Agents of the Department against Cybercrime of the UCO, in an image provided by the Civil Guard.
He used an assumed name, carried false documentation and hired a young Spanish actor to impersonate him in the videos with which he deceived his victims. The benefits of his scams allowed him to live in luxury on the Costa del Sol for at least six months a year, where he was videotaped driving high-cylinder vehicles. He even traveled in private jets. And all this before turning 30 years old. However, the blazing criminal career of what is considered “one of the largest cryptocurrency scammers established in Spain”, as described by the Ministry of the Interior this Tuesday, ended at the end of last October thanks to the investigation of the Central Unit Operative (UCO) of the Civil Guard that managed to identify him. After spreading it to the rest of the police through Intepol, the alleged crypt wetter was arrested when entering Latvia, his native country. The clue that led to him was given by his latest scam, the launch of a new electronic currency baptized as Holdfile, the unicorn token. To perpetrate it, he allegedly used the Wi-Fi network of the exclusive hotels where he was staying in Spain.
So far, the Civil Guard has identified more than a thousand affected people whom the now detained had allegedly snatched control of cryptocurrencies worth more than 500,000 euros. “In most cases they were small investors who were attracted by the aggressive advertising campaigns it had launched on social networks and in which it promised to distribute the commissions it obtained with them,” detail sources close to the investigation, which They are convinced that victims will continue to appear both in Spain and in other countries in the coming weeks. In fact, the US had issued an international arrest and extradition order against him since 2015, and there are also open investigations into his activities in Germany, the Police and his country of origin.
The investigation that has allowed him to be identified began at the end of last May, when one of his victims in Spain went to the Department against Cybercrime of the UCO to report that he had been the subject of a scam. This first was followed by others in the following weeks with one point in common: they all pointed to a platform called Hodlife as the supposed origin of the cryptocurrency embezzlements suffered. The investigations revealed that the detainee used profiles on behalf of this platform on the social network Twitter and on the instant messaging application Telegram, as well as on a web page created for the sole purpose of advertising their new virtual currency through them and attracting their victims. In all of them he broadcast videos in which a person appeared who introduced himself as him, although in reality it was a Spanish actor whom he had hired through an agency. In these images, he sent messages in English of thanks to investors and supposedly kept them informed of the news, achievements and changes that he was introducing in his cryptocurrency project.
The last one was on June 29, shortly before 11 in the morning. That day he uploaded a message to his Twitter profile in which he congratulated “all those who participated and joined the private sale” of his cryptocurrency and announced another offer for the next day that never occurred. The chat on Telegram, with about 3,600 members, was active for two more days, as EL PAÍS has been able to verify. Investigators believe he then did what is known in police jargon as rug pull (pull the rug, that is, disappear with virtual money). Investors then saw that the cryptocurrencies they had invested in the project had been transferred to other wallets without a trace. The Civil Guard then began the search for the funds with the difficulty that the alleged fraudster had maneuvered to erase any trace of its final destination. For this, as detailed by the armed institute, he changed the currency of cryptocurrencies, made transfers in different networks of blockchain (the information coding system behind each virtual currency) and mixed the stolen funds with those of other users outside their activities in the so-called platforms of mixing.
Despite this, the UCO agents managed to link the cryptocurrencies with a virtual wallet in which a citizen who answered the initials of AT, 29 years old and with a Lithuanian passport, appeared as the owner. Neither identity nor nationality were real, but the money movements that appeared in it, and that exceeded 600,000 before the alleged Hodlife scam, suggested that they were spent in Spain and, more specifically, on the Costa del Sol. The investigations revealed that its owner, whose identity was still unknown at the time, had rented a luxury home in an urbanization of Benahavís (Malaga) for which he paid 1,000 euros a day, although he had also stayed with other people of his environment in luxury hotels in Estepona, Marbella, Ibiza and Tenerife. The Civil Guard verified that he was taking advantage of his stay in these establishments to use their Wi-Fi networks to transfer the stolen cryptocurrencies to his victims.
The investigation then focused on identifying who was actually hiding behind that false Lithuanian citizen who, in addition to living in luxury homes and hotels, rented more exclusive brand vehicles and spent “huge amounts of money” in designer clothing stores and in the most famous restaurants on the Costa del Sol, the Civil Guard stands out. Finally, they learned that it was a Latvian in his twenties who used high-quality false documentation to move around different countries, mainly in Europe, where, in addition to maintaining a high standard of living, he had opened bank accounts and used credit cards to name of your fictitious identity. Also that he had prepared a false Swiss document with the photograph of the Spanish actor without his knowledge to deceive his victims.
The inclusion of both this false and the real identity in the databases shared by the European police and Interpol allowed last October to locate him when he entered his native country through an airport and was arrested. The Civil Guard now focuses its work on locating more possible victims (Interior has provided the email address [email protected] so that those who believe they have suffered the activities of the alleged fraudster contact the investigators) and determine if he can be charged with a crime in Spain.