Trenton Johnston, a 19-year-old Canadian national, has been sentenced to 25 months in prison by the U.S. District Court for the Southern District of Florida for his role in a crypto social engineering scheme that stole about 185 BTC from a California victim. Court records say Johnston posed as Google and Trezor support staff to trick the victim into handing over private keys to cold wallets, leading to losses valued at about $13 million at the time.
The sentence also includes three years of supervised release after prison and joint restitution of $13.1 million. Court filings indicate that most of the money has still not been recovered.
Two calls led to the loss of 185 BTC
According to the factual proffer tied to Johnston’s plea, he and his co-conspirators used social engineering tactics from January 2024, when he was 17, through March 24, 2026, in New York, California, and Florida. Prosecutors said the group impersonated Google support and employees of other crypto companies and stole about $13.041 million in total.
The California victim in the 185 BTC theft received a phone call on March 13, 2026, with caller ID showing "Google." The caller claimed to be from Google support and said someone was trying to change the victim’s email password. The caller also sent a photo of the victim’s driver’s license as supposed identity verification. When the victim checked his inbox, he found signs of compromise, including an email sent to Trezor requesting account cancellation that he said he had never sent.
Shortly after that call ended, a second call came in. This caller claimed to be from Trezor and said someone was trying to access the victim’s crypto account. The victim was told not to connect the device to a computer and instead to use a link sent by text message and enter his private key there.
He did so, entering the private keys for his Trezor wallet and another cold wallet. Both wallets were then drained, wiping out about 185 BTC, worth roughly $13 million at the time.
Witness described how the scheme worked
A cooperating witness identified as CW3 described the process in broader terms. The group, according to court records, selected targets from leaked databases, posed as Google employees to break into Gmail accounts, searched for signs of crypto holdings, and then contacted victims while pretending to be customer support staff.
The indictment said that as of the April charging date, the 185 BTC had "not yet been recovered." A presentence filing cited by the defense said the victim described the stolen funds as his life savings.
On the day of the theft, Johnston also sent a Signal message to an unnamed associate. Prosecutors quoted a message recovered from his phone in which he wrote on March 13, "We actually smacked a 185btc target today," then added that they were not done yet.
The associate replied that it was unheard of and said he would not spend his share, instead converting it into the privacy coin Monero (XMR).
Records showed a $310,000 Lamborghini payment the next day
Transaction records included in the factual proffer point to how some of the proceeds were spent. Johnston met Miami exotic car rental operator Brandon Michael Tardibone in November 2025. Tardibone, a co-defendant in the case, also admitted to conspiracy to commit money laundering.
According to the filings, Tardibone helped Johnston rent cars and used crypto proceeds provided by Johnston to buy a Lamborghini Aventador SVJ and two BMW vehicles. The indictment also alleged that Tardibone provided a luxury residence to help Johnston avoid immigration authorities. From January 2026 through March 24, 2026, the amount laundered through Tardibone totaled $1,187,683.74.
The timeline drew particular attention because the 185 BTC theft took place on March 13, and transaction logs showed a $310,000 payment for a Lamborghini SVJ on March 14. The filings did not say that the car payment came directly from those 185 BTC. The factual proffer said only that the vehicles were purchased with proceeds from the fraud scheme.
Witnesses described his day-to-day conduct
Three witnesses named in the indictment offered a picture of Johnston’s routine. On March 24, 2026, police stopped a white Rolls-Royce in North Miami with Johnston inside. Officers then interviewed the three other people in the vehicle, identified as CW1 through CW3.
CW1 said he had lived with Johnston for about a year and that Johnston covered living expenses despite having no legitimate job. CW1 told investigators that Johnston would share his screen on Discord so others could watch him steal cryptocurrency. CW2 said he had successfully stolen crypto after learning from Johnston. CW3 said he had taken part in the activity, stealing about $20,000, and estimated Johnston’s proceeds at "tens of millions of dollars," though the factual proffer put the total at about $13.041 million.
HSI arrested him after a tip from an informant
The investigation did not begin with Discord activity. Court records say law enforcement first received information from a confidential source identified as CS1, who provided messages indicating that Johnston had made millions of dollars through fraud.
During the March 24 stop, Homeland Security Investigations, or HSI, arrested Johnston and seized a computer, phones, a Hermès Birkin bag, $16,362 in cash, and handwritten seed phrase notes found in his luggage.
One set of seed words matched an Ethereum wallet that had received 21 ETH stolen in February from another California victim. That became a key piece of evidence in the case.
Why the sentence was 25 months
Johnston pleaded guilty to one count of conspiracy to commit money laundering. Prosecutors dropped the conspiracy to commit wire fraud charge under the plea agreement. When the Justice Department announced the case in May, it said the two charges together carried a maximum sentence of 20 years. The plea agreement stated that the money laundering conspiracy count carried a maximum of 10 years, with an agreed guideline range of 51 to 63 months.
The sentence was pushed lower after prosecutors filed a substantial assistance motion. On Oct. 21, prosecutors sought a 40% reduction under §5K1.1, saying Johnston had provided meaningful help in the investigation and prosecution of others. The court granted that request. Defense filings calculated that a 40% reduction from the 51-to-63-month range would produce a range of about 30.6 to 37.8 months.
The court ultimately imposed a 25-month prison term.
$13.1 million restitution ordered, but defense said his net worth was zero
The restitution order was set at $13.1 million, but the defense said Johnston’s net worth was zero. A jointly signed factual proffer from prosecutors and Johnston also said that the $3.8 million he had surrendered represented all of the criminal proceeds still in his possession.
That means most of the roughly $13 million tied to the case was no longer in Johnston’s hands. The filings did not say who held the rest.
