a year probation. His probation conditions include not accessing or possessing cryptocurrency.
The teen spent a year in custody before being released on bail under strict conditions, including electronic monitoring. He was given credit for 18 months behind bars.
In sentencing the youth, Ontario Court Justice Joe Fiorucci noted the theft happened in an age of technological advancements that allowed a “theft of such a grand scale” to be committed by a young person. The “highly sophisticated nature of the theft” and its “impact on the victim,” were aggravating factors in the case.
Court heard that the teen and at least one other unnamed accomplice perpetrated a so-called SIM swap attack that allowed them to access Jones’ phone and then email, gaining access to his cryptocurrency. At the time of the February 2020 theft, the stolen Bitcoin was valued at $48.3 million — the largest reported cryptocurrency theft from a single victim.
SIM swap attacks typically involve someone calling up a mobile phone provider and impersonating the victim, getting the company to switch the account to a new phone controlled by the scammer. It can also involve hacking.
In this case, the court did not hear details about how the teen or any accomplices infiltrated Jones’ T-Mobile account. But once they did, they got access to his email from him and were able to get at his cryptocurrency on blockchain.com. Court heard Jones got an alert that his Gmail account had been accessed and soon after saw his Bitcoin missing.
Jones first reported the theft to the Los Angeles FBI, who contacted other police agencies. The investigation involved the Santa Clara County District Attorney’s Office, in the San Francisco Bay Area. Its specialized tech-crime team received tips after news of the theft spread in cryptocurrency circles, including in a since-deleted Reddit post rumored to have been posted by Jones himself.
Hamilton police were contacted in March 2020 after US investigators discovered some of the stolen cryptocurrency had been used to by a unique online gaming name. This purchase led authorities to Hamilton.
Court heard that Hamilton police seized nearly 94 Bitcoin, worth about $2.5 million. Now that the case has concluded police will return the Bitcoin to Jones, said assistant Crown attorney Fraser McCracken.
However, it’s unclear where the rest of the millions in Bitcoin went.
The teen’s lawyer Luka Rados told the court this was a “massive wake up call” for his client.
“There are people online who would think (what he did) was cool,” Rados said, but for the teen it is the source of shame.
The silver-lining is that after his arrest, the teen’s dad returned to Ontario from the west coast, danced out his son and the ordeal has brought them closer.
Rados said the teen wants to apply his talents to work in cybersecurity.
“This is him growing up,” Rados said, adding that pleading guilty is the ultimate sign of remorse.
Rados called the case “historic” and “novel.” It would have been a complex case for court and there were many possible defense strategies, he said, adding that they could have challenged warrants, made applications under the Charter of Rights and Freedoms, called in tech experts, floated the possibility of alternate suspects and argued that the teen was a “dupe or a scapegoat.”
The teen and his lawyer appeared in court Friday by Zoom. Rados gave the court several letters of support from family and a former teacher, highlighting his support of him in the community and prospects at rehabilitation.
The teen is working to “make things right,” Rados said.
Jones did not provide a victim impact statement, but court heard he will be given access to a report that shows where his recovered Bitcoin was moved. Exhibits in youth court cases are not publicly accessible without a judge’s order.
Jones co-founded DreamHost, a successful web hosting provider, in 1996 with three fellow classmates at Harvey Mudd College, a private college in California. In 2013, he sold his shares of it, but has been involved in numerous other ventures. He was one of the earliest investigators in Bitcoin in 2010.
Bitcoin, the most well-known cryptocurrency, is a digital currency that uses blockchain technology that spreads transactions across multiple computers. It’s considered largely secure against hacking, outside of SIM swap attacks where someone scams their way into accessing someone’s phone.
In court Friday one other count of possession of property obtained by crime was withdrawn.
The matter is scheduled to return to court briefly in August to resolve an issue around returning property seized by police. Court heard a substantial number of items were seized when police arrested the teen in Mississauga.
Nicole O’Reilly is a crime and justice reporter at The Spectator. [email protected]