Criminal
Bitcoin

New documents shine a light on Iceland’s ‘Bit Bitcoin Heist’

7 convicted suspects will serve time for cocaine possession and a weird attempt at growing marijuana

Our favorite Bitcoin story of all time seems to be closing as Iceland’s courts found ringleader Sindra Þór Stefánssyni guilty of stealing over 100 crypto mining rigs in Iceland. The incredible story—which at one point had Sindra breaking out of prison and fleeing the country on the same plane as the Prime Minister—now seems to have come to an end with him heading back to prison and no Bitcoin mining equipment recovered.

Now for the first time the police, courts, and prosecutors have given us more details of the “Big Bitcoin Heist.”

“All violations are directed against data centers that hosted equipment for ‘mining’ of electric coins and they took place in a short period, or from December 5, 2017 to January 16, 2018,” a final charge sheet obtained by Modern Consensus reads. “In addition, an attempt was made twice to break into the fifth data center, which is also located at Ásbrú.”

Police and courts kept information under wraps for most of the past year until the report was issued. Now a picture emerges of how the conspirators communicated via messaging apps Snapchat and Telegram and how they thought they would get away with it.

Sample of the Icelandic police documents related to the Big Bitcoin Heist. Don't ask us to pronounce anything here.
Sample of the Icelandic police documents related to the Big Bitcoin Heist. Don’t ask us to pronounce anything here.

Sindra is headed to prison for four years and six months—although he is getting credit for time served before the final break in. He did, however, miss the chance to get more time off of his sentence due to the fact that he escaped from prison and fled to Amsterdam.

Kjartani Sveinarssyni, Pétri Stanislav Karlssyni, and Viktori Inga Jónassyni all got over two years on charges ranging from breaking and entering to cocaine possession. Matthias Jón Karlsson was sentenced to two and a half years in prison and Hafþór Logi Hlynsson was sentenced to 20 months. And since this is Viking-style justice, they have to repay the police $121,365.37 for arresting them.

Our Icelandic is pretty poor but we're certain this is a list of people in a lot of trouble.
Our Icelandic is pretty poor but we’re certain this is a list of people in a lot of trouble.

The crime appears monumentally absurd now, but it at least seemed like a good idea when it all went down in December 2017. The prices of Bitcoin and other major cryptocurrencies were skyrocketting and at one point, BTC traded as high as $20,000. It seemed at the time that anybody could just print money—or, at least, mine it—by getting into the crypto game. The stolen mining equipment was worth valued at $2 million at the time or $2,000 per rig. Today an Antminer S9 sells on eBay for $179.

All seven defendants are on the hook to pay back the data company, Advania, a total of 33 million ISK or $274,484. The courts were never able to recover any of the stolen equipment.

Peter Stanislav will also do time “for drug abuses, by having, on February 1, 2018, been in custody at his home” for the cocaine that police found on him when arrested. Matthias Jon “for a violation of arms law, by having, on February 1, 2018, been in custody, without permission, of an electric gun in his car.”

Icelandic courts are also very efficient. All crimes committed by all members of the crew against four different data companies were tried at the same time. “During the period from December 5, 2017 to January 16, 2018, four data centers were broken into Iceland, all of which hosted computer equipment and accessories for ‘digging’ [i.e., mining] of electric coins”.

They will serve time for what they stole and for what they attempted to steal. “In all cases, a large amount of equipment was stolen and the damage amounts to considerable sums. In addition, an attempt was made twice to break into the fifth data center, which is also located at Ásbrú. The police say the accused in this case is involved in the burglary, but to varying degrees.”

A boom in crypto mining at the time left Iceland on edge as the normally sleepy island nation noticed an uptick in home burglaries. Lucky for police, this atmosphere heightened locals’ alertness. They noticed a suspicious rental van parked near the data center and reported it.

Sindri maintained his innocence for most of 2018, but he just so happened to have rented the same van seen on security footage at the same time as the burglary.  “Slightly after the break-in that [NAME REDACTED] and [REDACTED] discussed the police with a witness who had informed Securitas employee that he had heard someone talk of seeing two people in dark clothes changing their number plates on a Thrifty rental car. She herself said the witness had noticed a large white van and watched the data center for several days.”

Police were able to tie that van to the December break in. “Subsequently, the police contacted the car rental company Thrifty in Akureyri and it was found that the accused Sindri had hired the white Ford Transit Custom van on December 4, 2017 and was returned there on December 7, 2017. During the rental period the vehicle had been driven about 1,300 km. The same automobile was seen driving in a surveillance camera in the vicinity of the burglary platform, more specifically on 6 December 2017.”

Icelanders also reported someone stealing license plates just before the burglary. The courts said a witness could hear them peeling duct tape. “He had heard sound as if tearing tape, he suspected they were changing the number plates,” according to court documents.

Shockingly, it wasn’t the last time the perps rented a car in their own name and taped on some new plates.According to prosecutors, they staked out another vehicle nine days later. “On the morning of December 15, 2017, the police in West Iceland were notified of the theft of bitcoin computer equipment from the premises of AVK [data company] in Borgarnes. There were 28 bitcoin machines, a graphics card box and a PC controller, worth a total of 5 – 6 million ISK.” That would be $41,586.

[The Icelandic language is very good at using itself instead of Americanized words. The word for computer translates as “number witch” and the rest of the language is just as adorable. Police believe they were able to get into the next lab through an open window because “a big windmill” was broken there. They mean the building’s ventilation system.]

What is astounding about this next phase of the crime is how much it resembles crypto mining. The criminals got better at “mining” the mining equipment and even had the funds to do it better. In that regard, they were like someone who started mining crypto on their laptop and then used the money they earned to buy better mining equipment.

With their initial ill-gotten gains, they bought a new van and looked for more targets. “Matthías paid ISK 80,000 for the van and was registered as its owner from that time,” the courts say.

December 15 break-in goes smoothly

This time, the group worked swiftly and managed to disconnect the Bitcoin miners while they were running in under five minutes. “According to the computer system of the house, the first bitcoin engine was disconnected at. At 2:30 am and 5 minutes later, they had all been disconnected.”

It’s also hard to hide much in the tiny island nation and authorities have Sindri on camera paying a toll near the next break in site. Another vehicle involved in the break in followed six seconds later. “The driver’s face was not seen, but when the driver pays the toll, a tattoo, leather armlet and his left wrist are shown.” The courts used that tattoo and leather bracelet to identify the suspect.

Bitcoin reached record highs around December 16, 2017 (via CoinMarketCap).
Bitcoin reached record highs around December 16, 2017 (via CoinMarketCap).

Both of the vehicles were later seen stopping and refueling at the same gas station. Mattías was arrested the next day on December 16, 2017. But he claimed not to be part of the burglary, only to have given someone a ride in the same area. He said instead that the had gotten a message on “Messenger / Snapchat to pick up a party at Kjalarnes just before.” Kjalarnes is the least populated area of Iceland with only 600 inhabitants.

The Christmas Failure

Keep in mind that over the holiday season in 2017, Bitcoin was a major conversation topic. In Iceland, Sindri was arrested on December 17, 2017 which is when one would think this whole story would end. But then late on Christmas—of all days—Sindri made an attempted to break into another data operation known as BDC Mines. One again, an attempt was made to get in through a window. “On the southeast side of the building, a hole had been cut on the canvas that had been placed over the window.”

Security footage shows two men attempting a break in until a security alarm went off.  “According to a survey of Sindra’s telephone use, it can be seen that his phone was repeatedly connected to a cellular radio communication system at Breiðbraut in Ásbrú,” near the BDC mining operation. Police don’t mention any transactions just then, but they do note that Sindri checked his bank balance at 1:21 and 2:07 AM. He later appeared in  “a photo from a surveillance camera in Hvalfjörður tunnel” headed North from the direction of the mine at 7:02.

That break in was unsuccessful.

The January market crash

Crypto converts met their first bear market as the price of Bitcoin fell in January. Crypto seemed like a passing fad. People who had only got into it a few weeks before were now pulling out. But Sindri and the gang were back at it again. This is when they went in for one last heist—and got caught.

Bitcoin mining is a strange endeavor. If your computer system does 99 percent of the work to mine a single block and someone else does 100% you lose all that work and end up with zilch while the other person gets everything. It’s the same for stealing mining rigs. You can do the entire crime and break and enter and still get left with nothing.

This time, Sindri went all in. They broke in wearing stolen security guard uniforms. “On the eve of January 16, 2018, between 8 am and 6 pm. 03:00 and 05:00, was broken into the data center of Advania. …They seemed to know where the surveillance cameras were and were never seen in their faces or the vehicle registration number.”

Here's Sindri during the Advania break-in. Not the sort of thing one wants on their Instagram feed.
Here’s Sindri during the Advania break-in. Not the sort of thing one wants on their Instagram feed.

They ran in, punched in a code, and disable the security system. “After this, burglars ran to the south side of the building.”

Sindri still maintains his innocence. If true, it would mean that he has really bad timing with renting custom vans on the same day as a major break-in. “Accused Sindri Þór reserved the car at the branch of the car rental in Akureyri and paid for her rent with his credit card, but the accused Matthías picked it up in Reykjavik.”

Security footage shows two men disguised as security guards but they were wearing outdated uniforms. “The police investigation also revealed that in 2014, the Safety Center had stopped using garments with the markings that were seen on a garment of one that broke in and was seen in a surveillance camera.”

Amusingly, even though security had updated its uniforms since 2014, it was still using the same passcode from 2014. Ivar, a security guard whose phone records tie him to Sindri, was on duty that night. He is charged with the others.

The data center in Advania (via Google)
The data center in Advania (via Google)

On January 31, 2018 Sindri was arrested and police search his mother in law’s house. There they found a pair of his jeans with a rental car agreement matching the vehicle at the last heist. It gets even more ridiculous then: “In the same jeans, a small slip was also found with a handwritten drawing that proved to be an indoor rendition of the Advania server room.”

With this evidence, Sindri admitted to taking part in the crime, but not in the conspiracy. “It is stated that the accused Sindri Þór and Matthías Jón have accepted membership in the said burglary and theft, but both refused their preparation and planning. Other accused, Pétur Stanislav, Ívar, Hafþór Logi, Viktor Ingi and Kjartan, however, deny all membership of the crime, as well as its involvement.”

Police have never recovered the mining equipment, leading many to wonder if they had started their own mining operation in secret. Investigators did find that Sindri looked into renting a remote industrial space, similar to the kind that would be used for data mining.

But then, in a bizarre last ditch twist—though a similar move to many who left crypto for greener pastures—Sindri claimed that an industrial space he had looked into renting was for growing marijuana, not for Bitcoin mining. “Sindri admitted having been looking for an industrial building for rent on Hofsós in January 2018, and has communicated with the landlord himself as Bjarna Stefánsson. He said he intended the premises for cannabis cultivation, but refused to use it to ‘dig’ by bitcoin.”

Marijuana is illegal in Iceland, so it is surprising that he would admit that in court.

“Accused Matthias, who also acknowledged his involvement in burglary and theft in the latter data center, said he also did not know what had happened to the computers, even though he should have received two million dollars for the work.”

In the end, the “Big Bitcoin Heist” fizzled out the same way that crypto markets did in that time period. When the thieves rented their first getaway van, Bitcoin had just doubled in price to $19,535. It was cool, even sexy, and there were no indications that it wouldn’t double again over the next year. As of press time, BTC was down to $3,458. Over the past year, we have breathlessly followed this story, but now it just seems like an idiotic idea from a yokel computer scientist that we only sort of understand. The computers were never recovered but, coincidentally, 600 mystery rigs did turn up in China. Icelandic authorities were not able to identify them.

We did have fun getting to learn more about Iceland and data mining. And our DMs are open if Netflix wants to buy this series and make it into a crazy Nordic detective show. Hey, they give shows to just about everyone.

Brendan Sullivan is a writer, producer, and author of the memoir Rivington Was Ours: Lady Gaga, the Lower East Side, and the Prime of Our Lives. Disclosure: he owns cryptocurrencies. Follow him on Twitter.

Subscribe to MODERN CONSENSUS Newsletter