154: Hijacked Line

23:30This allowed you to acquire some Twitter and Instagram were your main things? Twitter and Instagram, yeah. I mean, they're still the main ones now. They're the most popular social medium. So that's what people would go for the most. Connor was making some scratch from all this. All in Bitcoin, of course. Looking through database breaches, finding passwords that would work on Twitter, then stealing those usernames and selling them. Okay, so roughly how profitable was this for you selling OG users? I don't know. I couldn't quantify a figure. Probably$20 ,000 or$30 ,000. No, probably a lot less. I didn't really get into it that deep.

24:10He built up a reputation for having quite a bit of usernames for sale on OG users. It was going well. But then something else caught his attention, something so much bigger, that eventually made him lose interest in OG users altogether. The thing he saw some people doing was sim swapping. Yeah, so it would start with a target. You've doxed the user. You'd use various different methods of getting all their information. So their full name, address, phone number, their SSN. And there's a certain website that you can buy credits on and input someone's first and last name and get their SSN. So you'd have all that information.

24:49Back in the day, it was a lot simpler than it was now. So say if you were on T-Mobile, I would call up and say, hey, my name is Jack Reesider. My last for my SSN is 1234. I've just lost my phone and my SIM card is inside it. I have a replacement SIM card here. If I give you the ICC ID, can you swap my SIM over to this card? And the agent would happily do it. And once that's done, your phone number is now mine. Your phone number is now mine. Just think about how scary that sounds. If someone can take your phone number from you, they can pretty much become you. So much of our identity is tied to our phone number.

25:23Yes, they can text the people you know as you. They might be able to call your bank and pretend to be you. But perhaps the scariest is that they can often recover some of your accounts. Like if you have a Google account and you go there and say, oh, I forgot my password. They might have an option to text you a code to confirm it's you. And they text you thinking nobody in the world is going to have access to your phone except you, right? Which you can use to reset a Google account. And now you have access to their email, drives, photos, and maybe even their YouTube channel and more. And once they have control of your main email account, they can just go through and reset your other accounts.

26:03Say you lost your Twitter password. It'll say, okay, no problem. Let's email you a new one. And so now they can get into your Twitter too. And this whole thing hinges on whether or not you can convince the T-Mobile customer service rep that you really did lose your phone and to get them to switch SIM cards for you. So were some carriers easier for you than others? Yeah, T-Mobile by far was the easiest. It was insane. Sometimes you'd have to brute force these calls. So you'd have to call 10 or 15 times until you get an agent who just doesn't care enough. And you'll just swap it. T-Mobile was insane.

26:35you just make one call and they do it willy-nilly happily just swap this in. AT &T was definitely the hardest on them. Verizon I'd say was in the middle. Sprint as well although not many people used it Sprint was another one and then I think Cricket is what it's called. Cricket and Sprint were pretty easy too but as it got harder people started to look into exploits on the actual websites of these carriers. So there's a couple of well-known exploits in AT &T and T-Mobile that people would use to either retrieve the pin off someone's account or remotely swap the same to themselves or pull their information or whatever else.

27:14It's crazy to me how in-depth of knowledge you have of this, right? You understand wireless carriers of the world and SIM cards and the usernames and passwords and computers skills are just going higher and higher. And yet you have to go to like, I don't know, history class and learn about the war and stuff like in the afternoon and then go back to like this crazy technical stuff. Did it feel like you were living two different worlds? Yeah, definitely. And nobody knew about it in my personal life.

27:50So that was the thing. You kind of have this detached personality where in person you're a completely different guy. And then when you're online, it's like your brain is in a different place. So you completely dissociate from your real life. So it's like two separate personas that you have. It was like that the whole time. Yeah, I mean, it's also interesting to look at maybe some of the other kids in school who are trying to build up their social media, right? And you see these people who are on Instagram and you're like, all right, so you've got like 300 followers. I can get you to count by this afternoon with a million followers.

28:24What's the deal here? There's no game. Did you ever look at that like that? Look at these fools. It was actually exactly that. I mean, when you're young and impressionable like I was, I thought I was on top of the world and way smarter than everybody else. So I would kind of look at them and be like, oh, you're an idiot. How do you not know what I know? Or how are you so impressed or whatever else? Well, you had to know that what you were doing is not exactly the straightforward way to do things. It's the back way, wrong way, and it works way, but it's not exactly the way you're supposed to. Yeah, yeah, of course.

29:02I mean, it's hard to know that though, right? The ethical compass isn't quite as aligned as it should be because when you go online, this is all you see, right? And it's kind of like if you really want to get married and you go online and all you see is other people getting married and other people's engagement photos and their marriage and all this stuff. And he was like, I want to get married so bad. And it's like all you see, right? And so it's like everyone's getting married but me. And so when you go online, you're just like, dang, everyone's getting paid but me. I got to get paid too because this is all you see.

29:32Your mind is kind of tuned into it. Yeah, exactly. And so it's hard to know exactly what is right and wrong in this world when everyone's around you is doing this stuff. And it's like, okay, I'm not even going to ask if this is legal or not. But if you guys are getting away with it, I guess it's not so bad. Yeah, there is no forethought of illegality, at least back then, because it was, like I said, it was completely separating the real world from a computer screen. So you wouldn't even be thinking of legality because it wouldn't be an idea or a thought in your head because you're in this other world, essentially.

30:08Quite often people come to me in a panic, telling me that someone just took over their Instagram, Twitter or Facebook account, and they can't log in anymore. And they ask me, what should I do? And unfortunately, I don't have a good answer. I mean, you can open a ticket with that site and ask for help. But because the site is so overwhelmed with help tickets, it's likely that your ticket gets ignored. It's as if their support team doesn't exist. But really, that's like the only option I have. Go through support to get it back. I would tell them to go on LinkedIn. sort by company employer and look through all the people that work at Twitter and Instagram and just message them all on LinkedIn and hope someone sees your message and helps you out.

30:51That's probably the only way it's happening. Yeah, but it does sound like the other way is to go hire a hacker to get it back as well. I'm never going to recommend that, but gosh, that sounds like the more likely way to get it back. I'm sure it's a thought for a lot of people, yeah. So up until now, the reason why Connor would do a SimSwap was to steal someone's Twitter or Instagram account so he could sell it on OG users. There was this direct connection between SimSwapping and making money selling users. Granted, it's criminal, but he didn't care. But then he started learning about cryptocurrency.

31:29By the time you start doing your SimSwap for crypto, how old are you?

31:35Must have been 17, 16 or 17. So were you out of school by then? No, I would have been still being in school. Okay. It was my last couple of years of school. Yeah, you're doing that sort of thing. Do you have extracurricular activities at school that you're doing stuff to? No, no, thanks. As soon as school's out, you're like, I'm going straight home. Yeah, exactly. That's when I went to school. That's where all my friends are. My friends are home. Why would I go somewhere else? Exactly. So you go home, you log into the chat app, whatever it is, like you just said. and you just sort of like, what's the crack?

32:09What's everyone up to? Yeah. We're going to forums and trawl around and see what's going on that day. And what would some of the stuff you'd see?

32:23Just the marketplace is really and what people are up to and what's happening in the kind of community that I was in on these forums. I mean, was it addicting to the point where you're like, I want to check to see what's going on. I want to see what's going on. I want to see what's going on. Or was it like, no, I'm going home to play. video games and I'll check on it maybe Sunday night. Yeah, well, see, I would game and look at it intermittently. So I would game a lot. I would sometimes game with these people and then I would check back on the forums or check in with the other people and see what's going on.

32:51Counter-Strike. You moved on. Years ago. Yeah. I knew it. Yeah. All right. And you're griefing on Counter-Strike, I bet, too. You hit your own teammates. Yeah. Yeah. Exactly. Oh, I hate you. The thing about crypto is you have to secure your own. With traditional money, a bank will secure your money for you. And if they get robbed, they're insured, so they still have your money. But that's not the case with cryptocurrency. People have to stand up their own security. And some people are worse than others at this. And Connor's friends were starting to go after people for their cryptocurrency instead of their usernames.

33:34because stealing their cryptocurrency is way more valuable than stealing their usernames. Someone had messaged me. I think they'd sent me like a blockchain explorer link of their wallet and I had like maybe 10 or 15 Bitcoin. And I messaged them back like, how did you do this? Like, how did you get this money? And then they kind of introduced me into sim swapping for crypto then. And that's where it all started. Oh, yeah. We're 30 minutes in and now we're going to get started. But we're going to take a quick break first before we do. Stay with us.

34:34is that you don't need to spend hours poring over every little detail. Shopify has thousands of templates and tools that help streamline website creation, making sure your site isn't just aesthetically pleasing, but functional at the same time. And you can draw customers in with the ease of convenience and checkout with ShopPay, Shopify's expedited checkout that saves customers information and reduces hassle. This Black Friday, join the thousands of new entrepreneurs hearing for the first time with Shopify. Sign up for your free trial today at shopify.com slash darknet. That's shopify.com slash darknet.

35:09Go to shopify.com slash darknet and make this Black Friday one to remember.

35:17Connor was adept at sim swapping and Bitcoin and now was ready to combine the two. I kind of had joined calls with these guys and I'd be witnessing them carrying out these heists while I was in the call and then I kind of ended up getting involved. The first one I can't remember, I'm sure it was someone on Twitter that was parading about having crypto and they were chosen as a target. Yeah, step one of robbing someone is to figure out who to rob. He's got the skills to get into someone's account if he knows their phone number and stuff. So now he just needs to figure out who are the people with a lot of crypto out there and then try to target them.

35:55So my main role throughout the whole thing really was seeking out people with crypto, So doxing them and then sharing this information. And then my other group members would carry out the SIM swap process. And sometimes I would help with that. Sometimes I wouldn't. So my role was really the pre-attack OSINT, I would say. Since he was in Ireland, it was harder for him to navigate the whole SIM swap aspect since a lot of targets had American numbers and stuff. So his job was to find the people who had crypto. And really, it wasn't that hard. A big thing was Twitter. Obviously, a lot of people in the crypto community are active on Twitter.

36:35So sometimes people would post stupidly or not stupid. Really, really, they should be allowed to post their wallet balance. But people would post their wallet balance on these social media sites, Twitter, for example, stating that they had 100 bitcoins or something like that. And then they didn't become a target for us or for other people doing the same thing. Another thing was altcoins. So people who create their own crypto, we would target. They'd typically be teams of 10 or 15 people that would always have a CEO and a CFO. So they were the two roles that we would target. The CFO is obviously the chief financial officer.

37:09So they're normally in charge of the assets. And then the CEO would have a big stake in the actual altcoin. So we would normally target people either on Twitter or target these team members of up and coming altcoins. If you have crypto, the first step in securing it is to not let anyone know you have it. because if it's not Connor and his lads coming after you, it'll be North Korea coming after you or maybe even your own government if they don't like you having crypto. And on top of that, don't use your real name online. It just makes it easier for everyone to find your address and where you work and everything.

37:41What some Twitter users were doing, they were using their real name and posting their wallet balance. And this would immediately make Connor zoom in on them and he would start a new document and just start going through his methods to find information about them. There's a couple of different ones. One good one is, say you knew their full name and you knew their approximate location. So let's say you're Jack and you're living in Tampa, Florida or somewhere like that. If you had maybe posted on Twitter about ordering your favorite Asian food and you had maybe a bag that had the restaurant's name on it, we could call that restaurant.

38:16And then you could say, my name's Jack. I want to place an order. Do you have me on file? I just want to make sure you have the right address. the person working in the Chinese restaurant that you've ordered food from before would then reiterate your address to who they think is Jack and then you'd have their address there in front of you. Going back to the exploits as well AT &T and T-Mobile had exploits at some point. AT &T you could put in a mobile number and then you could pull back their SSN or the last word of SSN from their AT &T account unauthorized. That was a big one that we used many other people abused if you couldn't find their SSN on the other sources.

38:56He wants as much information as he can get about them because the more he knows, the easier it'll be to hack into their digital life. Yes, you'd namely need the full name, the address, the last four of the SSN. You might need the last four of a debit or credit card number. In some cases, a date of birth. You might need a mother's maiden name, previous addresses maybe, all these different types of things. But I mean, they were all easily sought out online. So we would essentially profile them before we executed the attack. So we would have a full docs, like all their family, their previous addresses, like a huge list of information about them.

39:37So when it came to that time, we weren't lacking any information. It was just, we were ready to go. Ready to go, as in, he'd hand this information to the other guys in the group and say, okay, I found a guy with 100 Bitcoin. Here's his info. I think he's a good target. Should we? Because the thing about stealing crypto is that there's no way to reverse the transfer. There's no central authority. There's no support ticket to open. If you snatch it, you can keep it. Unless, of course, someone catches you. Now, as he said, he's not operating alone here. Once the other guys decide that this is a good target that he found and he has info on, then other people join in to do this M-Swap process and the heist begins.

40:15Typically, I'd be waiting at the reset password screen. So we'd all be in a call together on Discord. And someone would be doing the same swap process, and I would be ready then to reset the password and input the 2FA code. So they'd let me know when it was go time, really. And I would send a code. They'd read it out to me and reset the password and then start looking true. The code he's waiting for is to get into their Gmail. He knows their Gmail address, and he started the login process, but said, I forgot my password. And it asks him, okay, do you want us to text you a code to let you in? So his finger is on that button, waiting until the SIM swap happens before he says yes.

40:55And so as soon as they get the SIM swapped, he says, yes, go ahead and send me that code. And then the person reads off that code over the phone and he can log in. It's all very coordinated and done extremely quickly. What are all the roles going on here, right? So you've got you as the OSINT doxer targeting person, and then there's someone who does the SIM swap, and they're the holder of the phone as well, right? The holder, exactly, yeah. Is there a holder that's a different person than the one you're calling? It depends on the circumstances. So, no, you'd always really have a holder, at least back then anyway.

41:30So you'd have someone that would find the target. You'd have someone that would engage with someone to SIM swap the target. You'd either do it themselves or they'd engage an employee of a carrier. And then you'd have someone who's the holder. So that's the person who's physically holding the phone and replacing the SIM card in the phone with the blank SIM that the number has been swapped to. So you're on a call with the holder and the SIM swapper. So the SIM swapper is like, okay, hold on, let me call him, try to get it. No, it's not working, let me call again. No, it's not working, let me call again.

42:02Okay, it worked. I got him to port the number. Do you see a holder? And the holder's like, yeah, it's active. Okay. And then you're like, okay, great. I'm going to initiate a password reset. Tell me the number. And then the holder's like, I don't see it yet. I don't see it yet. Okay, here it is. Is that kind of how those calls went? Yeah, that's exactly how they went. It was like clockwork, the process. So eTrell would execute their action and then he'd go then directly after that. So the holder would say the same is active. As soon as the same is active, then you send the reset code and you get going.

42:35Then it's the email. Connor's second task is now to find the crypto. They got access to this person's phone and Gmail. And they're assuming somewhere in this digital life of theirs must be the keys to their crypto wallet. And all they need is a seed phrase or a private key. And these are very important to keep safe and have backups of. So a lot of people store them somewhere in their online world. So as soon as Conor gets in, he immediately starts sniffing for blood. So the first thing, which is crazy the way that it was and still is. So if you have a Gmail account, go into Chrome. If you're assigned into your Chrome account with your Gmail address, if you type in passwords.google.com, it'll pop up.

43:17You'll be prompted to put in your password. Once that's done, you'll be prompted with a page that has every single website you've used. And the password, if you've saved that password for that website, But this would sync across devices. So say I took your Gmail account and you had saved your Twitter password or your Gemini or whatever, your Binance password onto your Gmail account. I could log into your email and view all these saved passwords, which would then allow me to just use them and log straight in. And in the event that I needed 2FA, we had your phone so we could get that code. Okay, hold it.

43:51Just stop right there. I just tried this and I'm so upset right now. I've been using Gmail since like 2007 or so. And in the last few years, I've taken drastic measures to de-Google my life. However, I just logged into my Gmail and then went to passwords.google.com, just like he said. And what do you know? Some of my most sensitive passwords are sitting right there, easily organized and in clear text. I must have told Google at some point, yeah, you can remember to log into this site. And it did. But I have my own password manager. I don't ever remember using Google's password manager, yet I'm looking at my logins here and I'm miffed about it.

44:30Dang, there's even an option to export all these passwords too. And it shows me all the sites I've declined to save passwords for. Like, this just lays out my whole digital life. And I had no idea Google was saving any of this. And I'm a guy who's super focused on computers and security and tech and privacy. I can't imagine how a non-techie navigates this. I deleted all my passwords from here. and the sites that I said I want to opt out of saving passwords for because I never want Google to be storing my passwords. I've just been finding more privacy-focused apps to use instead of Google. Most of their products are not end-to-end encrypted.

45:05And I feel that my stuff is just too important to be subject for an eventual data breach or being subpoenaed or something. My sensitive data is either stored locally and never sees the internet at all or is stored on some end-to-end encrypted service somewhere. So even if it shows up in a breach, you can't be seen by someone. Taking your personal privacy seriously is the only way to make sure that your stuff is safe. Next thing then would be Evernote, which was the cloud now taking up. But a lot of crypto investors seem to use that for whatever reason. So we'd reset the Evernote account, look to the notes, see if we could find it.

45:42Nomex somewhere or seed phrase. We'd go through Google Docs, Google Drive, any linked cloud accounts, like anything that was there. Did you have like a regular expression that you were able to search for for seed phrases? Yeah, mnemonic or seed phrase or Bitcoin or crypto or you just try a plethora of different things and you need to find it eventually. Or you'd look in their sent emails. Sometimes people would send their mnemonic to themselves or a different email. So it'd be in the sent emails. But it is kind of an art. You'd need to know what to look for or else you'll find nothing like this.

46:20And is it just you in this account or other people looking as well? No, most of us would be logged in, looking simultaneously. But if you had too many people on at the one time, it would lock everyone out. So it would be probably two or three people. But just to go back to the OSINT stage, the pre-SIM swapping stage, I'll say, I missed this step. So what you could do is, say your email is jack at darknetdiaries.com or whatever. I could go on to coinbase.com, go into reset password and input your email. If your email existed in their database, it would send out a password reset form. If it didn't exist, it would pop up and say, this user does not exist or this email does not exist.

47:03So what we would do is try their email against these different services and we compile a list of services that we knew they used. So once we were in the email account, we would go to them directly straight away. so say I would try all the different crypto exchanges with their email see which ones they're registered to and then as soon as we have access to the account we can try them instantly so there's no time wasting yeah so they fix that if you try to reset an email password there it'll say well if we had an account here we'll send you the password right now and they don't give any sort of clue so the way to do it nowadays I believe it still works is just to go register at Coinbase with that email address and it'll say, oh, this account already exists.

47:47Okay, thank you. That's all I wanted to know. Yeah, not a great patch they put in.

47:55I don't mention this enough, but I do think that you should have a different username on every site you log in for. You already know how to use a different password for every site. Take it a step up and use unique email addresses or usernames for every site. Like what some people do is they'll get a domain. Like I have darknetdiaries.com and I have a catch-all email rule so that anything going to darknetdiaries.com I will get in my inbox. So I can make something like Coinbase at darknetdiaries.com or Evernote at darknetdiaries.com. As ever many email addresses as I want. I don't even have to create them.

48:30I can just use them because there's a catch-all email and gets them all. This way I can have unlimited email addresses and each one is unique for every single site I use. because you don't want people to be able to profile you by just taking your email that you use everywhere to register accounts for, and then they can cross-reference that or Google that or search databases to see what are all the accounts that this email address is valid for. When you're protecting your digital life, the goal is to make it as hard as you can for people like Connor. You can't have perfect security, but I'm a big fan of making it as painful as possible for someone to hack you because eventually they'll run out of time or energy to hack you and move on to the easier targets.

49:13I've said it before, being secure online is like running from a bear in the woods. You don't need to be faster than the bear. You just need to be faster than your friend in order to survive the bear. So that should be your personal goal, to be more private and more secure than your friends. I recently met someone whose privacy was way better than mine, I mean, we became friends and it really made me step up my game. And defense in depth is important too. Hiding all your most personal data behind a single login or account is a bit scary. But if you assume someone does get into your Gmail, why not also limit them to what they can see and do from there?

49:51Make them run into dead ends again and again. So like delete your emails when you don't need them anymore. I don't know about you, but every time I get a new Windows or Mac computer, I create a fresh Microsoft or Apple account just for that machine, which is not tied to any other profile that I use. And that severely limits the damage that can be caused if someone gets into that account without my consent or gets breached or something. Oh, and I should also mention, it's a good idea to use two-factor authentication that isn't SMS text messages because he had access to the person's phone, right?

50:23If the 2FA code can be sent by text, he can get it. But if you're using something like Google Authenticator for 2FA codes, that's harder for him to access. However, as you know, I'm skeptical about what Google is collecting about me. They want it all. So I personally use Aegis to store my 2FA codes. That's spelled A-E-G-I-S. It's an open source app that works great for this. And in my opinion, it's way more private than Google Authenticator is or Authy. God, I gotta stop ranting about privacy. Sorry. All right, let's get back on track. All right, so let's say you find a private key. What do you do?

50:59So if you found a private key, you'd load up the wallet. Say I found an Exodus key, I'd have an Exodus client downloaded and ready. Or I'd have a couple of different clients. Say I found a Bitcoin private key, I could go into Exodus or blockchain and import that seed phrase and have access to the wallet. No, just because they found the private key or seed phrase doesn't always mean there's crypto in that wallet. So there's a moment of truth. Does this wallet have money in it? You're right. Nine out of ten times, you wouldn't know what's in that wallet. So you could put it in and you could hit nothing.

51:30You could say zero. You could put it in and it would say$1 ,500 ,000,$600 ,000. So you'd be on this call and you'd input this wallet and you'd see X amount of money and you'd be freaking out. And then everyone would collaboratively freak out then altogether on the call. It would sound like monkeys in a zoo. Once we had access, then we would send the funds to a newly created wallet. And then from there, we would disperse the funds evenly from that fresh wallet. And just like that, the heist is a success. Each of the people involved would get their cut and go on their merry way. Some would convert their Bitcoin to Monero to make it harder to trace.

52:11Others would convert it to cash and some sort of street deal type thing. And others would just try to buy crazy things with crypto. And of course, once they were able to steal money and get away with it, they wanted to do it again and again. So it became a regular thing for these guys. And Conor went along on a number of crypto heists. There were ones that were smaller sums of money in maybe the tens of thousands. And then there were some that were low to high six figures. The biggest one was$2 million. $2 million in one wallet. In one wallet, yeah. Or I think it might have been spread across a couple of different ones.

52:46But it was one victim that was$2 million. That was kind of a freak out moment when that happened. that sounds like quite a high yeah it was and that's the thing you know it wasn't really about the money for me like I didn't spend if you look at all the other people there was a kid arrested recently I don't know if you've seen it but he stole hundreds of millions of crypto through sim swapping but he was spending his money on luxury cars and bottles and clubs I wasn't that type of person like I think I spent a hundred thousand max out of two million that I had um so it was more the high that I chased and and uh the sense of achievement that you'd get when you found the wallet looking back now it's pathetic getting the achievement from that but back then it was it was like a high and it just became addicting then this I mean again it's still one of these crazy moments of like, whatever your family, what is your family life like?

53:47You got, you got, uh, you got like homework and stuff to do and your family's like, Dave, make sure you do your chores, Connor. You got to make sure to get this done and that, and you're like, okay, okay. And then, and then they're like, giving you like a few dollars for doing your chores or whatever. I don't know what's going on there. You just kind Like, oh, that's great. But I got, and then I just imagine like, mom, don't interrupt me. It's Friday night. We got it. I got a big thing going on tonight. Just please do not come in my room. Like, was it just in the bedroom of your parents' house?

54:21In the bedroom of my parents' house, yeah. But it's, I live with my mom, or I lived with my mom back then. And see, because I was making money, or a smaller amount of money back in the heyday and the older days before any of this started, I always kind of used to have a small bit of money just from different online ventures. But when this happened, I had kind of told her and the rest of my family that I was investing in crypto because this was at the point of the crypto boom where Bitcoin first exploded. So it was kind of believable that I had invested early with the funds that I made when I was 12 or 13 into Bitcoin and it's now exploded and multiplied my wallet when in reality it was stolen.

55:05So that was the, I mean, what were the excuses of just like, hey, I'm busy tonight. Please don't schedule dinner. Like, just bring dinner in the room. Like, I'm not going to come out because I'm on a really intense investment thing. What are you saying to her? Yeah, see, I was kind of a hermit already. So it wasn't unusual for me not to leave the room for extended periods of time. So it's, I don't know. She didn't really suspect much because she was so used to it from years and years of me being like that. Yeah. And I've watched these old Western movies where the bandits robbed the train or whatever or the gold mine.

55:48And they kill people on the way to do it, right? But then there's like three or four bandits involved in this. And they're camping out there in the desert or whatever. And they're looking at each other like, I could kill these other two guys and then I don't have to split my cut. was that kind of experience happening? Because like you said, you see someone post on Twitter, hey, I've got$100 ,000 in crypto. You're like, there's my target. Well, if somebody sees your chat, like, oh, these kids just stole$100 ,000. There's our new target. Let's target these kids. Well, like other people targeting us?

56:23Yeah. No, not for me because of where I am, but I know what happened to a lot of other people in the States. There was a lot of swatting and doxing and various things going on between the community. People would get pissed off. Targets would be stolen and people would start doxing people, sim swapping them, swatting them, crazy things. I know there's a bigger community now of violence as a service, which people are now using to hire people to commit violent acts against other community members, like throwing bricks through windows and things like that. That wasn't a big thing back then, but I know it's increasing in popularity now.

56:58All right. Did we reach the height of this? like is this where things start going wrong yeah so after the two million one that was really where I called it quits I mean I wanted to for a long time but that the big one someone kind of reached out to me and I said I joined in and then we did that and I got my split and that was it I was done and that went on for a good while I think that was in 2018 Yeah, so altogether you said you made about$2 million from all this. Yeah, roughly around there. Like you said, you stopped at around$2 million. Was that a goal to hit$2 million and then say, I think I've got enough for a while?

57:42What was your future plans? No, yeah, I'll get into the future plans in a minute. But no, there was no monetary value. I think at that point, just before that hack happened, And I think I was kind of, my moral compass was starting to develop and my conscience was starting to develop as well. So I kind of started realizing that it was wrong. And then that happened. And then I kind of knew I can't do this anymore. This is what I'm doing isn't right. And I'm stealing money from people. And that's when I kind of stepped away from it. In terms of the exit plan, I had looked at a couple of different things.

58:23There's a couple of islands. one that I was looking at with St. Kitts and Nevis so you could purchase a citizenship through ownership of property so say you could buy a three bedroom house for$300 ,000 and they would give you a passport and St. Kitts and Nevis or these islands I think they're the Virgin Islands or something like that they have no income tax so I was kind of thinking of buying a house there moving over there and somehow laundering my money I mean it was a pipe dream now that I think of it now but back then that was my plan of action. That's a funny plan because that sounds like I don't know gangster drug dealer plans of like okay we're just going to rob one more bank and then we're going to disappear into the Virgin Islands and it's not a plan for an 18 year old to be like I'm retired at the age of 18 and then I'm just going to live on the island forever now.

59:17It's a weird feeling. I don't know what I'm hoping but It's like, okay, now I have this money. I'm going to start a big business and I'm going to start the startup and I'm going to do this great stuff. After that, I had kind of, or before it ended, I had kind of started thinking about how to legitimize my skills. So I was thinking of maybe opening up a cybersecurity consulting business because of what I was doing, which is ironic. But I was thinking of using my funds to create a business to protect people online or help them protect their organizations or themselves. So that was also part of the exit plan to create my own consulting company in that space.

59:53But yeah, that never panned out. You had these plans. You're like, okay, that's the end. Last one. That was a big, nice one. Do you just leave the group entirely? Yeah, kind of, yeah. It got to a point where I had stopped. And then I was so paranoid that every day I would be searching SimSwap arrest and things like that. One day I had woken up and checked my phone and I had searched this term and I had seen one of the people I was associated with was arrested over in America, in the States. And that's when I kind of knew my time was coming, once I seen this article. And then it was really just a countdown then after that.

1:00:36Yeah, so what did you do after that? Nothing. I just waited. You got to go to the Virgin Islands. No. Now's the time. Go, go, go. Because like I said, my conscience was growing more and more guilty. I was developing as a person. I was a young adult, so I was growing older. My brain was kind of developing out of being a stupid little kid stealing money. So, I mean, my guilty conscience just told me to just wait and get arrested. And that's what happened. One of the holders in this group, the person who had the physical phone during the SIM swap, was just 15 years old. and his parents heard him calling T-Mobile trying to act like someone else lying on the phone his parents caught him in the act and they called the police on their own kid or so the story goes that 15 year old was very cooperative with the police which Connor thinks is how the police learned who he was well that and Connor simply went by Connor in the group that he was with so his OPSEC wasn't really that good I was woken up by a knock on the door while I was in bed My mother let them in.

1:01:42I'd say 12 to 15 police officers came into my room. Your mother probably had no idea. No clue at all. That you had done anything illegal. Yeah. Okay, so 12 officers come into your room? There was a huge amount, yeah, because they obviously needed a search team, and they didn't know whether I was going to kick off or try and hurt them. That's got to be quite the shock to be sitting there playing CSGO or whatever and turn around and say, 12 officers in your room. Like, well, hold on, fellas. Yeah, so I was actually asleep in bed, so I had woken up. I'd sat up and opened my eyes, and in a semicircle surrounding the end of my bed was this mass amount of police officers, and I thought I was dreaming, so I went to grab my phone next to me, and they kind of shouted at me, put the phone down.

1:02:25I went to go and check the time, so that's when it hit me then that this situation is happening now, and there's police in my home. Do the police in Ireland have guns? No, not normal officers, no. Okay, so you had no guns pointed at you? Not from what I can recall. There might have been a couple of armed officers, but I highly doubt it. I mean, they knew what they were getting into when they raided me. They knew this fat little 18-year-old wasn't going to pull out an AK-47 and start shooting them. Well, they had no idea, but that's why they brought 12 of them with them. Like, hey, it's not just some fat little 18-year-old.

1:03:01We got to really muscle this guy if he does something. Okay, so that's quite a shock. So I imagine they start talking with you. They take all your devices? They took all my devices. I'd asked to see the search warrant, and they produced it. The United States versus Connor Freeman or whatever, extradition request search warrant. And then it all started becoming real. They started searching everything and then brought me down to the station and booked me into the system then. Did you tell them you did it or did you talk or what? No, I kind of acted ignorant. But I mean, the evidence was substantial that they had.

1:03:44So, I mean, they weren't relying on me saying I did anything. I mean, I was kind of screwed either way. So, I mean, I didn't really have to tell them anything. I was just arrested. I was brought down to the police station and they carried out a search and she had stolen my devices. Okay, so the United States wanted you. They didn't want you. This was not an Irish investigation. That's correct, yeah. Well, that's scarier, I think, because the United States is more harsh on criminals than the Irish. Well, I wouldn't say that. I mean, maybe in terms of headline sentencing, but for white-collar crime, I think they're pretty similar.

1:04:28but it was an extradition request so there's an extradition treaty between the USA and Ireland that they can I don't know exactly how it works but the USA can conscript Irish police forces to carry out an arrest on their behalf to be extradited back to the States so that's what happened So you went to the United States? No, didn't go to the US, no so I was arrested on this extradition warrant and I was booked into an Irish jail but they had sought my extradition so it's obviously a long legal process before that actually happens so I was booked into an Irish jail and I was there for a couple of weeks and then I was kind of released so when my property was searched I had all my crypto on a Trezor, a hardware wallet that was never found when my house was being searched so while I was on bail I had made an agreement with my lawyer to hand over my crypto wallet to the Irish police to then hand over to the U.S.

1:05:35So I'd given up all of my assets voluntarily. That's a decision I've heard that other criminals in your situation have to think hard about. Because the two options are hold on to it until after all this is over, maybe 10 years from now, and I come back and there's all this crypto that I could just live off of. Or give it all up in order to reduce my sentencing. And hopefully that's a nice gesture that they notice and think positive of me for giving it. Yeah, well, it was a mix about, to me, really, it was dirty money. So whether I had it or not, I didn't care. I didn't really want to be in possession of it anyway anymore because I just didn't feel right having that money.

1:06:19So we made an agreement. I'll give it back to them. And that obviously went in my favor in the end. But yeah, I was in jail for about a month and then I was released on bail. And then the legal process went on for quite a while until I was eventually sentenced. I thought there was an article where I saw that you were going to get 108 years. Yeah, so the headline sentence in the USA was 108 years. That's the maximum penalty for each of the charges added up consecutively. I mean, did you freak out if you heard, did you hear that that was a possibility or you were going to go to prison for 108 years?

1:06:59It definitely freaked me out, yeah. What did they sentence you to? So I got three years in prison and then because I spent a month in jail, I was given one month off, so it was two years and 11 months. and in Ireland typically every prisoner gets a quarter of their sentence off but if you're sentenced to under three years you get a third of your sentence off so I served 11 or 12 months in total out of the two years, 11 months So what was prison like? It was fine I mean it helped me a lot in some ways It was fine Well I mean prisoners, prisoners, it was as fine as it can be A lot of people ask me how did it feel when when I got arrested and I spent my first time and first night in jail.

1:07:45And they're weirded out when I say it felt great. But like, that was the best sleep I'd had in years because I my conscience had grown so guilty and I had felt so bad like I was sleeping horribly for a long time. So when I finally got arrested, it was kind of like a kind of moment like I could sleep peacefully knowing that this was the end of things. How did you pass the time in prison? Exercising and reading, really. I read a lot and I exercised a lot. What kind of books did you like reading? A lot of self-help books. Yeah. Okay. So how long have you been out of prison? I've been out since 2020, I think.

1:08:28What's going on now? I literally just finished a master's degree in cybersecurity last month. So I was doing that for two years. after I got out of prison I think I'd been out for about a year and I'd seen it a college here was offering a course in a master's in cyber security and I'd applied for that and luckily I was accepted and undertook that for the last two years so I've just finished that last month similar to what you wanted to do right which is to help people get secure yeah it's kind of it's turned around a lot the opposite of what I used to be

1:09:36my phone SIM swap proof. So I opened up the little SIM card tray and I filled it with glitter and hot glue. Now if someone tries to get in there, they're going to get a dazzling surprise. This is Darknet Diaries.