British hacker Grant West has been ordered to pay back more than $1.1 million in Bitcoin and other cryptocurrencies to his victims. The seizure of the funds marks the first crypto asset seizure for the Metropolitan Police.

Under the pseudonym ‘Courvoisier’, the 27-year old hacker from Sheerness, Kent carried out phishing attacks against hundreds of businesses internationally, amassing more than US$1.1 million in the process.

Targeting companies like Argos, Sainsbury, TMobile, Uber, and others, West stole the financial data of “tens of thousands” of customers, which he would then sell on the dark web in exchange for Bitcoin, Ethereum, and Bitcoin Cash.

Two-year investigation of ‘one-man cybercrime wave’

A two-year investigation into the activities of the man authorities called a ‘one-man cybercrime wave’ found that between March 2015 and his arrest in September 2017, West had carried out more than 47,000 illegal transactions online.

The transactions included not just the sale of stolen customer data, but also drugs and hacking ‘how-to’ guides.

Code-named ‘Operation Draba’, the investigation also detailed an elaborate scam in which West posed as a food delivery service called Just Eat between July and December 2015.

West attempted to steal the financial data of more than 165,000 of Just Eat’s customers during the course of the six-month-long scam. Though he was unsuccessful, his actions wound up costing the company more than $244,000.

Arrest and court proceedings

West was arrested in September 2017 after authorities tracked him to a train station in Rhyl, where he was found on a train bound for London.

When the police raided the first-class car in which West sat, he was caught with his fingers literally on the keyboard of a laptop which was found to contain the financial data of more than 100,000 people.

Following his arrest, the Metropolitan Police Cyber Crime Unit (MPCCU) also seized an SD card found in West’s house. The SD card reportedly contained approximately 78 million usernames and passwords along with 63,000 debit and credit card details.

In May 2018, the Southwark Crown Court found West guilty of two counts each of conspiracy to defraud and possession of criminal property as well as one count each of unauthorized modification of computer material and concealing/removing criminal property.

West was also convicted of several drug-related charges and was sentenced to 10 years and eight months in jail.

Although the police have had possession of West’s crypto assets since his arrest, UK law requires that “the defendant must legally agree to the default sentence” before they can be sold.

After being informed that an additional four years would be added to his sentence if he decided not to compensate his victims through the sale of the seized cryptocurrencies, West conceded.

On August 23, under the UK’s Proceeds of Crime Act, Southwark Crown Court judge Joanna Korner QC granted the confiscation of the seized funds.

“I therefore order a confiscation of that amount, £915,305.77, to be paid as a way of compensation to the losers,” Korner announced.

Speaking about the judge’s order, prosecuting counsel Kevin Barry said that the crypto assets, which have been held by authorities in secure accounts, would be “sold on the open market in due course by an agent of the crown.”

He also noted that there would likely be further hearings on the sale and disbursement of the cryptocurrencies due to the market’s volatility.

“Inevitably in any case like this there will have to be a further hearing after this,” Barry said, adding that “there is likely to be fluctuation which will require in due course for the order to be amended upwards or downwards.”