One unhidden IP address at an exchange signup broke the $240 million bitcoin heist case

Prosecutors say the group hired money laundering specialists to wash the bitcoin through multiple exchange platforms and convert it into government-issued cash ^[8]. The finding that broke the case was clerical. Serrano opened an account at a cryptocurrency exchange to hold nearly $30 million of the proceeds and failed to conceal his IP address, and investigators linked that address to a house in Encino, California, that he was renting for $47,500 a month ^[9][10]. He was vacationing in the Maldives when they identified him as a suspect ^[20].

The second evidence stream was the receipts. The defendants, a network of young men in their late teens or early 20s, bought fleets of sports cars, flew on private jets, hired security guards and rented mansions in Miami and the Hamptons ^[26][14]. Lam spent over $569,000 in one evening at a Los Angeles night club ^[12], out of roughly $4 million that he and his friends ran through LA nightclubs in one month, according to authorities ^[13]. One evening was about a seventh of the month's club spend ^[24]. Veer Chetal gifted his parents a Lamborghini and hid a duffel bag with $500,000 in cash in their laundry machine ^[15].

Neither account describes how investigators reached the other 17 defendants ^[27]. So what is public supports a narrower reading than chain analysis solving this: the identification thread runs through one exchange signup and a rented address, and the corroboration runs through a month of purchases, not through the laundering chain the group paid specialists to build ^[8][9][10].

That distinction shows what the next case will cost to crack. The phone script cost two callers an afternoon and returned more than 4,100 coins ^[3]. The evidence that answered it was generated by the defendants after the money landed, and it was perishable: an account open under a real address, a tab at a club, a car in a driveway in Connecticut.