Verify a decision

{"actor":"system:backfill","investigation_id":"39fa81fa-065d-4dbd-9013-342ab1bedc38","kind":"publish","page_slug":"faris-ali-uk-crypto-home-invasion-ring","published_at":"2026-06-08T02:45:35.399Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Faris Ali / UK Crypto Home Invasion Ring","sections":[{"content":"The ringleader of the robbery is referred to as 'Faris Ali' in ZachXBT's October 2024 public investigation thread, which is the name by which this entity became publicly known in the crypto security community. Sheffield Crown Court proceedings and mainstream UK press reporting of the November 2025 sentencing identify the ringleader as Faris Hassan, a Sheffield resident who was approximately 16 years old at the time of the offence and 18 at sentencing. Mikyle Bethune, also from Sheffield and also 18 at sentencing, was named as the second accomplice. The third defendant, aged 17 at sentencing, cannot be named under UK youth protection law. Whether 'Ali' was an online alias, a surname variant, or a reporting error has not been clarified in any source reviewed. All factual claims in this dossier use 'Faris Hassan' where court records are the source, and 'Faris Ali' where ZachXBT's pre-sentencing investigation is the source.","heading":"Identity and Name Discrepancy","severity":"medium","sources":[{"credibility":2,"name":"Decrypt: UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":2,"name":"Cryptopolitan: ZachXBT exposes scammer Faris Ali who stole $4.3m in crypto from a Twitter user","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":2,"name":"Yahoo News Canada: Moment teenage burglars pose as Amazon delivery drivers to steal £3million in crypto at knifepoint","type":"news_article","url":"https://ca.news.yahoo.com/moment-teenage-burglars-pose-amazon-094731533.html"}]},{"content":"On June 17, 2024, the three perpetrators travelled from Sheffield to London. On June 18, 2024, they arrived at a residential flat in Hoxton, east London, disguised as Amazon delivery drivers carrying parcels. Once the victim opened the door, they forced entry, threatened him with large knives, and compelled him to transfer his cryptocurrency holdings — reported as approximately £3.1 million by UK press and as $4.3 million USD by crypto-focused outlets — to addresses under the attackers' control. The victim also had his blue BMW X3 stolen. The attack is classified as a 'wrench attack,' a category of physical coercive robbery targeting known or suspected cryptocurrency holders. After leaving the scene, the perpetrators posted celebratory footage on Snapchat from inside the stolen vehicle, which provided evidence later used in prosecution. Police pursuing the vehicle tracked it via automatic number-plate recognition on the M1 in Northamptonshire and stopped it on the M6 in Warwickshire, where Faris Hassan reportedly reached speeds of approximately 100 mph. All three were arrested approximately three hours after the robbery.","heading":"The Robbery: Method and Execution","severity":"critical","sources":[{"credibility":2,"name":"Decrypt: UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":2,"name":"The Sheffield Star: Sheffield teenagers tricking and threatening Hoxton flat occupant","type":"news_article","url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"},{"credibility":2,"name":"Inkl / Daily Mail: Moment teenage burglars pose as Amazon delivery drivers","type":"news_article","url":"https://www.inkl.com/news/moment-teenage-burglars-pose-as-amazon-delivery-drivers-to-steal-3million-in-crypto-at-knifepoint"},{"credibility":2,"name":"Cryptopolitan: Faris and 2 accomplices sentenced in the UK for $4.3M+ crypto robbery at gunpoint","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"}]},{"content":"The victim was identified and located using TLOxp, a TransUnion product marketed to licensed law enforcement, private investigators, and financial institutions for skip-tracing and identity verification. The perpetrators allegedly obtained unauthorised access to TLOxp or a downstream reseller of its data in order to obtain the victim's residential address from his online crypto identity. ZachXBT cautioned that the compromise of this and similar investigator databases 'may have directly resulted in eight to nine figures worth of thefts' across multiple incidents. The misuse of restricted investigator databases to deanonymise cryptocurrency holders and then physically rob them represents an escalating threat vector noted by ZachXBT and TRM Labs in separate analyses. The victim's exposure to this database lookup is reported to have stemmed from a prior crypto data breach that linked his personal details to his on-chain identity.","heading":"Victim Targeting: TLOxp Database Misuse","severity":"high","sources":[{"credibility":2,"name":"Coinspeaker: Teen Gets Prison for $4.3M Crypto Machete Heist Cracked by ZachXBT","type":"news_article","url":"https://www.coinspeaker.com/teen-gets-prison-for-4-3m-crypto-machete-heist-cracked-by-zachxbt/"},{"credibility":2,"name":"Yahoo News: Teen Gets Prison for $4.3M Crypto Machete Heist","type":"news_article","url":"https://www.yahoo.com/news/articles/teen-gets-prison-4-3m-200210259.html"},{"credibility":2,"name":"TRM Labs: The Rise of Wrench Attacks and Crypto-related Violent Crime","type":"research","url":"https://www.trmlabs.com/resources/blog/the-rise-of-wrench-attacks-and-crypto-related-violent-crime"}]},{"content":"After the victim publicly disclosed the robbery on X (formerly Twitter) on June 18, 2024, blockchain investigator ZachXBT began an independent investigation. ZachXBT obtained chat logs between the alleged ringleader (identified online as 'Faris Ali') and an accomplice discussing their disguise, approach, and target — including photographs of the victim's building and door taken in the hours before the attack. A key piece of identifying evidence was a photograph of bail documentation that the ringleader had shared via Telegram with associates, inadvertently revealing personal details including his identity. Additionally, an Ethereum Name Service domain, 'farisali.eth', was registered after the robbery and used to embed an on-chain message reading: 'Faris, pay up no games I will be aiding the police in 24 Hours, with your full DOB/location/Addresses with images and full proof of your involvement.' ZachXBT published his full investigation on October 10, 2024. The evidence gathered by ZachXBT is reported to have contributed to the Metropolitan Police's prosecution. ZachXBT confirmed in a post-sentencing statement (June 2025) that nearly the full amount of stolen funds was seized by the Metropolitan Police.","heading":"ZachXBT On-Chain and Open-Source Investigation","severity":"high","sources":[{"credibility":2,"name":"ZachXBT on X (post-sentencing statement)","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"},{"credibility":2,"name":"Cryptopolitan: ZachXBT exposes scammer Faris Ali","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":2,"name":"Mitrade: ZachXBT exposes scammer Faris Ali (October 11 2024)","type":"news_article","url":"https://www.mitrade.com/insights/news/live-news/article-3-404792-20241011"},{"credibility":2,"name":"CoinMarketCap: Blockchain Investigator ZachXBT Warns of Rise in Home Invasion Crypto Thefts","type":"news_article","url":"https://coinmarketcap.com/academy/article/blockchain-investigator-zachxbt-warns-of-rise-in-home-invasion-crypto-thefts"}]},{"content":"All three defendants pleaded guilty in proceedings at Sheffield Crown Court. Sentencing took place on November 7, 2025. Faris Hassan, 18 at sentencing, pleaded guilty to dangerous driving, aggravated burglary, transferring criminal property, theft of a motor vehicle, and driving without insurance or a licence; he was sentenced to 67 months in youth detention. Mikyle Bethune, 18 at sentencing, pleaded guilty to aggravated burglary, theft of a motor vehicle, and possession of a knife; he was sentenced to 46 months in youth detention. The third defendant, 17 at sentencing and unnamed under UK youth protection law, pleaded guilty to aggravated burglary, possession of criminal property, and theft of a motor vehicle; he received 80 months in youth detention. The combined total across all three defendants is 193 months, or approximately 16 years. Detective Constable Jonathan Leung of the Metropolitan Police stated: 'This case is a clear example of how the suspects thought posting their criminal exploits on social media would build them a following, however all it built was the case against them.'","heading":"Criminal Charges, Guilty Pleas, and Sentencing","severity":"critical","sources":[{"credibility":2,"name":"MEXC News: Teenagers arrested after posting $3.1 million crypto robbery online","type":"news_article","url":"https://www.mexc.com/news/643786"},{"credibility":2,"name":"The Sheffield Star: Sheffield teenagers tricking and threatening Hoxton flat occupant","type":"news_article","url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"},{"credibility":2,"name":"Cryptopolitan: Faris and 2 accomplices sentenced","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"Crypto Economy: Teen Burglars Disguised as Amazon Couriers Steal Over $3.9M in Crypto","type":"news_article","url":"https://crypto-economy.com/teen-burglars-disguised-as-amazon-couriers-steal-over-3-9m-in-crypto/"}]},{"content":"The stolen cryptocurrency was traced and recovered within 72 hours of the robbery. It was returned to the victim approximately two weeks after the theft. ZachXBT confirmed in his post-sentencing statement that nearly the full amount of stolen funds was seized by the Metropolitan Police. The rapid recovery is consistent with the perpetrators having been arrested approximately three hours after the offence while still in possession of the victim's vehicle, before they had time to move or obfuscate the on-chain funds. The specific blockchain addresses to which funds were transferred and the exact recovery mechanism — whether via court order, voluntary return under police pressure, or direct seizure — have not been detailed in any publicly available source reviewed.","heading":"Asset Recovery","severity":"low","sources":[{"credibility":2,"name":"Cryptopolitan: Faris and 2 accomplices sentenced","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"ZachXBT on X (post-sentencing statement)","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"},{"credibility":2,"name":"Inkl / Daily Mail: Moment teenage burglars pose as Amazon delivery drivers","type":"news_article","url":"https://www.inkl.com/news/moment-teenage-burglars-pose-as-amazon-delivery-drivers-to-steal-3million-in-crypto-at-knifepoint"}]},{"content":"This case is part of a documented pattern of physical 'wrench attacks' targeting individuals with publicly known or deanonymised cryptocurrency holdings. ZachXBT and TRM Labs have each published analyses warning that compromised law-enforcement and investigator databases — including TLOxp — are being systematically exploited by criminal networks to identify and physically rob crypto holders. The Oxford robbery of November 4, 2024, involving £1.1 million in crypto and a luxury watch, is cited in secondary reporting as a related case; four arrests were made in that incident and it remained pending trial as of the reporting date. Separately, a Metropolitan Police operation resulted in the arrest of twelve individuals in September 2024 in connection with a series of violent home-invasion crypto robberies across the UK, which may or may not be connected to this ring.","heading":"Broader Context: Wrench Attacks on Crypto Holders","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: The Rise of Wrench Attacks and Crypto-related Violent Crime","type":"research","url":"https://www.trmlabs.com/resources/blog/the-rise-of-wrench-attacks-and-crypto-related-violent-crime"},{"credibility":2,"name":"Cryptopolitan: Faris and 2 accomplices sentenced (Oxford case mention)","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":3,"name":"Hacker News: Twelve sentenced for violent home invasion robberies to steal cryptocurrency","type":"community_report","url":"https://news.ycombinator.com/item?id=41544059"},{"credibility":3,"name":"This $4.3M crypto home invasion shows how a single data leak can put anyone at risk","type":"news_article","url":"https://bitcoinethereumnews.com/crypto/this-4-3m-crypto-home-invasion-shows-how-a-single-data-leak-can-put-anyones-wallet-and-safety-at-risk/"}]},{"content":"Multiple credible sources report the stolen amount as £3.1 million GBP, including the Inkl/Daily Mail report citing court proceedings, the MEXC News article, and the Crypto Economy report. Crypto-focused outlets including Cryptopolitan, CryptoRank, and ZachXBT's own post-sentencing statement refer to '$4.3M+' or '$4.3 million USD.' The discrepancy likely reflects the GBP/USD exchange rate at the time of the offence (mid-2024), combined with the possibility that ZachXBT's valuation was calculated at a different point in time or used a different asset price. Investigators should treat £3.1 million as the court-verified figure; $4.3 million USD is the figure reported by ZachXBT and widely circulated in crypto media.","heading":"Reported Amount: Currency Discrepancy","severity":"low","sources":[{"credibility":2,"name":"Inkl / Daily Mail: Moment teenage burglars pose as Amazon delivery drivers","type":"news_article","url":"https://www.inkl.com/news/moment-teenage-burglars-pose-as-amazon-delivery-drivers-to-steal-3million-in-crypto-at-knifepoint"},{"credibility":2,"name":"Cryptopolitan: Faris and 2 accomplices sentenced","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"ZachXBT on X (post-sentencing statement)","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT on X (post-sentencing statement, June 2025)","type":"social_media","url":"https://x.com/zachxbt/status/1990809384738230584"},{"credibility":2,"name":"Cryptopolitan: ZachXBT exposes scammer Faris Ali who stole $4.3m in crypto from a Twitter user","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"credibility":2,"name":"Cryptopolitan: Faris and 2 accomplices sentenced in the UK for $4.3M+ crypto robbery at gunpoint","type":"news_article","url":"https://www.cryptopolitan.com/faris-sentenced-uk-4-3m-crypto-robbery-gun/"},{"credibility":2,"name":"Decrypt: UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video","type":"news_article","url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"credibility":2,"name":"Coinspeaker: Teen Gets Prison for $4.3M Crypto Machete Heist Cracked by ZachXBT","type":"news_article","url":"https://www.coinspeaker.com/teen-gets-prison-for-4-3m-crypto-machete-heist-cracked-by-zachxbt/"},{"credibility":2,"name":"Yahoo News: Teen Gets Prison for $4.3M Crypto Machete Heist","type":"news_article","url":"https://www.yahoo.com/news/articles/teen-gets-prison-4-3m-200210259.html"},{"credibility":2,"name":"Yahoo News Canada: Moment teenage burglars pose as Amazon delivery drivers to steal £3million in crypto at knifepoint","type":"news_article","url":"https://ca.news.yahoo.com/moment-teenage-burglars-pose-amazon-094731533.html"},{"credibility":2,"name":"Yahoo News: UK Teens Jailed After $4.3M Wrench Attack Robbery Caught on Police Video","type":"news_article","url":"https://www.yahoo.com/news/articles/uk-teens-jailed-4-3m-154516225.html"},{"credibility":2,"name":"The Sheffield Star: Sheffield teenagers tricking and threatening occupant of London flat","type":"news_article","url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"},{"credibility":2,"name":"Inkl / Daily Mail: Moment teenage burglars pose as Amazon delivery drivers to steal £3million in crypto at knifepoint","type":"news_article","url":"https://www.inkl.com/news/moment-teenage-burglars-pose-as-amazon-delivery-drivers-to-steal-3million-in-crypto-at-knifepoint"},{"credibility":2,"name":"MEXC News: Teenagers arrested after posting $3.1 million crypto robbery online","type":"news_article","url":"https://www.mexc.com/news/643786"},{"credibility":2,"name":"Crypto Economy: Teen Burglars Disguised as Amazon Couriers Steal Over $3.9M in Crypto","type":"news_article","url":"https://crypto-economy.com/teen-burglars-disguised-as-amazon-couriers-steal-over-3-9m-in-crypto/"},{"credibility":2,"name":"Cryptopolitan: Teen burglars posing as Amazon couriers steal £3.1M in crypto","type":"news_article","url":"https://www.cryptopolitan.com/teen-steal-3-1m-in-crypto/"},{"credibility":2,"name":"CryptoRank: UK court jails Faris, accomplices over $4.3M crypto theft at gunpoint","type":"news_article","url":"https://cryptorank.io/news/feed/e09a6-faris-sentenced-uk-4-3m-crypto-robbery-gun"},{"credibility":2,"name":"Mitrade: ZachXBT exposes scammer Faris Ali (October 11 2024)","type":"news_article","url":"https://www.mitrade.com/insights/news/live-news/article-3-404792-20241011"},{"credibility":2,"name":"CoinMarketCap: Blockchain Investigator ZachXBT Warns of Rise in Home Invasion Crypto Thefts","type":"news_article","url":"https://coinmarketcap.com/academy/article/blockchain-investigator-zachxbt-warns-of-rise-in-home-invasion-crypto-thefts"},{"credibility":2,"name":"TRM Labs: The Rise of Wrench Attacks and Crypto-related Violent Crime","type":"research","url":"https://www.trmlabs.com/resources/blog/the-rise-of-wrench-attacks-and-crypto-related-violent-crime"},{"credibility":3,"name":"Hacker News: Twelve sentenced for violent home invasion robberies to steal cryptocurrency","type":"community_report","url":"https://news.ycombinator.com/item?id=41544059"},{"credibility":2,"name":"404 Media: Feds Charge Alleged TLO Underground Data Broker","type":"news_article","url":"https://www.404media.co/feds-charge-tlo-data-seller-tloxp/"}],"summary":"Three Sheffield teenagers carried out an armed home-invasion robbery on June 18, 2024 at a flat in Hoxton, east London, stealing approximately £3.1 million (reported as $4.3M USD in some outlets) in cryptocurrency from a victim they had located using a misappropriated law-enforcement database. Blockchain investigator ZachXBT publicly identified the ringleader online as 'Faris Ali' in October 2024; Sheffield Crown Court proceedings name the ringleader as Faris Hassan. All three perpetrators pleaded guilty and were sentenced to a combined 16 years in youth detention at Sheffield Crown Court on November 7, 2025, with the stolen cryptocurrency recovered within 72 hours and returned to the victim.","timeline":[{"date":"2024-06-17","event":"Three perpetrators travel from Sheffield to London in preparation for the robbery.","source":"CoinMarketCap / ZachXBT investigation","source_url":"https://coinmarketcap.com/academy/article/blockchain-investigator-zachxbt-warns-of-rise-in-home-invasion-crypto-thefts"},{"date":"2024-06-18","event":"Armed home-invasion robbery at a flat in Hoxton, east London. Three attackers posed as Amazon delivery drivers, threatened victim with knives, and forced transfer of approximately £3.1 million (reported as $4.3M USD) in cryptocurrency. Victim's BMW X3 also stolen.","source":"Sheffield Star / Inkl / Cryptopolitan","source_url":"https://www.thestar.co.uk/news/crime/sheffield-london-cryptocurrency-burglary-5503859"},{"date":"2024-06-18","event":"Victim publicly discloses the robbery on X (Twitter), tagging ZachXBT. Stolen cryptocurrency traced and recovered by Metropolitan Police within 72 hours.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-exposes-scammer-faris-ali-who-stole-4-3m-in-crypto-from-a-twitter-user/"},{"date":"2024-06-18","event":"All three perpetrators arrested approximately three hours after the robbery when their stolen vehicle is stopped by police on the M6 in Warwickshire after a high-speed pursuit.","source":"Decrypt / MEXC News","source_url":"https://decrypt.co/357058/uk-teens-jailed-after-4-3m-wrench-attack-robbery-caught-on-police-video"},{"date":"2024-06-18","event":"ENS domain 'farisali.eth' registered by an unknown party post-robbery; on-chain message embedded threatening to provide police with identifying evidence about 'Faris' within 24 hours.","source":"Cryptopolitan / Mitrade","source_url":"https://www.mitrade.com/insights/news/live-news/article-3-404792-20241011"},{"date":"2024-10-10","event":"ZachXBT publishes full investigation identifying the ringleader as 'Faris Ali', including chat logs, surveillance photos, and the leaked bail document shared via Telegram. The investigation also details the alleged use of TLOxp to locate the victim's address.","source":"Mitrade / Cryptopolitan","source_url":"https://www.mitrade.com/insights/news/live-news/article-3-404792-20241011"},{"date":"2025-11-07","event":"Sheffield Crown Court sentences all three defendants. Faris Hassan: 67 months. Mikyle Bethune: 46 months. Unnamed 17-year-old: 80 months. Combined: approximately 16 years in youth detention.","source":"MEXC News / The Sheffield Star / Cryptopolitan","source_url":"https://www.mexc.com/news/643786"},{"date":"2025-06-07","event":"ZachXBT publishes post-sentencing statement on X confirming sentences and that nearly the full amount of stolen funds was seized by the Metropolitan Police.","source":"ZachXBT on X","source_url":"https://x.com/zachxbt/status/1990809384738230584"}]},"v":1}