In May 2018, Darren Marble was attending a cryptocurrency conference in New York City when he discovered he had become a victim of a new and financially devastating form of crime.

The first sign that something was amiss was when Marble, an executive producer for a streaming series, started having issues with his mobile phone. He couldn’t connect to email, or send a text.

It wasn’t until later that night when he got back to his hotel room, logged into the wifi and investigated further that his worst fears were realized. His crypto wallet had been drained.

“I’d lost $100,000 of cryptocurrency instantaneously,” he said. “I just remember thinking, ‘This can’t be real.’”

Marble called his wife in a panic, feeling a sense of hopelessness and shame as he explained what had happened. The money was gone, he could see it had been transferred into other people’s wallets, but he couldn’t tell who those wallets belonged to, because the whole point of cryptocurrency was its anonymity.

“I just remember having this sinking feeling in my heart. I felt guilty, I felt ashamed, I felt naive, and I felt embarrassed,” he said.

“Then I wondered, ‘What’s gonna happen next?’ Who do you call when you get hacked for cryptocurrency?”

Marble didn’t know it yet, but he was the victim of a new and growing form of cyber crime called “sim swapping,” that’s been linked to huge crypto heists in which millions of dollars have been stolen.

Chart the rise and fall of Joel Ortiz in our brand new documentary – The Crypto Bandit:

The technique involves a hacker tricking or bribing a cellphone carrier employee to redirect the victim’s phone number to a different phone, giving the hacker access to all their calls and messages, allowing them to reset their passwords and, ultimately, empty their accounts.

The hacker holding the phone that was used to steal Marble’s crypto was Joel Ortiz: an 18-year-old college student who, from his mother’s Boston apartment, would go on to steal more than $7.5 million in this way.

Ortiz, an isolated teen whose only social connections were online, would go on to splurge large amounts of the money he stole from high-value crypto investors on a lavish luxury lifestyle, a world removed from his modest upbringing as the son of a disabled, immigrant solo mother.

The story of Ortiz’s remarkable crime wave, and the team of investigators who would eventually bring him to justice, is told in The Crypto Bandit – a new documentary in VICE’s Cowboy Kings of Crypto series.

“Ortiz was a brainy guy,” said Erin West, deputy district attorney in Santa Clara County, California, where Ortiz would eventually be charged, becoming the first person sentenced for “sim swap” offending in the US.

“He graduated as valedictorian of his class and got a scholarship to UMass. And we know that he had skills that were really usable in this way. He exploited a vulnerability that I don’t think the rest of the nation was really thinking much about.”

Known online by the handle @0, Ortiz operated as part of a hacker ring, working with online associates to pull off his audacious crimes. Investigators say he and others in the gang targeted individuals publicly associated with the crypto world, drawing up lists of rich potential targets in the hope of catching a “whale.”

With one victim in particular, Ortiz and his fellow hackers would hit the jackpot. Saswata Basu is a Silicon Valley-based founder of a company that raised capital from the crypto market, who would also find himself a victim of Ortiz’s scams.

Like Marble, he would discover he was being hacked when his phone started displaying messages about his passwords being changed. But the scale of the theft from Basu would dwarf Marble’s losses.

“There was one wallet… which was hacked,” he told VICE. “The amount was about $5 million.”

Ortiz flaunted his new wealth on social media: buying Gucci outfits and designer goods, and renting luxury mansions in Los Angeles to party in.

“If you’re an 18-year-old kid and you just stole $5 million, what would you do with that money?” said Samy Tarazi, a criminal investigator in the Santa Clara district attorney’s office. Tarazi was a member of REACT, an elite taskforce that had been formed in California to tackle this kind of cybercrime.

“The answer is always something dumb. He had traveled from Boston to Hollywood and had rented out Airbnbs.”

Ortiz’s habit of posting his wild lifestyle on social media would only help investigators, and he was eventually arrested at LAX airport, as he prepared to board a flight to Europe. In April 2019, he was given a 10-year sentence after pleading no contest to eight counts of identity theft and computer crimes. He is currently serving his sentence at Centinela Prison in California, and is due to be released in 2028.

But the bulk of the stolen millions in crypto remains unaccounted for, having been laundered by his gang in a process that makes the funds virtually untraceable.

Tarazi and West said that, when arrested, Ortiz showed them about $250,000 in cryptocurrency, and had probably blown about the same amount in his excessive spending.

“There was a huge gap between what he could account for and what we knew he took,” said West.

For Marble, there was an unexpected silver lining. Long after the theft, he received an unexpected email from the High Court in Ireland, informing him that one of Ortiz’s co-conspirators–a Dublin-based hacker named Conor Freeman–had been arrested, and the money that had been stolen from him recovered. Freeman was sentenced in November 2020 to two years and 11 months in prison.

“It was another, just surreal moment,” said Marble, who was returned $90,000 of the stolen crypto. “I was basically made whole right there.”

But most victims weren’t so lucky. The whereabouts of millions of dollars stolen by the hacker gang remained a mystery, said Tarazi.

“We don’t know if they gave it to trusted third parties we haven’t identified, [or] they have it buried in a forest somewhere and they’ll get it when they get out of prison,” he said. “I don’t know.”