Identified one of the biggest cryptocurrency scammers established in Spain and searched by INTERPOL since 2015
In his latest scam, after the creation of a new virtual currency under the “Holdlife” token, he stole more than half a million euros from hundreds of people affected
At first, the collaboration of many of these people in the channels opened by the Civil Guard to pursue this criminal phenomenon, has been decisive to know the volume of this scam
The Department Against Cybercrime of UCO, formerly known as the Department of Telematic Crimes, makes the email account ciberestafas@guardiacivil.org available to potential victims of this scam as a point of contact.
The Civil Guard, through its Department Against Cybercrime of the Central Operational Unit, has carried out what has been called Operation Hodlife, in which one of the largest known cryptocurrency cyber crooks has been arrested in Latvia, escaping from the international justice and sought by international law enforcement agencies since 2015.
Launch of a new cryptocurrency; "HODLIFE, The Unicorn Token"
Thanks to the volume of information provided by affected people in the citizen communication channels enabled by the Civil Guard for this purpose, it was possible to follow the trail of the launch, or "airdrop", of a new virtual currency, a project called by its creators as "HODLIFE, The Unicorn Token ”, who, to attract investment of funds, promised their“ hodlers ”, or users who invest in cryptocurrency, the distribution among all of them of part of the commissions of the operations that were carried out in this new platform.
In this way, the now detained man took control of cryptocurrencies worth more than € 500,000, leaving behind more than a thousand affected.
For the dissemination of this project, the detainee used the most common channels in current digital communication, through aggressive advertising campaigns on Twitter profiles, Telegram and on a website created expressly, quickly attracting a large community of users who, Thanks to the messages launched from these platforms, they were being duped into depositing their cryptocurrencies in this new line of business.
To give these campaigns greater credibility, the creator of HODLIFE obtained the services of an actor, who recorded promotional videos of the project posing as the creator of the project.
In these videos, the actor and false creator, transmitted messages of thanks to the entire new community of followers, at the same time that he kept them abreast of the most relevant news, achievements and new implementations in the mechanics of the project.
"Rug pull" or "pull the rug". Start of the investigation
Finally, at the end of last June, all investors who had invested their cryptocurrencies in HODLIFE could see how they had been transferred to other portfolios, leaving no trace of their investments, realizing at that moment that they had been scammed.
This type of scam is commonly known as “rug pull” or “throwing the carpet”, and it consists of the developers of a project abandoning it and fleeing with the investors' money.
Thus initiated the investigation by the Department Against Cybercrime of UCO, the investigators were able to slowly trace the route that the stolen funds followed, despite the fact that the author of the fraud used various measures to erase it, such as the change of currency of the cryptocurrencies, transfers to different networks of the blockchain, or the use of platforms that offer services of “mixing” or mixing crypto assets with those of other users, thus making it difficult to identify the ownership of each of the portfolios in the that the funds are deposited.
In this exhaustive analysis of the traceability of digital wallets associated with HODLIFE, the agents were able to corroborate the links with another wallet whose ownership fell to AT, a 29-year-old Lithuanian citizen who had been known to have stayed in our country for long periods of time since 2020.
In the same way, it was found that most of the funds in that wallet had their origin in the same “mixing” platforms that were used to divert the cryptocurrencies from HODLIFE. All these income were prior to the scam object of this investigation, amounting to € 600,000, showing that this person made the scam his way of life.
Mansions of € 1000 per day for rent
In parallel, the investigation focused on being able to define the exact location from where the scammer was carrying out all his operations, being able to specify after the study and analysis of different internet connections, that this individual was acting from Spain, specifically from a one of the most exclusive areas of the Costa del Sol.
By following the trail of this person, the agents were able to verify the high standard of living that he and his companions led, residing in luxury villas with rents exceeding one thousand euros a day or renting high-end cars of the most exclusive brands, as well as spending huge amounts of money in designer clothing stores and in the most prominent restaurants on the Costa del Sol.
It was also decisive for the agents to know how they alternated residence in the aforementioned villas, with others in hotels, being able to verify that it was in the latter where they used their internet connections to connect to different platforms for buying and selling cryptocurrencies and transferring funds stolen from wallets you own.
False documentation and arrest warrant and extradition by the US
Focusing the investigation on both the now detained and his closest environment, the agents were able to confirm that in reality this individual was not of Lithuanian origin but Latvian and that he has been carrying false personal documentation for several years.
Once identified without any doubt, the Civil Guard activated all international police cooperation mechanisms, thus being able to learn about the scammer's journey through different countries, renting vehicles and mansions in all of them, even owning credit cards and bank accounts with false ownership.
It has also been possible to specify that this person had a search, arrest and extradition order ordered by the United States in 2015 motivated by the commission of fraud.
For more information, you can contact the Press Office of the Central Operational Unit (U.C.O.), telephone 91.503.13.27.
