Mystery Solved: $6.6 Million Bitcoin Theft That Brought Down Dark Web Site Tied To 2 Florida Men 

bitcoin

The U.S. government has seized $4.5 million from two Florida men who allegedly stole 5,400 bitcoins from illegal online drug sales site Sheep Marketplace in late 2013, shortly before the price of bitcoin hit its peak of around $1,200, according to forfeiture documents filed last week in Jacksonville, Florida.

The money was forfeited back in the spring of 2014, along with a 2012 Toyota Camry and a 2008 Honda motorcycle, by Nathan Gibson and Sean Mackert, who are both 24, but were 21 at the time of the heist.

(The government says the amount was equivalent to $6.6 million, though it appears to be using an exchange rate, about $1,200, that wasn’t reached till nine days later, during which time Bitcoin’s value doubled and peaked before beginning a downward slide. Bitcoin is a digital currency created from computer software that has gone from $0 in value to more than $500 today since its birth in 2009.)

The 2013 theft led to the shuttering of Sheep Marketplace, which had sprung up in response to the closing of Silk Road, the first online drug marketplace to use Bitcoin. At the time, news articles and Reddit claimed the amount stolen was $100 million or $220 million and Reddit vigilantes watched transactions out of an address they were convinced was associated with the theft, until they realized it was instead owned by a Bitcoin exchange.

“There was nothing where [Gibson and Mackert] were injecting code. There was no hacking. This was just a poorly created website that was just exploited by very young kids who immediately accepted responsibility for their actions,” said Jeffrey Lichtman, Gibson and Mackert’s criminal defense attorney, a high-profile New York lawyer who is known for having gotten extortion and racketeering charges against John Gotti, Jr., who was accused of ordering a 1992 kidnapping, dismissed.

However, Lichtman conceded, “They’re responsible for exactly what’s contained within that document.”

Despite the fact that movements of the digital money are public, Gibson and Mackert deposited some of the stolen bitcoins into accounts at Coinbase, one of the most well-capitalized startups in the space that was also one of the first to bring Bitcoin from its Wild West days into its more law-abiding phase.

Its user agreement is full of statements such as, “You hereby authorize Coinbase to, directly or through third parties make any inquiries we consider necessary to verify your identity and/or protect against fraud, including to query identity information contained in public reports … to query account information associated with your linked bank account … and to take action we reasonably deem necessary based on the results of such inquiries and reports.”

Both Coinbase and the United States attorney who submitted the forfeiture agreement could not be reached for comment.

Though Sheep Marketplace calls the thief a vendor, and though the site was a drug marketplace, Lichtman denies that Gibson and Mackert were either drug dealers or even buying drugs.

“These are not sophisticated criminals. These were not people who were well-versed in terms of criminality. They were curious kids who exploited a poorly made website,” he says, adding that since then, they’ve been working and have had no run-ins with the law.

The forfeiture agreement states that after the November heist, Sheep Marketplace notified users, “We are sorry to say, but we were robbed on November 21, 2013 by vendor EBOOK101. This vendor found bug [sic] in our system and stole 5400 BTC – your money, our provisions, all was stolen.”

It then details how two Department of Homeland Security special agents named only as Johnston and Gino used the website Blockchain.info, which publicly displays bitcoin transactions, to track the movement of the stolen bitcoins across various addresses, including one assigned by Coinbase.

In response to a subpoena, Coinbase revealed the owner of that address was Gibson, that the account was linked to one at Bancorp Bank and that from late December 2013 to late January 2014, Gibson had deposited more than 842 bitcoins valued at more $646,000.

He also was using the same IP address as Coinbase customer Mackert, who also linked his account to a Bancorp Bank one, and who, from late December to late January, had deposited more than 1,016 bitcoins valued at more than $670,000. (The price of bitcoin fluctuated quite a bit during this period from $700 to more than $1,000.)

Mackert opened his Coinbase account on December 30, 2013, and then deposited 7.72 bitcoins into the account the next day. One special agent noted that 24 transactions earlier, those bitcoins had originated in one of the 14 wallets suspected in the Sheep Marketplace theft, receiving 200 bitcoins at that time.

The special agents’ analysis showed that the 14 addresses that received the stolen bitcoins all were used in transactions that ultimately ended in deposits into Gibson’s and Mackert’s Coinbase accounts. “This is documented on numerous occasions,” the forfeiture agreement states.

The special agents also learned that in early December, Gibson had deposited $150,000 at the Jax Federal Credit Union in Jacksonville, Florida, and that on the same day, Mackert went with Gibson into JFCU, also with $150,000, to open an account. However, the next day, the credit union’s management met with Mackert and Gibson, closed their accounts and returned the money to them.

In March, Gibson tried to transfer $243,000 worth of bitcoins converted into U.S. dollars into his Bancorp account, but the bank refused to accept additional ACH transfers to his account due to suspicious activity, so the money was converted back to bitcoin and credited back to his Coinbase account. The same happened to Mackert when he tried to transfer $251,000 to his Bancorp account.

In early March, Gibson added two new banks to his Coinbase account: Simple, an online bank owned by Bancorp Bank, and Bank of America BAC +1.22%. In mid-March, Mackert linked an additional account, at PNC Bank, to his Coinbase account. He also had an account with Simple.

The funds they each kept at Simple were held by Bancorp Bank, which had closed their accounts due to suspicious activity. Bancorp employee Myfanwy Bonilla told the special agents that “Mackert and Gibson claimed to be bitcoin miners and that the amount of currency being converted was unrealistic based on her training and experience.”

She stated that between late December and early March, Gibson had received $1.01 million in ACH transfers from Coinbase, with $817,000 still remaining in the Bancorp account, and that Mackert had received $1.14 million in ACH transfers from Coinbase and still had $873,000 in his account.

But Gibson, who had been employed by Jacksonville-based Information and Computing Services, reported 2013 earnings of only $45,500, and Mackert, just $11,100, from temp agency Kelly Services, according to information Johnston received from the Florida Department of Revenue.

When the government seized their funds, it obtained the following from their financial accounts, as well as cash held in their homes and other residences:

  • $817,426 held by Gibson at Bancorp
  • $872,571 held by Mackert at Bancorp
  • $224,705 held by Gibson at Coinbase
  • $354,315 held by Mackert at Coinbase
  • $49,841 held by Gibson at Bank of America
  • $891,400 in cash held by Mackert at a residence
  • $5,420 held by Mackert at his home
  • $78,480 held by Gibson at his residence
  • $380,042 held by Mackert at Coinbase and converted to USD
  • $814,267 held by Gibson at Coinbase and converted to USD
  • $25,760 held by Mackert at VyStar Credit Union

Lichtman said that in the forfeiture and criminal cases, no hearings or other events are scheduled for now, but that he and his clients are in discussions with the government.

Source: Forbes

Leave a Comment


Broker Cyprus TopFX