← Faris Ali / UK Crypto Home Invasion Ringreviewed 2026-09-07 · 23 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Faris Ali / UK Crypto Home Invasion Ring against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #12[disputed][awaiting moderator]in section: Victim Targeting: TLOxp Database Misuse
“ZachXBT cautioned that the compromise of this and similar investigator databases 'may have directly resulted in eight to nine figures worth of thefts' across multiple incidents.”
reviewerZachXBT cautioned that compromise of TLOxp and similar databases 'may have directly resulted in eight to nine figures worth of thefts' across multiple incidents.The page presents this in quotation marks as a direct quote, but the wording does not match ZachXBT's actual statement and drops the Coinbase-specific context, making it a misquotation rather than a paraphrase.Proposed correction (not yet applied)ZachXBT cautioned that the compromise of this and similar investigator databases 'has resulted in eight to nine figures worth of thefts from Coinbase users.' - #13[disputed][awaiting moderator]in section: ZachXBT On-Chain and Open-Source Investigation
“ZachXBT confirmed in a post-sentencing statement (June 2025) that nearly the full amount of stolen funds was seized by the Metropolitan Police.”
reviewerZachXBT's post-sentencing statement confirming near-full fund seizure was made in June 2025.Internal inconsistency: sentencing occurred Nov 7, 2025, so a 'post-sentencing' statement dated June 2025 predates the event it follows. Status-ID decoding places the actual tweet on Nov 18, 2025, 11 days after sentencing, which is consistent with the tweet's own text ('were just sentenced').Proposed correction (not yet applied)ZachXBT confirmed in a post-sentencing statement (November 2025) that nearly the full amount of stolen funds was seized by the Metropolitan Police. - #14[disputed][awaiting moderator]in the timeline
“2025-06-07”
reviewerZachXBT's post-sentencing statement on X was published on 2025-06-07.Same underlying date error as the section 3 finding above; both should be corrected together. The stored date field, not just the prose, needs to change.Proposed correction (not yet applied)2025-11-18 - #17[disputed][awaiting moderator]in section: Broader Context: Wrench Attacks on Crypto Holders
“Separately, a Metropolitan Police operation resulted in the arrest of twelve individuals in September 2024 in connection with a series of violent home-invasion crypto robberies across the UK, which may or may not be connected to this ring.”
reviewerA Metropolitan Police operation resulted in the arrest of twelve individuals in September 2024 for a series of UK home-invasion crypto robberies.The page conflates a US DOJ prosecution with a UK Metropolitan Police operation; the country, the agency, and the nature of the legal action (sentencing vs. arrest) are all misstated relative to the cited source.Proposed correction (not yet applied)Separately, a U.S. Department of Justice case in the Middle District of North Carolina resulted in twelve individuals being sentenced in September 2024 for a series of violent home-invasion robberies to steal cryptocurrency in the United States; this is unrelated to the Metropolitan Police and not confirmed to be connected to this ring.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #18[link rot][awaiting moderator]in section: Criminal Charges, Guilty Pleas, and Sentencing
“https://www.mexc.com/news/643786”
reviewerMEXC News (mexc.com/news/643786) is a live, working citation for the sentencing details in the Criminal Charges section.The live URL is dead. An archived snapshot is already recorded in sources_used with a July 2026 timestamp and should be substituted as the direct citation.Proposed correction (not yet applied)https://web.archive.org/web/20260726105133/https://www.mexc.com/news/643786 - #19[link rot][awaiting moderator]in the timeline
“https://www.mexc.com/news/643786”
reviewerMEXC News (mexc.com/news/643786) is a live, working citation for the Nov 7, 2025 sentencing timeline entry.Same dead link as the section-4 citation above; both point to the same now-gone MEXC article and should be fixed together.Proposed correction (not yet applied)https://web.archive.org/web/20260726105133/https://www.mexc.com/news/643786
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #8[partially supported][awaiting moderator]in the timeline
“Three perpetrators travel from Sheffield to London in preparation for the robbery.”
reviewerThe three perpetrators travelled from Sheffield to London on June 17, 2024, in preparation for the robbery.The underlying fact appears to be true and is corroborated elsewhere, but the specific source cited for this timeline entry does not contain it — a miscitation rather than a factual error. - #15[partially supported][awaiting moderator]in the summary
“All three perpetrators pleaded guilty and were sentenced to a combined 16 years in youth detention at Sheffield Crown Court on November 7, 2025, with the stolen cryptocurrency recovered within 72 hours and returned to the victim.”
reviewerStolen cryptocurrency was recovered within 72 hours and returned to the victim (summary framing implies prompt return).The page's dedicated Asset Recovery section is accurate and appropriately hedged; the summary line, by omitting the two-week return lag, reads as though recovery and return were simultaneous. - #16[partially supported][awaiting moderator]in section: Broader Context: Wrench Attacks on Crypto Holders
“The Oxford robbery of November 4, 2024, involving £1.1 million in crypto and a luxury watch, is cited in secondary reporting as a related case; four arrests were made in that incident and it remained pending trial as of the reporting date.”
reviewerThe Oxford robbery of November 4, 2024 involved £1.1 million in crypto and a luxury watch, with four arrests, pending trial.Core facts (date, four arrests, watch, crypto theft) are corroborated, but reported totals vary between £1.1m and £1.5m across outlets — a discrepancy the page does not note, unlike its careful treatment of the main case's currency discrepancy. - #23[partially supported][awaiting moderator]in section: Victim Targeting: TLOxp Database Misuse
“The misuse of restricted investigator databases to deanonymise cryptocurrency holders and then physically rob them represents an escalating threat vector noted by ZachXBT and TRM Labs in separate analyses.”
reviewerThe misuse of restricted investigator databases to deanonymise and rob crypto holders is an escalating threat vector noted by ZachXBT and TRM Labs in separate analyses.The general framing (wrench attacks are an escalating threat, tracked by multiple crypto-security researchers) is accurate, but TRM Labs' own cited piece does not specifically corroborate the investigator-database angle attributed to it; only ZachXBT's reporting does.
confirmed
13 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Three Sheffield teenagers carried out an armed home-invasion robbery on June 18, 2024 at a flat in Hoxton, east London, stealing approximately £3.1 million (reported as $4.3M USD in some outlets) in cryptocurrency from a victim they had located using a misappropriated law-enforcement database.”
reviewerThree Sheffield teenagers carried out an armed home-invasion robbery on June 18, 2024 at a flat in Hoxton, east London, stealing approximately £3.1M/$4.3M in crypto from a victim located via a misappropriated law-enforcement database.Core facts of date, location, amount and method are consistently corroborated across multiple independent tier-2 outlets. - #2[confirmed][no action needed]in section: Reported Amount: Currency Discrepancy
“Investigators should treat £3.1 million as the court-verified figure; $4.3 million USD is the figure reported by ZachXBT and widely circulated in crypto media.”
reviewerMultiple credible sources report £3.1 million as the court-verified figure and $4.3 million USD as the crypto-media figure.The page transparently discloses and reasonably explains a real, well-documented currency/figure discrepancy across sources rather than picking one silently. - #3[confirmed][no action needed]in section: Identity and Name Discrepancy
“The ringleader of the robbery is referred to as 'Faris Ali' in ZachXBT's October 2024 public investigation thread, which is the name by which this entity became publicly known in the crypto security community.”
reviewerZachXBT's October 2024 investigation thread refers to the ringleader as 'Faris Ali'.Well corroborated by independent search of multiple crypto-media write-ups of ZachXBT's thread. - #4[confirmed][no action needed]in section: Identity and Name Discrepancy
“Sheffield Crown Court proceedings and mainstream UK press reporting of the November 2025 sentencing identify the ringleader as Faris Hassan, a Sheffield resident who was approximately 16 years old at the time of the offence and 18 at sentencing.”
reviewerSheffield Crown Court proceedings and UK press reporting identify the ringleader as Faris Hassan, ~16 at offence, 18 at sentencing.Consistent across independently retrieved secondary reporting. - #5[confirmed][no action needed]in section: Criminal Charges, Guilty Pleas, and Sentencing
“All three defendants pleaded guilty in proceedings at Sheffield Crown Court. Sentencing took place on November 7, 2025.”
reviewerAll three defendants pleaded guilty; sentencing took place at Sheffield Crown Court on November 7, 2025.Date independently corroborated by multiple outlets. Note the direct MEXC citation for this section is now dead (see separate link_rot finding). - #6[confirmed][no action needed]in section: Criminal Charges, Guilty Pleas, and Sentencing
“Faris Hassan, 18 at sentencing, pleaded guilty to dangerous driving, aggravated burglary, transferring criminal property, theft of a motor vehicle, and driving without insurance or a licence; he was sentenced to 67 months in youth detention.”
reviewerFaris Hassan pleaded guilty to specified charges and received 67 months; Bethune 46 months; the unnamed 17-year-old 80 months.193 total months (67+46+80) matches independently found reporting of '16 years and 1 month' combined. - #7[confirmed][no action needed]in section: Criminal Charges, Guilty Pleas, and Sentencing
“Detective Constable Jonathan Leung of the Metropolitan Police stated: 'This case is a clear example of how the suspects thought posting their criminal exploits on social media would build them a following, however all it built was the case against them.'”
reviewerDetective Constable Jonathan Leung of the Metropolitan Police made the quoted statement about social media building the case against the suspects.Quote wording matches independently retrieved reporting closely enough to be treated as an accurate rendering of the same statement. - #9[confirmed][no action needed]in section: The Robbery: Method and Execution
“Police pursuing the vehicle tracked it via automatic number-plate recognition on the M1 in Northamptonshire and stopped it on the M6 in Warwickshire, where Faris Hassan reportedly reached speeds of approximately 100 mph.”
reviewerPolice tracked the stolen vehicle via ANPR on the M1 in Northamptonshire and stopped it on the M6 in Warwickshire, with Hassan reaching ~100 mph.Precise route and speed details independently corroborated. - #10[confirmed][no action needed]in section: Victim Targeting: TLOxp Database Misuse
“The victim was identified and located using TLOxp, a TransUnion product marketed to licensed law enforcement, private investigators, and financial institutions for skip-tracing and identity verification.”
reviewerThe victim was located using TLOxp, a TransUnion product for licensed law enforcement, PIs, and financial institutions.Directly confirmed by WebFetch of the cited source. - #11[confirmed][no action needed]in section: ZachXBT On-Chain and Open-Source Investigation
“Additionally, an Ethereum Name Service domain, 'farisali.eth', was registered after the robbery and used to embed an on-chain message reading: 'Faris, pay up no games I will be aiding the police in 24 Hours, with your full DOB/location/Addresses with images and full proof of your involvement.'”
reviewerThe ENS domain 'farisali.eth' was registered post-robbery and used to embed the quoted on-chain message.Exact quotation verified word-for-word against the cited source via WebFetch. - #20[confirmed][no action needed]in section: ZachXBT On-Chain and Open-Source Investigation
“A key piece of identifying evidence was a photograph of bail documentation that the ringleader had shared via Telegram with associates, inadvertently revealing personal details including his identity.”
reviewerA photograph of bail documentation shared via Telegram inadvertently revealed the ringleader's identity.Consistent with independently retrieved reporting on ZachXBT's investigation methodology. - #21[confirmed][no action needed]in section: The Robbery: Method and Execution
“After leaving the scene, the perpetrators posted celebratory footage on Snapchat from inside the stolen vehicle, which provided evidence later used in prosecution.”
reviewerAfter leaving the scene, the perpetrators posted celebratory footage on Snapchat, later used as prosecution evidence.Well corroborated across independently retrieved reporting, including DC Leung's quoted statement about social media evidence. - #22[confirmed][no action needed]in section: The Robbery: Method and Execution
“The victim also had his blue BMW X3 stolen.”
reviewerThe victim's blue BMW X3 was stolen during the robbery.Specific color detail independently corroborated, not just the vehicle model.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.