How a Teenaged Hacker Pulled Off a $24 Million Crypto Heist

The break-in happened around 4 a.m., on a leafy street in the otherwise sleepy and sleeping village of Irvington, New York. Four men wearing ski masks and gloves, armed with knives, rope, brass knuckles, and a fake 9 mm, crept around the back of the large suburban home, their ghostly forms captured by its security-camera footage. As would later be alleged in court proceedings, the rope was intended to tie up the family. The knife was to torture them until the oldest son told them what they wanted to know. The gun was for show: A fake gun can evoke the same amount of fear as a real one but leads to lesser charges. These men knew what they were doing. And they apparently knew exactly what they wanted to find.

A bedroom community 20 miles up the Hudson River from New York City, Irvington’s whole point is to be a place of calm, not calamity, a place where white-collar families can disperse themselves sparsely in well-appointed homes with river vistas and two-car garages. There are good public schools. There is a historic Main Street that runs up from the water, a parade of American flags suspended from buildings that look as though they were plucked from a Christmas village. The town is named for former resident Washington Irving, whose Rip Van Winkle is cast in bronze, forever waking from his long slumber in the yard beside Town Hall, oblivious to the soccer moms in Lululemon and the teenagers in Ivy League sweatshirts who saunter by throughout the day. Beyond Main Street, tended lawns extend up into the hills, deliberately at a peaceful remove from the crime and grime of urban life.

And yet, Ellis Pinsky had feared that something dangerous and violent was headed toward Irvington. He’d feared it for weeks now. He’d sat in his 12th-grade math class and pondered the various means by which calamity might befall him, how it would arrive, what form it would take, what he might do to defend himself. His answer to that last concern was a shotgun, which he had stored in a drawer by his bed, near the chess trophies he’d won when he was younger, when the games he played stuck to their borders. At Blueline Shooting Sports a couple of towns over, his slender, studious form had drawn looks from the rougher types who spent their afternoons aiming assault weapons at targets next to a store full of tactical supplies. He ignored the stares, drawn the shotgun up to his smooth, handsome face under its shock of black hair, trained his brown eyes on a point in the distance, and pulled the trigger.

He’d been right to prepare. On May 23, 2020, a broken window set off the alarm that woke Pinsky’s family. An unknown man dropped down into their unfinished basement, his own gaze trained in the direction of a safe that had been installed by a previous owner.

In the floors above, Pinsky loaded the shotgun and met his mother in the hallway outside his bedroom. She directed him to the adjacent room where his three younger brothers were gathered, terrified and tearful. Pinsky hustled them behind something — a chair, a mattress; he can’t remember now — closed the door and backed away from it, the shotgun raised to his shoulder, his finger on the trigger, his eyes on the doorknob. Then he waited. From somewhere downstairs, there was yelling. One of his brothers whimpered. The gun metal grew warm in Pinsky’s hands.

He knew — or, at least, was pretty sure he knew — why the men were there, breaking into his family home at 4 a.m. Two years earlier, on Jan. 7, 2018, when he was 15 years old, Pinsky had pulled off a heist of $23.8 million, one of the largest cryptocurrency hacks of its kind ever executed. Two weeks before the break-in, a lawsuit had been filed against him, and news stories had circulated connecting him to the hack. He knew that the thieves wanted this money, the millions and millions of dollars he had stolen. He also knew that he couldn’t give it to them. He didn’t have it. Not anymore. The only thing in the basement safe at that particular moment was a pair of his mother’s Uggs.

In the two years since Pinsky’s case became public, he has remained an enigma. He did not speak to the media, who portrayed him as a mini mastermind, a suburban teenage sociopath. When I finally meet up with him on a chilly day this spring, he is no longer a kid. He is an anxious young man in Invisalign braces. “I just feel it’s important for my side of the story to be heard,” he says after hugging me in greeting. “There should always be two sides.”

Over the course of the next few months, we meet periodically at a series of coffee shops and cafes not far from his university dorm. Often, we forgo the establishments’ bustling interiors and sit bundled up outside, in the privacy of empty tables and preoccupied passersby. Pinsky doesn’t want me to know exactly where he lives and is clearly nervous about the repercussions of speaking to the press. His voice and affect are mellow, but there is a spring-loaded nature to his physicality, a nervous energy that hums below the suave surface. When he concentrates on how to answer a question I’ve asked, he blinks quickly. He takes long pauses. He favors black corduroy pants and a black sweater, and mentions several tattoos he is considering getting. He is affable, though sometimes I can sense him emotionally retreating. He shows up with notes of what he wants to say typed out on his phone. His approach is methodical. He wants to start at the beginning. “Everything’s important,” he says of the details of his story.

As he explains it, moving to the suburbs in fifth grade had seemed like a win to 11-year-old Pinsky. Gone was the cramped apartment on Manhattan’s Upper East Side, where his younger brothers slept in cribs in the living room and his overworked mother left him in the care of her aging parents, emigrés from the former Soviet Union, who carted him to meetings with a punishing chess coach and plied him with food that made him pudgy. In Irvington, his mother called him to breakfast from an entirely different floor of the house, as if he were some kid in a sitcom. In Irvington, he found himself possessed of the digs any tween would dream of: his own room painted blue, his own TV, and his own Xbox One, to which he applied his obsessive personality to the mastery of both Call of Duty: Ghosts and to the social posturing of the online lobbies of Xbox Live. He learned the art of trash-talking. And, as with anything he set his mind to, he learned it well.

Still, it all seemed like a game because that’s all it was. Then one day, in the midst of spouting verbal abuse into a flimsy headset, a simple question in one of his trash-talking chats stopped him in his tracks: “How’s the weather in Irvington?” The weather in Irvington was fine. What wasn’t fine is that someone, somewhere — a person who up until that moment had been merely an avatar, a disembodied voice floating on electrical currents — well, that person knew where he lived. And was breezily threatening him with that information.

He immediately logged off. But he almost as immediately realized that this was the next level of the game. This was leveling up. Asking around to other gamers, he soon learned that a free program called Wireshark could be installed that “sniffed out” incoming network connections and identified their internet protocol addresses. A quick Google search of an IP address would tell you approximately where it was coming from. It seemed a revelation to Pinsky. “That’s when it really clicked at the age of 12 or 13: ‘Wow, I’m this little kid, but I can really wield this power,’” he says. The internet held such secrets. All he had to do was uncover them.

As he soon found, there were plenty of people working to uncover them all the time, and willing to share their methods — for a price. The most highly regarded of them, at least among the more sketchy gamers with whom Pinsky started associating, went by the username Ferno. Pinsky DM’d him on Twitter, saying he wanted to learn his skills. Ferno responded, if tersely, as Pinsky recalls. He would tolerate Pinsky, teach him, mentor him on how to uncover the powerful secrets the internet held, if Pinsky would then use the methods he’d learned to track down information for Ferno. He didn’t explain to Pinsky what he was doing with these addresses, these Social Security numbers, these other details — nor did Pinsky ask. It didn’t matter. It was just part of the game, one with tokens and everything. “His avatar was a little gold coin,” Pinsky explains. “Which I came to be familiar with as bitcoin.”

Pinsky had learned on his own how to do distributed denial of service, or DDoS, attacks, flooding servers with such a volume of requests that it overwhelmed the system and shut them down. In their rudimentary forms, DDoS attacks can be a kind of mischief helpful to a gamer who might want to boot another player from the game. But Ferno also introduced him to ISP doxxing, a method that involved calling up an internet service provider, pretending to be a member of the tech-support team, and using someone’s IP address to try to get a real employee to share the confidential information attached to it — a form of interpersonal “hacking” known as social engineering. “It’s basically manipulating someone to give you information or do a certain thing,” Pinsky says. “At the age of 13, this was really my first experience with that.”

Even as he was helping Ferno track down other people’s identities, Pinsky, who went by the username Pie, knew little of Ferno’s. Pinsky guessed the more senior hacker to be about 18. He says he suspected that Ferno had ties to Lizard Squad, a group of hackers who had gained notoriety by using DDoS to take down Xbox Live’s servers one Christmas. Though the event had made headlines, Pinsky soon realized that most of Ferno’s connections were little more than “script kiddies,” would-be hackers who simply used programs created by others to carry out their hacks. Nothing they were doing was technically that difficult; it just took a questionable moral compass and a desire to wreak havoc. Pinsky lost interest. By the time he was 13, he again wanted to level up.

If Ferno had revealed little of himself, what he had revealed was the fringes of a secret cyber world of mischief and mayhem, one with, if not allegiances, at least collaborations and a certain type of criminal hierarchy inherent in the common knowledge of who could pull off what. OGUsers, a forum around which such hackers coalesced, offered an array of new methods to glean confidential information, which was then often used to hack accounts and steal cool usernames — the shorter and simpler the name, the more prestige it conferred. The forum seemed to have a few hundred users, overwhelmingly young and male as far as Pinsky could tell, and sometimes fairly flush. Desirable Twitter or Instagram usernames — or ones belonging to celebrities or influencers — could be sold for hundreds to even thousands of dollars. Pinsky got to where he could sometimes gain control of one in minutes.

Soon, he says, he was making his way up the ranks of the OGUser community, finding that his skills would quickly surpass those of whatever mentor he took on. “I’ve always been an autodidact, always been very persistent,” he tells me. He was adept at social engineering — personable and clever, with a voice like he knew his way around Cupertino — but he also had an ease with the more technical side of hacking. Realizing that a lot of the information social engineers used came from hacked databases, he began teaching himself to program, particularly to do the Structured Query Language injections and cross-site scripting that allowed him to attack companies’ database architecture. The terabyte upon terabyte of databases he extracted, traded, and hoarded made him valuable to OGUsers as well as to others, like the Russian hackers he was able to converse with thanks to his fluency with his mother’s native language. Sometimes he’d see their names in headlines, connected to successful hacks of companies like LinkedIn. By the time he was 14, he tells me, “I think it’s fair to say I had the capabilities to hack anyone.”

Still, he maintains that the practical implications of the game he was playing seemed far removed, even if he sometimes had awareness of the strangeness of the double life he was leading, attending high school by day and extracting the source code of major corporations by night. Online, he says, “I think I had a reputation of someone who had these digital skills that they could wield, someone who was knowledgeable and powerful. At that point, I was toward the top of the food chain, and the people who were up there with me were people who really did this professionally, as opposed to a game.”

Yet as far as anyone in Irvington could tell, Pinsky was simply a well-liked, well-rounded kid who was “so smart it was stupid,” as one of his classmates put it. Perhaps he did have a quality of being a little set apart, a little more worldly than his Irvington peers. One of his friends tells me that if she’d had to guess which of her classmates had a secret life, she would have guessed it was him. Yet no one did guess. His friends on his soccer team knew he was skilled with computers — if someone happened to forget a password to an account, he could always help them recover it — but, he says, he confided in no one IRL. He was 14 years old and taken with the thrill of possessing a hidden superpower, of spending his nights secretly tapping into an underground world where he was esteemed and even feared. And then, in the morning, being called downstairs to breakfast.

By 2016, when President Obama wrote an op-ed in The Wall Street Journal talking up the importance of two-factor authentication for cybersecurity, hackers were hard at work trying to figure out how to get around it. This is how Pinsky first heard of a new and intriguing method called “SIM swapping” or a “port-out scam.” It involved persuading employees at wireless carriers to remotely switch a SIM card from a target’s phone to one controlled by the hacker so that when the two-factor-authentication text came through, it would be the hacker who received it. Controlling someone’s phone gave Pinsky control of their entire digital identity — at least for a time — a prospect so enticing that he began to seek a more efficient way to go about it than tricking guileless employees at Verizon or AT&T. He wrote a Python script to comb through social media networks and seek out any mentions of working for a carrier. Then he’d reach out with an offer of compensation for helping him with a task. Every fifth or sixth person — underpaid and often working a short-term contract — would say they were game, as Pinsky tells it. For a couple hundred dollars’ worth of bitcoin, they’d be willing to do a SIM swap, no questions asked. Eventually, Pinsky says, he had employees at every major carrier also working for him.

Then the stakes got even higher. It was only a matter of time before OG hackers, known to each other as “the Community,” realized that if they could use the SIM-swapping method to steal usernames, they could just as easily use it to steal cryptocurrency. Suddenly, nerdy kids who had never worked a real job and who had grown up in a virtual world full of virtual tokens and virtual friends, were using a rip in the fabric of the internet to access the type of wealth most people could only dream of having at an age when their frontal lobes hadn’t even fully developed. With one hack and one good target, they could potentially make not thousands, but millions.

In early 2018, someone with the username Harry reached out to Pinsky and asked if he could hack an AT&T phone, which, of course, he could. According to Pinsky’s account, Harry said he had a target he thought was good. Michael Terpin, then 60, was a heavyweight in the crypto world. An early tech enthusiast, he’d helmed a PR firm that repped America Online and launched the Motley Fool, Match.com, and Earthlink. He’d then started the first internet-based press-release distribution company, sold it for $35 million, and co-founded BitAngels, the first angel-investment group for startup cryptocurrencies. Working in PR for new coins, he’d ask to be paid in the coin itself: The more he could convince people that a coin was about to take off, the more likely it was to actually do so — and the more his own coins would be worth. He was very good at his job.

Or so it seemed to Harry. Pinsky says Harry gave him a phone number and an email address, and they decided they’d try to pull off the hack the next day.

On the evening of Jan. 7, Pinsky sat at his desk — a folding table from Costco lined with $20 LED lights — and started the process. Over Telegram, he contacted his employee at AT&T and had him port Terpin’s SIM to the phone of an online acquaintance he’d recruited for the task, hoping to leave no physical trace that would connect the hack back to him. Then, he says, he and Harry — joining in from Skype — reset Terpin’s email and made a new password. Pinsky ran a script to search the emails for certain keywords that might contain electronic keys to crypto wallets, software programs where crypto coins are stored. There was evidence that Terpin had crypto — subscription emails and the like — but nothing that would get them in. Harry was about to give up when Pinsky started searching for email accounts with other providers and resetting the passwords to those. Finally, an Outlook account turned up the type of file they’d been hoping to find. “It was called ‘Passwords’ or ‘Keys,’” Pinsky recalls. “At that point, it was like, ‘Holy shit.’ We open that file, and see that there’s just a bunch of keys to various wallets.”

At this point, they were racing against the clock: It wouldn’t take Terpin long to realize that his phone had gone dead, that he couldn’t access his email, and that he needed to lock accounts down. Pinsky says he was able to see the balance for a wallet holding the cryptocurrency Ethereum — “The balance we saw was around $900 million; we were like, ‘Holy crap. That’s crazy’” — but the interface required an additional password, which he couldn’t find (Terpin denies that he ever had anywhere near $900 million in cryptocurrency and argues that Pinsky has fabricated this amount to make his crime seem less financially devastating). Adrenaline racing, they tried a wallet from a company called Counterparty and were able to unlock it with a 12-word seed phrase — a series of words that serves as a kind of password on steroids. Inside were roughly 3 million coins of a currency called Triggers, which Pinsky had never heard of. His first instinct was that it was probably close to worthless, valued at a penny, if that; but he went to CoinMarketCap, the Nasdaq of cryptocurrencies, just to be sure. He’d been wrong: On that day, Triggers was worth more than $7 a coin. Pinsky quickly did the math in his head and then did it again to be sure — he was still in algebra, after all. The math checked out. The account, the very one he now controlled, was worth close to $24 million. He’d won the game. And he hadn’t yet turned 16.

There have been perfect hacks, ones where the hackers made not a single error. Pinsky’s wasn’t one of them.

Part of that has to do with the enormous sum — it is known to be the largest SIM-swapping hack pulled off by an individual (as opposed to, say, a government like North Korea, which has also gotten in on the crypto-heist game). The sheer volume of crypto — and the limits crypto exchanges put on daily transactions — meant it would take more people to launder the coins. And more people meant more loose ends, more chances that someone would talk.

Quickly, Pinsky needed to get the Triggers converted to bitcoin on a cryptocurrency exchange like Binance, which allowed for such conversions. He created a Twitter post asking if anyone had a Binance account, or knew someone who did. Once he’d rounded up as many people as he could — six or seven, as he recalls — he began directing the Triggers coins into their accounts, having them exchange them for bitcoin, and then divert the bitcoin (minus $20,000 to $50,000 as payment for their “services”) into an account Pinsky and Harry controlled. But first — and against his better judgment — Pinsky sent a small amount from Terpin’s account to his own, just to make sure it was real. It was. That also left a footprint.

Throughout this process, Pinsky says, millions of dollars worth of cryptocurrency were lost. Terpin’s 3 million Triggers represented about 10 percent of the Triggers market; as Pinsky’s money launderers were converting it, the market was crashing in real time. There were also fees associated with such large transactions. And — no honor among thieves — not all the bitcoin that was meant to make its way into Pinsky and Harry’s account actually did so. Notably, after sending a half-million-dollar test to a guy with the username @erupts, Pinsky sent him another million to launder. Instead, Pinsky claims, @erupts kept the million for himself. Pinsky also claims that Harry was so pissed off at the theft of stolen crypto he floated the idea of putting a hit on @erupts. “He wanted to get some, in his word, ‘thugs’ to take care of it or something like that,” Pinsky explains, though he says that idea was quickly nixed. In real life? “That’s just crossing the line.”

Eventually, Pinsky and Harry split the spoils, with Pinsky taking a larger share, as he’d done most of the technical work, as he tells it. When all was said and done, Pinsky says, he ended up with 562 bitcoins, worth close to $10 million at the time. At some point in the night, he finally went to sleep. He had school the next morning.

After that, Pinsky says, his life didn’t change much. At least not at first. For a while, he half-expected the FBI to knock on his door at any moment, just like in the movies; but as time passed, he grew less anxious. He spent $50,000 worth of bitcoin on a Patek Philippe watch and took out about $100,000 in cash, which he kept under his bed in a $40 safe he’d ordered on Amazon. On a trip back from Chicago with his mom, he paid $870 for them to take an empty leg flight on a private jet. But mostly, Pinsky says, he didn’t think too much about his riches. “It made me a little more bored in my history class,” he recalls. “That’s about it.” He’d wanted to win the game, and now he had. “I felt like I sort of went to the highest level,” he tells me. “After this Terpin event, obviously, the money was there, but also I had this feeling that I was sort of done with that life. It wasn’t attractive to me. That was it.”

He says he moved on to learning different types of programming. He ran a sneaker business that used bots and scripts to snap up limited pairs then flip them: “Like Yeezy’s and all that. It’s a legit thing.” He went to soccer practice. He and his friends had started hanging out with girls on the weekend, driving down to the docks where you could see the glowing lights from the Tappan Zee Bridge. Pinsky was socially awkward in large groups, but one-on-one he was good at cultivating intimacy, which had secured him a spot in a more popular group at school. After he turned 16, his parents let him drive around Irvington in their Audi, passing himself off as an average, lucky teen rather than a crypto millionaire whose ruthlessness online was so extreme that one kid placed a report with his local police alleging that Pinsky “made threats about having me and my mom killed.” In trying to launder Terpin’s crypto, the kid apparently had sent some of it to the wrong account.

Then one day he got a message from @erupts, the hacker who he alleged had disappeared with that $1 million from the Terpin hack. As it turned out, @erupts’ real name was Nick Truglia, he was 20 or 21 years old, and he lived in Manhattan. He wanted to meet Pinsky, to take him for a night out in the city. From what Pinsky could tell, Truglia seemed to view him as a legendary figure, a kid who could pull off anything — and Pinsky figured Truglia probably wanted in on whatever he might cook up next. As for the missing million, it’s not like Pinsky could really point fingers, anyway. Truglia was persistent, and though Pinsky was suspicious, he agreed to meet up.

In his account of how that Friday night went down, Pinsky and a high school friend he’d recruited for the trip disembarked from a Metro North train to find Truglia waiting for them in Grand Central Station, wearing a baseball cap, a sparkling Audemars Piguet watch, and a wide grin. He told them he was going to show them a good time, then whisked them from an Uber to his apartment in a high-rise luxury building called Sky on West 42nd Street. Inside, Pinsky claims, there were sleek lines and stacks of cash, which Pinsky gauged to be tens of thousands of dollars, and which seemed to be left there conspicuously. Pinsky wasn’t impressed with the money, but Truglia had plenty of other enticements on offer, starting with the two models who showed up at his place shortly after the high school kids arrived, followed by dinner at some fancy Italian restaurant and a brief hang at the swanky SoHo pad of a real estate billionaire’s son. Before long, Pinsky and his friend were being surrounded by models outside of a club called Up&Down, where Rich the Kid was performing and where they were shuffled inside among the distracting camouflage of clavicles and cheekbones. By the time Truglia threw down a platinum Amex and bottles of $2,000 tequila started materializing, Pinsky could tell from the look on his friend’s face that this moment was meant to be epic, that they would forever be legends at Irvington High School for managing to pull off this one night. They sent a Snapchat to their friends from the VIP area to make sure the moment was documented. “Everyone was like, ‘How’d you get in? It’s crazy!’” he says.

Still, as far as Pinsky was concerned, it wasn’t all as great as it appeared on social media. It was weird hanging out with people who were actual adults and who he didn’t really know, and to the extent he did know Truglia, it wasn’t for a great reason. It made him nervous that people in Truglia’s orbit seemed familiar with who he was. At 6 a.m., Pinsky and his friend took an Uber home, each telling their parents that their sleepover at the other’s house had ended early. In pictures from that night, he says, “if you look closely, you can see I’m not having the best time. It’s a little awkward.”

Pinsky was right to be unsettled by Truglia (who, through his lawyers, declined to comment). On Nov. 14, 2018, members of the Regional Enforcement Allied Computer Team (REACT) high-tech task force arrested Truglia at his Manhattan apartment after a $1 million SIM-swapping heist he’d helped conduct a few weeks earlier. While searching his iCloud backup file, investigators found evidence that he’d also been involved in stealing Michael Terpin’s $23.8 million, including messages sent the day of the heist telling friends that “today my life changed forever” and “I’m a millionaire. I’m not kidding. I have 100 bitcoin.” Beforehand, he’d been texting his dad to ask for money; now he was offering to hire “porn star escorts” and take his friends to the Super Bowl. Acquaintances online and otherwise knew about his dealings with Pinsky. It wasn’t long before people started talking. Some of what they said was even true.

Over the years, Pinsky tells me, strange things had happened that he assumed were connected to his activity online, hints he should have picked up on that the so-called game could potentially bleed into real life. Once, someone had called and said there was a car bomb in his house. Another time, a stranger showed up at the front door asking for Pinsky, though he wasn’t home. He told his mom and stepfather that these were gamer pranks, and he says that they seemed to believe him. They also knew he dabbled in cryptocurrency. In August 2019, nine months after the Terpin heist, Pinsky says his father randomly emailed him an article about how Terpin was suing AT&T for $224 million for gross negligence in his SIM-swapping case. Pinsky replied, “Why are you sending this to me?”

Law-enforcement officials confirm that the parents of SIM swappers are often clueless, easily convinced that their children’s newfound wealth is from early investments in bitcoin — or not even aware that the wealth exists at all. “The reality is, there are [lots of] parents who don’t know that their teenagers are technically many times wealthier than they are on paper,” says Brian Krebs, a cybersecurity analyst and author of Spam Nation. “Certainly, if they start driving Ferraris, then you’ve got to ask some hard questions” — one SIM swapper did use crypto to buy a McLaren — “but in a lot of cases,” he says, “the parents are just kind of oblivious.”

Pinsky maintains that his parents definitely were. On New Year’s Eve 2018, his mom received an email from Terpin’s lawyer, famed trial attorney Pierce O’Donnell (once referred to as “the new Perry Mason in Hollywood”) that spelled out many of the details of the heist and argued that her son was the mastermind. Panicked, she forwarded Pinsky the email and said, “We need to talk,” which they did later that night around the kitchen table. “I was terrified,” Pinsky says. “This was the first time, at 16 years old, I sort of realized this video game that I’ve been living in for several years just got real. And I need to address this.” He recalls that he gave his mom just enough information for her to quickly realize that he’d need a lawyer, and in early January, they took the train down to 500 5th Avenue to the law offices of Lankler Siffert & Wohl, where they met in a conference room with Siffert himself. It was the first of many trips Pinsky would take to the office that year, the first of many times he’d be asked to go through the details of the past few years of his life.

And it was the beginning of what can properly be described as a legal shitshow, on par with — and in fact directly related to — the extreme volatility of crypto. Pinsky and his legal team preempted his arrest by contacting the U.S. attorney directly and offering his cooperation. In February 2020, he voluntarily returned every last thing he says he got from the Terpin heist: 562 bitcoins, the Patek watch, and the cash he’d stored in the safe under his bed. He knew it would be an admission of guilt, but says he was fine with that — he was guilty, after all — and he hoped returning everything would be viewed as an act of good faith. Terpin viewed it far less generously. He’d lost a fortune, much of which had ended up in Pinsky’s possession. On the night of Jan. 7, 2018, 562 bitcoins had been worth about $10 million; on the day they were returned, they were worth less than $2 million. Multiple rounds of settlement negotiations confirmed that Terpin wanted more.

Actually, he wanted much more. He wanted $71.4 million, and he believed he was entitled to it under the RICO Act, which allows for treble damages in cases of organized crime. Terpin has long argued that that is what cyber gangs are. “You know, in a bank robbery, you got a guy with a gun, a guy who cases the joint, a guy in the getaway car,” he says. “Everybody’s got a job. Same thing in a SIM-swap gang. Once they get control of your cell, they go in and have a gang of programmers.” He also doesn’t understand why Pinsky has never been criminally charged. “I’ve been told that it’s because he was a minor. They have a hard time figuring out what to do with minors,” he says. “But these kids basically learn this thing from other kids and they get away with it until the age of 18, and then they stop and are pretty much rewarded for life. I mean, had [Pinsky] stopped one before me, nobody would have ever known.”

Terpin tells me this over Zoom one day this spring, wearing chunky glasses and a sleeveless T-shirt, and sitting in front of what appears to be a harbor, a virtual background that he says was an image of his real background (“It’s actually even sunnier today”). He says that he was the first of the big crypto guys to make the move to Puerto Rico, taking advantage of the island’s tax exemption for tech, which he discusses at length. He also talks about his days as an early adopter of cryptocurrency, back when bitcoin went for $120 a coin and he was kicking himself for not getting it at $4. “I’m a non-geek, but I understand tech, and I’ve tried to just basically go and find industries that interested me personally and that I thought were growing at a faster speed than the economy,” he says. When it came to blockchain technology, “I was like, ‘This is the next internet.’ I totally got it right away.” He does not refer to the currency that Pinsky had stolen as Triggers, but rather as an “altcoin,” and this is possibly intentional: He has been listed as a partner at Triggers, which has since crashed and been de-listed from the crypto exchanges. Its value went up roughly 800 percent the month before Pinsky stole it, and Terpin tells me he’d been in the process of slowly selling it off because its value was peaking. “They actually picked the peak day of the market to hack me,” he says. “Most altcoins, as they call them, never got higher than that day.”

Nevertheless, even if the value of what he stole was highly inflated, even illusory, Pinsky stole it. And Terpin wanted to make an example of him. He started reaching out to those he thought might have been involved and offering them money for information about the hack (Terpin does not dispute this, but says that he has “not paid anything to date, let’s put it that way”). Soon, the calls were rolling in. “My wife’s joke,” he tells me, “is that every Saturday morning, we would get some kind of call from somebody using Auto-Tune to disguise their voice.”

Some of those people, Terpin thinks, must have had a grudge against Pinsky. Some were clearly trying to squirm out of trouble themselves. But the calls solidified Terpin’s belief that he was dealing with a teenage villain, a “Baby Al Capone,” as he puts it. Terpin became convinced that Pinsky was hiding money — from other heists if not his own — that he was going on lavish trips, buying costly watches, and otherwise trying to pull one over on Terpin.

That is all possible. “A big part of these cases is trying to recover the funds, and there’s no way of knowing if you’ve gotten them all,” says Erin West, the deputy district attorney for REACT, the high-tech task force that arrested Truglia. Bitcoin offers anonymity by design. The factors needed to access bitcoin funds could be memorized and exist only in the mind of their owner, or written down in the margins of a random book, or stored on a buried hardware wallet. Investigators comb through houses, looking for papers that might contain seed phrases or passcodes or keys. They read defendants’ mail in the hopes that they’ll uncover clues. They listen in on their calls. And they know that they don’t find everything. For some of her cases, says West, “We went through the numbers and we went through the numbers and we went through the numbers, and there is money missing.”

Yet Pinsky has a clear rebuttal to the idea that he’s hiding millions: He’s not in prison. Terpin’s case is a civil one, not a criminal one. In part, that has to do with Pinsky’s age at the time of the heist, but it also has to do with the fact that, as he states plainly, “I cooperated and was completely forthcoming with law enforcement.” (The FBI declined to comment on an “ongoing matter.”) Pinsky’s not sure how he’s supposed to prove to Terpin that he isn’t hiding some crypto fortune — “It’s hard to prove a negative” — but says he has spent much of the past two years trying. He imagines that the government may monitor him for the rest of his life to make sure his lifestyle is what it seems it should be. When I ask if he has also worked with the FBI to help bring down other hackers, he blinks quickly and then changes the subject.

One day in late April, Pinsky wants to go for a walk. Spring is here, and the city seems to have come alive, teeming with sundresses and good will. As he meanders past the fish stalls of Chinatown and the sidewalk cafes of SoHo, he blends into the crowd, a compact coed in a T-shirt and cords. Today, the 562 bitcoins he’d returned to Terpin happens to be worth $24,539,814, though who’s to say whether he is keeping track. He considers shelling out for some ice cream. It is a good day for simple delights.

Blending in has done Pinsky good. His senior year of high school was a travesty of notoriety after a round of settlement agreements fell through in 2020 and Terpin started publicizing the heist and Pinsky’s role in it. Most of his friends’ parents no longer wanted their kids hanging out with him. At graduation, he received thunderous applause, but he knew the cheers were ironic, offered only because, as he puts it, “I had become this person of interest in my town, but for all the wrong reasons.”

He had also become someone who was constantly looking over his shoulder. His family’s home invasion had occurred only a few weeks before graduation. Police had arrived in time to apprehend two of the four men who were attempting to break in. One was found in the basement, and was led out of the house in handcuffs while Pinsky’s mom screamed, “Who sent you? Who sent you?” The two men were sentenced to 60 months jail time on counts of Hobbs Act Robbery, but Pinsky knows that their partners are still out there somewhere. Maybe they still think Pinsky is hiding a fortune. Maybe others do. “The scariest part about it all is that I didn’t have it,” he says of the money. “And so, what would it take for them to believe that?” After the break-in, Pinsky says, his family got an assault rifle, and he started taking his mom along to the shooting range. He admits that being around her is hard now: As supportive as she’s tried to be, she moves through the world with a fear she never had before, and he knows that’s his fault. (Pinsky’s mother and stepfather declined to speak for this article.)

Often, Pinsky says, he wishes he could just sit down with Terpin and talk things through. Even outside the Triggers heist, he knows that a lot of the things he did were ugly. There were other accounts of Terpin’s that Pinsky got into with lesser degrees of success. There was money he tried to move even days later, sending instructions for how to launder it in the breaks between his classes at school. There were people he threatened, and people who feared him. He’s aware that when he got behind a computer, he became a kind of monster, and that the monster is all that Terpin knows. “I can see where they’re coming from,” he says. “We were all doing this sociopathic crap. I would not hang out with a 15-year-old Ellis. I would run away from him. Even at 16, I would run away from him. Even at 18, I would run away from him. Probably not as fast.”

Much of what is in this article, much of what Pinsky tells me over the course of our time together, is verifiable through legal documents, photos, texts, emails, and other sources. There is no doubt that the SIM-swapping crime happened; Pinsky’s and Terpin’s versions of the particulars mostly align. (For matters such as the contents of the safe and the itinerary of the night out with Truglia, I am relying on Pinsky’s account.) What can never be verified is what is or was in Pinsky’s head — the way he felt or didn’t feel in certain moments, his motivations or lack thereof, his view of the crime as a game.

I point out that people who get caught are the ones who tend to see the error of their ways, and he doesn’t dispute that. But, he says, he looks at it differently: Who would he be if he hadn’t gotten caught, if he hadn’t gotten this crash course in “What’s right and wrong from my lawyers, books, my therapist”? He speaks of morality as though it were an academic pursuit, something one could steep oneself in and internalize. He’s read Crime and Punishment, Extreme Ownership, Letters From a Stoic. Sometimes, he’s found himself watching a video of Terpin recounting the hack. “And he spoke about it rather matter-of-fact, but hearing in his words how methodical and calculated this was, I felt very, very ashamed,” Pinsky says. “It added a human element to what was, back then, this completely online thing for me. I feel like shame is not the most useful feeling, but I have accountability. Certainly, I don’t feel good about what I’ve done.” He’s talking to me because he “wants people to recognize that.” He wants people to know that “things change, and in my life, things have changed for the better.”

He says that college has helped with that. He was sure that he wouldn’t get in, but then, miraculously, just a few days before Terpin’s lawsuit was filed, he got his acceptance letter to a university he asks me not to name. He also says he got a free ride and that not paying tuition has helped his family cover legal fees, though they can’t be paid forever. Pinsky is coming to terms with the likelihood that the settlement negotiations will not go his way.

What he can’t come to terms with is the idea that something he did when he was 15 years old might be the main thing that ever defines him. He’s majoring in computer science and economics, and wants to be an entrepreneur, a field that doesn’t necessarily require a pristine backstory and that might even value a bit of a renegade one. He’s developed an app called Rentr that connects people who need things to people who own them (at the time of this writing, you can get a Canon printer, an electric scooter, a hookah, and a wedding tent, among other items). He wants to add value for a change, he says, “to eventually try to be useful.” It’s the language of disruption mixed up with the language of remorse.

When he moved into his dorm last year, he’d surprised his suitemates by pulling down his name from the front door and barricading himself in his room each night. Sometimes he wanted to tell them why — that he’d done something very bad and that people who thought he had lots of money might try to come after him — but he could never quite bring himself to do so. Since then, however, things have gotten less fraught. He’s made a few close friends. Over time, he’s told them what he’s done, and they’ve kept being friends with him anyway. He spent last fall studying abroad in Florence, Italy. The farther he gets from Irvington, the easier he says it is to distance himself from what he did there.

These days, Pinsky rarely goes back to Irvington. He avoids the blue bedroom, the picturesque Main Street, the far-off lights of the Tappan Zee Bridge. He avoids the places where he can’t even attempt to blend in. Irvington was meant to be a place of calm, not calamity, but Pinsky could have gotten his family killed there. Going home is too much of a reminder of everything that went wrong. “I think about what I’ve put them through, and I feel really, really bad and selfish,” he says. It’s a moment of clarity that can make things a little too clear.

At the end of our walk, Pinsky and I finally end up in a park. Musicians are busking, and people are lounging on the grass, sunglasses on, faces tipped back toward the late-afternoon sky. There is a carefree element that he hopes he can one day share. “I deeply want to distance myself from all of this stuff,” he tells me. “It is so ugly, so bad, so gross. There’s nothing more than I want to do than move on.” For now, moving on may be more of a mental exercise than a material one, but it’s the next level up. Pinsky will do whatever it takes to get there.