U.S. court records outline a crypto theft scheme that began around January 2024, with Johnston and his associates accused of posing as employees of Google, Trezor, and other major crypto firms to gain unauthorized access to victims’ accounts. In one case from February, a victim was persuaded that their Google email and Coinbase accounts had been compromised, leading to the theft of about $41,000 in Ether. Less than a month later, another victim in California was tricked by scammers claiming to represent Google and Trezor, and a wallet holding roughly $13 million in Bitcoin was emptied.
Impersonation attacks focused on trust, not software flaws
The filings describe a classic social engineering operation built around deception rather than technical exploitation. Trezor is known for hardware wallets that keep private keys offline, and prosecutors said the suspects used the credibility of well-known brands to lower victims’ defenses. Cyvers co-founder and CEO Deddy Lavid said the biggest crypto thefts today often come from manipulative tactics aimed at people, not from sophisticated code exploits.
Prosecutors say $1.2 million was spent on luxury purchases
According to prosecutors, about $1.2 million of the stolen cryptocurrency was spent within two months on luxury expenses in Miami and Los Angeles. A large share of that money went to the purchase and rental of high-end cars, with car rental business owner Brandon Tardibone — who also pleaded guilty to money laundering — said to have facilitated many of the transactions. The spending included two BMWs and a Lamborghini Aventador SVJ.
Investigation records also say the stolen funds paid for private jet charters, a rented house in North Miami, and airfare for two people traveling from New York. Prosecutors alleged that all of those expenses were covered by criminal proceeds. Lavid said the speed and irreversible nature of most crypto transfers makes this kind of attack especially dangerous.
A traffic stop opened the door to the broader case
The investigation accelerated in March after Johnston was stopped for speeding in a Rolls Royce. Authorities found 21 pills suspected to be amphetamines inside the vehicle. After that, investigators examined his seized laptop, phone, and handwritten notes, and prosecutors said those materials produced evidence directly connecting him to the organized fraud scheme.
After his arrest, Johnston surrendered about 53.16 BTC and 275.23 ETH to authorities, worth a combined $3.7 million at current prices. Prosecutors recommended a prison sentence of 51 to 63 months because of his guilty plea and full cooperation. Wire fraud charges could be dropped under the agreement. Tardibone faces a recommended sentence of 27 to 33 months.
Case adds to a growing list of U.S. crypto crime prosecutions
The report places this prosecution among several recent high-value crypto cases in the United States. In April, a California resident was sentenced to 70 months in prison for participating in a $263 million crypto crime ring linked to social engineering and home burglary. In February, a Chinese national received a 20-year federal sentence for running a global crypto fraud that took more than $73 million, mostly from American investors.
Cyvers security executives said user education alone is no longer enough. They argued that wallet providers, exchanges, custodians, and banks need real-time security checks that can detect suspicious activity and risky wallets before funds leave an account.