Drew says his story began at age thirteen with playing Roblox.
Explicit Confidence 99% · Drew EP 112 Details
“it starts at age thirteen at Roblox, like playing Roblox”
Episode
08 March 2022 Official episode · Official transcript
cybercrime botnet black hat bitcoin
Jack Rhysider interviews Drew about online criminal communities involving Roblox fraud, phishing, account trading, SIM-swapping, credential theft, cryptocurrency theft, and NFT scams.
Topics: SIM-swapping and insider-assisted number transfers, Physical theft of carrier-authorized tablets, Social engineering and phishing for employee credentials, Credential stuffing using combo lists and password reuse, Password-hash cracking, Account trading and username sniping, Doxxing, extortion, swatting, and harassment, Cryptocurrency exchange account takeover, Two-factor authentication bypass and SMS OTP interception, Cryptocurrency wallet theft and laundering, NFT phishing and wallet draining, Discord authentication-token theft, Fake NFT communities, bots, and exit scams, Gift-card balance phishing, Roblox botting and artificial engagement, Operational security and identity exposure
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Drew says his story began at age thirteen with playing Roblox.
Explicit Confidence 99% · Drew EP 112 Details
“it starts at age thirteen at Roblox, like playing Roblox”
Drew USES Google Ads
Jack says Drew set up and ran Google Ads to attract people to his phishing site.
Explicit Confidence 98% · Jack Rhysider EP 112 Details
“he learned how to clone a website ... and started running Google Ads himself”
Drew says the fake gift-card balance site was a phishing page, and Jack says Drew operated one himself.
Explicit Confidence 99% · Drew EP 112 Details
“It’s a phishing page.”
“He learned how to clone a website which is really easy, and set up his own phishing site”
Drew came across OGUsers and became one of its early users.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“he came across a forum called OGUsers”
“I’m the 700th user to make an OGUser account”
Turbo USES Username swapping
Turbo is described as an automated system for claiming a username during username swapping.
Explicit Confidence 99% · Drew EP 112 Details
“an automated system called a swapper or a claimer or a turbo”
“the turbo automatically uses an Instagram endpoint to claim this username”
Roblox botnet AFFECTS Roblox
The Roblox botnet/service is used to create nonexistent players and falsely increase a Roblox game's popularity.
Explicit Confidence 98% · Drew EP 112 Details
“it would use a botnet to do it. It would have players that didn’t exist join the game”
Drew USES Roblox botnet
Drew hired a Roblox botmaster service to add artificial players to his game, although the service allegedly did not deliver them.
Explicit Confidence 98% · Jack Rhysider EP 112 Details
“he hired a service like a Roblox botmaster kind of thing”
“The botmaster takes the money, but doesn’t deliver users to his game”
Combo list USES Credential stuffing
Combo lists are used to test reused username-and-password combinations against many sites.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you could take this combo list and have a tool just automatically try logging into tons of sites”
Sentry NBA USES Combo list
Sentry NBA is named as software used to automatically check combo lists.
Explicit Confidence 99% · Drew EP 112 Details
“they use software such as Sentry NBA, OpenBullet, or SilverBullet to thereby automatically check all these combo lists”
OpenBullet USES Combo list
OpenBullet is named as software used to automatically check combo lists.
Explicit Confidence 99% · Drew EP 112 Details
“Sentry NBA, OpenBullet, or SilverBullet to thereby automatically check all these combo lists”
SilverBullet USES Combo list
SilverBullet is named as software used to automatically check combo lists.
Explicit Confidence 99% · Drew EP 112 Details
“Sentry NBA, OpenBullet, or SilverBullet to thereby automatically check all these combo lists”
SIM swapping USES Credential stuffing
Drew describes SIM-swappers using reused credentials from databases to identify and access Coinbase accounts.
Explicit Confidence 97% · Drew EP 112 Details
“They’re using commons from databases, getting into Coinbase – this is all automated – and then they get their balance; they had SIM-swapped them”
SIM swapping USES Telegram
SIM-swapping operations are organized through Telegram channels and chats.
Explicit Confidence 98% · Jack Rhysider EP 112 Details
“They all get organized inside a Telegram chat room”
“people on Telegram aren’t the type of person to go run into a store”
Remo snatching TARGETS T-Mobile
Remo snatching is described as stealing a T-Mobile store manager's tablet to enable a SIM swap.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you are going to T-Mobile. T-Mobile is the easiest place to hit right now. You go to a T-Mobile, you run in, you take the store manager’s tablet”
Remo snatching USES social engineering
Before stealing the tablet, attackers allegedly social-engineer the store manager to obtain the manager's password.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you need to do recon on the store, figure out everything you can about the manager to try to social-engineer them”
“They send you a fake URL, you enter your manager login”
Discord token theft AFFECTS Discord
Discord token theft allows an attacker to log in as a Discord user without their password.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“if you can just take the authentication token, then you can log in as that person without needing a password”
NFT phishing AFFECTS MetaMask
NFT phishing is described as tricking a victim into connecting MetaMask and revealing a wallet seed phrase, enabling wallet theft.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“the site said in order to mint the NFT, you just need to connect your MetaMask crypto wallet and enter your twenty-four-word seed phrase”
“this person put their seed phrase into the bogus website, and as soon as they did, the thief got in their crypto wallet”
Coinbase balance-disclosure flaw AFFECTS Coinbase
Drew alleges that for about one month Coinbase exposed account balances when a valid username and password were supplied without 2FA; Jack says this may be the flaw reported in connection with drained accounts.
Uncertain Confidence 91% · Drew EP 112 Details
“there was an exploit in Coinbase for about one month where you could check the balance of any valid password and username”
“Bleeping Computer ran an article back in October 2021 saying that 6,000 Coinbase customers had their crypto wallets drained due to a flaw in Coinbase’s 2FA system”
Coinbase wallet-drain incident INVOLVES Coinbase balance-disclosure flaw
Jack believes the Coinbase wallet-drain reports may refer to the balance-disclosure/2FA flaw described by Drew.
Uncertain Confidence 86% · Jack Rhysider EP 112 Details
“I’m pretty sure it’s talking about this bug that Drew just said”
Michael Turpin cryptocurrency theft INVOLVES SIM swapping
The theft of Michael Turpin's cryptocurrency is described as following the SIM-swapping process discussed in the episode.
Derived Confidence 95% · Jack Rhysider EP 112 Details
“someone did the steps you just heard to hack into Turpin’s crypto wallet and steal $23 million worth of crypto out of it”
Michael Turpin cryptocurrency theft INVOLVES AT&T
Jack says AT&T insiders helped with the theft of $23 million from Michael Turpin's cryptocurrency wallet.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“In this case, it was insiders working at AT&T that helped do this”
Michael Turpin cryptocurrency theft ATTRIBUTED_TO Nicholas Truglia
Police investigation evidence led to Nicholas Truglia, whom Jack later calls the hacker sued by Turpin; the episode presents this attribution through its account of police and court proceedings.
Attributed Confidence 91% · Jack Rhysider EP 112 Details
“were able to find some pretty solid evidence that led them to a guy named Nicholas Truglia”
“Turpin also sued the hacker, Nicholas”
Michael Turpin cryptocurrency theft ATTRIBUTED_TO Joel Ortiz
The episode says police evidence led to Joel Ortiz in connection with the cryptocurrency theft and that he was arrested and sentenced.
Attributed Confidence 90% · Jack Rhysider EP 112 Details
“were able to find some pretty solid evidence that led them to a guy named Nicholas Truglia who was twenty-one, living in Manhattan, and Joel Ortiz”
“Joel Ortiz was sentenced to ten years in prison”
Baby Al Capone ASSOCIATED_WITH SIM swapping
Jack identifies Baby Al Capone as a person who allegedly stole cryptocurrency through SIM-swapping-related activity, while the episode does not provide a fuller identity claim.
Attributed Confidence 88% · Jack Rhysider EP 112 Details
“There’s a guy, goes by the nickname Baby Al Capone; he stole $20 million in cryptocurrency”
“This guy was just fifteen years old when he was arrested”
James O’Connor ASSOCIATED_WITH SIM swapping
Jack says authorities accused James O’Connor, also known as PlugWalkJoe, of stealing cryptocurrency through SIM-swapping.
Attributed Confidence 96% · Jack Rhysider EP 112 Details
“Then there’s PlugWalkJoe, James O’Connor. He was twenty-two, living in the UK, when he was arrested for SIM-swapping”
“Authorities say he stole over $700,000 doing this”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:30:35.826893+00:00