Episode

EP 154 — Hijacked Line

04 February 2025 Official episode · Official transcript

cybercrime black hat bitcoin

The episode features Conor Freeman describing his progression from Minecraft account abuse and online scams to OG username theft and cryptocurrency SIM-swap heists, followed by his arrest, imprisonment, and later cybersecurity education.

Topics: SIM swapping and fraudulent number porting, Social engineering of carrier support agents, OSINT-based target selection, Doxing and personal-data aggregation, Credential stuffing and breached-password reuse, Account takeover through SMS-based password recovery, Two-factor authentication weaknesses, Cloud-stored passwords and secrets, Cryptocurrency wallet seed phrases and private keys, Cryptocurrency theft and laundering, Swatting and online harassment

Official episode-page sources

Links published on the Darknet Diaries episode page. Not LLM output.

Entities (46)

Claims (26)

Qualified statements from this episode, not graph facts.

Minecraft DEVELOPED_BY Mojang

Jack states that Mojang is the creator of Minecraft.

Explicit Confidence 99% · Jack Rhysider EP 154 Details

“Mojang’s website, the creator of Minecraft”

Jack Rhysider · offsets 5175–5217

Conor Freeman USES Minecraft

Conor says Minecraft was where he got involved and that he played multiplayer servers.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“it was really Minecraft where I got into everything”

Conor Freeman · offsets 2025–2076

Conor Freeman USES Roblox

Conor says Minecraft and Roblox were both involved at different points in the story.

Explicit Confidence 90% · Conor Freeman EP 154 Details

“they’re both involved at certain points throughout the story”

Conor Freeman · offsets 1913–1973

Conor Freeman USES Skype

Conor says he communicated with another Minecraft player on Skype.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“we ended up talking on Skype”

Conor Freeman · offsets 3309–3337

Conor Freeman USES griefing

Conor describes griefing Minecraft servers and trolling players.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“Just — yeah, griefing, that’s the term”

Conor Freeman · offsets 2592–2630

Conor Freeman USES social engineering

Conor learned and used social engineering to obtain secret-question answers and take over an administrator’s account.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“he socially-engineered the admin of this server into giving him the two answers to his secret questions”

Conor Freeman · offsets 4844–4947

Conor Freeman USES refund scam

Conor describes participating in refund scams and return scams involving online purchases.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“people used to do refund scams”

Conor Freeman · offsets 8268–8298

Conor Freeman USES Credential stuffing

Conor describes trying lists of usernames and passwords against Hilton accounts to obtain accounts with reward points.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“They’d load up a massive list of usernames and passwords and try them against the Hilton log-in page”

Conor Freeman · offsets 11219–11319

Conor Freeman USES Hack Forums

Conor says Hack Forums was one of the forums through which he discovered hacking-related services and communities.

Explicit Confidence 98% · Conor Freeman EP 154 Details

“Hack Forums was one of the forums that was around a long time”

Conor Freeman · offsets 15508–15569

Conor Freeman USES OGUsers

Conor says he joined OGUsers and used it as a marketplace for acquiring and selling usernames.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“there was a new forum that opened up called OGUsers”

Conor Freeman · offsets 18558–18609

“that was my next venture then, getting into acquiring these usernames”

Conor Freeman · offsets 18836–18905

Conor Freeman USES Bitcoin

Conor says he possessed Bitcoin and used it in connection with buying and selling usernames.

Explicit Confidence 98% · Conor Freeman EP 154 Details

“I had a bit of Bitcoin”

Conor Freeman · offsets 20043–20065

Conor Freeman USES doxing

Conor describes using breached databases to dox account holders and obtain information for account takeover attempts.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“what I was doing was doxing these account holders”

Conor Freeman · offsets 20986–21035

Conor Freeman USES SIM swapping

Conor describes using social engineering and carrier processes to transfer victims’ phone numbers to replacement SIM cards.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“I have a replacement SIM card here. If I give you the ISE ID, can you swap my SIM over to this card?”

Conor Freeman · offsets 23621–23721

Conor Freeman USES T-Mobile

Conor says T-Mobile was the easiest carrier for carrying out SIM swaps.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“T-Mobile by far was the easiest”

Conor Freeman · offsets 25084–25115

Conor Freeman USES AT&T

Conor discusses using an AT&T account exploit to retrieve part of a victim’s Social Security number.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“AT&T, you could put in a mobile number and then you could pull back their SSN or the last four of their SSN”

Conor Freeman · offsets 37058–37165

Conor Freeman USES OSINT

Conor identifies his main role in the group as pre-attack OSINT, finding and profiling people with cryptocurrency.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“my role was really the pre-attack OSINT”

Conor Freeman · offsets 34311–34350

Conor Freeman USES Discord

Conor says the group coordinated SIM swaps and password resets in Discord calls.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“we’d all be in a call together on Discord”

Conor Freeman · offsets 38779–38820

Conor Freeman USES Gmail

Conor describes taking control of victims’ Gmail accounts after SIM swaps and using them to access other accounts.

Explicit Confidence 96% · Jack Rhysider EP 154 Details

“The code he’s waiting for is to get into their Gmail”

Jack Rhysider · offsets 39101–39153

Conor Freeman USES Google Password Manager

Conor says he accessed passwords saved in Google Password Manager after taking control of a victim’s Gmail account.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“I could log into your e-mail and view all these saved passwords”

Conor Freeman · offsets 42406–42469

Conor Freeman USES Evernote

Conor says the group reset victims’ Evernote accounts and searched their notes for seed phrases.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“we’d reset the Evernote account, look through the notes, see if we could find a pneumonic somewhere or a seed phrase”

Conor Freeman · offsets 44514–44630

Conor Freeman USES Seed phrase

Conor searched victims’ online accounts and notes for seed phrases that could provide access to cryptocurrency wallets.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“see if we could find a pneumonic somewhere or a seed phrase”

Conor Freeman · offsets 44571–44630

Conor Freeman USES Private key

Conor says he would import a discovered private key or seed phrase into a wallet client to gain access to the wallet.

Explicit Confidence 99% · Jack Rhysider EP 154 Details

“If I found a Bitcoin private key, I could go into Exodus or a blockchain and import that seed phrase and have access to the wallet”

Jack Rhysider · offsets 33780–33895

Conor Freeman USES Exodus

Conor says he used or prepared an Exodus client to import cryptocurrency keys and access wallets.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“I’d have an Exodus client downloaded and ready”

Conor Freeman · offsets 50203–50249

Conor Freeman USES Monero

Jack says some participants converted stolen Bitcoin to Monero to make it harder to trace.

Explicit Confidence 95% · Jack Rhysider EP 154 Details

“Some would convert their Bitcoin to Monero to make it harder to trace”

Jack Rhysider · offsets 51347–51416

Conor Freeman USES Trezor

Conor says he kept his cryptocurrency on a Trezor hardware wallet and later surrendered it to police.

Explicit Confidence 99% · Conor Freeman EP 154 Details

“I had all my crypto on a Trezor hardware wallet”

Conor Freeman · offsets 64435–64482

Jack Rhysider AUTHORED Darknet Diaries

Jack says he created the episode and identifies himself as the creator of the show.

Explicit Confidence 98% · Conor Freeman EP 154 Details

“This episode was created by me”

Conor Freeman · offsets 68227–68257

Transcript references

Works mentioned in the transcript. Distinct from show-note sources.

Extraction provenance

Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:33:49.879781+00:00