Earlier this month I wrote about how I spent $25 on a cryptocurrency “mystery box,” a twist on gambling where you pay a flat fee to a semi-anonymous entity via PayPal and get back a supposedly randomized amount of cryptocurrency.

I had my doubts about the scheme at the time, even as another startup popped up with the same concept. While some customers enjoyed the gambling aspect of the boxes, some never received a single coin in return and no one interviewed by The Outline ever made more than they spent on their box.

Now it appears that the person selling cryptocurrency mystery boxes has pulled off an “exit scam,” a classic move in the cryptocurrency underworld.

An exit scam basically means you collect a bunch of money for promised goods and then disappear. That seems to be what happened to Rich Hall, the young scam artist selling cryptocurrency mystery boxes and lottery tickets under the handle @CryptoMystery, which later changed to @CryptoBoxes.

Pravin, a 19-year-old Twitter user in Holland who asked that we not use his last name, had been watching Hall promote Ignition Coins, a new limited-supply currency launched in December that claims to be a more power-efficient coin, through the @CryptoMystery/@CryptoBoxes account. He asked Hall where he could buy some and purchased 101 Ignition Coin at a $40 valuation using funds given to him by his father to dip his toes into cryptocurrency trading.

Soon after, the market slumped and the value of Ignition Coin dropped to $25 a coin. Through Twitter DMs, Hall offered Pravin a deal — he said he was a partner with the Ignition Coin founders and, since he got a bonus for running transactions, he could buy Pravin’s currency from him at the $40 valuation, plus part of the bonus, with the equivalent number of Bitcoin.

Pravin considered holding onto his coin and wait til the market recovered but, “he said he would me give me more,” Pravin told me over Twitter DM. “So, ‘why not’ was my feeling.”

Pravin sent Hall his Ignition Coins, which were worth roughly $2,525 USD at the time. He was expecting to receive $4,200 USD worth of Bitcoin in return, but it didn’t take long to figure out Hall was not being honest.

“He never gave me the BTC back,” Pravin wrote. “I was panicking.” Hall blocked Pravin on Twitter, but Pravin kept opening new Twitter accounts and messaging him again.

“You are literally taking my life,” he told Hall.

Pravin, a user in Holland, messaging Rich Hall after the latter failed to pay him.

Meanwhile, Brandon Rhodes, a stay-at-home dad and full-time student at the University of Colorado, had arranged to purchase the @CryptoMystery/@CryptoBoxes Twitter account for $500 USD worth of Ethereum, another popular cryptocurrency. Rhodes, who studies marketing, was planning on rebranding the account and using it to promote cryptocurrency market news.

Of course, Rhodes was never given control of the account.

“I knew I was scammed about 20 minutes after the money cleared,” Rhodes told me in a Twitter DM. “He stopped responding to my DMs. I immediately asked for control of his account, he kept blowing me off, giving me excuses. Then he blocked me.”

Rhodes tweeted about the encounter and was immediately approached by Pravin, who was messaging anyone in the cryptocurrency community who would listen about his own losses. Rhodes was also contacted by Julia Stinger, a spokesperson for @LTC_lottery, a low-cost cryptocurrency lottery with a live video drawing.

Along with one other user, the group decided they needed to put an end to Hall’s scamming.

Stinger managed to get Hall, who had his full name listed on his PayPal account, to click on a bait link to record his IP address and pinpoint his location in Perth Amboy, New Jersey. The group started accumulating information on Hall, including his real Twitter, Facebook, and Instagram accounts.

If anybody was #scammed by @cryptoboxes AKA @cryptomystery AKA @richiedelorey Please DM me. Preparing a case against him now. Gathering evidence and currently in contact with the @Plymouth_Police He goes down today! RT, Follow, Like and Share. #cryptocurrency — Litecoin Dad (@litecoindad) January 22, 2018

“[We] formed a strategy that we would threaten to and release his information if he did not return the money,” wrote Rhodes. “So slowly I started tweeting out his name, relative location, then his IP address, then his full name, then his picture and social media profiles.”

“He began to erase his digital footprint, deleting all accounts.” Rhodes wrote. “That's when we knew we had him.”

But Hall did not budge, continuing to block any attempt to contact him, even after creating a fake profile with his photos, outing him as a scammer.

“So we needed to put the pressure up,” Stinger said in an email. “Privacy is highly valued, but when you steal big amounts of money you are willing to take the risks.”

Rhodes says @CryptosQueen, a “$LTC & Crypto enthusiast” who did not respond to requests for an interview, used the information they had collected to find and contact Hall’s father.

“I was contacted by someone who said Rich had ripped them off, that he owed them something,” said Steve Hall when I spoke with him on the phone. “I don’t know anything about cryptocurrency, I don’t care about that, but I called Rich up and asked him about it.”

“I said ‘Hey, whatever you did, there are people contacting me and they’re pissed off so you better fix whatever you did,” he said. “He’s an adult, so it’s not in my control. I keep getting messages about it though.”

That’s when Rich Hall agreed to return payments to stop the messages to his dad and avoid any legal action.

“I did not want to ruin his life with felonies, I made that clear to him,” wrote Rhodes. “He got off lucky in the last minute.”

Hall did not respond numerous to requests for an interview, but in messages to Rhodes over Facebook he claimed he had become a scammer to pay off debt after another scammer had broken into his Coinbase account. “It was really a kick in the ass,” Hall wrote. “Does not make [my actions] right.”

“Richard seemed apologetic but it was a Facebook message, it’s hard to tell if he was sincere,” wrote Rhodes. “He said he felt terrible... I mean he got caught. What do you expect him to say, you know? I still think he'd do it again.”

Pravin said he had his money returned to him as well.

“Hey sorry bud. I’ll give you your IC back,” Hall wrote. “I’m really sorry bro.”

It’s unclear how many people have lost money to Hall’s schemes. Stinger said she has coordinated another refund of $500 for another scam victim and has talked with two people who claims to have been scammed out of $2,500 and $3,000, but Hall stopped responding to their messages.

That’s when Rich Hall agreed to return payments to stop the messages to his dad and avoid any legal action.

Soon after, Rhodes started encouraging all victims to report their encounters to the FBI.

Stinger and Rhodes are currently discussing ways to clean up Twitter’s cryptocurrency community and make it more welcoming for newcomers.

“Crypto is new, and attracts both good and bad people. One of the benefits is that it is anonymous and decentralised, but that’s also a risk,” wrote Stinger. “But crypto is not a game, it is real money, from real people.”

“I'm talking to some different people about organizing some sort of task force dedicated to keeping crypto twitter clean of shit like this,” wrote Rhodes. “Once crypto Twitter has a recognizable force dedicated to taking out scams, we will have succeeded in mitigating scams. Till then it’s going to be a clusterfuck.”