Canadian Teen Pleads Guilty to $13 Million Crypto Theft, Faces 4-Year Prison Term
At 19, when prosecutors filed charges in May, Johnston fabricated identities that impersonated employees of Google, Trezor and other crypto firms. Court documents show his first hit in February 2024: he convinced a victim that their Google email and Coinbase accounts were compromised, leading to the loss of about $41,000 in Ether (ETH). Less than a month later, he and co‑conspirators posed as Google and Trezor representatives to a California victim, draining roughly $13 million in Bitcoin (BTC).
The stolen funds funded a two‑month spree of luxury in Miami and Los Angeles. Prosecutors say roughly $1.2 million of the crypto was spent on two BMWs, a Lamborghini Aventador SVJ, private‑jet rentals, a North Miami house, and flight tickets for two women from New York. The case drew attention when Johnston was stopped in March driving a Rolls‑Royce and found carrying 21 suspected amphetamine tablets.
In return for full cooperation, Johnston surrendered 53.16 BTC and 275.23 ETH, worth about $3.7 million at current prices. Prosecutors recommended a 51‑ to 63‑month prison term and the dismissal of wire‑fraud charges.
Brandon Tardibone, an exotic‑car‑rental company owner who also pleaded guilty to money laundering, is expected to receive a 27‑ to 33‑month sentence.
The case highlights a broader trend of social‑engineering scams in the crypto space. Cyvers CEO and co‑founder Deddy Lavid told Cointelegraph that “some of the biggest crypto thefts today are not driven by sophisticated code exploits, but by basic human manipulation.” He added that the speed and irreversibility of crypto transactions make such attacks especially dangerous.
The U.S. has recently adopted a hard line against crypto fraud. In April, a California resident was sentenced to 70 months for a scheme that stole $263 million through social engineering and burglary. In February, a Chinese national received a 20‑year federal sentence for a global scam that stole more than $73 million from American investors.
Johnston’s case demonstrates how attackers can exploit trust in well‑known brands to bypass security, underscoring the need for real‑time, pre‑transaction controls that detect suspicious behavior and laundering patterns before funds leave an account.
As the U.S. continues to pursue crypto‑related crimes, outcomes of cases like Johnston’s will shape enforcement strategies and industry best practices. Court proceedings will likely focus on the extent of the laundering network, the role of co‑conspirators, and the effectiveness of the defendants’ cooperation.
The case remains a cautionary tale of how quickly a teenager can amass and spend millions in digital assets, and how law‑enforcement agencies are adapting to counter increasingly sophisticated social‑engineering tactics.