UK court jails Faris, accomplices over $4.3M crypto theft at gunpoint

The 16-year-old who skip-traced the identity of a crypto holder and sent two of his friends to go steal the assets at gunpoint has been sentenced in the UK, according to blockchain security sleuth ZachXBT. 

The teenager, known as Faris Ali, reportedly orchestrated a violent home-invasion robbery that netted more than $4.3 million in digital assets, and has been sentenced alongside two young men going by the names Zay and Tommy. 

Nearly all of the stolen funds were seized by the Metropolitan Police after blockchain investigator ZachXBT traced the attack in October 2024.

1/ An investigation into Faris Ali (Zay/Tommy) from the UK and his alleged involvement in robbing an X user out of $4.3M in June 2024 during a home invasion as the result of a crypto data breach. pic.twitter.com/aaFKSkeFdA

— ZachXBT (@zachxbt) October 10, 2024

ZachXBT investigated the robbery after the victim reached out

The robbery took place on 18 June last year, when three masked men disguised as delivery couriers forced their way into a home in the UK. Armed with machetes, the attackers compelled the victim to unlock accounts and send more than $4 million in crypto. He publicly revealed the incident hours after the attack on X, saying he had been forced at gunpoint to send the funds.

According to the victim’s account, the group posed as couriers delivering a package. Once the door opened, they rushed inside, brandished weapons, and demanded access to digital wallets. 

They instructed the victim to transfer the equivalent of more than $4.3 million to two Ethereum addresses 0x7d1…86d99 and 0xe925…c4dcef, which were both inactive in the days that followed. 

Soon after the attack, the victim tagged blockchain researcher ZachXBT in his post, prompting the 2D investigator to launch an independent query. ZachXBT obtained messages exchanged by Faris and Tommy discussing their plan, including how they would impersonate delivery workers and what approach they would use to reach the victim’s door.

“Well I mean, it’s unlikely for someone to deny a package that was sent to his apartment and under his name,” Faris told Tommy in one of the chat threads shared by ZachXBT. 

Screenshot of texts between Faris and Tommy. Source: ZachXBT on X.

The chat history included an image of the victim’s building, apparently taken during pre-robbery surveillance, and a photo showing the group dressed as delivery staff while standing outside the victim’s home minutes before entering. 

Clues that exposed Faris Ali as the ringleader

Investigators said Faris had inadvertently exposed his identity weeks before the robbery. According to evidence reviewed by ZachXBT, Faris had sent a photograph of his bail documentation to friends on Telegram with personal details that linked him to the home invasion.

Faris (Zay//Tommy) flexing Audi earlier this year pic.twitter.com/OXxGLWgPHG

— Caught in 4k (@bestvideosofct) October 10, 2024

An Ethereum Name Service (ENS) domain connected to the handle “farisali.eth” was registered and used to send an on-chain message in the aftermath of the robbery. ZachXBT said authorities have not disclosed if the message was directly tied to the perpetrators.

“I previously published my investigation identifying Faris and worked closely with the victim to communicate all findings to law enforcement. Due to minor protection laws certain details about the case are sealed.”

Crypto robbery in Oxford ensues, still under investigation

Still within the UK, masked attackers robbed a group traveling in a vehicle on 4 November in Oxford and stole a watch and crypto from the victims. 

Thames Valley Police said three men in face coverings entered the car and threatened the occupants before stealing a luxury watch valued at about £450,000 and forcing a victim to transfer roughly £1.1 million in cryptocurrency.

The attack occurred in the Kidlington area during the afternoon, with the suspects fleeing the car after about 30 minutes. Police issued several warrants in London and Birmingham, and later made four arrests in Kent, London, and Birmingham.

The accused men said to have been part of the heist are a 21-year-old man from London for conspiracy to commit robbery, kidnap and several driving offenses, a 37-year-old man from London for robbery, a 23-year-old from Kent, and a 19-year-old from Birmingham on suspicion of robbery, kidnap and related offenses, who all were released on conditional bail.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.