Verify a decision

{"actor":"system:backfill","investigation_id":"e793c9b3-b1f4-4ad3-9c95-ec1aa0bc8730","kind":"publish","page_slug":"faris-ali","published_at":"2026-06-14T17:32:45.371Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Faris Ali","sections":[{"content":"On June 17, 2024, three masked teenagers from Sheffield traveled to Hoxton, East London, where they gained entry to a victim's flat by posing as Amazon delivery couriers. Once inside, they threatened the victim with large knives (described in some reports as machetes) and forced him to transfer over $4.3 million (approximately £3.1 million) in cryptocurrency. The attackers also took the victim's car keys, and later fled the scene in the victim's blue BMW X3. The robbery was premeditated: according to ZachXBT's October 2024 investigation, chat logs between Faris and an accomplice showed them discussing how to use the delivery-driver cover story, sharing photographs of the victim's building and door, and confirming their position outside the target address prior to entry. The victim had previously suffered a crypto data breach that allowed the perpetrators to skip-trace his real-world identity and residential address before planning the attack.","heading":"The Robbery","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT exposes scammer Faris Ali who stole $4.3m in crypto from a Twitter user - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":2,"name":"UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video - Decrypt","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":2,"name":"Moment teenage burglars pose as Amazon delivery drivers to steal £3 million in crypto at knifepoint - Yahoo News","type":"news_article","url":"https://ca.news.yahoo.com/moment-teenage-burglars-pose-amazon-094731533.html"}]},{"content":"After the victim reached out to blockchain investigator ZachXBT, ZachXBT launched an independent on-chain and open-source intelligence investigation. He traced stolen funds sent to two Ethereum addresses (0x7d1...86d99 and 0xe925...c4dcef) and obtained Telegram chat logs in which the perpetrators coordinated the attack, shared reconnaissance photographs of the victim's building, and confirmed they were positioned outside the flat in delivery uniforms. A key piece of identifying evidence was that Faris had previously shared a photograph of his bail documentation on Telegram to friends, inadvertently disclosing his full legal name and linking him to the crime. An ENS (Ethereum Name Service) domain, \"farisali.eth\", was also registered and used to send an on-chain message to the perpetrators after the robbery, further anchoring the investigation. ZachXBT published his full findings on October 10, 2024, and shared them with the Metropolitan Police and the victim.","heading":"ZachXBT Investigation and On-Chain Evidence","severity":"high","sources":[{"credibility":2,"name":"ZachXBT exposes scammer Faris Ali who stole $4.3m in crypto from a Twitter user - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":3,"name":"ZachXBT post on X confirming sentencing and fund recovery","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"},{"credibility":2,"name":"Faris and 2 accomplices sentenced in the UK for $4.3M+ crypto robbery at gunpoint - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"}]},{"content":"Automatic number plate recognition (ANPR) cameras on the M1 motorway in Northamptonshire detected the victim's stolen blue BMW X3 within approximately three hours of the robbery. Police stopped the vehicle on the M6 in Warwickshire after a brief pursuit. Separately, Metropolitan Police detectives traced the stolen cryptocurrency using the on-chain evidence provided by ZachXBT and seized nearly all of the funds. The stolen cryptocurrency was recovered within 72 hours and returned to the victim approximately two weeks after the robbery, according to reporting by Decrypt and Yahoo News. The self-incriminating Snapchat video the suspects posted of themselves celebrating in the stolen car also aided police identification.","heading":"Asset Recovery","severity":"medium","sources":[{"credibility":2,"name":"UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video - Decrypt","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":2,"name":"Faris and 2 accomplices sentenced in the UK for $4.3M+ crypto robbery at gunpoint - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"UK court jails Faris, accomplices over $4.3M crypto theft at gunpoint - CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/e09a6-faris-sentenced-uk-4-3m-crypto-robbery-gun"}]},{"content":"The three defendants were sentenced at Sheffield Crown Court on November 7, 2025, to a combined total of 16 years in youth detention. Faris Hassan (referred to in ZachXBT's investigation and crypto media as \"Faris Ali\") pleaded guilty to dangerous driving, aggravated burglary, transferring criminal property, theft of a motor vehicle, and driving without insurance or a licence; he received a sentence of 67 months in custody. Accomplice Mikyle Bethune, also of Sheffield and aged 18 at sentencing, pleaded guilty to aggravated burglary, theft of a motor vehicle, and possession of a knife, and received 46 months in custody. A third defendant, a minor whose name is withheld under youth protection laws, pleaded guilty to aggravated burglary, possession of criminal property, and theft of a motor vehicle, and received 80 months in custody. The case reference reported by ZachXBT is 01GD1223024. Court records note that certain details are sealed due to minor protection provisions.","heading":"Criminal Convictions and Sentencing","severity":"critical","sources":[{"credibility":2,"name":"Sheffield teenagers tricking victim to hand over $4.3 million in cryptocurrency - The Star","type":"news_article","url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"},{"credibility":2,"name":"Faris and 2 accomplices sentenced in the UK for $4.3M+ crypto robbery at gunpoint - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video - Decrypt","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":3,"name":"ZachXBT post on X confirming sentencing - Sheffield Crown Court case reference 01GD1223024","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"}]},{"content":"Investigators determined that the perpetrators identified and located the victim through a prior cryptocurrency data breach that exposed personal information linked to the victim's crypto holdings. The skip-tracing methodology allowed the group to connect an on-chain wallet to a real-world individual and residential address before executing the physical attack. This method of using leaked data to bridge on-chain and real-world identities has been noted by security researchers as an emerging threat vector for high-value crypto holders. The Cryptoslate analysis of the case (published November 23, 2025) specifically examined this data-linkage risk as a systemic vulnerability.","heading":"Social Engineering and Victim Identification","severity":"high","sources":[{"credibility":2,"name":"ZachXBT exposes scammer Faris Ali who stole $4.3m in crypto from a Twitter user - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":2,"name":"Home invasion stalked $4.3M crypto wallet - CryptoSlate","type":"news_article","url":"https://cryptoslate.com/the-uks-4-3m-crypto-home-invasion-shows-how-a-single-data-leak-can-put-anyones-wallet-and-safety-at-risk/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT exposes scammer Faris Ali who stole $4.3m in crypto from a Twitter user - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":2,"name":"Faris and 2 accomplices sentenced in the UK for $4.3M+ crypto robbery at gunpoint - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"UK court jails Faris, accomplices over $4.3M crypto theft at gunpoint - CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/e09a6-faris-sentenced-uk-4-3m-crypto-robbery-gun"},{"credibility":2,"name":"UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video - Decrypt","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":2,"name":"Sheffield teenagers tricking victim to hand over $4.3 million in cryptocurrency - The Star","type":"news_article","url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"},{"credibility":2,"name":"Moment teenage burglars pose as Amazon delivery drivers to steal £3 million in crypto at knifepoint - Yahoo News","type":"news_article","url":"https://ca.news.yahoo.com/moment-teenage-burglars-pose-amazon-094731533.html"},{"credibility":2,"name":"Home invasion stalked $4.3M crypto wallet - CryptoSlate","type":"news_article","url":"https://cryptoslate.com/the-uks-4-3m-crypto-home-invasion-shows-how-a-single-data-leak-can-put-anyones-wallet-and-safety-at-risk/"},{"credibility":3,"name":"ZachXBT post on X confirming sentencing and Sheffield Crown Court case reference","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"},{"credibility":2,"name":"Teen burglars posing as Amazon couriers steal £3.1M in crypto - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/teen-steal-3-1m-in-crypto/"}],"summary":"Faris Ali (legal name reported as Faris Hassan in court proceedings) is a UK teenager from Sheffield who, at age 16, orchestrated a violent home-invasion robbery in Hoxton, East London on June 17, 2024, in which three masked attackers posing as Amazon delivery couriers forced a victim at knifepoint to transfer over $4.3 million in cryptocurrency. Blockchain investigator ZachXBT publicly exposed Ali in October 2024 through on-chain forensics and leaked Telegram chat logs; the Metropolitan Police recovered nearly all stolen funds within 72 hours. Ali and two accomplices were sentenced to a combined 16 years in youth detention at Sheffield Crown Court in November 2025.","timeline":[{"date":"2024-06-17","event":"Three masked teenagers from Sheffield, posing as Amazon delivery couriers, force their way into a flat in Hoxton, East London, and compel the victim at knifepoint to transfer over $4.3 million in cryptocurrency. The attackers flee in the victim's BMW X3.","source":"Cryptopolitan; Decrypt; Yahoo News","source_url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"date":"2024-06-17","event":"Within approximately three hours of the robbery, Metropolitan Police detect the stolen BMW X3 via ANPR cameras on the M1 in Northamptonshire. The vehicle is stopped on the M6 in Warwickshire after a brief pursuit.","source":"Decrypt; Yahoo News","source_url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"date":"2024-06-18","event":"Victim publicly announces the robbery on Twitter (X), tagging ZachXBT and requesting investigative assistance.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"date":"2024-06-19","event":"Metropolitan Police recover the stolen cryptocurrency within approximately 72 hours of the robbery. Funds are returned to the victim roughly two weeks later.","source":"Decrypt","source_url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"date":"2024-10-10","event":"ZachXBT publishes his full investigation publicly, identifying the ringleader as Faris Ali (Faris Hassan), detailing Telegram chat logs, on-chain fund flows to two Ethereum addresses, and the bail documentation photograph that confirmed his identity. The investigation is shared with law enforcement.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"date":"2025-11-07","event":"Sheffield Crown Court sentences the three defendants to a combined 16 years in youth detention. Faris Hassan receives 67 months, Mikyle Bethune receives 46 months, and the unnamed minor receives 80 months. Case reference: 01GD1223024.","source":"The Star; Cryptopolitan; Decrypt; ZachXBT on X","source_url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"}]},"v":1}