Inside the Bitcoin Heist: Five-Star Hotels, Envelopes Stuffed with Cash, and Vanished Funds
TechFlow Selected TechFlow Selected
Inside the Bitcoin Heist: Five-Star Hotels, Envelopes Stuffed with Cash, and Vanished Funds
A precision hunt targeting a mining CEO.
Navigating Web3 tides with focused insightsText by: Joel Khalili
Translated by: Luffy, Foresight News
Complex cryptocurrency scams are on the rise, but few have been as meticulously orchestrated as the one that ensnared a Bitcoin mining executive earlier this year.
Standing in the bathroom of a luxury hotel in central Amsterdam, thousands of miles from home, Kent Halliburton ran his fingers over an envelope stuffed with crisp €10,000 notes and began to wonder what kind of trouble he had gotten himself into.
Halliburton is co-founder and CEO of Sazmining, a company that operates Bitcoin mining hardware for clients—a model known as "mining-as-a-service." Based in Peru, Halliburton oversees Sazmining’s mining equipment distributed across third-party data centers in Norway, Paraguay, Ethiopia, and the United States.
According to Halliburton, he flew to Amsterdam on August 5 to meet Even and Maxim—two men who claimed to represent a wealthy family office based in Monaco. The family office proposed purchasing hundreds of Bitcoin mining rigs from Sazmining worth around $4 million, which would be installed at a new mining facility under construction in Ethiopia. Before finalizing the deal, the family office insisted on meeting Halliburton in person.
Upon arriving at the Hotel de l’Europe, Halliburton found Even and Maxim already seated in a private booth. They gave off the aura of high-rolling playboys—especially Maxim, dressed in a tailored tan three-piece suit, long dark hair parted neatly down the middle, and a Rolex peeking out from beneath his cufflinks.
Over a three-course lunch (ceviche garnished with caviar, Chilean sea bass, and cherry cake), they discussed the structure of the deal and exchanged personal backgrounds. Even was talkative and joked about lavish parties in Marrakech; Maxim remained aloof, mostly staring at Halliburton in long, penetrating gazes as if sizing him up.
To build trust, Even suggested Halliburton sell approximately $3,000 worth of Bitcoin to the family office. Halliburton hesitated at first but viewed it as an unusual “icebreaker.” One of them handed him an envelope filled with cash and instructed him to count it privately in the restroom. “It felt like something out of a James Bond movie,” Halliburton said. “Very surreal for me.”
Halliburton left in a taxi, confused yet hopeful about closing the deal with the family office. For Sazmining, a company with just around 15 employees, the transaction could have been transformative.
Less than two weeks later, Halliburton was scammed out of more than $200,000 worth of Bitcoin. He wasn’t sure whether Sazmining could survive the blow or exactly how the con had been pulled off.
After lunch with Even and Maxim, Halliburton flew directly to Latvia for a Bitcoin conference, then onward to Ethiopia to inspect progress on the data center.
While in Ethiopia, Halliburton received a WhatsApp message from Even expressing eagerness to move forward—but with a condition: following the small Bitcoin purchase at the Hotel de l’Europe, Sazmining must now sell more Bitcoin to the family office. The two sides eventually agreed on $400,000—roughly one-tenth of the total deal value.
Even demanded Halliburton return to Amsterdam to sign contracts required for the transaction. Halliburton, already weeks away from home, objected, but Even was insistent: “Remote doesn’t work for me—I don’t do business like that anymore.”
On the afternoon of August 16, Halliburton returned to Amsterdam. That evening, he was scheduled to meet Maxim at the teppanyaki restaurant inside the five-star Okura Hotel. The interior was traditionally Japanese—wood paneling, paper walls, Zen gardens, and a string of origami cranes hanging above a spiral staircase in the lobby.
Halliburton spotted Maxim sitting on a sofa in the reception area outside the restaurant, wearing a flashy silver suit. As they waited to be seated, Maxim asked Halliburton to prove Sazmining had sufficient Bitcoin to fulfill the additional purchase proposed by Even. He requested Halliburton transfer half of the agreed amount—about $220,000—to a Bitcoin wallet app trusted by the family office. The funds would remain under Halliburton’s control, but the family office could verify their existence via public blockchain data.
Halliburton pulled out his iPhone. The app, called Atomic Wallet, had thousands of positive reviews and had been available on Apple’s App Store for years. Under Maxim’s watchful eye, Halliburton downloaded the app and created a new wallet. “I wanted to earn his trust,” Halliburton said. “This was a $4 million contract, after all.”
Dinner went relatively smoothly. Maxim seemed less guarded this time, chatting about his passion for luxury watches and his role scouting deals for the family office. Exhausted from days of travel, Halliburton just wanted to wrap things up quickly.
Before parting ways, they agreed: Maxim would submit the signed contract to the family office for execution, while Halliburton would send the $220,000 in Bitcoin to the new wallet address as agreed.
Back in his hotel room, Halliburton initiated a small test transaction through the new Atomic Wallet address, then reset the wallet using the recovery phrase (seed words) generated when he first downloaded the app—ensuring everything worked properly. “Had to take some security measures—now I’m almost ready. Thanks for your patience,” Halliburton wrote in a WhatsApp message to Even. Even replied: “No problem, take your time.”
At 10:45 PM, after confirming the test was successful, Halliburton instructed a colleague to send $220,000 worth of Bitcoin to the Atomic Wallet address. Once the funds arrived, he sent an updated balance screenshot to Even. One minute later, Even replied: “Thx.”
Halliburton sent another message asking about the contract, but the usually responsive Even went silent. Halliburton opened the Atomic Wallet app and sensed something was wrong—the Bitcoin was gone.
A wave of nausea hit him. He sat on the edge of the bed, nearly vomiting. “Like getting punched in the gut,” he said. “Just shock and disbelief.”
Halliburton scrambled to understand how he’d been tricked. At 11:30 PM, he messaged Even again: “This is the most sophisticated scam I’ve ever experienced. I know you probably don’t care, but my company might go under because of this. I spent four years building it.”
Even responded denying any wrongdoing—but that was the last message Halliburton ever received. Halliburton provided WIRED with the Telegram account used by Even, which showed its last activity on the day the funds were stolen. Even did not respond to requests for comment.
Blockchain analysis from firms Chainalysis and CertiK shows that the funds from Halliburton’s wallet were broken up within hours, moved through multiple addresses, and deposited into third-party platforms where they were converted into fiat currency.
Some Bitcoin was split across instant exchange services, while most flowed into a single address and merged with funds flagged by Chainalysis as potentially linked to “scam transactions”—a type of fraud where scammers impersonate investors to steal cryptocurrency from startups.
“The services these scammers use aren’t illegal themselves,” says Margaux Eckle, senior investigator at Chainalysis. “But the consolidation addresses they use are closely tied to known fraudulent activity, indicating this is an organized crime group.”
Part of the Bitcoin flowing through the consolidation address was deposited into a cryptocurrency exchange, likely converted into fiat; the rest was swapped into stablecoins and transferred via cross-chain bridges to the Tron blockchain. Researchers say Tron hosts several over-the-counter services that facilitate large-scale cashouts.
The purpose of multiple transfers, splits, conversions, and cross-chain movements is to obscure the trail and enable cashouts without raising suspicion. “These scammers are highly sophisticated,” Eckle said. “Even though we can track funds post-bridge, it slows down investigators significantly.”
Eventually, the public transaction trail goes cold. To identify the perpetrators, law enforcement would need to subpoena these cashout platforms, which typically require user identification.
Transaction data alone cannot reveal exactly how the scammers accessed and moved the wallet funds without Halliburton’s permission—but details of his interactions provide clues.
Initially, Halliburton suspected a possible link to a 2023 attack attributed to North Korean state-linked hackers, during which Atomic Wallet users lost $100 million (Atomic Wallet did not respond to requests for comment).
However, security researchers interviewed by WIRED believe Halliburton was the victim of a targeted surveillance-style attack. “High-profile executives known to hold large amounts of cryptocurrency are extremely attractive targets,” said Guanxing Wen, head of security research at CertiK.
Researchers speculate that the dinner meeting, expensive attire, wads of cash, and displays of wealth were all tactics designed to lower Halliburton’s guard. “This is a common trust-building technique in high-value confidence scams,” Guanxing Wen said. “The longer victims spend in a relaxed setting with attackers, the less likely they are to question subsequent technical requests.”
To pull off the theft, the scammers needed access to the recovery phrase of Halliburton’s newly created Atomic Wallet—the key that grants full control over the wallet’s Bitcoin.
One possibility is that the scammers hijacked or spoofed the hotel’s Wi-Fi network to intercept information from Halliburton’s phone. “Devices like that are readily available online—compact enough to fit in a couple of suitcases,” said Adrian Cheek, chief researcher at cybersecurity firm Coeus. But Halliburton insists his phone never left his possession and that he used mobile data—not public Wi-Fi—to download the Atomic Wallet app.
Guanxing Wen believes the most plausible explanation is: The scammers may have used an accomplice nearby—or a long-lens camera—to capture the recovery phrase displayed on Halliburton’s phone screen when he first set up the app—right there on the sofa at Okura Hotel.
Guanxing Wen said the scammers likely had a “sweeping script” in place even before Halliburton sent $220,000 in Bitcoin to the Atomic Wallet address. This automated program would instantly transfer funds once a significant balance change was detected.
In such cases, the individuals the victim meets in person—like Even and Maxim—are rarely the ultimate beneficiaries. More often, they are hired “mercenaries” working for a broader criminal network whose core members may be located on the other side of the world.
“They’re usually recruited through underground forums and encrypted chat groups,” Cheek said. “If you know where to look, you’ll see ongoing recruitment posts.”
For several days, it was uncertain whether Sazmining could survive the financial blow—the stolen funds equaled six weeks of company revenue. “I worked hard to keep the company running and manage this sudden cash crunch,” Halliburton said. Ultimately, the company maintained solvency by delaying payments to suppliers and extending loan repayment terms.
That week, a board member of Sazmining filed reports with law enforcement agencies in the Netherlands, the UK, and the US. Only the UK’s National Fraud Intelligence Bureau and the US Secret Service’s Cyber Fraud Task Force confirmed receipt—the former stated no immediate action would be taken; the latter did not respond to requests for comment.
The volume of cryptocurrency-related scams is staggering, making it nearly impossible for law enforcement to investigate every case. “The scale of these threats and crimes has reached unprecedented levels,” Eckle said.
Eckle noted that the best hope for victims to recover funds lies in law enforcement dismantling entire scam networks. In such cases, recovered assets are often distributed among reported victims.
Until then, Halliburton must accept the loss. “It still hurts,” he said, “but it’s not fatal.”
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@WIRED
