DOJ: Support-impersonation led to $13M crypto theft

The Department of Justice filed an indictment on May 11 alleging a support-impersonation scheme that enabled unauthorized access to cryptocurrency wallets and resulted in more than $13 million in reported losses.

Prosecutors identify the defendants as Trenton Richard David Johnston, 19, a Canadian national, and Brandon Michael Tardibone, 28, of Miami. They face charges including conspiracy to commit wire fraud and conspiracy to commit money laundering. An additional harboring count is tied to lodging at a luxury Miami-area residence while Johnston was allegedly unlawfully present in the United States. Prosecutors say investigators are still identifying more victims, and the full scope of losses remains under review.

Court documents describe the alleged scheme as impersonating customer support representatives linked to a popular search engine and cryptocurrency firms. Investigators say the impostors told victims their accounts were compromised and sought login credentials, two-factor authentication codes, seed phrases or remote access to devices. Once access was obtained, funds were transferred from victims’ wallets into addresses controlled by the conspirators.

Laundering allegations in the indictment trace more than $1 million of proceeds to luxury vehicle leases, jewelry purchases and nightlife and entertainment expenses. The indictment states, “Once access was obtained, the conspirators allegedly transferred victims’ cryptocurrency holdings for their own benefit.”

Federal warnings issued before the indictment described similar tactics, including the use of sponsored search ads and manipulated search results to display fraudulent support numbers and prompt urgent security claims. Those alerts outlined how scammers request the same kinds of access and credentials identified in the court papers.

The case is at the indictment stage and the defendants are presumed innocent until proven guilty. The DOJ and law enforcement continue to notify potential victims and trace funds. Federal advisories recommend users avoid sharing seed phrases or authentication codes and verify support contacts through official company channels.