154: Hijacked Line

Conor Freeman (x.com/conorfrmn) https://x.com/conorfrmn stole money online. Lot’s of it. In this episode we talk with him, and hear how he did it, why he did, and what he spent it on. Conor’s website: https://conorfreeman.ie https://conorfreeman.ie/ Conor’s X: https://x.com/conorfrmn SponsorsSupport for this show comes from ThreatLocker® https://www.threatlocker.com/. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com https://www.threatlocker.com/. Support for this show comes from Drata https://drata.com/darknetdiaries. Drata is the trust management platform that uses AI-driven automation to modernize governance, risk, and compliance, helping thousands of businesses stay audit-ready and scale securely. Learn more at drata.com/darknetdiaries https://drata.com/darknetdiaries. Support for this show comes from ZipRecruiter https://www.ziprecruiter.com/DARKNET. ZipRecruiter has solved the hiring problem. Employers prefer it the most for so many reasons. Let’s start by telling you about their matching technology. They work hard to find the best candidates for your needs, and will instantly show you results once you post a job listing. ZipRecruiter will speed up your hiring process. See it for yourself at www.ziprecruiter.com/DARKNET https://www.ziprecruiter.com/DARKNET. Sources https://www.cbc.ca/news/canada/toronto/kidnapping-toronto-businessman-cryptocurrency-1.7376679 https://www.irishtimes.com/news/crime-and-law/courts/circuit-court/man-jailed-for-role-in-2-million-cryptocurrency-theft-1.4411641 https://www.irishtimes.com/news/crime-and-law/dun-laoghaire-man-could-face-108-year-us-prison-term-over-alleged-hacking-and-wire-fraud-1.3887715 https://www.sundayworld.com/crime/irish-crime/irish-authorities-to-transfer-2m-in-stolen-cryptocurrency-back-to-us-owners-after-cab-probe/40576219.html

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  I just heard about this thing called KNR Insurance. I didn't even know this was possible. KNR stands for kidnapping and ransom. If you think you're a likely target for kidnapping and people are going to hold you until you pay a ransom, then this might be worth buying. Why do I know this? I just ran across an article that said a guy was kidnapped in Toronto and held for ransom. They wanted him to pay a million dollars and then they'll let him go. And I think he paid it and then they dumped him off at a park and they sped off. Why did they kidnap him? Because they knew he had cryptocurrency, a lot of it. He was the founder of a crypto-based startup. And if he didn't have the money, surely his company did. Well, at least that's what the thieves thought. And they were right. Scary stuff.

• 0:48Jack Rhysider?

  These are true stories from the dark side of the internet.

• 0:55Jack Rhysider?

  I'm Jack Resider. This is Darknet Diaries.

• 1:16Jack Rhysider?

  This episode is sponsored by Black Hills Information Security. Black Hills InfoSec loves sharing their knowledge through free webcasts, blogs, zines, comics, and courses designed for beginners and those more advanced. Through their anti-siphon training, they teach you the cybersecurity skills you need, from SOC analyst tools and methodologies to setting traps and running deception operations. It's hands-on, practical training built for people who want to advance and hone their skills. The world of cybersecurity has changed a lot in the last year, and every day seems to bring new questions about what comes next. And that's why anti-siphon training is hosting a free summit on December 9th, asking what in the actual cyber happened in 2026?

• 1:58Jack Rhysider?

  Join experienced practitioners as they share practical lessons, real-world experiences, and insights into the top security news of 2026. And because you're a Darknet Diaries listener, they've got a little something extra waiting for you at blackhillsinfosac.com/darknet. Go to blackhillsinfosac.com/darknet.

• 2:24Jack Rhysider?

  This episode is sponsored by Arctic Wolf. Everyone is slapping AI-powered on their security tools. But Arctic Wolf took a different approach. Instead of duct taping AI onto the SOC, they rebuilt the SOC around AI and called it the Aurora Super Intelligence Platform. If you ever tried to build your own AI pipeline, you know the pain. Data engineering, model tuning, governance, validation. Aurora removes all of it. You deploy it and instantly inherit the intelligence, guardrails, and operational maturity of one of the world's largest agentic SOC. Under the hood, Aurora is running a fully agentic architecture. They call the Swarm of Experts. These agents are battle-tested inside the world's largest commercial SOC and only ship when they can outperform human-only workflows.

• 3:09Jack Rhysider?

  And its integration is seamless as Aurora works within Arctic Wolf's concierge experience, allowing your security team to focus on higher-value strategy and proactive risk reduction. If you want to see what a real trustworthy agent-led SOC looks like, not the marketing slide version, go to arcticwolf.com/darknet. That's arcticwolf.com/darknet.

• 3:34Jack Rhysider?

  Let's see, what are you using for a mic here?

• 3:36Speaker 01

  Steel Series headset is a bad.

• 3:38Jack Rhysider?

  It sounds good.

• 3:39Speaker 01

  Yeah, perfect.

• 3:41Jack Rhysider?

  So are you ready to tell us about the worst time of your life?

• 3:45Speaker 01

  Yeah.

• 3:46Jack Rhysider?

  It always seems so weird to me to be digging into stories like this because it is probably a hard thing to talk about, isn't it?

• 3:53Speaker 01

  Yeah, it is. Especially when it just happened. But I mean, it's been four or five years now. So I've kind of overcome it at this point.

• 4:02Jack Rhysider?

  How old are you now?

• 4:03Speaker 01

  Twenty-five.

• 4:04Jack Rhysider?

  Okay, so I bet all this started in a video game somewhere, didn't it?

• 4:10Speaker 01

  Yeah, yeah, it did.

• 4:12Jack Rhysider?

  What game was that?

• 4:13Speaker 01

  You're right. Minecraft.

• 4:15Jack Rhysider?

  Okay, I was gonna guess Minecraft or Roblox.

• 4:18Speaker 01

  Yeah, you know, there's actually, they're both involved at certain points throughout the story. So that was a fantastic guess. Yeah, so it was really Minecraft where I got into everything. Ever since I was younger, I've always had an obsession with computers and technology. And I was always kind of reserved when I was a kid. So a lot of the time I spent online and on computers and on video games. And in my younger years, that was Minecraft specifically.

• 4:47Speaker 01

  So yeah, I used to play Minecraft multiplayer servers.

• 4:51Speaker 01

  One day I just got bored and I decided to just join a server and start messing with people. Which I I cruelly took enjoyment of at the time.

• 5:01Jack Rhysider?

  So messing with, is that like uh grieving?

• 5:03Speaker 01

  Just, yeah, grieving, that's the term, exactly.

• 5:05Jack Rhysider?

  Yeah, so uh i- is that using in-game mechanics to just screw with them, or were you doing more than that?

• 5:10Speaker 01

  In-game mechanics, yeah, just to mess with them. Um, or just trolling them in the chat, like a little kid. But um. Yeah, I was doing that for a while, uh I had eventually joined one server. And I had seen this other player on the server teleport into blocks. So Minecraft's obviously made of blocks, this guy teleported a couple of blocks downwards. And I was impressed, I didn't know what he was doing. So I think he kinda knew that I was I was messing around with the server, he was doing the same thing. So I had messaged him, private messaged him at the server, and we ended up talking on Skype. And uh that that was the beginning of everything, really. This is back when I was probably eleven or twelve years old.

• 5:54Jack Rhysider?

  So so this is where you start learning uh uh like glitches and hacks of some kind?

• 6:00Speaker 01

  Yeah, so this guy was a programmer, he he was a a Java programmer. But he had his own custom coded client on Minecraft that he used to carry out various exploits or little glitches. Um, and we had eventually, I'd eventually befriended him and and we would go on these servers together and mess with people. Just just for fun, uh because we enjoyed it. Uh but alongside programming in Java, he was also partaking in social engineering. Um, that time I had no idea what it was until he introduced me to it. So we would join servers, we'd mess with the admin of the server, so the owner. And there was one, at one point, the first time it happened, we had joined this server.

• 6:43Speaker 01

  He was talking to the admin kind of in a friendly way. And then eventually, a couple of hours later, he logged into the admin's account on Minecraft on the server and took it over and deleted everything. And I had no idea what was going on at this time.

• 6:55Jack Rhysider?

  Let me give you a little bit more context. Minecraft is a game where players can create their own servers with unique content and stuff. And sometimes you even need to pay to play on some of these player-made servers. And somehow, this guy was able to find the person who's the administrator to this Minecraft server, access their account, and delete the whole server. What?

• 7:14Speaker 01

  I eventually had figured out he socially engineered the admin of this server into giving him the two answers to his secret questions on his Minecraft account, reset his password, logged in, and destroyed the server.

• 7:25Jack Rhysider?

  Oof, the admin got pwned. No more Minecraft server. Now it's a time to take control of someone's Minecraft account. You had to log into Mojang's website, the creator of Minecraft. And what you needed to do is have the username and password. But if you didn't have the password, you could reset the password if you knew the answers to the two secret questions, like, what was your first car and who's your sixth grade teacher? And since he watched his friend do this, he wanted to learn how to do it too.

• 7:51Speaker 01

  So for example, let's say the admin's secret question was, what's your first pet's name? Second question was, what's your hometown or what school did you go to? The second one's no problem. You can easily find that out. Simple Google searches. The first question is a tough one. So what we used to do is, say, we'd join a server. We'd find the admin, we'd target him. And we'd know his first question was, what was your first pet's name? So we'd say, or I would say in the chat, oh, my little kitten died today. Buttons.

• 8:22Speaker 01

  Have you ever had any pets before? And we'd try and get talking to the admin. And try and get him to divulge the answers to that question. So I'd say, what was your first pet's name? Unbeknownst to him, here I am, typing it out, putting it into his Mojang account, getting ready to reset it. And that was the first experience of socially engineering someone.

• 8:41Jack Rhysider?

  This is Conor Freeman. By the way, I should have probably introduced you to him earlier, but I forgot. He liked the sense of power that these little hacks gave him. When you get control of a server like that, you become unstoppable. You have full control of the server now and you can delete it all if you wanted. And there's something alluring about that, that sense of power. But to me, it's quite a funny power dynamic. A TV show I really like, I think it's hilarious. It's called Trailer Park Boys, and it's about life in a trailer park. But the thing that intrigues me about the show is the immense power struggle that's going on in this trailer park. Like, there's a huge clash between the park supervisor and a couple of guys who are always scheming to make money off of other people in the park. And then there's some drug dealers that live at home with their mom. I mean, there's a power struggle right there.

• 9:24Jack Rhysider?

  And then there's a guy who doesn't even live in the trailer park, who comes by to try to assert his dominance over the park. It's this incredible battle for power. All for what, though? To get the respect of the people in the trailer park? It just seems so meaningless on the grand scheme of things. But they take this tiny trailer park so seriously, as if it's their whole world. I like it maybe because I grew up in different trailers myself, so I can relate. But it just makes me think that there's this huge battle going on over a Minecraft server that a few hundred people play. And it's all taken so seriously, too. Anyway, after a while, Minecraft hacking got old to Connor, and he was wondering what else is out there to mess around with. And he found some hacking forums, which explained all kinds of new stuff he could do.

• 10:08Speaker 01

  Yeah, a lot of social engineering things. Like, back in the day, people used to do refund scams. So say you'd order something on Amazon. You'd get onto Amazon after it's said delivered on Amazon and say, "It hasn't arrived. Someone might have stolen it off my porch," or something like that. You'd get a refund and get your money back. That was a huge thing back then. It still is now, but it's a lot less prevalent because Amazon had kind of caught on. There was other kind of scams and schemes. People would do return programs, did scam return programs. So Steel Series was targeted a lot back then. You could basically create a support ticket to say that you've bought a pair of Steel Series headphones. "They're not working. Can I get a return?"

• 10:51Speaker 01

  And they would send you out a free headset, and they wouldn't ask for anything in return. The only thing you had to do was send them a picture of the headset or a serial number, which you could source from eBay or some kind of online marketplace where people are reselling them.

• 11:03Jack Rhysider?

  Hold on, Connor. You're using a Steel Series headset right now?

• 11:09Speaker 01

  Yeah, no, I paid for this one.

• 11:11Jack Rhysider?

  Okay.

• 11:12Speaker 01

  Yeah, it's not from back then. I mean, this is a long time ago.

• 11:15Jack Rhysider?

  So refund scams were becoming a thing back in 2018 or so. There were instructions on how to do it, but some people did not feel comfortable calling up somewhere and lying to someone to try to convince them that you want a refund. So there were actually people you could hire to do it for you.

• 11:31Speaker 01

  Exactly. So that was the makeup of it. Essentially, you'd order, and that was, Apple products were huge. So essentially, you'd order something. You'd have a, you'd order something, you'd go to a refunder. They were called on the forums and you would say, hey, I ordered a MacBook for $1,200. Can you refund it for me and I'll give you 20%? So the refunder would log into your account or they'd call Amazon and pretend to be you. And they'd execute this kind of scam on Amazon. They'd socially engineer the rep into believing that the item was never delivered. They get a refund for their customer and then they get 20% of the total order value. And that was a huge thing on that forum, like there were so many people doing it.

• 12:12Jack Rhysider?

  So you would pay a scammer like $200, $400? And then that's how you'd get your MacBook?

• 12:18Speaker 01

  Yeah, exactly.

• 12:20Jack Rhysider?

  Instead of paying a full price for it? Hmm. Okay, what other, what other ways to make money? What were kids doing those days?

• 12:28Speaker 01

  There was a lot of cracking services, which are still around now. But again, cyber hygiene has gotten better and as well as that service's security has gotten better, thankfully. But back then, you could crack most online accounts like, what's an example? Like Hilton Hotel was a massive one. People that had Hilton accounts that stayed a lot in Hilton Hotels, you'd build up these points and you could spend the points on free rooms in Hilton branches worldwide. So what people would do is crack these accounts. They'd load up a massive list of usernames and passwords and try them against the Hilton login page. Try and land a few accounts that had points on them and they'd then resell them on these forums to, to people looking to.

• 13:13Jack Rhysider?

  This one, this one always surprised me because if, if I go on there and I buy a Hilton account with a ton of points. And I actually go to the hotel and I stay there with these stolen points, like I'm in the room.

• 13:27Speaker 01

  Yeah.

• 13:28Jack Rhysider?

  If they wanna like say, hold on, this is some stolen points.

• 13:31Speaker 01

  Yeah, looking back on it now, it's insane, but I myself would never do that because like just this stupidity of it. If somebody, if that person who owned that account was to call up Hilton and say, look, I didn't book this room. Like you're one phone call away from somebody knocking, knocking on the door and saying, hey, this isn't your account. And you're, you've stolen this room. So, uh, but people got pretty brave with it. Like people didn't care. Pizza Hut was another big one. So you'd order pizzas and you'd build up points and people would then try and crack your Pizza Hut account. And you could use these points to get pizzas on other people's accounts and you'd just walk into the store, use their points and walk out with a free pizza.

• 14:07Jack Rhysider?

  Uh, yeah, it, it reminds me of pizza plugs as well.

• 14:10Speaker 01

  Yeah, but pizza plugs are slightly different. They're mostly carders. So they're, they're credit card fraudsters. So they'd use stolen cards and order the pizza for collection or delivery.

• 14:19Jack Rhysider?

  A pizza plug is where you find someone who will give you really cheap pizzas, like for five bucks, they'll send you three large pizzas or something. And what they're doing is they're using a stolen credit card to order the pizzas to be sent to you. And then you just pay them like five bucks for it.

• 14:32Speaker 01

  But again, that's insane because you're associating stolen card details with your own address. If you say you get it delivered with a stolen card, like not the brightest.

• 14:43Jack Rhysider?

  Um, cook groups, is this, is this a thing?

• 14:48Speaker 01

  Uh, cook groups in terms of like clothes online?

• 14:52Jack Rhysider?

  Yeah.

• 14:53Speaker 01

  Yeah.

• 14:57Jack Rhysider?

  Funny, it's about the clothes, but it's called cook groups.

• 15:01Speaker 01

  Cook groups. Yeah, it's funny you mention that because I used to be hugely into fashion. I still am now, but not as much as back then. So. Cook groups essentially would be groups that they would employ bots, so someone would create a macro. So I don't know if you're aware of what Supreme, I'm sure you are, Supreme or say Palace, they're world widely popular streetwear brands. They have weekly releases or bi-weekly or whatever way they do it. So they release a very limited amount of stock on a certain day at a certain time. So it's very hard to guess, especially items, certain items like box logo hoodies or something like that. So people would create these macros or scripts that would automatically log them into the Supreme website. They'd buy these clothes instantly before anyone else put and then resell them.

• 15:44Speaker 01

  That that's a part of the cook groups or they would, people would put their names on an item and someone would bought it for them and resell it to them at a marked up price.

• 15:53Jack Rhysider?

  Yeah, it's kind of like scalping concert tickets.

• 15:56Speaker 01

  Yeah.

• 15:56Jack Rhysider?

  So is this, is there anything illegal about cook groups?

• 16:00Speaker 01

  No, I'd not, not from what I'm aware of. Sure.

• 16:03Jack Rhysider?

  Yeah, I didn't, I didn't notice that either.

• 16:05Speaker 01

  In terms of legality, no.

• 16:07Jack Rhysider?

  But it is kind of an underground culture there, right? You gotta find a group and and sometimes it's the wrong group you're in and those guys are just there to rip you off. So you gotta find a trustworthy group that actually has, has these orders or whatever you're looking for.

• 16:20Speaker 01

  Yeah, that's the hard thing. A lot of these people aren't trustworthy because what they're doing is isn't trustworthy in itself. So it's hard to find someone that's actually gonna pull through.

• 16:30Jack Rhysider?

  Yeah, it's, it's, it's amazing to me how big the, uh, the hidden parts of the internet are and all these things going on at once. And we never see it as just like a common internet user. You never see any of this. How are you discovering all these different places on the internet?

• 16:45Speaker 01

  Um, but through this forum, so the forum was massive. I don't really wanna say the name of it, but, um, it was probably one of, so Hack forums was one of the forums that was around a long time. I think it's been going for fifteen years, maybe a little less than that. Um, that would be the oldest kind of clear now hacker forum that I'm aware of. This forum that I was a member of kind of branched off of Hack forums because the, the admin of Hack forums was, I think it was kind of a well-known fed. People didn't really like him. And he was really stringent on the rules on that website. So this forum that I was on kind of branched off of Hack forums and allowed for more

• 17:21Speaker 01

  black hat or gray hat or unethical methods. So all of the, the scumbags that weren't allowed to advertise their services on Hack forums kind of moved over to this forum that I was a part of. So I mean, there was a huge range of services offered because there were so many people on it.

• 17:37Jack Rhysider?

  Well, you call them scumbags. But you were one of the users.

• 17:41Speaker 01

  I was one of them, yeah.

• 17:43Jack Rhysider?

  What do you get dabbling in? What's kind of the first, like, money you're making in this kind of world?

• 17:52Speaker 01

  Thinking back, so Xbox ran a promo a long time ago, or Microsoft rather. They ran a promo, I think it was a collab with Skittles or something like that. So they still do it now with Mountain Dew and Doritos. Like, you buy a bag of Doritos and they'll have a code on the back of it and get double XP or something for Call of Duty. But way back when, there was a promo that was ran with, I think it was Skittles, where you'd buy a pack of Skittles, input the code on the back of the pack of Skittles, and you'd get a free seven-day membership or a 14-day membership on Microsoft Live. But there was people that had scripts or macros that were brute forcing this code. So you just set up the script, brute force the code, throw hundreds and thousands of it against it, and you would eventually just keep racking up free membership codes

• 18:36Speaker 01

  because there was no rate limit or anything on the website. So you could just get like 50 to 100 to even more thousands of these 14-day Xbox codes. But I eventually got my hands on that script. So that was probably the first money I made when I had that script. I had it running, and then I was reselling these membership codes for like probably five or $10 apiece to people on the forum, on eBay and online marketplaces.

• 19:02Jack Rhysider?

  When I was young, I discovered a way to get free Audible books. So so far, I'm with you, right? I was hanging out in shady chat rooms, grieving people in video games too, and getting free stuff. But I think this is where our paths are about to diverge.

• 19:24Jack Rhysider?

  All right, so this was making a few bucks for you, but not very much because you were just learning. What were you like, 14 years old then?

• 19:32Speaker 01

  Uh, probably thirteen or fourteen, yeah, which is insane looking back. After a while of being on this forum, I kinda got bored of it. I I kinda, I was had a relationship with the admin. We talked back and forth and I, I think he kinda annoyed me one day. So I just quit that forum and luckily for me, or unluckily, looking back, there was a new forum that opened up called OG Users. Um, which was an online marketplace where people would buy and sell OG original usernames. So say at Jack on Instagram or at Jack on Twitter. And they'd buy and sell these different usernames for hundreds of thousands of dollars. Um, and that was my next venture then, getting into acquiring these usernames.

• 20:15Jack Rhysider?

  So Jack on Twitter is Jack Dorsey, the original owner of Twitter. Good luck getting that one. But the thing about OG Users that I think is worth pointing out is, is half of them were fine and legit reselling, and then half of them were social engineered stolen accounts. Would you consider that to be true?

• 20:31Speaker 01

  I'd say it's a lot more skewed. I'd say it was probably ninety five, five, ninety five percent stolen, five percent, if even that genuine.

• 20:40Jack Rhysider?

  So if you're not aware, OG Users is a place where people are selling usernames. That is Twitter accounts, Instagram accounts, Snapchat accounts. Why? Well, because we all hate it when we go to register at one of these places and someone has already taken our name. And so some people would pay extra for an account with a cool name. The problem is the stuff for sale on this site is often stolen accounts, where people would hack into that account, get control of it, and then sell it on this site, OG Users.

• 21:08Speaker 01

  Yeah, so I had a bit of crypto. I discovered Bitcoin back when I I dabbled in the other things on on the other forum. But I had an understanding of what crypto was, so I I had a bit of Bitcoin. And I had bought a username one day on Twitter. I can't remember the exact handle, but I bought it to resell it. I held it for a couple of weeks, put it back up for sale and I made a couple of hundred on that. So that was my first venture into buying and selling the usernames.

• 21:36Speaker 01

  I didn't last long though buying them. That's when it turned into me then stealing them or

• 21:44Speaker 01

  being introduced to people that were stealing them and I'm kind of falling into that.

• 21:47Jack Rhysider?

  What was your method for stealing usernames?

• 21:49Speaker 01

  Breached databases were a huge thing back then. I know they're even bigger now, but a lot of people didn't know how to use them, utilize them, or how to find them. So there were services where there still is now, I'm sure, but there were services where you could search someone's username or email and pull their data from a breached database, like their password, username, full name. So what I was doing was doxing these account holders. I would find their email. I'd search the email through the breach databases and then find their password and I'd try my luck at logging into the the account with that password. And because not many people were doing this at the point, I had quite some success with that.

• 22:29Jack Rhysider?

  Probably, probably most of these were just crappy usernames though, and you just didn't even care and you just logged back out?

• 22:35Speaker 01

  Yeah, a lot of them were. Yeah, it was more the thrill of of being able to find the password and log in or sometimes you'd get a password that's incorrect or you might add an exclamation mark or an at or something at the end and that would be the correct one. And you get a bit of a thrill out of that. But yeah, most of them weren't anything amazing.

• 22:51Jack Rhysider?

  Yeah, I imagine that's a big thrill to be like, yeah, nope, wrong password. And then you're like, what if I add an exclamation point? And then bang, you're in. Oh my gosh, I'm brilliant. I'm a genius. I'm the best hacker in the world. Look at me.

• 23:04Speaker 01

  Yeah, you feel like a genius.

• 23:06Jack Rhysider?

  This allowed you to acquire some, Twitter and Instagram were your main things?

• 23:11Speaker 01

  Twitter and Instagram, yeah. I mean, they're still the main ones now. They're the most popular social medium. So that's what people would go for the most.

• 23:20Jack Rhysider?

  Connor was making some scratch from all this, all in Bitcoin, of course. Looking through database breaches, finding passwords that would work on Twitter, then stealing those usernames and selling them. Okay, so roughly, how profitable was this for you, selling OG users?

• 23:36Speaker 01

  I don't know. I couldn't quantify a figure. Probably. Twenty or thirty thousand dollars now, probably a lot less. See, I didn't really get into it that deep.

• 23:46Jack Rhysider?

  He built up a reputation for having quite a bit of usernames for sale on OG users. It was going well, but then something else caught his attention, something so much bigger that eventually made him lose interest in OG users altogether. The thing he saw some people doing was SIM swapping.

• 24:02Speaker 01

  Yeah, so it would start with a target. You'd dox the user. You'd use various different methods of getting all their information, so their full name, address, phone number, their SSN. There's a certain website that you can buy credits on and input someone's first and last name and get their SSN. So you'd have all that information and then you'd... Back in the day, it was a lot simpler than it was now. So say if you were on T-Mobile, I would call up and say, hey, my name is Jack Rhysider. My last four of my SSN is one, two, three, four. I've just lost my phone and my SIM card is inside it. I have a replacement SIM card here. If I give you the ICCID, can you swap my SIM over to this card? And the agent would happily do it. And once that's done, your phone number is now mine.

• 24:47Jack Rhysider?

  Your phone number is now mine. I just think about how scary that sounds. If someone can take your phone number from you, they can pretty much become you. So much of our identity is tied to our phone number. Yes, they can text the people you know as you. They might be able to call your bank and pretend to be you. But perhaps the scariest is that they can often recover some of your accounts. Like if you have a Google account and you go there and say, oh, I forgot my password. They might have an option to text you a code to confirm it's you. And they text you thinking, nobody in the world is going to have access to your phone except you, right? Which you can use to reset a Google account. And now you have access to their email, drives, photos, and maybe even their YouTube channel and more.

• 25:32Jack Rhysider?

  And once they have control of your main email account, they can just go through and reset your other accounts. Say you lost your Twitter password. It'll say, okay, no problem, let's email you a new one. And so now they can get into your Twitter too. And this whole thing hinges on whether or not you can convince the T-Mobile customer service rep that you really did lose your phone and to get them to switch SIM cards for you. So were some carriers easier for you than others?

• 25:57Speaker 01

  Yeah, T-Mobile by far was the easiest. It was insane. You'd get it. Sometimes you'd have to brute force these calls, so you'd have to call ten or fifteen times until you get an agent who just doesn't care enough and he'll just swap it. T-Mobile was insane. You'd just make one call and they'd do it willy-nilly, happily, just swap the SIM. Uh, AT&T was definitely the hardest and then Verizon, I'd say was in the middle. Sprint as well, although not many people used it. Sprint was another one. And then I think Cricket is what it's called. Cricket and Sprint were pretty easy too. But as it got harder, people started to look into exploits on the actual websites of these uh, these carriers. So there's a couple of well-known exploits in AT&T and T-Mobile

• 26:41Speaker 01

  that people would use to either retrieve the PIN off someone's account or remotely swap the SIM to themselves or or pull their information or whatever else.

• 26:50Jack Rhysider?

  It's crazy to me how in-depth of knowledge you have of this, right? You you understand wireless carriers of the world and SIM cards and the usernames and passwords and computers skills are just going higher and higher. And yet you you have to go to like, I don't know, history class and learn, learn about the war and stuff like in the afternoon and then go back to like this crazy technical stuff. It, did it, did it feel like you were living two different worlds?

• 27:19Speaker 01

  Yeah, definitely. And nobody knew about it in in my, my personal life.

• 27:26Speaker 01

  So it, and that was the thing. You kind of have this detached personality where where in person you're a completely different different guy. And then when you're online, it's like your, your brain is in a different place. So you completely dissociate from from your real life. So it's like two separate personas that you have. It was like that the whole time.

• 27:44Jack Rhysider?

  Yeah, I mean, it it's also interesting to look at maybe some of the other kids in school who are trying to build up their social media, right? And you see these people are on Instagram and you're like, all right, so you've got like, you know, three hundred followers. I can get your account by this afternoon with a million followers. Like, what's the, what's the deal here? There's no, there's no game. And I don't, how did you, like, did you ever look at that like that, like? Look at these fools.

• 28:07Speaker 01

  Yeah, it was actually exactly that. I mean, when you're young and impressionable like I was, I I thought I was on top of the world and I was way smarter than everybody else. So I would kind of look at them and be like, oh, you're an idiot. How do you not like know what I know? Or how are you so impressed or whatever?

• 28:25Jack Rhysider?

  Well, you had to know that you had to know that what you were doing is not exactly the straightforward way to do things. It's the back way, uh, wrong way and it works way, but it's not exactly the way you're supposed to do.

• 28:37Speaker 01

  Yeah, yeah, of course.

• 28:38Jack Rhysider?

  I mean, it's hard to know that though, right? The ethical compass is quite, isn't quite as aligned as it should be because when you go online, this is all you see, right? And it's kind of like, if you, if, if you really want to get married and you go online and all you see is other people getting married and other people's engagement photos and their marriage and all this stuff. And you're just like, ah, I want to get married so bad. And and it's like all you see, right? And so it's like, everyone's getting married but me. And so when you go online, you're just like, dang, everyone's getting paid but me. I gotta get paid too, because this is all you see. Your mind is kind of tuned into it.

• 29:10Speaker 01

  Yeah, exactly.

• 29:11Jack Rhysider?

  And so it's hard to know exactly what is right and wrong in this world when everyone's around you is doing this stuff. And it's like, okay, I'm not even gonna ask if this is legal or not, but if you guys are getting away with it, I guess it's not so bad.

• 29:25Speaker 01

  Yeah, there is no, there's no forethought of illegality, or at least back then, because it was, like I said, it was completely separating the real world from a computer screen. So you wouldn't even be thinking of legality because it wouldn't be an idea or a thought in your head because you're in this this other world essentially.

• 29:44Jack Rhysider?

  Quite often people come to me in a panic telling me that someone just took over their Instagram, Twitter or Facebook account and they can't log in anymore. And they ask me, what should I do? And unfortunately, I don't have a good answer. I mean, you can open a ticket with that site and ask for help, but because the site is so overwhelmed with help tickets, it's likely that your ticket gets ignored. It's as if their support team doesn't exist. But really, that's like the only option I have. Go through support to get it back.

• 30:15Speaker 01

  I would tell them to go on LinkedIn, sort by company employer and look through all the, uh, the people that work at Twitter and Instagram and just message them all on LinkedIn and hope someone sees your message and helps you out. That's probably the only way it's happening.

• 30:29Jack Rhysider?

  Yeah, but but it does sound like the other way is to go is to go get hire a hacker to get it back as well.

• 30:35Speaker 01

  Yeah, hack it back.

• 30:35Jack Rhysider?

  I'm never gonna recommend that, but that if, gosh, that sounds like the more likely way to get it back.

• 30:43Speaker 01

  I'm sure it's just all for a lot of people, yeah.

• 30:45Jack Rhysider?

  So up until now, the reason why Connor would do a SIM swap was to steal someone's Twitter or Instagram account. So he could sell it on OG users. There was this direct connection between SIM swapping and making money selling users. Granted, it's criminal, but he didn't care. But then he started learning about cryptocurrency. By the time you start doing your first SIM swap for crypto, how old are you?

• 31:11Speaker 01

  Must have been seventeen, sixteen or seventeen.

• 31:14Jack Rhysider?

  So were you out of school by then?

• 31:16Speaker 01

  No, I was, would have been still been in school.

• 31:18Jack Rhysider?

  Okay.

• 31:19Speaker 01

  It was my last couple of years of school.

• 31:21Jack Rhysider?

  Yeah, you you're doing that sort of thing. Do you have extracurricular activities at school that you're doing stuff to?

• 31:26Speaker 01

  No, nothing.

• 31:27Jack Rhysider?

  As soon as school's out, you're like, I'm going straight home.

• 31:29Speaker 01

  Yeah, exactly. That's if I, that's when I went to school.

• 31:33Jack Rhysider?

  That's where all my friends are. My friends are home. Why would I go somewhere else?

• 31:36Speaker 01

  Exactly.

• 31:38Jack Rhysider?

  So you go home, you log into the chat app, whatever it is, like you, like you just said. And you just sort of like, what's the crack? What's everyone up to?

• 31:46Speaker 01

  Yeah, we're going to forums and trawl around and see what's going on that day.

• 31:52Speaker 01

  But yeah, we.

• 31:53Jack Rhysider?

  And what would some of these stuff you'd see?

• 31:57Speaker 01

  Um, just the marketplace is really and what people are up to and what's happening in the, the kind of community that I was in on these forums.

• 32:06Jack Rhysider?

  I mean, was it addicting to the point where you're like, I have, I wanna check to see what's going on, I wanna see what's going on, I wanna see what's going on? Or was it like, no, I'm going home to play video games and I'll check on it maybe Sunday night?

• 32:16Speaker 01

  Yeah, well, see, I would game and and look at it intermittently, so I I would game a lot. I would sometimes game with these people and then I would, I would check back on the forums or check in with the other people and see what's going on.

• 32:27Jack Rhysider?

  Counter-Strike. You moved on.

• 32:29Speaker 01

  Yes, go, yes.

• 32:30Jack Rhysider?

  I knew it.

• 32:33Speaker 01

  Yeah.

• 32:36Jack Rhysider?

  All right, and you're griefing on Counter-Strike, I bet, too, with your own teammates?

• 32:40Speaker 01

  Yeah.

• 32:42Speaker 01

  Yeah, exactly.

• 32:44Jack Rhysider?

  Oh, I hate you. The thing about crypto is you have to secure your own. With traditional money, a bank will secure your money for you. And if they get robbed, they're insured, so they still have your money. But that's not the case with cryptocurrency. People have to stand up their own security. And some people are worse than others at this. And Connor's friends were starting to go after people for their cryptocurrency instead of their usernames. Because stealing their cryptocurrency is way more valuable than stealing their usernames.

• 33:15Speaker 01

  Someone had messaged me, I think they'd sent me like a Blockchain Explorer link of their wallet. And I had like maybe 10 or 15 Bitcoin. And I messaged them back like, how did you do this? Like, how did you get this money? And then they they kind of introduced me into SIM swapping for crypto then. And that's where it all started.

• 33:34Jack Rhysider?

  Oh, yeah, we're 30 minutes in. And now we're going to get started. But we're going to take a quick break first before we do. Stay with us.

• 33:43Jack Rhysider?

  This episode is sponsored by Vanta. As AI adoption grows, so do your company's security risks and requirements. New frameworks, audits, and vendors keep piling on. But your team isn't getting any bigger. Most compliance tools promise automation. But you're really just stuck doing all the work by hand, chasing screenshots, validating controls, and playing catch up when audit season comes around again. Vanta works differently. Their Agentic Trust platform is built to scale with you, not slow you down. With over 1,400 automated tests across 400-plus integrations, Vanta collects evidence and monitors your controls year round, cutting your audit prep by 82%. Plus, you can access the Vanta agent anywhere you work,

• 34:25Jack Rhysider?

  whether your team is in Vanta every day or living in tools like Claude or Cursor. You want proof? Over 16,000 fast-growing companies like Ramp, Ryder, and Harvey save time and resources while scaling fast with Vanta. Learn more at vanta.com/darknet. That's spelled V-A-N-T-A, vanta.com/darknet.

• 34:50Jack Rhysider?

  Connor was adept at SIM swapping and Bitcoin and now was ready to combine the two.

• 34:57Speaker 01

  I kind of joined calls with these guys and I'd be witnessing them carrying out these heists while I was in the call and then I kind of ended up getting involved. The first one, I can't remember, I'm sure it was someone on Twitter that was parading about having crypto and they were chosen as a target.

• 35:15Jack Rhysider?

  Yeah, step one of robbing someone is to figure out who to rob. He's got the skills to get into someone's account if he knows their phone number and stuff. So now he just needs to figure out who are the people with a lot of crypto out there? And then try to target them.

• 35:28Speaker 01

  So my main role throughout the whole thing really was seeking out people with crypto, doxing them and then sharing this information. And then my other group members would carry out the SIM swap process. And sometimes I would help with that, sometimes I wouldn't. So my role was really the pre-attack ocean, though, to say.

• 35:50Jack Rhysider?

  Since he was in Ireland, it was harder for him to navigate the whole SIM swap aspect since a lot of targets had American numbers and stuff. So his job was to find the people who had crypto. And really, it wasn't that hard.

• 36:01Speaker 01

  A big thing was Twitter, obviously, a lot of people in the crypto community are active on Twitter. So sometimes people would post stupidly, or not stupid, really, really, they should be allowed to post their wallet balance. But people would post their wallet balance on these social media sites, Twitter, for example, stating that they had 100 Bitcoins or something like that. And then they'd instantly become a target for us or for other people doing the same thing. Another thing was altcoins. So people who create their own crypto, we would target. They typically be teams of 10 or 15 people that would always have a CEO and a CFO. So they were the two roles that we would target. The CFO is obviously the chief financial officer, so they're normally in charge of the assets.

• 36:44Speaker 01

  And then the CEO would have a big stake in the actual altcoin. So we would normally target people either on Twitter or target these these team members of up and coming altcoins.

• 36:54Jack Rhysider?

  If you have crypto, the first step in securing it is to not let anyone know you have it. Because if it's not Connor and his lads coming after you, it'll be North Korea coming after you, or maybe even your own government if they don't like you having crypto. And on top of that, don't use your real name online. It just makes it easier for everyone to find your address and where you work and everything. What some Twitter users were doing, they were using their real name and posting their wallet balance. And this would immediately make Connor zoom in on them. And he would start a new document and just start going through his methods to find information about them.

• 37:28Speaker 01

  There's a couple of different ones. One good one is, say you knew their full name and you knew their their approximate location. So let's say you're Jack and you're living in Tampa, Florida, or or somewhere like that. If you had maybe posted on Twitter about ordering your favorite Asian food and you had a maybe a bag that had the restaurant's name on it, we could call that restaurant and then you could say, my name's Jack, I want to place an order, do you have me on file? I just want to make sure you have the right address. The person working in the Chinese restaurant that you've ordered food from before would then reiterate your address to to who they think is Jack and then you'd you'd have their address there in front of you. Going back to the exploits as well, AT&T and T-Mobile had exploits at some point.

• 38:13Speaker 01

  AT&T, you could put in a mobile number and then you could pull back their SSN or the last four of their SSN from their AT&T account unauthorized. That was a big one that we used. Many other people have used if you couldn't find their SSN on the other sources.

• 38:30Jack Rhysider?

  He wants as much information as he can get about them because the more he knows, the easier it'll be to hack into their digital life.

• 38:37Speaker 01

  Yes, you'd namely need the full name, the address, the last four of the SSN. You might need the last four of a debit or credit card number, in some cases, a date of birth. You might need a mother's maiden name.

• 38:51Speaker 01

  Previous addresses, maybe all these different types of things, but I mean, they were all easily, easily sought out online. So we, we would essentially profile them before we executed the attack. So we would have a full docs, like their, all their family, the previous addresses, like a huge list of information about them. So when it came to that time, we weren't, we weren't lacking any information. It was just, we were ready to go.

• 39:16Jack Rhysider?

  Ready to go as in he'd hand this information to the other guys in the group and say, okay, I found a guy with a hundred Bitcoin. Here's his info. I think he's a good target. Should we? Because the thing about stealing crypto is that there's no way to reverse the transfer. There's no central authority. There's no support ticket to open. If you snatch it, you can keep it unless of course someone catches you. Now, as he said, he's not operating alone here. Once the other guys decide that this is a good target that he found and he has info on, then other people join in to do this SIM swap process and the heist begins.

• 39:48Speaker 01

  Typically I'd be waiting at the, the reset password screen. So we'd all be in a, a call together on Discord and, and someone would be doing the, the SIM swap process and I would be ready then to, to reset the password and input the two FA codes. So they'd let me know when, when it was go time really. And I would send the code, they'd read it out to me and reset the password and, and then start looking through.

• 40:10Jack Rhysider?

  The code he's waiting for is to get into their Gmail. He knows their Gmail address and he started the login process, but said, I forgot my password. And it asks him, okay, do you want us to text you a code to let you in? So his finger is on that button, waiting until the SIM swap happens before he says yes. And so as soon as they get the SIM swapped, he says, yes, go ahead and send me that code. And then the person reads off that code over the phone and he can log in. It's all very coordinated and done extremely quickly. What are all the roles going on here, right? So you've got you as the OSINT doxer targeting person. And then there's someone who does the SIM swap and they're, they're the holder of the phone as well, right?

• 40:53Jack Rhysider?

  Is there a holder that's a different person than the one he's calling?

• 40:56Speaker 01

  It depends on the circumstances, so. No, you'd always really have a holder, at least back then anyway. So you'd have someone that would find the target. You'd have someone that would engage with someone to SIM swap the target. Either do it themselves or they'd engage an employee of a carrier. And then you'd have someone who's the holder. So that's the person who's physically holding the phone and replacing the SIM card in the phone with the blank SIM that the number's been swapped to.

• 41:24Jack Rhysider?

  So you're on a call with the holder and the SIM swapper. So the SIM swapper is like, okay, hold on, let me call him, try to get it. No, it's not working, let me call again. No, it's not working, all right, let me call again. Okay, it worked, I got him to port the number. Do you see it, holder? And the holder's like, yeah, it's active. Okay. And then you're like, okay, great, I'm going to initiate a password reset. Tell me the number. And then the holder's like, I don't see it yet, I don't see it yet. Okay, here it is. Is that kind of how those calls went?

• 41:52Speaker 01

  Yeah, that's exactly how they went. It was like clockwork, the process. So E12 would execute the action and then it'd go then directly after that. So the holder would say the SIM's active. As soon as the SIM's active, then you send the reset code and you get going. Then it's the email.

• 42:09Jack Rhysider?

  Connor's second task is now to find the crypto. They got access to this person's phone and Gmail. And they're assuming somewhere in this digital life of theirs must be the keys to their crypto wallet. And all they need is a seed phrase or a private key. And these are very important to keep safe and have backups of. So a lot of people store them somewhere in their online world. So as soon as Connor gets in, he immediately starts sniffing for blood.

• 42:35Speaker 01

  So the first thing, which is crazy the way that it was and still is. So if you go on to, if you have a Gmail account, go on to Chrome. If you're assigned into your Chrome account with your Gmail address. If you type in passwords.google.com, it'll pop up. You'll be prompted to put in your password. Once that's done, you'll be prompted with a page that has every single website you've used and the password, if you've saved that password for that website. But this would sync across devices. So say I took your Gmail account and... And you had saved your Twitter password or your Gemini or whatever your Binance password onto your Gmail account. I could log into your email and view all these saved passwords, which would then allow me to just use them and log straight in. And in the event that

• 43:19Speaker 01

  I needed to FA, we had your phone, so we could get that code.

• 43:24Jack Rhysider?

  Okay, hold it. Just stop right there. I just tried this, and I'm so upset right now. I've been using Gmail since like 2007 or so, and the last few years I've taken drastic measures to de-Google my life. However, I just logged into my Gmail and then went to passwords.google.com, just like he said. And what do you know, some of my most sensitive passwords are sitting right there, easily organized and in clear text. I must have told Google at some point, "Yeah, you can remember to log into this site," and it did, "but I have my own password manager." I don't ever remember using Google's password manager, yet I'm looking at my logins here and I'm miffed about it. Dang, there's even an option to export all these passwords, too,

• 44:06Jack Rhysider?

  and it shows me all the sites I've declined to save passwords for. Like, this just lays out my whole digital life, and I had no idea Google was saving any of this. And I'm a guy who's super focused on computers and security and tech and privacy. I can't imagine how a non-techy navigates this. I deleted all my passwords from here, and the sites that I said I want to opt out of saving passwords for, because I never want Google to be storing my passwords. I've just been finding more privacy-focused apps to use instead of Google. Most of their products are not end-to-end encrypted, and I feel that my stuff is just too important to be subject for an eventual data breach or being subpoenaed or something. My sensitive data is either stored locally and never sees the internet at all, or is

• 44:51Jack Rhysider?

  stored on some end-to-end encrypted service somewhere. So even if it shows up in a breach, it can't be seen by someone. Taking your personal privacy seriously is the only way to make sure that your stuff is safe.

• 45:04Speaker 01

  Next thing then would be Evernote, which was the cloud note taking app. But a lot of crypto investors seem to use that for whatever reason. So we'd reset the Evernote account, look through the notes, see if we could find it. Mnomic somewhere or seed phrase. We'd go through Google Docs, Google Drive, any linked cloud accounts, like anything that was there.

• 45:25Jack Rhysider?

  Did you have like a regular expression that you were able to search for for seed phrases?

• 45:29Speaker 01

  Yeah, mnemonic or seed phrase or Bitcoin or crypto or you just try a plethora of different things. And you need to find it eventually or you'd look in there, send emails. Sometimes people would send their mnemonic to themselves or a different email. So it'd be in the sent emails. But it is, you're right, it is kind of an art. You'd need to know what to look for or else you'll find nothing like to say.

• 45:53Jack Rhysider?

  And is it just you in this account or are other people looking as well?

• 45:56Speaker 01

  No, be most of us would be logged in, um, looking simultaneously. But if you had too many people on at the one time, it would lock everyone out. So it would be probably two or three people. But just to go back to the the ocean stage, the the pre SIM swapping stage, I'll say, I I missed this step. So what you could do is say your emails, [email protected] or whatever. I could go onto coinbase.com, go into reset password and input your email. If your email existed in their database, it would send out a password reset form. If it didn't exist, it would pop up and say, this user does not exist or this email does not exist. So what we would do is try their their email against these different services.

• 46:41Speaker 01

  And we compile a list of services that we knew they used. So once we were in the email account, we just, we would go to them directly, straight away. So say I would try all the different crypto exchanges with their email, see which ones they're registered to. And then as soon as we have access to the account, we can, we can try them instantly. So there's no time wasting.

• 46:59Jack Rhysider?

  Yeah, so they they've they'd fix that. If you tried to reset an email password there, it'll say, well, if we had an account here, we'll send you the password right now. And they don't give any sort of clue. So the way to get, the way they, the way to do it nowadays, I believe it still works, is just to go register at Coinbase with that email address. And it'll say, oh, this account already exists. Okay, thank you. That's all I wanted to know.

• 47:22Speaker 01

  Yeah, not a great patch they've put in.

• 47:29Jack Rhysider?

  I don't mention this enough, but I do think that you should have a different username on every site you log in for. You already know how to use a different password for every site. Take it a step up and use unique email addresses or usernames for every site. Like what some people do is they'll get a domain. Like I have darknetdiaries.com and I have a catch-all email rule so that anything going to @darknetdiaries.com, I will get in my inbox. So I can make something like [email protected] or [email protected] as ever many email addresses as I want. I don't even have to create them. I could just use them because there's a catch-all email and gets them all. This way, I can have unlimited email addresses and each one is unique for every single site I use.

• 48:12Jack Rhysider?

  Because you don't want people to be able to profile you by just taking your email that you use everywhere to register accounts for, and then they can cross-reference that or Google that or search databases to see what are all the accounts that this email address is valid for. When you're protecting your digital life, the goal is to make it as hard as you can for people like Connor. You can't have perfect security, but I'm a big fan of making it as painful as possible for someone to hack you because eventually they'll run out of time or energy to hack you and move on to the easier targets. I've said it before, being secure online is like running from a bear in the woods. You don't need to be faster than the bear. You just need to be faster than your friend in order

• 48:56Jack Rhysider?

  to survive the bear. So that should be your personal goal, to be more private and more secure than your friends. I recently met someone whose privacy was way better than mine and we became friends and it really made me step up my game. And defense in depth is important, too. Hiding all your most personal data behind a single login or account is a bit scary, but if you assume someone does get into your Gmail, why not also limit them to what they can see and do from there? Make them run into dead ends again and again. So like, delete your emails when you don't need them anymore. I don't know about you, but every time I get a new Windows or Mac computer, I create a fresh Microsoft or Apple account just for that machine, which is not tied to any other profile that I use.

• 49:41Jack Rhysider?

  And that severely limits the damage that can be caused if someone gets into that account without my consent, or gets breached or something. Oh, and I should also mention, it's a good idea to use two-factor authentication that isn't SMS text messages. Because he had access to the person's phone, right? If the 2FA code can be sent by text, he can get it. But if you're using something like Google Authenticator for 2FA codes, that's harder for him to access. However, as you know, I'm skeptical about what Google is collecting about me. They want it all. So I personally use Aegis to store my 2FA codes. That's spelled A-E-G-I-S. It's an open source app that works great for this. And in my opinion, it's way more private than Google Authenticator is or Authi. God, you gotta stop ranting about privacy. Sorry. All right, let's get back on track.

• 50:26Jack Rhysider?

  All right, so let's say you find a private key. What do you do?

• 50:33Speaker 01

  So if you found a private key, you'd load up the wallet. Say I found an Exodus key, I'd have an Exodus client download it and ready. Or I'd have a couple of different clients. Like, say I found a Bitcoin private key. I could go into Exodus or Blockchain and import that seed phrase and have access to the wallet.

• 50:49Jack Rhysider?

  No, just because they found the private key or seed phrase doesn't always mean there's crypto in that wallet. So there's a moment of truth. Does this wallet have money in it?

• 50:58Speaker 01

  You're right, nine out of 10 times, you wouldn't know what's in that wallet. So you could put it in, you could hit nothing, you could say zero, or you could put it in and it would say 1,500,600,000. So you'd be on this call and you'd input this wallet and you'd see X amount of money and you'd be freaking out. And then everyone would collaboratively freak out then altogether on the call. It would sound like monkeys in a zoo.

• 51:23Speaker 01

  Once we had access, then we would send the funds to a newly created wallet. And then from there, we would disperse the funds evenly from that fresh wallet.

• 51:34Jack Rhysider?

  And just like that, the heist is a success. Each of the people involved would get their cut and go on their merry way. Some would convert their Bitcoin to Monero to make it harder to trace. Others would convert it to cash and some sort of street deal type thing. And others would just try to buy crazy things with crypto. And of course, once they were able to steal money and get away with it, they wanted to do it again and again. So it became a regular thing for these guys. And Connor went along on a number of crypto heists.

• 52:04Speaker 01

  There were ones that were smaller sums of money in maybe the tens of thousands. And then there were some that were low to high six figures. The biggest one was two million.

• 52:13Jack Rhysider?

  Two million dollars in one wallet?

• 52:15Speaker 01

  In one wallet, yeah. Or I think it might have been spread across a couple of different ones, but it was one victim. That was two million. That was kind of a freak out moment when that happened.

• 52:26Jack Rhysider?

  That sounds like quite a high.

• 52:29Speaker 01

  Yeah, it was. And that's the thing, you know, it wasn't really about the money for me. Like I didn't spend, if you look at all the other people, there was a kid arrested recently. I don't know if you've seen it, but he stole hundreds of millions of crypto through sim swapping, but he was spending his money on luxury cars and bottles and clubs. I wasn't that type of person. Like I think I spent a hundred thousand max out of two million that I had.

• 52:59Speaker 01

  So it was more the high that I chased and the sense of achievement that you'd get when you found the wallet. Looking back now, it's pathetic getting the achievement from that. But back then, it was, it was like a high and it just became addicting then.

• 53:14Jack Rhysider?

  I mean, again, it's still one of these crazy moments of like.

• 53:18Speaker 02

  Whatever your fam- what is your family like, life like? You got a, you got like homework and stuff to do. And your family's like, Dave, make sure you do your chores, Connor. You gotta make sure to get this done and that. And you're like, okay, okay. And then, and then they're like, give it you like a few, a few dollars for doing your chores or whatever. I don't know what's going on there. But you're just kinda like, oh, that's great. But I got, and then, and then I just imagine like, Mom, don't interrupt me. It's Friday night. We gotta, I got a big thing going on tonight. Uh, just please do not come in my room. Like, was it just in the bedroom of your parents' house?

• 53:54Speaker 01

  In the bedroom of my parents' house, yeah, but it's, I live with my mom or I live with my mom back then and, and uh,

• 54:02Speaker 01

  see, because I was making money or smaller amounts of money back in the, in the heyday and the older days before any of this started, um, I always kinda used to have a small bit of money just from different online ventures. But when this happened, I had kinda told her and the rest of my family that I was investing in crypto. Because this was at the point of the crypto boom where Bitcoin first exploded. So it was kinda believable that I had invested early with the funds that I made when I was 12 or 13 into Bitcoin. And it's now exploded and multiplied my, my wallet when in reality it was, it was stolen.

• 54:38Speaker 02

  So that was the, uh, now, I mean, what, what were, what were the excuses of just like, hey, I'm, I'm busy tonight. Please don't. Schedule dinner for, like, just bring dinner in the room. Like, I'm not gonna come out because I'm on a really intense me, uh, call, uh, investment thing. What are you saying to her?

• 54:57Speaker 01

  Yeah, see, I was kind of a hermit already. So it wasn't unusual for me not to leave the room for extended periods of time. So it's a, it, I don't know. She, she didn't really suspect much because she was so used to it from years and years of me being like that.

• 55:13Speaker 02

  Yeah. Um, and I, I've watched these old Western movies where they, the, the bandits rob the train or whatever, or the gold mines. And they kill people on the way to do it, right? But then there's like, you know, three or four bandits involved in this and they're camping out there.

• 55:30Jack Rhysider?

  Desert or whatever and they're looking at each other like I could kill these other two guys and then I don't have to split my cut. Was that kind of experience happening because like you said, you see someone post on Twitter. Hey, I've got a hundred thousand dollars in crypto. You're like, there's my target. Well, if somebody sees your chat like, oh, these kids just stole a hundred thousand dollars. There's our new target. Let's target these kids.

• 55:54Speaker 01

  Well, like other people targeting us?

• 55:56Jack Rhysider?

  Yeah.

• 55:57Speaker 01

  No, not for me because of where I am, but I know what happened to a lot of other people in the States. Um, there was a lot of swatting and doxing and various things going on between the community. People would get pissed off, targets would be stolen and then people would start doxing people, sim swapping them, swatting them. Crazy things. I know there's a bigger community now of violence as a service, which people are are now using to hire people to commit violent acts against other community members, like throwing bricks through windows and things like that. That wasn't a big thing back then, but I know it's it's increasing in popularity now.

• 56:32Jack Rhysider?

  All right. Did we reach the height of this? Um, like, is this where things start going wrong?

• 56:38Speaker 01

  Yeah. So after the two million one, that that was really where I I called it quits. Um, I mean, I wanted to for a long time, but that the big one, someone kind of reached out to me and and and I said, I joined in and then we did that and I got my split and and that was it. I was done. And that went on for a good while. I think that was in twenty eighteen.

• 57:03Jack Rhysider?

  Yeah. So altogether, you said you've made about two million dollars from all this.

• 57:07Speaker 01

  Yeah, roughly around there.

• 57:09Jack Rhysider?

  Like you said, you stopped at around two million. Was that a goal to hit two million and then say, I think I've got enough for a while? Or what was your future plans?

• 57:18Speaker 01

  No. Yeah, I could listen to the future plans in a minute, but um. No, there was no monetary value. I think at that point, just before that hack happened, I think I was kind of, my moral compass was starting to develop and and my conscience was starting to uh to develop as well. So I kind of started realizing that was wrong and then that happened and. And then I kinda knew, I can't do this anymore. This is, what I'm doing isn't right and I'm stealing money from, from people. Um, and that's when I kinda stepped away from it. In terms of the exit plan, I, I had looked at a couple of different things. There's a couple of islands, one that I was looking at with Saint Kitts and Nevis.

• 58:00Speaker 01

  So you could purchase a citizenship through ownership of property. So say you could buy a, a three bedroom house for three hundred thousand dollars and they would give you a passport. And Saint Kitts and Nevis or these islands, I think they're the Virgin Islands or something like that. They have no income tax. So. I was kinda thinking of buying a house there, moving over there and somehow laundering my money. I mean, it was a pipe dream now that I think of it now, but back then that was my, my plan of action.

• 58:31Speaker 02

  That's a funny plan because um, that's, that sounds like, I don't know, uh.

• 58:37Speaker 02

  Gangster drug dealer plans of like, okay, we're just gonna rob one more bank and then we're gonna disappear into Virgin Islands. And it, it, it's not a plan for an eighteen year old to be like, I'm retired at the age of eighteen.

• 58:48Speaker 01

  Yeah.

• 58:48Speaker 02

  And I'm just gonna live on the island forever now.

• 58:51Speaker 01

  It's a weird feeling.

• 58:52Speaker 02

  It, I was hoping, I don't know what I'm hoping, but it, it's like, okay, now I have this money. I'm gonna start a, a big business and I'm gonna start the startup and I'm gonna do this great stuff.

• 59:02Speaker 01

  After I, I had kinda, or before it ended, I had kinda started thinking about how to legitimize my skills. So I, I was thinking of maybe opening up a cyber security consulting business because of, of what I was doing, which is ironic. But I'm thinking of using my funds to create a business to, to protect people online or, or help them protect their organizations or themselves. So that was also part of the exit plan to create my own consulting company in that space. But yeah, but that never panned out.

• 59:29Speaker 02

  You had these plans. You're like, okay, that's the, that's the end. Last one. That was a big, that was a big nice one. Uh, do you just leave the group entirely or?

• 59:37Speaker 01

  Yeah, kind of, yeah. Um, it got to a point where I had stopped and then. Uh, I was so paranoid that every day I would be searching SIM swap arrest and things like that. And one day I had woken up and checked my phone and I had searched this term and. I had seen one of the people I was associated with was, was arrested over in America in the States and um, that's when I kinda knew my time was coming.

• 1:00:05Speaker 01

  Once I seen this article and then it was really just a countdown then after that.

• 1:00:09Jack Rhysider?

  Yeah, so what'd you do after that?

• 1:00:11Speaker 01

  Nothing, nothing. I just waited.

• 1:00:13Jack Rhysider?

  You gotta go to Virgin Islands.

• 1:00:14Speaker 01

  No.

• 1:00:15Jack Rhysider?

  Now's the time, go, go, go.

• 1:00:17Speaker 01

  Because like I said, my, my conscience was growing more and more guilty. I was developing as, as a person. I was a young al- adult. So I was growing older. My brain was kind of developing out of being a stupid little kid stealing money. So. I mean, my guilty conscience just told me to, to just wait and get arrested and that's what happened.

• 1:00:38Jack Rhysider?

  One of the holders in this group, the person who had the physical phone during the SIM swap was just fifteen years old. And his parents heard him calling T-Mobile, trying to act like someone else lying on the phone. His parents caught him in the act and they called the police on their own kid, or so the story goes. That fifteen year old was very cooperative with the police, which Connor thinks is how the police learned who he was. Well, that and Connor simply went by Connor in the group that he was with. So his op sec wasn't really that good.

• 1:01:09Speaker 01

  I was woken up by a knock on the door. Um, while I was in bed, really, my mother let them in. I'd say twelve to fifteen police officers came into my room.

• 1:01:19Jack Rhysider?

  Your mother had probably had no idea.

• 1:01:21Speaker 01

  No clue at all.

• 1:01:21Jack Rhysider?

  That you had done anything illegal.

• 1:01:23Speaker 01

  Yeah.

• 1:01:23Jack Rhysider?

  Okay, so twelve, twelve officers come in your room?

• 1:01:26Speaker 01

  There was a huge amount, yeah, because they obviously needed a search team and they didn't know whether I was gonna kick off or try and hurt them.

• 1:01:34Jack Rhysider?

  That's gotta be quite the shock to be sitting there playing CS:GO or whatever and turn around and say twelve officers in your room. Like, well, hold on, fellas.

• 1:01:42Speaker 01

  Yeah, so I was actually asleep in bed, so I had, I had woken up, I'd sat up and opened my eyes and in a semicircle surrounding the end of my bed was, was this mass amount of police officers and I thought I was dreaming, so I went to grab my phone next to me and they kind of shouted, put the phone down. I went to go and check the time, so that's when it hit me then that this situation is happening now and, and there's police in my home.

• 1:02:07Jack Rhysider?

  Do the police in Ireland have guns?

• 1:02:10Speaker 01

  No, not, not normal officers, no.

• 1:02:13Jack Rhysider?

  Okay, so you had no guns pointed at you?

• 1:02:15Speaker 01

  Uh, not from what I can recall. There might have been a couple of armed officers, but I, I highly doubt it. I mean, they knew what they were getting into when they raided me. They knew this fat little eighteen year old wasn't gonna pull out a, an AK forty seven and start shooting them, so.

• 1:02:29Jack Rhysider?

  They, they had no idea, but that's why they brought twelve of them with them, like, it's, it's not just some fat little eighteen year old. We gotta, we gotta really muscle this guy if he, if he does something. Uh, okay, so, I mean, that's quite, that's quite a shock. So I imagine they, they start talking with you. They, they take all your devices?

• 1:02:46Speaker 01

  They took all my devices here. I'd asked to see the search warrant and they produced it, um, United States versus Conor Freeman or whatever extradition request, search warrant and. And, uh, then it all started becoming real. They started searching everything and, and then brought me down to the, the station and, and booked me into the system then, and.

• 1:03:06Jack Rhysider?

  Did you tell them you did it, or did you talk or what?

• 1:03:09Speaker 01

  Uh, no, I, I kinda acted ignorant, but I mean, the, the evidence was substantial that they had, so I mean, they weren't relying on me saying I did anything. I mean, I was kinda screwed either way. So, I mean, I didn't really have to tell them anything. I was just arrested. I was brought down to the police station and they carried out a search and, and seized all my devices.

• 1:03:33Jack Rhysider?

  Okay, so the United States wanted you. They didn't want you. This was not a Irish, uh, investigation?

• 1:03:41Speaker 01

  Uh, that's correct, yeah.

• 1:03:43Jack Rhysider?

  Well, that's scarier, I think, because the United States is more harsh on, um, criminal, criminals and the Irish.

• 1:03:52Speaker 01

  Well, I wouldn't say that. I mean, maybe in terms of headline sentencing, but for white collar crime, I think they're, they're pretty similar.

• 1:04:01Jack Rhysider?

  Okay.

• 1:04:02Speaker 01

  But it, it was an extradition request. So there's an extradition treaty between the USA and Ireland that, that they can, um.

• 1:04:10Speaker 01

  I don't know exactly how it works, but the the USA can conscript conscript Irish police forces to to carry out an arrest on their behalf to be extradited back to the the States. So that's that's what happened.

• 1:04:23Jack Rhysider?

  Uh, you so you went to the United States?

• 1:04:25Speaker 01

  No, didn't go to the US, no. So I was arrested on this extradition warrant and I was booked into an Irish jail. Um, but they had sought my extradition, so it's obviously a long legal process before that actually happens.

• 1:04:38Jack Rhysider?

  Um.

• 1:04:39Speaker 01

  So I was booked into it, an Irish jail. And I was there for a couple of weeks. And then, yeah, I was I was kind of released. So when I when I when my property was searched, I had all my crypto on a treasure hardware wallet that was never found when when I my house was being searched. So while I was on bail, I had made an agreement with my uh my lawyer to hand over my crypto wallet to the Irish police to then hand over to the the US. So I'd given up all of all of my assets voluntarily.

• 1:05:14Jack Rhysider?

  Hmm, that's that's a decision I've heard that other criminals in your situation have to think hard about. Um, because the two options are hold on to it until after all this is over, maybe ten years from now, and I come back and there's all this crypto that I could just like live off of, or give it all up in order to reduce my sentencing. And hopefully that's like nice gesture that they notice and and think it was positive of me for giving it.

• 1:05:40Speaker 01

  Yeah, well, it was a mix about to me, really, it was dirty money. So whether I had it or not, I didn't care. I didn't really want to be in in possession of it anyway anymore because it was, I just didn't feel right having that money. So I we made an agreement that I give it back to them and that obviously went in my favor in the end. But um.

• 1:06:01Speaker 01

  Yeah, I I was in jail for about a month and then I was released on bail. And then the the legal process went on for quite a while until I was eventually sentenced.

• 1:06:11Jack Rhysider?

  Um, I thought there was an article where I saw that you were gonna get a hundred and eight years.

• 1:06:16Speaker 01

  Yeah, so the headline sentence in the USA was a hundred and eight years. That that's the maximum penalty for each of the charges added up consecutively.

• 1:06:26Jack Rhysider?

  I mean, did you freak out if you heard, did you hear that that was a possibility? Or you were gonna go to prison for a hundred years?

• 1:06:32Speaker 01

  Definitely freaked me out, yeah.

• 1:06:34Jack Rhysider?

  What's the, what did they sentence you to?

• 1:06:37Speaker 01

  So I got three years in prison. And then, because I spent a month in jail, I was given one, one month off. So it was two years and eleven months. And in Ireland, typically, every prisoner gets a quarter of their sentence off. But if you're sentenced to under three years, you get a third of your sentence off. So I served eleven or twelve months in total, out of the, the two years, eleven months.

• 1:07:01Jack Rhysider?

  So what was prison like?

• 1:07:03Speaker 01

  Um, it was fine. I mean, it helped me a lot in some ways.

• 1:07:07Jack Rhysider?

  It was fine?

• 1:07:08Speaker 01

  Well, I mean, prison is prison. It was as fine as it can be. Um, a lot of people ask me, how did it feel when, when I got arrested and I spent my first time in, my first night in jail? Um, and they're weirded out when I say it felt great, but like, that was the best sleep I'd had in years. Because I, I, my conscience had grown so guilty and I had felt so bad, like I was sleeping horribly for a long time. So when I finally got arrested, it was kind of like a, ah, kind of moments, like I could sleep peacefully. Um, knowing that this was the end of things.

• 1:07:41Jack Rhysider?

  How'd you pass the time in prison?

• 1:07:42Speaker 01

  Uh, exercising and reading, really. I read a lot and I exercised a lot.

• 1:07:48Jack Rhysider?

  What kind of books did you like reading?

• 1:07:50Speaker 01

  A lot, a lot of self-help books. Um, yeah.

• 1:07:55Jack Rhysider?

  Okay, so how long have you been out of prison?

• 1:07:58Speaker 01

  I've been out since twenty twenty, I think.

• 1:08:02Jack Rhysider?

  What's going on now?

• 1:08:03Speaker 01

  I ju- literally just finished a master's degree in cybersecurity last month. So I was doing that for two years. Um, after I got out of prison, I, I think I'd been out for about a year and, and I'd seen it. A college here was offering a course in a, a master's in cybersecurity and I'd applied for that. Luckily, I was accepted and undertook that for the last two years. So I've just finished that last month.

• 1:08:28Jack Rhysider?

  Hmm. Similar to what you wanted to do, right? Which is to help people get secure.

• 1:08:34Speaker 01

  Yeah, it's kind of a, it's turned around a lot, uh, uh, the opposite of what I used to be.

• 1:08:50Jack Rhysider?

  A big thank you to Conor Freeman for coming on the show and telling us this wild internet adventure he went on. Stay out of trouble, kids. This episode was created by me, the Pocket Pirate, Jack Rees-Cider. Our editor is the Busy Tone Bandit, Tristan Ledger. Mixing by Proximity Sound and our intro music is by the mysterious Breakmaster Cylinder. I wanted to make my phone SIM swap proof, so I opened up the little SIM card tray and I filled it with glitter and hot glue. Now if someone tries to get in there, they're gonna get a dazzling surprise. This is Darknet Diaries.