The call came from support. The support did not exist.

Marco was eating standing up when the phone rang. Leftover chicken, a paper towel, the kitchen counter in a one-bedroom in Tampa. He was fifty-four. He cleaned teeth for a living. He had been buying crypto in small amounts since 2019, the way some people buy lottery tickets and some people buy savings bonds, except he had been disciplined about it and the pile had grown into something he did not talk about at work. Around one hundred and ninety thousand dollars, last he checked. He checked often.

The number was unfamiliar. He let it ring. It rang again ten seconds later. He picked up.

The voice said it was calling from the fraud department at his exchange. The voice was calm. The voice was a little tired, the way real customer service sounds at 7 p.m. on a Tuesday. The voice had his name. The voice had the last four digits of the account.

The voice said there had been an unauthorized login from a device in Eastern Europe.

That part is not in any filing about Marco, because Marco is a composite. But the script is the script. The Department of Justice and Homeland Security Investigations announced on May 11, 2026 that a federal grand jury in Miami had indicted a 19-year-old Canadian named Trenton Richard David Johnston and a 28-year-old Miami resident named Brandon Michael Tardibone for a cryptocurrency theft operation that prosecutors say moved more than $13 million out of victim accounts and into theirs. The mechanism, according to the indictment, was the call. Johnston is alleged to have impersonated customer support staff at major search engines and crypto companies, walked victims through "security" procedures, and used the access he tricked them into giving to drain their wallets.

That is the entire machine. The machine is a phone call.

There is no smart contract here. No exploit. No bug in a lending protocol. The code that failed was the code in the back of the victim's head that says: a person who calls and knows my name and sounds calm and helpful is probably a person who is calling to help.

I have built crypto systems. I have audited them. The thing nobody who has not been inside this industry quite understands is that the actual on-chain architecture is, in most cases, fine. The math is fine. The cryptography is fine. The trapdoor is almost never in the contract. The trapdoor is in the moment a human being is asked to verify something, and a stranger on the phone tells them what to type.

Prosecutors allege Johnston and Tardibone spent more than $1 million of the stolen money on leased luxury cars, jewelry, and nightlife in South Florida. Read that again. Leased. The cars were not bought. The cars were rented at premium prices because the people renting them did not have the kind of identity or banking history that lets you buy a Lamborghini outright. The lease is the tell. The lease is what you do when the money is hot and you want to look rich before the money runs out.

Picture it. A nineteen-year-old. A Miami summer. A car that costs more per month than most of his victims earn. A bottle service tab. A watch.

And then picture Marco.

The voice on Marco's phone told him to open his laptop. The voice told him there was a "secure verification portal" the support team used to reset two-factor authentication. The voice walked him through it patiently. The voice waited while he typed. The voice did not rush him. That is the thing the recordings of these calls always show, when investigators recover them. The patience. A scammer in a hurry sounds like a scammer. A scammer who waits sounds like a professional.

By the time Marco's laptop refreshed, the balance had moved. Not all at once. In pieces. Small enough at first to look like a verification charge, then larger, then everything. The voice was already gone. The line had clicked off somewhere around the third transaction, and Marco had not noticed because he was watching the screen.

This is what social engineering means, in plain English. Engineering is design. Social engineering is the design of a conversation that produces a specific behavior from a specific person at a specific time. It is not improvised. There is a script. There is a flowchart. There are responses pre-loaded for "I need to call you back" and "let me ask my wife" and "I do not remember setting up two-factor." The operator is not winging it. The operator is reading.

Johnston is charged with conspiracy to commit wire fraud and conspiracy to commit money laundering. Each charge carries a maximum of twenty years. Tardibone is charged with money laundering conspiracy and with harboring an undocumented person in the United States, which is the part of the indictment that tells you Johnston was, according to prosecutors, in the country on an expired visa and living in a setup somebody had arranged for him. The harboring count is the seam where the operation stops looking like two kids on a spree and starts looking like infrastructure.

The U.S. Attorney's Office for the Southern District of Florida has said more victims are still being identified. That sentence is the one that sits with me. It means the calls were still being made up until close to the arrest. It means there are people who have not yet checked their balances. It means there are people who already checked, saw the zero, and have not figured out yet that the person who called them last week was the same operation.

The Miami case is not alone. In April 2026, an international operation called Operation Atlantic, run jointly by Canadian, U.S., and U.K. agencies, disrupted what the participating bodies described as over $45M in cryptocurrency fraud and froze roughly $12M in stolen assets, much of it tied to a related social engineering pattern called approval phishing, where the victim is tricked not into handing over a password but into signing a wallet permission that lets the operator drain the account on their own schedule. Days earlier, the DOJ's Scam Center Strike Force announced charges and the restraint of more than $700M in crypto tied to Southeast Asian scam compounds. The Miami indictment is one node. The network is larger.

Canadians alone reported $224M in losses to crypto investment scams in 2024, according to the Canadian Anti-Fraud Centre. The 19-year-old now sitting in a Miami federal courtroom grew up in that statistic.

Back to Marco. He spent four hours on hold with the real exchange that night. He filed a police report the next morning. He filed an IC3 complaint with the FBI that afternoon. He told his sister a week later because he could not keep it inside anymore. He has not told his coworkers. He has not told his mother. The money is, in the language of crypto recovery, "likely unrecoverable" because by the time he called the real support line, the assets had already been moved through three exchanges, and the wallets they landed in were either drained or frozen by someone else.

What Marco lost is not just the one hundred and ninety thousand. It is the thing underneath. He thought of himself as careful. He thought of himself as someone who would not fall for this. He had read articles about scams. He had laughed at them. He had explained to his sister, once, the difference between a phishing email and a real one.

He just had not understood that the next version of the call would sound like the help line.

The indictment alleges the machine. The machine is not new. The machine is the oldest machine in the financial fraud catalog, the impersonation of authority, retrofitted for a market where the assets are bearer instruments and the transfers are final. The voice on the line is the trapdoor. The smart contract had nothing to do with it.

Johnston and Tardibone are presumed innocent. The case will move through the Southern District of Florida on the standard timeline. The indictment is the allegation. A trial or a plea is the verdict.

What is already adjudicated, in a different court, is the design of the call.

You will get one. Maybe you have already gotten one. The voice will be calm. The voice will know your name. The voice will be calling to help.

That is the moment the machine is in the room.