Fake Wallet From Reddit - Revision history

Azoundria: COMPLETE 30 minutes. All sources updated with titles. Brian Krebs Tweet source updated with quote from Twitter. Adding extensive further information on both culprits and families. Fixing spelling of Oliver Read. Added further information about the lawsuit complaint and jury trial demand. Located and added information about the specific transaction.

2025-02-12T23:23:57Z

COMPLETE 30 minutes. All sources updated with titles. Brian Krebs Tweet source updated with quote from Twitter. Adding extensive further information on both culprits and families. Fixing spelling of Oliver Read. Added further information about the lawsuit complaint and jury trial demand. Located and added information about the specific transaction.

← Older revision		Revision as of 17:23, 12 February 2025
Line 3:		Line 3:
	In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The teenagers did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years finding the culprits and attempting to sue them. However, the statute of limitations limits claims to 2-3 years.		In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The teenagers did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years finding the culprits and attempting to sue them. However, the statute of limitations limits claims to 2-3 years.

	This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232~~" /><ref name="briankrebstwitter-6233~~" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" /><ref>https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903 (Accessed Jan 31, 2025)</ref><ref>https://bitcointalk.org/index.php?topic=5357642.0 (Accessed Feb 6, 2025)</ref>		This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" /><ref>[https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903 Anatomy of a Bitcoin Heist: The Electrum Atom Malware Saga - Nick Bax Medium] (Accessed Jan 31, 2025)</ref><ref>[https://bitcointalk.org/index.php?topic=5357642.0 Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents - BitcoinTalk] (Accessed Feb 6, 2025)</ref>

	Unsure if related:<ref>https://web.archive.org/web/20171227183707/https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom?tab=readme-ov-file#readme (Accessed Jan 31, 2025)</ref><ref>https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom (Accessed Jan 31, 2025)</ref>		Unsure if related:<ref>https://web.archive.org/web/20171227183707/https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom?tab=readme-ov-file#readme (Accessed Jan 31, 2025)</ref><ref>https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom (Accessed Jan 31, 2025)</ref>

	== About Andrew Schober ==		== About Andrew Schober ==
	Andrew Schober lived in Colorado, USA.		Andrew Schober lived in Colorado, USA<ref name="yahoomovies-6235" />.

	== The Reality ==		== The Reality ==
Line 15:		Line 15:
	Schober had downloaded a malicious cryptocurrency wallet app from Reddit, which was reportedly created by the minors<ref name="decrypt-6229" />.		Schober had downloaded a malicious cryptocurrency wallet app from Reddit, which was reportedly created by the minors<ref name="decrypt-6229" />.

	=== ~~Oliver Reid / Janders6~~ ===		=== Benedict Thompson ===
	~~Oliver Reid used~~ the ~~username janders6~~<ref name=":0"~~>[https://bitcointalk.org~~/~~index.php?action=profile;u=1306048 janders6 Profile - BitcoinTalk] (Accessed Feb 6, 2025)</ref~~> ~~on BitcoinTalk.~~		Mr Benedict is from Southampton, Hampshire, and “currently studying Computer Science at the University of Warwick.”<ref name="yahoomovies-6235" />

	=== rad3onx ===		Benedict's father's name is Edward J. Thompson<ref name="krebsonsecurity-6230" />, and his mother's name is Claire L. Thompson<ref name="krebsonsecurity-6230" />.

			=== Oliver Read / Janders6 ===
			Oliver Read used the username janders6<ref name=":0">[https://bitcointalk.org/index.php?action=profile;u=1306048 janders6 Profile - BitcoinTalk] (Accessed Feb 6, 2025)</ref> on BitcoinTalk. He also widely used the username rad3onx<ref name="krebsonsecurity-6230" /> and Swagoi<ref name="krebsonsecurity-6230" />.

			Mr Read is described as being from Bradford, West Yorkshire, and studied computer science at Greenhead College in Huddersfield.<ref name="yahoomovies-6235" />

			Oliver's mother's name is Hazel Davina Wells<ref name="krebsonsecurity-6230" /><ref name="yahoomovies-6235" /> and his father is Paul Read<ref name="krebsonsecurity-6230" />.

	== What Happened ==		== What Happened ==
Line 67:		Line 74:
	\|Careful On This Warning		\|Careful On This Warning
	\|A user on BitcoinTalk posts the Twitter post by ElectrumWallet, which notes that Electrum Gold is confirmed malware, and warns users to be careful<ref name=":2" />.		\|A user on BitcoinTalk posts the Twitter post by ElectrumWallet, which notes that Electrum Gold is confirmed malware, and warns users to be careful<ref name=":2" />.
			\|-
			\|January 28th, 2018 12:25:04 AM MST
			\|Andrew Schober Wallet Transaction
			\|After failing to notice that the wallet address had been modified by clipboard malware which was inadvertently installed on his computer, Andrew Schober sends his 16.45520843 BTC from his wallet to a wallet owned by the defendants<ref>[https://www.blockchain.com/explorer/transactions/btc/a6db589147ec24d3d97acf244ac957cbfaeaf145d04c06ec57d782a62c365169 Transfer Of 16.45520843 BTC From Andrew Schober To Malware Address] (Accessed Feb 12, 2025)</ref>.
	\|-		\|-
	\|October 21st, 2018		\|October 21st, 2018
Line 79:		Line 90:
	\|Unknown Cheats Forum		\|Unknown Cheats Forum
	\|The last activity of rad3onx on the Unknown Cheats Forum<ref>[https://www.unknowncheats.me/forum/members/881032.html Member rad3onx's Profile - unknowncheats.me] (Accessed Feb 6, 2025)</ref>.		\|The last activity of rad3onx on the Unknown Cheats Forum<ref>[https://www.unknowncheats.me/forum/members/881032.html Member rad3onx's Profile - unknowncheats.me] (Accessed Feb 6, 2025)</ref>.
			\|-
			\|May 21st, 2021
			\|Complaint And Jury Trial Demand
			\|A complaint and jury trial demand is filed in the District of Colorado<ref>[https://krebsonsecurity.com/wp-content/uploads/2021/08/schobervthompson.pdf Complaint And Jury Trail Demand - Krebs On Security] (Accessed Feb 12, 2025)</ref>.
	\|-		\|-
	\|August 9th, 2021		\|August 9th, 2021
	\|Initial Disclosure		\|Initial Disclosure
	\|Initial Disclosure submitted to court. Defendant Hazel Davina Wells submits her initial disclosures under Rule 26(a)(1) of the Federal Rules of Civil Procedure. The disclosure includes a list of individuals with relevant information, such as Defendant Oliver Read, who has knowledge of correspondence from the Plaintiff, cryptocurrency mining, and UK police involvement, and Defendant Hazel Davina Wells, who has knowledge about the Plaintiff’s correspondence and her son’s questioning by UK police. The document also lists various correspondences, including those between the Plaintiff and the Read Defendants, and affirms Wells will supplement her disclosures as needed during discovery. Additionally, it includes a certificate of service stating the document was sent to the parties involved in the case.		\|Initial Disclosure submitted to court. Defendant Hazel Davina Wells submits her initial disclosures under Rule 26(a)(1) of the Federal Rules of Civil Procedure<ref name="krebsonsecurity-6230" />. The disclosure includes a list of individuals with relevant information, such as Defendant Oliver Read, who has knowledge of correspondence from the Plaintiff, cryptocurrency mining, and UK police involvement, and Defendant Hazel Davina Wells, who has knowledge about the Plaintiff’s correspondence and her son’s questioning by UK police. The document also lists various correspondences, including those between the Plaintiff and the Read Defendants, and affirms Wells will supplement her disclosures as needed during discovery. Additionally, it includes a certificate of service stating the document was sent to the parties involved in the case<ref name="krebsonsecurity-6230" />.
	\|-		\|-
	\|August 25th, 2021 5:52:00 PM MDT		\|August 25th, 2021 5:52:00 PM MDT
	\|Krebs On Security Article		\|Krebs On Security Article
	\|Brian Krebs from Krebs On Security promotes his article about the situation. "Andrew Schober was robbed of ~$1M in bitcoin in 2018. Investigators he hired found 2 minors in the UK who allegedly authored the clipboard stealing malware that siphoned his bitcoin. Now he's suing the kids' parents after they refused to return the $"		\|Brian Krebs from Krebs On Security promotes his article about the situation. "Andrew Schober was robbed of ~$1M in bitcoin in 2018. Investigators he hired found 2 minors in the UK who allegedly authored the clipboard stealing malware that siphoned his bitcoin. Now he's suing the kids' parents after they refused to return the $"<ref name="briankrebstwitter-6233" />
	\|}		\|}

Line 186:		Line 201:
	<ref name="krebsonsecurity-6231">[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Accessed Feb 4, 2022)</ref>		<ref name="krebsonsecurity-6231">[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Accessed Feb 4, 2022)</ref>
	<ref name="nypost-6232">[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Accessed Feb 4, 2022)</ref>		<ref name="nypost-6232">[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Accessed Feb 4, 2022)</ref>
	<ref name="briankrebstwitter-6233">[https://twitter.com/briankrebs/status/1430679517857714177 ~~@briankrebs~~ Twitter] (Accessed Feb 4, 2022)</ref>		<ref name="briankrebstwitter-6233">[https://twitter.com/briankrebs/status/1430679517857714177 Brian Krebs - "Andrew Schober was robbed of ~$1M in bitcoin in 2018. Investigators he hired found 2 minors in the UK who allegedly authored the clipboard stealing malware that siphoned his bitcoin. Now he's suing the kids' parents after they refused to return the $" - Twitter/X] (Accessed Feb 4, 2022)</ref>
	<ref name="livebitcoinnews-6234">[https://www.livebitcoinnews.com/andrew-schober-is-one-of-many-victims-of-crypto-theft-but-hes-taking-action/ Andrew Schober Is One of Many Victims of Crypto Theft, but He's Taking Action \| Live Bitcoin News] (Accessed Feb 4, 2022)</ref>		<ref name="livebitcoinnews-6234">[https://www.livebitcoinnews.com/andrew-schober-is-one-of-many-victims-of-crypto-theft-but-hes-taking-action/ Andrew Schober Is One of Many Victims of Crypto Theft, but He's Taking Action - Live Bitcoin News] (Accessed Feb 4, 2022)</ref>
	<ref name="yahoomovies-6235">[https://ca.movies.yahoo.com/two-british-schoolboys-stole-nearly-184712819.html Two British schoolboys stole nearly $1m in Bitcoin and families refused to give it back, US lawsuit claims] (Accessed Feb 4, 2022)</ref>		<ref name="yahoomovies-6235">[https://ca.movies.yahoo.com/two-british-schoolboys-stole-nearly-184712819.html Two British schoolboys stole nearly $1m in Bitcoin and families refused to give it back, US lawsuit claims - Yahoo News] (Accessed Feb 4, 2022)</ref>
	<ref name="cryptonewsflash-6236">[https://www.crypto-news-flash.com/victim-of-malware-attack-sues-parents-of-thieves-who-stole-his-16-bitcoins/ Andrew Schober sues parents of young men who stole his 16 Bitcoins] (Accessed Feb 4, 2022)</ref>		<ref name="cryptonewsflash-6236">[https://www.crypto-news-flash.com/victim-of-malware-attack-sues-parents-of-thieves-who-stole-his-16-bitcoins/ Andrew Schober sues parents of young men who stole his 16 Bitcoins - Crypto News Flash] (Accessed Feb 4, 2022)</ref>
	</references>		</references>

Azoundria: COMPLETE 30 Minutes - Integrated information from BitcoinTalk, Unknown Cheats, Toribash, Reddit, Loyce Club sources into rest of article. Tweaked initial description. Started adding profiles for culprits.

2025-02-11T18:18:22Z

COMPLETE 30 Minutes - Integrated information from BitcoinTalk, Unknown Cheats, Toribash, Reddit, Loyce Club sources into rest of article. Tweaked initial description. Started adding profiles for culprits.

← Older revision		Revision as of 12:18, 11 February 2025
Line 1:		Line 1:
	{{Case Study Under Construction}}{{Unattributed Sources}}		{{Case Study Under Construction}}{{Unattributed Sources}}

	In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The ~~thieves~~ did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years ~~tracking down~~ the culprits and ~~is presently~~ attempting to sue them. However, the statute of limitations limits claims to 2-3 years.		In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The teenagers did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years finding the culprits and attempting to sue them. However, the statute of limitations limits claims to 2-3 years.

	This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" /><ref>https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903 (Accessed Jan 31, 2025)</ref><ref>https://bitcointalk.org/index.php?topic=5357642.0 (Accessed Feb 6, 2025)</ref><ref>https://loyce.club/archive/members/130/1306048.html (Accessed Feb 6, 2025)</ref><ref>https://bitcointalk.org/index.php?topic=2398686.0 (Accessed Feb 6, 2025)</ref><ref>https://bitcointalk.org/index.php?action=profile;u=1306048 (Accessed Feb 6, 2025)</ref><ref>[https://www.reddit.com/user/Rad3onx/ Rad3onx User Deleted - Reddit] (Accessed Feb 6, 2025)</ref><ref>https://www.toribash.com/forum/member.php?u=3111548 (Accessed Feb 6, 2025)</ref><ref>https://www.unknowncheats.me/forum/members/881032.html (Accessed Feb 6, 2025)</ref>		This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" /><ref>https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903 (Accessed Jan 31, 2025)</ref><ref>https://bitcointalk.org/index.php?topic=5357642.0 (Accessed Feb 6, 2025)</ref>

	Unsure if related:<ref>https://web.archive.org/web/20171227183707/https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom?tab=readme-ov-file#readme (Accessed Jan 31, 2025)</ref><ref>https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom (Accessed Jan 31, 2025)</ref>		Unsure if related:<ref>https://web.archive.org/web/20171227183707/https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom?tab=readme-ov-file#readme (Accessed Jan 31, 2025)</ref><ref>https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom (Accessed Jan 31, 2025)</ref>
Line 14:		Line 14:

	Schober had downloaded a malicious cryptocurrency wallet app from Reddit, which was reportedly created by the minors<ref name="decrypt-6229" />.		Schober had downloaded a malicious cryptocurrency wallet app from Reddit, which was reportedly created by the minors<ref name="decrypt-6229" />.

			=== Oliver Reid / Janders6 ===
			Oliver Reid used the username janders6<ref name=":0">[https://bitcointalk.org/index.php?action=profile;u=1306048 janders6 Profile - BitcoinTalk] (Accessed Feb 6, 2025)</ref> on BitcoinTalk.

			=== rad3onx ===

	== What Happened ==		== What Happened ==
Line 23:		Line 28:
	!Description		!Description
	\|-		\|-
	\|		\|August 6th, 2013
	\|		\|First Toribash Activity
	\|		\|The first activity of the account rad3onx on the Toribash forums<ref name=":1">[https://www.toribash.com/forum/member.php?u=3111548 rad3onx Profile - Toribash Forum] (Accessed Feb 6, 2025)</ref>.
			\|-
			\|May 23rd, 2014
			\|Last Toribash Activity
			\|The last activity of the account rad3onx on the Toribash forums<ref name=":1" />.
	\|-		\|-
	\|January 15th, 2017		\|January 15th, 2017
Line 33:		Line 42:
	\|November 11th, 2017 5:48:00 AM MST		\|November 11th, 2017 5:48:00 AM MST
	\|Confirmed Malware Tweet		\|Confirmed Malware Tweet
	\|Electrum (@ElectrumWallet) posts a warning on Twitter about the Electrum Gold wallet as "confirmed malware".		\|Electrum (@ElectrumWallet) posts a warning on Twitter about the Electrum Gold wallet as "confirmed malware" and warns users to be "extremely careful"<ref>[https://twitter.com/ElectrumWallet/status/929330017422757889 Electrum Wallet - "Be extremely careful with altcoin versions of Electrum. For example, Electrum Gold is confirmed malware." - Twitter/X] (Accessed Feb 11, 2025)</ref>.
			\|-
			\|November 12th, 2017 3:32:04 PM MST
			\|Janders6 Joins BitcoinTalk
			\|The Janders6 account first joins the BitcoinTalk forum<ref name=":0" />.
	\|-		\|-
	\|November 13th, 2017 12:53:50 PM MST		\|November 13th, 2017 12:53:50 PM MST
	\|BitcoinTalk Electrum Gold Posted		\|BitcoinTalk Electrum Gold Posted
	\|Oliver Reid "a wallet made especially for Bitcoin Gold users, as I felt that Electrum, being the master wallet, should be enjoyed by gold users too."		\|Oliver Reid releases "a wallet made especially for Bitcoin Gold users, as I felt that Electrum, being the master wallet, should be enjoyed by gold users too."<ref name=":2">[https://bitcointalk.org/index.php?topic=2398686.0 <nowiki>janders6 - Electrum Gold Release! [Wallet] [Github] - BitcoinTalk</nowiki>] (Accessed Feb 6, 2025)</ref> This forum post shares a link to his Github and Twitter<ref name=":2" />. Only a single post appears to have ever been made by the janders6 account<ref>[https://loyce.club/archive/members/130/1306048.html BitcoinTalk Posts By janders6 - Loyce Club] (Accessed Feb 6, 2025)</ref>.
			\|-
			\|November 13th, 2017 2:09:07 PM MST
			\|Only One False Positive
			\|Running the package through multiple virus scanners, it's noted that there was only one "false positive"<ref name=":2" />. This suggests that, out of all the virus scanner packages available at the time, only one was able to pick up on the clipboard malware component of the wallet<ref name=":2" />.
			\|-
			\|November 14th, 2017 1:32:16 AM MST
			\|Wallet Flagged By Github
			\|The wallet released on BitcoinTalk appears to have been flagged by Github, and is presumably no longer available for download<ref name=":2" />.
			\|-
			\|November 16th, 2017 3:35:17 PM MST
			\|Last Active BitcoinTalk
			\|The janders6 username is last active on BitcoinTalk<ref name=":0" />.
			\|-
			\|December 10th, 2017 5:15:32 AM MST
			\|Careful On This Warning
			\|A user on BitcoinTalk posts the Twitter post by ElectrumWallet, which notes that Electrum Gold is confirmed malware, and warns users to be careful<ref name=":2" />.
	\|-		\|-
	\|October 21st, 2018		\|October 21st, 2018
Line 46:		Line 75:
	\|Notification To Parents		\|Notification To Parents
	\|Andrew Schrober notifies and pleas with the parents of one of the boys who were able to take his funds.		\|Andrew Schrober notifies and pleas with the parents of one of the boys who were able to take his funds.
			\|-
			\|May 13th, 2020 10:36:00 PM MDT
			\|Unknown Cheats Forum
			\|The last activity of rad3onx on the Unknown Cheats Forum<ref>[https://www.unknowncheats.me/forum/members/881032.html Member rad3onx's Profile - unknowncheats.me] (Accessed Feb 6, 2025)</ref>.
	\|-		\|-
	\|August 9th, 2021		\|August 9th, 2021
Line 74:		Line 107:

	=== False Implication Of Sulaiman Hussain ===		=== False Implication Of Sulaiman Hussain ===
	One item mentioned in the initial disclosure is an impersonation/implication of Sulaiman Hussain,		One item mentioned in the initial disclosure is an impersonation/implication of Sulaiman Hussain, a banking executive who lives in the United Kingdom.

	<ref>[https://uk.linkedin.com/in/sulaimanhussain Actual Profile Of Sulaiman Hussain - LinkedIn] (Accessed Feb 6, 2025)</ref>		<ref>[https://uk.linkedin.com/in/sulaimanhussain Actual Profile Of Sulaiman Hussain - LinkedIn] (Accessed Feb 6, 2025)</ref>

	<ref>[https://www.cryptocompare.com/profile/sulaiman.h500/ sulaiman.h500 Profile - CryptoCompare] (Accessed Feb 6, 2025)</ref>		<ref>[https://www.cryptocompare.com/profile/sulaiman.h500/ sulaiman.h500 Profile - CryptoCompare] (Accessed Feb 6, 2025)</ref>



Line 114:		Line 148:

	"The plaintiffs point out that Schober’s investigators didn’t pinpoint one of the young men’s involvement until more than a year after they’d identified his co-conspirator, saying Schober notified the second boy’s parents in December 2019."		"The plaintiffs point out that Schober’s investigators didn’t pinpoint one of the young men’s involvement until more than a year after they’d identified his co-conspirator, saying Schober notified the second boy’s parents in December 2019."

			=== Social Media Presence ===
			The rad3onx user account appears to have been deleted from Reddit<ref>[https://www.reddit.com/user/Rad3onx/ Rad3onx - User Deleted - Reddit] (Accessed Feb 6, 2025)</ref>. It's unclear at what time this happened.

	== Total Amount Recovered ==		== Total Amount Recovered ==

Azoundria: Integrated information from KrebsOnSecurity article and lawsuit. Added significant additional sources from BitcoinTalk and online web search. Filling in extra information on wiki Timeline.

2025-02-06T18:56:54Z

Integrated information from KrebsOnSecurity article and lawsuit. Added significant additional sources from BitcoinTalk and online web search. Filling in extra information on wiki Timeline.

← Older revision		Revision as of 12:56, 6 February 2025
Line 3:		Line 3:
	In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.		In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.

	This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" /><ref>https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903 (Accessed Jan 31, 2025)</ref>		This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" /><ref>https://medium.com/@nbax/anatomy-of-a-bitcoin-heist-the-electrum-atom-malware-saga-1685abf7c903 (Accessed Jan 31, 2025)</ref><ref>https://bitcointalk.org/index.php?topic=5357642.0 (Accessed Feb 6, 2025)</ref><ref>https://loyce.club/archive/members/130/1306048.html (Accessed Feb 6, 2025)</ref><ref>https://bitcointalk.org/index.php?topic=2398686.0 (Accessed Feb 6, 2025)</ref><ref>https://bitcointalk.org/index.php?action=profile;u=1306048 (Accessed Feb 6, 2025)</ref><ref>[https://www.reddit.com/user/Rad3onx/ Rad3onx User Deleted - Reddit] (Accessed Feb 6, 2025)</ref><ref>https://www.toribash.com/forum/member.php?u=3111548 (Accessed Feb 6, 2025)</ref><ref>https://www.unknowncheats.me/forum/members/881032.html (Accessed Feb 6, 2025)</ref>

	Unsure if related:<ref>https://web.archive.org/web/20171227183707/https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom?tab=readme-ov-file#readme (Accessed Jan 31, 2025)</ref><ref>https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom (Accessed Jan 31, 2025)</ref>		Unsure if related:<ref>https://web.archive.org/web/20171227183707/https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom?tab=readme-ov-file#readme (Accessed Jan 31, 2025)</ref><ref>https://bitcoinatom.io/ (Accessed Jan 31, 2025)</ref><ref>https://github.com/bitcoin-atom/electrum-atom (Accessed Jan 31, 2025)</ref>
Line 22:		Line 22:
	!Event		!Event
	!Description		!Description
			\|-
			\|
			\|
			\|
	\|-		\|-
	\|January 15th, 2017		\|January 15th, 2017
Line 27:		Line 31:
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-		\|-
	\|		\|November 11th, 2017 5:48:00 AM MST
	\|		\|Confirmed Malware Tweet
	\|		\|Electrum (@ElectrumWallet) posts a warning on Twitter about the Electrum Gold wallet as "confirmed malware".
			\|-
			\|November 13th, 2017 12:53:50 PM MST
			\|BitcoinTalk Electrum Gold Posted
			\|Oliver Reid "a wallet made especially for Bitcoin Gold users, as I felt that Electrum, being the master wallet, should be enjoyed by gold users too."
			\|-
			\|October 21st, 2018
			\|Deadline To Return Funds
			\|The deadline which Andrew Schrober provides for return of the funds in an email to the parents.
			\|-
			\|December, 2019
			\|Notification To Parents
			\|Andrew Schrober notifies and pleas with the parents of one of the boys who were able to take his funds.
			\|-
			\|August 9th, 2021
			\|Initial Disclosure
			\|Initial Disclosure submitted to court. Defendant Hazel Davina Wells submits her initial disclosures under Rule 26(a)(1) of the Federal Rules of Civil Procedure. The disclosure includes a list of individuals with relevant information, such as Defendant Oliver Read, who has knowledge of correspondence from the Plaintiff, cryptocurrency mining, and UK police involvement, and Defendant Hazel Davina Wells, who has knowledge about the Plaintiff’s correspondence and her son’s questioning by UK police. The document also lists various correspondences, including those between the Plaintiff and the Read Defendants, and affirms Wells will supplement her disclosures as needed during discovery. Additionally, it includes a certificate of service stating the document was sent to the parties involved in the case.
			\|-
			\|August 25th, 2021 5:52:00 PM MDT
			\|Krebs On Security Article
			\|Brian Krebs from Krebs On Security promotes his article about the situation. "Andrew Schober was robbed of ~$1M in bitcoin in 2018. Investigators he hired found 2 minors in the UK who allegedly authored the clipboard stealing malware that siphoned his bitcoin. Now he's suing the kids' parents after they refused to return the $"
	\|}		\|}

Line 48:		Line 72:

	"The stolen funds were then [deposited] at the cryptocurrency exchange Bitfinex. With the help of an attorney and private investigation firm, the theft was traced to Oliver Paul Read, from Bradford, West Yorkshire. It seems your son has been using malware to steal money from people online."		"The stolen funds were then [deposited] at the cryptocurrency exchange Bitfinex. With the help of an attorney and private investigation firm, the theft was traced to Oliver Paul Read, from Bradford, West Yorkshire. It seems your son has been using malware to steal money from people online."

			=== False Implication Of Sulaiman Hussain ===
			One item mentioned in the initial disclosure is an impersonation/implication of Sulaiman Hussain,

			<ref>[https://uk.linkedin.com/in/sulaimanhussain Actual Profile Of Sulaiman Hussain - LinkedIn] (Accessed Feb 6, 2025)</ref>

			<ref>[https://www.cryptocompare.com/profile/sulaiman.h500/ sulaiman.h500 Profile - CryptoCompare] (Accessed Feb 6, 2025)</ref>


			Malicious Malware Transaction Of Someone Else: <ref>https://www.blockchain.com/explorer/transactions/btc/ca19c0ac445e262f6c980ce5760dd799e5e1a78dd0601262ada1a12e8f85d605 (Accessed Feb 6, 2025)</ref>

			One Receiving Wallet (May Be Unrelated): <ref>https://www.blockchain.com/explorer/addresses/btc/14uBM5CP8a5KmgJ1qJJfy3x8PRs9iHcUwH (Accessed Feb 6, 2025)</ref>

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost was 16.4 bitcoins. The value has been estimated at $220,000 USD.		The total amount lost was 16.4552 bitcoins<ref name="krebsonsecurity-6230" />. The value has been estimated at $220,000 USD.

	== Immediate Reactions ==		== Immediate Reactions ==
Line 110:		Line 146:
	<references>		<references>
	<ref name="decrypt-6229">[https://decrypt.co/79618/man-who-lost-800k-bitcoin-sue-teenagers-parents Man Who Lost $800K of Bitcoin Sues Parents of Alleged Teenage Thieves - Decrypt] (Accessed Jan 30, 2022)</ref>		<ref name="decrypt-6229">[https://decrypt.co/79618/man-who-lost-800k-bitcoin-sue-teenagers-parents Man Who Lost $800K of Bitcoin Sues Parents of Alleged Teenage Thieves - Decrypt] (Accessed Jan 30, 2022)</ref>
	<ref name="krebsonsecurity-6230">https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf (Accessed Feb 3, 2022)</ref>		<ref name="krebsonsecurity-6230">[https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf PLAINTIFF’S INITIAL DISCLOSURES - KrebOnSecurity] (Accessed Feb 3, 2022)</ref>
	<ref name="krebsonsecurity-6231">[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Accessed Feb 4, 2022)</ref>		<ref name="krebsonsecurity-6231">[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Accessed Feb 4, 2022)</ref>
	<ref name="nypost-6232">[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Accessed Feb 4, 2022)</ref>		<ref name="nypost-6232">[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Accessed Feb 4, 2022)</ref>

Azoundria: Updated case construction template. Dramatically restructured information from the about section into other sections of the wiki. Created basic about section. Looking up more information about the Electrum Atom software, which appears to be malware, though there is also a related protocol. Filling in immediate reactions and basic prevention part.

2025-02-01T00:32:04Z

Updated case construction template. Dramatically restructured information from the about section into other sections of the wiki. Created basic about section. Looking up more information about the Electrum Atom software, which appears to be malware, though there is also a related protocol. Filling in immediate reactions and basic prevention part.

Show changes

Azoundria at 16:28, 14 April 2023

2023-04-14T16:28:48Z

← Older revision		Revision as of 10:28, 14 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.		In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" />
	<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" />

	== About Unknown ==		== About Unknown ==
Line 79:		Line 78:
	!Description		!Description
	\|-		\|-
	\|January 15th, 2017 ~~12:00:00 AM~~		\|January 15th, 2017
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 106:		Line 105:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			All large transactions or new wallets should be tested first with a smaller value transaction.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	~~All large transactions or new wallets should be tested first with a smaller value transaction.~~		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==

Azoundria at 17:24, 16 February 2023

2023-02-16T17:24:06Z

← Older revision		Revision as of 11:24, 16 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}}
			{{Unattributed Citations}}

	In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.		In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="decrypt-6229" /><ref name="krebsonsecurity-6230" /><ref name="krebsonsecurity-6231" /><ref name="nypost-6232" /><ref name="briankrebstwitter-6233" /><ref name="livebitcoinnews-6234" /><ref name="yahoomovies-6235" /><ref name="cryptonewsflash-6236" />

	== About Unknown ==		== About Unknown ==
Line 57:		Line 59:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 79:		Line 80:
	\|-		\|-
	\|January 15th, 2017 12:00:00 AM		\|January 15th, 2017 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 92:		Line 89:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $220,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 103:		Line 100:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 114:		Line 111:

	== References ==		== References ==
	[https://decrypt.co/79618/man-who-lost-800k-bitcoin-sue-teenagers-parents Man Who Lost $800K of Bitcoin Sues Parents of Alleged Teenage Thieves - Decrypt] (Jan 30)		<references><ref name="decrypt-6229">[https://decrypt.co/79618/man-who-lost-800k-bitcoin-sue-teenagers-parents Man Who Lost $800K of Bitcoin Sues Parents of Alleged Teenage Thieves - Decrypt] (Jan 30, 2022)</ref>

	[https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf] (Feb 3)		<ref name="krebsonsecurity-6230">[https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf] (Feb 3, 2022)</ref>

	[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Feb 4)		<ref name="krebsonsecurity-6231">[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Feb 4, 2022)</ref>

	[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Feb 4)		<ref name="nypost-6232">[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Feb 4, 2022)</ref>

	[https://twitter.com/briankrebs/status/1430679517857714177 @briankrebs Twitter] (Feb 4)		<ref name="briankrebstwitter-6233">[https://twitter.com/briankrebs/status/1430679517857714177 @briankrebs Twitter] (Feb 4, 2022)</ref>

	[https://www.livebitcoinnews.com/andrew-schober-is-one-of-many-victims-of-crypto-theft-but-hes-taking-action/ Andrew Schober Is One of Many Victims of Crypto Theft, but He's Taking Action \| Live Bitcoin News] (Feb 4)		<ref name="livebitcoinnews-6234">[https://www.livebitcoinnews.com/andrew-schober-is-one-of-many-victims-of-crypto-theft-but-hes-taking-action/ Andrew Schober Is One of Many Victims of Crypto Theft, but He's Taking Action \| Live Bitcoin News] (Feb 4, 2022)</ref>

	[https://ca.movies.yahoo.com/two-british-schoolboys-stole-nearly-184712819.html Two British schoolboys stole nearly $1m in Bitcoin and families refused to give it back, US lawsuit claims] (Feb 4)		<ref name="yahoomovies-6235">[https://ca.movies.yahoo.com/two-british-schoolboys-stole-nearly-184712819.html Two British schoolboys stole nearly $1m in Bitcoin and families refused to give it back, US lawsuit claims] (Feb 4, 2022)</ref>

	[https://www.crypto-news-flash.com/victim-of-malware-attack-sues-parents-of-thieves-who-stole-his-16-bitcoins/ Andrew Schober sues parents of young men who stole his 16 Bitcoins] (Feb 4)		<ref name="cryptonewsflash-6236">[https://www.crypto-news-flash.com/victim-of-malware-attack-sues-parents-of-thieves-who-stole-his-16-bitcoins/ Andrew Schober sues parents of young men who stole his 16 Bitcoins] (Feb 4, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}} In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culpr..."

2023-01-24T20:49:54Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}} In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culpr..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/fakewalletfromreddit.php}}

In January 2017, Andrew Schober was tricked into downloading a malicious application which modified his clipboard. As a result, he ended up sending his bitcoin to 2 teenagers in the UK. The thieves did nothing to obscure the coins and deposited them directly on the Bitfinex platform. Andrew Schober spent tens of thousands of dollars and many years tracking down the culprits and is presently attempting to sue them. However, the statute of limitations limits claims to 2-3 years.

This is a global/international case not involving a specific country.

== About Unknown ==
"Colorado resident Andrew Schober’s stash of 16 Bitcoin was stolen from him in a 2018 malware attack, court documents allege. At the time, it was worth about $220,000 and was 95% of his net wealth."

In January 2017, Andrew Schober’s "computer was infected by a malicious program called Electrum Atom that stole £145,800 worth of Bitcoin from me." "A forensic investigation of Schober’s computer found he’d inadvertently downloaded malicious software after clicking a link posted on Reddit for a purported cryptocurrency wallet application called “Electrum Atom.” Investigators determined that the malware was bundled with the benign program, and was designed to lie in wait for users to copy a cryptocurrency address to their computer’s temporary clipboard."

"The malware was designed to wait for the user to copy a crypto wallet address to the temporary clipboard of his computer. When he tried to move 16.4 Bitcoins from his account to another, the malware changed his payment wallet address with a different address controlled by the two young men."

"Schober alleges that Benedict Thompson, of Hampshire, UK, and Oliver Read, of West Yorkshire, UK, orchestrated the theft when they were minors."

"Thompson is now studying computer science at the University of Warwick, the suit says, and Read previously studied computer science at Greenhead College in the UK."

"When the two were boys, they allegedly advertised criminal software on Reddit, where Schober inadvertently installed it, thinking it was a legitimate program."

"The malware was able to direct Schober’s bitcoin to a third-party account that allegedly belonged to Thompson and Read."

“He did not eat or sleep for days afterward and has been in a severe state of distress for the past three years.” It adds: “Mr. Schober was planning to use the proceeds from his eventual sale of the cryptocurrency to help finance a home and support his family.” "The cryptocurrency accounted for approximately 95 per cent of his net wealth at the time it was stolen from him."

"The stolen funds were then depositeed at the cryptocurrency exchange Bitfinex. With the help of an attorney and private investigation firm, the theft was traced to Oliver Paul Read, from Bradford, West Yorkshire. It seems your son has been using malware to steal money from people online."

"Schober spent $10,000 on an investigation and tracked the Bitcoin to the two teenagers in the U.K., documents say. Both Thompson and Read have studied computer science, including at a top U.K. university, the filing notes."

Schober then wrote a letter to the parents of Read, where he asked for the money to be returned. “Your son is obviously a very intelligent young man,” he wrote in 2018. “I do not wish for him to be robbed of his future.”

"As his parents, I am appealing to you first to give him the chance to make this right, without involving law enforcement. Your son is obviously a very intelligent young man. I do not wish for him to be robbed of his future, however it would not be just to let him inflict such a damaging blow to my future."

"If he returns what he stole in full, 16.4552 BTC, to [this address] by October 21, 2012, I will drop this matter and move on. If not, we will pursue recourse through Action Fraud. Given his age and the nature of the crimes, he would likely be charged as an adult. The minimum sentence for Theft: Category 1 Harm (>£100k) with high culpability, and Computer Misuse Section 3: Reckless Intent to Impair Operation, is 4 years and 6 months custody, plus payment of restitution."

"Now they are responding. One of the defendants —Hazel D. Wells — just filed a motion with the court to represent herself and her son in lieu of hiring an attorney. In a filing on Aug. 9, Wells helpfully included the letter in the screenshot above, and volunteered that her son had been questioned by U.K. authorities in connection with the bitcoin theft."

"Neither of the defendants’ families are disputing the basic claim that their kids stole from Mr. Schober. Rather, they’re asserting that time has run out on Schober’s legal ability to claim a cause of action against them."

“Plaintiff alleges two common law causes of action (conversion and trespass to chattel), for which a three-year statute of limitations applies,” an attorney for the defendants argued in a filing on Aug. 6 (PDF). “Plaintiff further alleges a federal statutory cause of action, for which a two-year statute of limitations applies. Because plaintiff did not file his lawsuit until May 21, 2021, three years and five months after his injury, his claims should be dismissed.”

"In August, lawyers for Hazel Davina Wells, the mother of Oliver Read, filed court papers that argued that the two year statute of limitations had passed before Mr Schober filed his case and asked a judge to dismiss the claim." "Schober’s attorneys argue (PDF) that “the statute of limitations begins to run when the Plaintiff knows or has reason to know of the existence and cause of the injury which is the base of his action,” and that inherent in this concept is the discovery rule, namely: That the statute of limitations does not begin to run until the plaintiff knows or has reason to know of both the existence and cause of his injury."

"The plaintiffs point out that Schober’s investigators didn’t pinpoint one of the young men’s involvement until more than a year after they’d identified his co-conspirator, saying Schober notified the second boy’s parents in December 2019."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Fake Wallet From Reddit
!Date
!Event
!Description
|-
|January 15th, 2017 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
All large transactions or new wallets should be tested first with a smaller value transaction.

== References ==
[https://decrypt.co/79618/man-who-lost-800k-bitcoin-sue-teenagers-parents Man Who Lost $800K of Bitcoin Sues Parents of Alleged Teenage Thieves - Decrypt] (Jan 30)

[https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf] (Feb 3)

[https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/ Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents – Krebs on Security] (Feb 4)

[https://nypost.com/2021/08/26/man-sues-over-bitcoin-stash-stolen-in-2018-and-now-worth-1m/ Man sues over bitcoin stash stolen in 2018 and now worth $1M] (Feb 4)

[https://twitter.com/briankrebs/status/1430679517857714177 @briankrebs Twitter] (Feb 4)

[https://www.livebitcoinnews.com/andrew-schober-is-one-of-many-victims-of-crypto-theft-but-hes-taking-action/ Andrew Schober Is One of Many Victims of Crypto Theft, but He's Taking Action | Live Bitcoin News] (Feb 4)

[https://ca.movies.yahoo.com/two-british-schoolboys-stole-nearly-184712819.html Two British schoolboys stole nearly $1m in Bitcoin and families refused to give it back, US lawsuit claims] (Feb 4)

[https://www.crypto-news-flash.com/victim-of-malware-attack-sues-parents-of-thieves-who-stole-his-16-bitcoins/ Andrew Schober sues parents of young men who stole his 16 Bitcoins] (Feb 4)