{"meta":{"database":"Global Social Engineering Impact Database","url":"https://global-social-engineering-impact-da.vercel.app","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","generated":"2026-08-29T09:23:25.137Z","total":1,"returned":1,"limit":50,"offset":0,"next":null,"note":"Read loss_kind before summing loss_usd: only direct_loss and ransom_paid are comparable. Entries with entry_type \"benchmark\" are aggregate agency statistics and overlap with everything else by construction."},"results":[{"title":"Fake Google and Gemini support calls cost a Genesis creditor $243M in bitcoin","date":"2024-08-19","date_precision":"day","victim_org":"An individual Genesis creditor in Washington, D.C.","sector":"Cryptocurrency","country":"United States","primary_vector":"Vishing (Voice Phishing)","secondary_vectors":["Tech Support Scam","Help Desk Impersonation"],"ai_involvement":"No AI reported","ai_notes":"No voice cloning or synthetic media was reported; the callers used spoofed caller ID and live pretexting.","outcomes":["Cryptocurrency Theft","Wire Fraud / Financial Loss"],"loss_usd":243000000,"loss_note":"4,064 BTC, worth approximately $243 million at the time. More than $9 million was subsequently frozen and about $500,000 returned to the victim.","records_affected":null,"threat_actor":"Malone Lam ('Greavys'), Jeandiel Serrano ('VersaceGod') and co-conspirators","summary":"On August 19, 2024, a Genesis creditor in Washington, D.C. lost 4,064 BTC, about $243 million, in what was among the largest single-victim crypto thefts on record. The victim received a call from a spoofed number purporting to be Google support, followed by callers impersonating Gemini support. Malone Lam, 20, and Jeandiel Serrano, 21, were arrested in September 2024 and charged with conspiracy to steal and launder cryptocurrency.","how_it_worked":"The crew opened with a spoofed call presenting as Google support warning of unauthorised account access, which established urgency and a reason for the victim to accept further contact. A second set of callers then posed as Gemini support and walked the victim through resetting the two-factor authentication on the exchange account. Under the guise of remediation, they had the victim install AnyDesk and share their screen, at which point the attackers were able to see private keys held in the victim's Bitcoin Core wallet and to direct transfers to a wallet they controlled. Funds were then split across many wallets and pushed through more than fifteen exchanges. The crew's spending on cars, watches and designer goods exposed an address that let investigators freeze over $9 million.","lessons":"No legitimate provider initiates a call asking you to reset MFA or install remote-desktop software; hanging up and calling back on a number obtained independently is the single control that defeats this entire sequence.","confidence":"Reported","sources":[{"title":"Police Arrest Two People Related to $243M Crypto Heist Targeting Genesis Creditor","url":"https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor","publisher":"CoinDesk"},{"title":"Hackers Posed as Google Support to Steal $243 Million in Crypto","url":"https://hackread.com/hackers-posed-google-support-steal-243m-crypto/","publisher":"Hackread"}],"entry_type":"incident","slug":"2024-fake-google-and-gemini-support-calls-cost-a-genesis-creditor-243m-in-bit","year":2024,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-fake-google-and-gemini-support-calls-cost-a-genesis-creditor-243m-in-bit"}]}