The customer support line was the trapdoor, and Miami was the landing pad

Marcus was forty-seven and he knew better. That is the part he keeps coming back to.

He had been in software for twenty-two years. He ran a team of nine engineers at a logistics company outside Atlanta. He kept his Bitcoin in a hot wallet because he liked to move it around, and he had read enough about cold storage to feel mildly guilty about it without ever doing anything. His wife teased him about the second monitor on his desk, the one that always had a price chart on it. He told her it was a hobby. It was a little more than that.

The sign-in failure happened on a Tuesday night. He typed his password, the wallet app spun, and then it asked for a code he did not recognize. He tried again. It locked him out.

He did what anyone does. He Googled the support number for the service.

The call came back to him in under four minutes. The number on his screen said Support. The voice was American, mid-twenties, calm, slightly bored in the way real call center people sound when they have done the same script three hundred times that week. The voice walked him through a verification flow. The voice asked him to read a code from his email. The voice told him to approve a session on his device so they could see what he was seeing.

Marcus approved the session.

He watched his own screen for the next ninety seconds the way you watch a magic trick. The cursor moved without his hand. A transaction window opened. A wallet address he had never seen filled the recipient field. He said into the phone, what is happening, and the voice said, sir, we are running a security check, please do not touch anything, and then the voice was gone and the wallet was gone and the room he was sitting in was the same room it had been four minutes earlier.

He sat there for a long time. The second monitor still showed the price chart.

---

On May 11, 2026, a federal grand jury in the Southern District of Florida returned an indictment naming Trenton Richard David Johnston, nineteen, a Canadian national who had overstayed his visa, and Brandon Michael Tardibone, twenty-eight, a Miami man who ran a luxury car rental business. According to the indictment, the two of them, along with unnamed co-conspirators, are responsible for more than $13M in crypto losses across an unknown number of victims. Investigators are still counting.

The mechanism, as described by prosecutors, was the trapdoor.

Johnston, the indictment alleges, impersonated customer support representatives for major search engines and major cryptocurrency companies. He called the victims. The victims, having just searched for help, picked up. The call was the lock. The victim was invited to open it from the inside, because every step the voice asked for sounded like the step a real support agent would ask for. Approve the session. Read the code. Confirm the device.

This is the part to read slowly. The fraud did not break into the wallet. The victim opened the wallet and held the door.

Once inside, the conspirators allegedly moved the cryptocurrency to wallets they controlled. From there, prosecutors say, the money walked into the second half of the machine.

That half had a Miami address.

---

Tardibone, according to the indictment, ran a luxury car rental business. He is charged with conspiracy to commit money laundering and with harboring an undocumented person, meaning Johnston, who was living in the United States past the expiration of his visa. The harboring count carries up to ten years. The laundering count carries up to twenty. The wire fraud conspiracy Johnston faces carries another twenty.

The blockchain investigator who goes by ZachXBT had been pointing at the rental business before the badges arrived. In posts on X, he traced wallet flows that landed at addresses he attributed to the rental operation. He said, in public, that the rental was being used to wash crypto. The indictment did not credit him. It did not need to. The flows it describes are the flows he described.

Prosecutors say more than $1M of the stolen funds was spent on leased luxury vehicles, jewelry, and what the press release called "an extravagant nightlife." Picture it. A car returned to the lot smelling like someone else's cologne. A receipt for a watch that costs more than the victim's mortgage payment. A bottle service tab at a club on a Saturday night, paid for by a retiree's retirement, paid for by a software manager in Atlanta who is still sitting at his desk staring at the price chart.

That is the renaming. The rental business is not a rental business. It is a laundromat with valet parking.

---

Marcus called his bank first. The bank told him, gently, that they did not handle crypto. He called the wallet provider's actual support line, the one he found this time through the official app instead of through search. They told him, also gently, that the transfer was final. The blockchain does not care who signed the transaction. It only cares that it was signed.

He filed a report with the FBI's IC3 portal. He filed a report with local police. He kept a folder on his desktop labeled with the date. He did not tell his wife for three days.

The thing he keeps coming back to is not the money. The money is bad. The money is not the worst part. The worst part is that he had been the person who explained to friends, more than once, that you should never give anyone remote access to your machine, that you should never approve a session from a phone call, that support will never ask you to read a code out loud.

He had said all of that. And then a voice that sounded right had called him at the exact moment he was waiting for a voice to call, and he had done every single thing he had warned other people not to do.

That part may be the hardest.

---

South Florida has become, in the language of federal prosecutors, a hotspot. In April 2026, Evan Tangeman was sentenced to seventy months in Miami federal court for laundering proceeds from a $263M crypto theft ring led by Malone Lam, a twenty-one-year-old Singaporean indicted in September 2024. The Lam ring stole over 4,100 Bitcoin from a single victim. In October 2023, Ryan James Crawford was sentenced to five and a half years for a separate scheme that netted nearly $1M.

The pattern in these cases is not the dollar figure. The dollar figure is whatever the operator can hold before the seams split. The pattern is the geography and the lifestyle and the laundromat. Young men, fast cars, jewelry that photographs well, a city that is happy to take cash without asking what the cash used to be.

The trapdoor in the Johnston indictment is not new. Impersonating support is one of the oldest social engineering plays in the catalog. What is new, if anything is new, is how clean the handoff has become. The call center sits offshore in spirit if not in fact. The wallets sit on a public ledger that does not need a subpoena to be read. The laundromat sits in a strip mall with a logo and a website and a leasing contract that looks like every other leasing contract.

The machine has parts. It has the voice on the phone. It has the wallet that receives. It has the business that converts crypto into a car someone can drive to a club. Take out any one part and the machine stops. Leave all three in place and the machine runs until somebody at HSI Miami pulls the plug, which they did, allegedly, last Monday.

---

Johnston and Tardibone are entitled to the presumption of innocence. The indictment is a charging document. It is not a verdict. Both men have the right to contest every allegation in court, and the government will have to prove what it has alleged beyond a reasonable doubt. None of what is described above has been adjudicated.

What is true, regardless of how the case resolves, is that the method works. The customer support number is the lock. The voice on the line is the key. The victim is the door.

Marcus is back at work. He moved what was left into cold storage. He bought a hardware wallet he should have bought four years ago. He has not searched for a support number since.

He keeps thinking about how fast the call came back. Under four minutes. That is the part that bothers him most now. Whoever was waiting for him had been waiting for someone exactly like him, at exactly that moment, and the wait had not been long.

The voice was not lying about being support. The voice was support. Just not his.