Virtual Event: Zero Trust Strategies Summit - Watch all Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Sixth Individual Arrested in Connection with Coin.mx, Links to JPMorgan Hack

A Florida man is the latest person to be charged in connection with alleged illegal activities associated with coin.mx, a now defunct unlicensed bitcoin exchange. Riccardo Hill, a resident of Brandon, Florida was charged with conspiring to operate an unlicensed money transmitting business. He was released Thursday on a $75,000 bond following a court appearance in Manhattan.

A Florida man is the latest person to be charged in connection with alleged illegal activities associated with coin.mx, a now defunct unlicensed bitcoin exchange. Riccardo Hill, a resident of Brandon, Florida was charged with conspiring to operate an unlicensed money transmitting business. He was released Thursday on a $75,000 bond following a court appearance in Manhattan.

Hill, 38, was arrested in October. He is the ninth person to be arrested following the investigation into the JPMorgan data breach that was disclosed in 2014. Prosecutors claim that coin.mx was owned by Gery Shalon, an Israeli charged with masterminding the hacks that breached JPMorgan and other companies.

Shalon, and Ziv Orenstein (another Israeli) were arrested in Israel in July 2015. They were extradited to the US and pleaded not guilty to a hacking and fraud scheme including but not limited to JPMorgan. Prosecutors said the scheme dated back to 2007 and compromised more than 100 million people’s personal information.

A third individual, Joshua Aaron from Florida, is also wanted in connection with these charges. Aaron is believed to have fled to Russia, which he frequently visited. This has led to some suggestions that the actual hacker (rather than the orchestrators) of the JPMorgan hack and others may be Russian. Last month Bloomberg reported that Aaron had been located in Russia, but is no longer welcome there. “The only American suspect named in the largest known hack of Wall Street is negotiating his return to the U.S. from a detention cell in Russia, where he’s no longer welcome.”

The investigation into the JPMorgan breach led to Sharon, and Sharon led to coin.mx. Coin.mx seems to have been used as a laundering facility for other criminal activities, including the proceeds of ransomware. It is possible that the personal details stolen from the JPMorgan and other hacks helped facilitate some of this illegal activity.

Coin.mx was operated by Anthony Murgio, also from Florida. He and four others associated with the bitcoin exchange were arrested around the same time as Shalon. At that time the FBI stated: “Murgio and his co-conspirators knowingly enabled the criminals responsible for those attacks to receive the proceeds of their crimes, yet, in violation of federal anti-money laundering laws, Murgio never filed any suspicious activity reports regarding any of the transactions.”

Advertisement. Scroll to continue reading.

The latest charge against Hill claims that he was employed as a finance support manager and business development consultant for an unlicensed bitcoin exchange, that is, Coin.mx. The complaint against Hill claims that he and others profited from numerous bitcoin transactions conducted on behalf of victims of schemes involving ransomware. 

Of the five other individuals arrested in connection with coin.mx, two have pleaded guilty. Murgio and two others have pleaded not guilty, and will face trial in February 2017. Neither Murgio nor Hill is accused of direct involvement with hacking.

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Register

People on the Move

Randy Resnick has joined IGEL as Field CTO.

Darktrace has named Adam Towns as CFOO, Mike McGuinness as CRO, and Beth Shea as CCO.

Acronis has appointed Gerald Caron as CISO.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.