Scattered Spider's $89M Ghost Got Caught Ordering Takeout | 2 Minute Drill with Drex DeFord

Tala Joubert was 19 years old, living in an apartment in East London, and by almost every measure he was a ghost. Online he went by Earth to Star, or Brad, or Austin, running an amnesic OS that wiped itself clean on shutdown and routing everything through VPNs with the kind of operational discipline most professionals never manage to sustain. Investigators believe he was a core player in Scattered Spider, the crew behind more than 120 attacks including a string of ransomware hits across US healthcare, with $89.5 million in cryptocurrency traced to wallets under his control.

The investigators could see the wallets and watch the money move in real time, but they couldn't put a name or an address to the person holding the keys. Then they followed the money to dinner. Joubert pulled crypto from those same ransomware wallets to buy gift cards, used those gift cards on food delivery apps, and had the meals sent to his own apartment. Blockchain analysis walked the money from the ransomware payment straight to his front door.

Stay a Little Paranoid.