Story by: Mattha Busby
A judge has ordered the confiscation of bitcoin worth more than £900,000 from a jailed hacker in the first case of its kind for the Metropolitan police.
Grant West, 27 – previously described as a “one-man cybercrime wave” – had about £1m-worth of the cryptocurrency seized from a number of accounts after his arrest in September 2017, but the value of bitcoin has since fluctuated radically, complicating attempts to compensate victims.
Proceedings in Southwark crown court on Friday morning were temporarily stalled as the order signed by West agreeing to the confiscation of the cryptocurrency related to a higher amount than that which was confiscated.
Eventually announcing the order under the Proceeds of Crime Act, the judge, Joanna Korner QC, said: “I therefore order a confiscation of that amount, £915,305.77, to be paid as a way of compensation to the losers.”
She said West would spend an additional four years in jail if he refused. He has agreed to comply with the order.
UK authorities have been in possession of 82 bitcoin previously obtained by West through criminal activity since before his sentencing. Unlike fiat currencies, there is no centralised exchange rate for the currency, which rose in value to almost £18,000 a bitcoin in December 2017 before falling below £7,000 in May 2018.
The value of the seized assets was calculated by authorities on Friday at a rate of about £8,500 a bitcoin.
“Inevitably in any case like this there will have to be a further hearing after this,” the prosecuting counsel, Kevin Barry, told the court. “As the court recognises today, as do the parties, there is likely to be fluctuation which will require in due course for the order to be amended upwards or downwards.”
The Metropolitan police had also seized a much smaller amount in other cryptocurrencies, including ethereum and bitcoin cash, after a lengthy investigation, codenamed Operation Draba.
About £200,000 in bitcoin was being held by the FBI under its own investigation, and had been frozen on the request of the Crown Prosecution Service, Barry told reporters.
Though police were already in control of the assets, the defendant must legally agree to the default sentence because he may have refused to sell the assets. The cryptocurrency was seized by the Met after West was caught on a train from Rhyl to London with his “fingers on the keyboard”.
It was being held by authorities in secure accounts and would be sold on the open market in due course by an agent of the crown, Barry said.
The head of the Met’s cybercrime unit, DCI Kirsty Goldsmith, said: “The MPS is committed to ensuring that individuals who are committing criminality on the dark web are identified, prosecuted and their criminal assets are seized … I am very proud of my team for bringing this offender to justice and ensuring we have secured this order.”
In May 2018, West, of Sheerness, Kent, was sentenced to 10 years and eight months in prison for a number of offences including unauthorised modification of computer material, conspiracy to defraud and possession of criminal property.
Using the online identity “Courvoisier”, he carried out cyber-attacks over two and a half years on more than 100 companies and organisations worldwide including Sainsbury’s, Asda, Uber, the British Cardiovascular Society and the bookmakers Ladbrokes and Coral.
He sold the information on the dark web and collected his profits in online caches. Officers discovered about 78m individual usernames and passwords along with 63,000 credit and debit card details stored on an SD card recovered from his address.
Masquerading as the food delivery service Just Eat between July and December 2015, he also attempted to obtain the email addresses of more than 160,000 people through an unsuccessful phishing scam, which cost the company about £200,000.
West started trading on the dark web in March 2015 and completed more than 47,000 sales from an online “store”, the Met said. Along with financial data, he also sold cannabis, which he shipped to customers, as well as how to guides instructing others how to carry out cyber-attacks.
The confiscation follows the sentencing in Norwich last week of Elliott Gunton, 19, who hacked the telecom company TalkTalk and sold personal data in exchange for hundreds of thousands of pounds in cryptocurrency.
A civil conversation…
… has never been more important in American public life. Guardian journalism, driven by fact-based reporting, offers an independent voice of reason at a time when the national conversation is divisive and embittered. At a time of acrimony, America is in need of public civility. For 200 years Guardian journalism has been committed to giving expression to hope, not hate, and choosing fairness over fear.
More people are reading and supporting The Guardian’s independent, investigative journalism than ever before. And unlike many news organisations, we have chosen an approach that allows us to keep our journalism accessible to all, regardless of where they live or what they can afford. But we need your ongoing support to keep working as we do.
The Guardian will engage with the most critical issues of our time – from the escalating climate catastrophe to widespread inequality to the influence of big tech on our lives. At a time when factual information is a necessity, we believe that each of us, around the world, deserves access to accurate reporting with integrity at its heart.
Our editorial independence means we set our own agenda and voice our own opinions. Guardian journalism is free from commercial and political bias and not influenced by billionaire owners or shareholders. This means we can give a voice to those less heard, explore where others turn away, and rigorously challenge those in power.
We need your support to keep delivering quality journalism, to maintain our openness and to protect our precious independence. Every reader contribution, big or small, is so valuable. Support The Guardian from as little as $1 – and it only takes a minute. Thank you.