CASE FILE · CW-004

Scam Token Cluster Uncovered

Entries
8
Evidence
16
01/Entry

2 In June 2024 a victim was brutally robbed for $4.3M+ of crypto assets at gunpoint via home invasion in the UK after the attackers posed as delivery drivers. I am proud to share that Faris & his two other accomplices were just sentenced and nearly the full amount of stolen funds was seized by MET Police. I previously published my investigation identifying Faris and worked closely with the victim to communicate all findings to law enforcement. Due to minor protection laws certain details about the case remain sealed. Court: Sheffield Crown Court Case reference number: 01GD1223024

Dossier evidenceDossier evidence
01/Entry

An investigation into Faris Ali (Zay/Tommy) from the UK and his alleged involvement in robbing an X user out of $4.3M in June 2024 during a home invasion as the result of a crypto data breach.

Dossier evidenceDossier evidence
02/Entry

On June 18th a victim posted to X post he had been victim of a robbery earlier that day forcing him to send $4.3M to two addresses. At the time of this post the majority of funds still remain dormant. Theft address 0x7d1ecbf05b7fdbaf338e0179af2ee8e2ca786d99 0xe925c31d47d1abc41bd8a407e027302ac8c4dcef

Dossier evidence
03/Entry

Shortly after being tagged by victim I began investigating and acquired chat logs between two perpetrators involved hours before the robbery.

Dossier evidenceDossier evidenceDossier evidence
04/Entry

Faris/Tommy discussed with an accomplice how they planned to pretend to deliver a package to the victims home and shared an image of their door.

Dossier evidenceDossier evidenceDossier evidence
05/Entry

They then sent a photo of the victims building and a photo to confirm they are outside the victims door dressed as three delivery drivers before saying they are going now.

Dossier evidenceDossier evidence
06/Entry

A few weeks prior Faris/Tommy has a criminal record and flexed a picture of his bail to his friends on Telegram leaking his identity in the process. After the robbery someone registered an ENS domain as farisali.eth and sent a message on-chain.

Dossier evidenceDossier evidence

Faris (Zay//Tommy) flexing Audi earlier this year

07/Entry

While this is a cautionary tale and hopefully this will help lead to arrests here are some measures you can take to protect yourself. >Avoid sharing personal information or details about your crypto holdings to “friends” or to flex on social media >Monitor your personal information when it is exposed online so you can take >Avoid giving out personal information whenever possible and provide fake information >I have received messages multiple other victims of home invasions in Western Europe over the past few months at a much higher rate than other regions.

··/Additional Evidence
Dossier evidence