$243M Genesis Creditor Theft (Greavys, Wiz, Box)

Summary

On August 19, 2024, approximately 4,100 BTC (about $243 million at the time) was reported stolen from a single creditor of the bankrupt lender Genesis. On-chain investigator ZachXBT traced the funds and identified three individuals; the investigation contributed to arrests and a U.S. Department of Justice indictment. ^[1][2][3]

Reported method

According to ZachXBT's incident summary, the attackers: ^[1]

• contacted the victim while impersonating Google support using a spoofed number;
• then impersonated Gemini support, stating the account had been compromised;
• induced the victim to reset two-factor authentication and move funds;
• used AnyDesk screen-sharing to obtain private keys.

The funds were subsequently distributed across more than 15 exchanges and swapped between Bitcoin, Litecoin, Ethereum, and Monero. ^[1][2]

Individuals named

ZachXBT identified the three individuals as Malone Iam ("Greavys"), Veer Chetal ("Wiz"), and Jeandiel Serrano ("Box"). ^[1][2] The DOJ indictment names Malone Lam and Jeandiel Serrano and charges conspiracy to commit wire fraud and conspiracy to launder monetary instruments. ^[3]

Outcome

ZachXBT reported that more than $9 million was frozen and over $500,000 returned, with assistance from CFInvestigators, ZeroShadow, and the Binance security team. ^[1][2] Two suspects were arrested in September 2024. ^[2][3] ZachXBT later reported that twelve people were charged in connection with the theft. ^[1]

Bracketed numbers refer to the numbered sources listed below.