Greavys, Wiz, Box: how 4,064 BTC left a Genesis creditor in one night

On 19 September 2024, ZachXBT posted the investigation that still defines this case: Greavys (Malone Lam), Wiz (Veer Chetal), and Box (Jeandiel Serrano) socially engineered a single Genesis creditor and moved roughly $243 million — about 4,064 BTC on the main theft leg — then peeled, swapped, and spent until FBI arrests in Miami and Los Angeles.

Almost two years later, on 9 September 2026, the BBC reported that Lam pleaded guilty in Washington, D.C. to a racketeering conspiracy charge over about $245 million stolen and laundered. He was 22. The maximum on that count is 20 years. Sentencing was not set in that report.

This article stays inside those public sources: ZachXBT’s thread (aliases, tx hashes, ETH addresses, freeze numbers), the DOJ indictment narrative, and the BBC plea piece. It is not a Sleuvo wallet export of the case. Where the thread publishes an address, we quote it. Where a filing only names a role, we keep the role.

Who they were

Handle (online)	Legal / reported name	Role in the night
Greavys (also Anne Hathaway, $$$, King Greavy)	Malone Lam	Ringleader; lifestyle face; Discord flex
Wiz	Veer Chetal	Large % cut; name leaked on screenshare
Box (VersaceGod / @SkidStar in filings)	Jeandiel Serrano	Gemini-support caller
Light / Dark	Aakaash Anand	Helped launder for Wiz via eXch / THORSwap
Meech	Danish (“Danny Trauma”)	Inner Telegram; bankruptcy-DB access alleged
Tiffany	(caller)	Phones victims as exchange / wallet support

They met through online gaming, per the DOJ narrative BBC summarised. Lam told U.S. investigators he dropped out of school in Singapore at 14, entered the U.S. in October 2023, and overstayed after January 2024.

The night of 19 August 2024

ZachXBT’s incident summary is still the clearest minute-by-minute:

1. Fake Google Support — spoofed number — compromise personal accounts.
2. Fake Gemini Support — “your account is hacked” — reset 2FA, move Gemini balances to an attacker wallet.
3. AnyDesk — victim shares screen “for security.”
4. Bitcoin Core private keys leak in the screenshare.
5. Main drain: ~4,064 BTC at ~04:05 UTC.

Published transaction hashes (ZachXBT)

Gemini warmup

• 59.34 BTC — 19 Aug 2024, 1:48 am UTC
  e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360
• 14.88 BTC — 19 Aug 2024, 2:30 am UTC
  7c7ebed785f0b4d4335d559b14b8215862fbe29db329e3ee0f2a7e64a16ce9e3

Main theft

• ~4,064 BTC — 19 Aug 2024, 4:05 am UTC
  4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090

ZachXBT also described a private recording of multiple actors reacting live to receiving ~$238M. That video is evidence of who was in the room, not of a hop you can paste into a tracer.

The DOJ indictment language matches the shape: digital communications with Victim-1 in D.C., fraudulent means to transfer, more than 4,100 BTC then worth over $230 million. Later reporting rounds the headline to $243–245M. Treat those as the same seed event with different reporters’ rounding — not three separate thefts.

How the money moved

Initial tracing in the thread: ~$243M split between the parties, then peeled toward 15+ exchanges, with immediate swaps across Bitcoin, Litecoin, Ethereum, and Monero.

That is the textbook post-compromise pattern:

• Fan-out — widen the graph before you deepen it.
• Peel chains — large remainder to change, smaller payment onward; looks like a spine with ribs.
• Pass-through wallets — receive and empty fast, often into an exchange deposit.
• Cross-asset hops — BTC → LTC / ETH / XMR to break simple UTXO follow.
• Mixer / privacy terminus — deterministic tracing stops; you report “value reached XMR / mixer,” not a fake reunification.

ETH addresses ZachXBT published (Sep 2024)

These are from the public thread. Balances were his contemporaneous attribution, not a 2026 re-trace.

Party	Note	Address
Wiz	~$34.5M sitting here	0x3c7a5f2795e73d2b94a9120a643f608cfc45c935
Wiz TC destination	Confirmed in video	0xa212d7441fed6db9ab666ba34e8c440c565f4af8
Greavys	~$3.5M tied here	0x21d7d256be564191a43553e574c06a4d0e629767
Box	~$18M tied here	0x98b0811e2cc7530380caf1a17440b18f71f51f4e
Wiz slip	Designer-clothes send; exposure to dirty cluster	0xb98b8ac004cea6617adcf3e94106d0eec1792bd9
Box slip	Dirty linked to “clean” via deposit reuse	0x6d865235ebb2504d3478fc1dd839100d210144df

Wiz’s friend Light/Dark (Aakaash) helped launder via eXch and THORSwap. Both Wiz and Aakaash leaked full names during screenshare. Accomplices also called Veer by name on audio.

A separate ~$41M+ ETH cluster tied to Box/Wiz received value from two exchanges over prior weeks, flowing primarily to luxury-goods brokers (cars, watches, jewelry, designer clothes) — consistent with chat talk about spending.

Most value was pushed toward XMR, but the slips above are why the case did not die in a mixer: screenshare destinations and reused deposits re-linked “cleaned” flows to the dirty cluster.

Freezes (ZachXBT, as of the thread)

With @CFInvestigators, @zeroshadow_io, and Binance Security: $9M+ frozen, $500K+ already returned, working with the victim.

That sentence is the whole point of speed. Freeze is a venue act. The graph’s job is to put a labeled hop and a venue name on one page before the peels finish.

Lifestyle — the second chain

ZachXBT: Greavys bought 10+ cars, clubs in LA and Miami at $250K–$500K per night, Birkin bags handed out. Friends and girls posted his location nightly. He had Instagram under his own name earlier that year. Discord flex with stolen funds.

BBC / DOJ on the plea coverage: exotic cars from ~$100K to $3.8M, Hermes Birkins thrown into nightclub crowds, watches up to $500K, rental homes in LA / Hamptons / Miami, private jets, private security. A magistrate compared him to “Ferris Bueller gone bad” and cited 30+ high-end cars and wild spending after coming into more than $230M.

OSINT on nightlife got him located. On-chain got the wallets. Law enforcement did the rest in mid-September 2024.

What happened after the thread

• Indictment unsealed (Lam & Serrano); DOJ press release on the $230M scam.
• Wiz (Veer Chetal) arrested later; ZachXBT posted a mugshot update.
• Update: twelve people charged; Aakaash named in the laundering clip.
• April 2026: Evan Tangeman — 70 months for laundering; evidence destruction after Lam’s arrest weighed against him (BBC).
• 9 Sep 2026: Lam guilty plea on RICO conspiracy (BBC). U.S. Attorney Jeanine Pirro: international network that preyed through deception and stole hundreds of millions.

Superseding allegations in the broader D.C. case (home invasions, longer conspiracy window into 2025, enterprise totals above the August seed) are separate charging language. Do not paste them onto the 19 August peel graph as if they were extra hops.

The victim should have used Sleuvo

This is not marketing filler. It is what the fact pattern demands.

Victim-1’s seed was not a zero-day. It was account takeover + exchange impersonation + remote desktop + keys. By 04:05 UTC the coins were gone. By dawn they were peeling toward 15+ exchanges.

If that victim (or counsel) had opened a Sleuvo case the same morning with either the drained wallet or the theft hash 4b277ba2…9090:

1. Case from the seed — wallet or outbound hash. No theory in the title.
2. Bounded peel trace — depth 3 is usually enough to see peel vs fan-out vs direct deposit. Peel chains eat depth; do not boil the ocean.
3. Exit Radar — question is not “where did every satoshi go.” Question is “where did enough value meet a service that will answer a preservation letter.”
4. Snapshot before writing counsel / exchange — the live graph will keep moving.
5. Venue letter the same day — ZachXBT’s own freeze numbers show what happens when venues get a clean hop list early. Mixer / XMR hops do not wait for a pretty report.

Sleuvo does not freeze coins. It does not seize cars. It puts hop count, USD figure, and venue name on one page a lawyer can attach. The people who can still stop value are the exchanges and the defendants — not the software.

What this desk should have refused to do: invent reunification after XMR, treat nightclub spend as an on-chain hop, or wait a week “for a full picture” while peels hit fifteen venues.

Videos worth watching

At the end of this article: Caser’s longform on the kids and the Miami lifestyle, and CNA’s explainer on the scam mechanics. Watch them for faces and timeline colour. For addresses and txids, prefer ZachXBT’s thread and the DOJ PDFs.