The Cyberwar That Never Was: Reassessing Choices During Cyber Conflicts – Analysis

 July 17, 2022  

By Elcano Royal Institute

The long road towards the Russian invasion of Ukraine gave rise to speculation about the strategic value of cyber operations to complement or replace conventional means. Nevertheless, the expected cyber ‘bang’ has so far been more of a ‘whimper’.

Summary

The action and rhetoric leading to the invasion of Ukraine early this year led to speculation about the effective use of Russian cyber capabilities to complement or replace conventional means at the outbreak of the conflict. Noting the observed and declared Russian prowess in cyberspace, some observers held that the deteriorating situation provided the opportunity to demonstrate the strategic value of cyber operations. Nevertheless, despite the seemingly favourable conditions, the exercise of Russian cyber power at the onset of hostilities –and throughout them– is limited at best.[1] Although disruptive tactics such as defacement and wiper malware were documented, the expected cyber ‘bang’ was more of a ‘whimper’, remaining much the same throughout the past three months.

Analysis

Responding to the limited strategic role of cyber operations thus far, both cybersecurity scholars and policy analysts weighed in on possible explanations. While the possibility exists of increasingly destructive action with notable strategic effects, most acknowledge its supportive or complementary value once a dispute is militarised.[2] Proponents of this view recognise: (1) the difficulty of planning and initiating cyber operations; (2) their limited effects; and (3) and the potential for escalation, which may temper decisions surrounding their use.

However, the question of whether such constraints are unique to this case or speak more broadly of the role of cyber operations during instances of armed conflict must be addressed. Due to the rarity of interstate war, there is limited empirical evidence available. Nevertheless, such questions need to be asked as our understanding of interaction between states in cyberspace has, thus far, been limited to periods of relative peace. Consequently, to be able to delve into the extent to which the exercise of cyber power delivers strategic gains in war has been the focus of analysis of the conflict’s cyber dimension thus far. Analysis, however, should not be limited solely to the expected utility of actions in and through cyberspace but should also account for the rationale behind these choices. Specifically, do decision-makers carefully consider the strategic environment and the capabilities of cyber operations when deciding how best to employ these instruments to obtain their strategic objectives?

This paper expands on the explanations advanced thus far by shifting the focus from structural and technological attributes to socio-cognitive constructs that shape preference formation. Doing so serves two purposes. First, it acknowledges the bounded nature of human rationality given the complexities of cyberspace and the action within it. Decision-makers revert to established socio-organisational practices and cognitive constructs to alleviate the ambiguity surrounding the international system and cyberspace. Secondly, it highlights the possibility that the limited use of offensive cyber operations may be case-specific, rooted in the process used to interpret the strategic environment. This should not be understood as an indictment of the possible irrationality of decision-makers. Instead, the lens with which Russian and other decision-makers interpret the environment shapes their preferences on how best to express power through cyberspace.

Consequently, future instances of conflict featuring a distinct cyber dimension may not unfold in the same manner as the Russia-Ukraine War. Nevertheless, the article recognises that Russian decision-making artifacts are unavailable. Consequently, arguments contained in the following sections rely on recently published case and wargaming data.

The remainder of this paper is organised into three further sections. Immediately following this introduction, it summarises the current rationale, grounded in structural and technological constraints, explaining the limited use of cyber operations in the ongoing Russia-Ukraine War. Bearing in mind that the conflict provides favourable conditions for the offensive use of cyber operations, their absence leads one to question whether this is indeed the true character of cyber conflict. The discussion then pivots by arguing that Russian cyber operations may be less a function of the material constraints they face but are, instead, a reflection of how the latter are interpreted using specific socio-cognitive devices. Finally, the paper concludes by explaining the possible consequences of the existing policy and security discourse surrounding cyber conflicts and draws attention to the need to understand the decision-making processes that generate specific policy choices rather than just evaluating the efficacy of operations.

Material limitations

Proponents of the revolutionary potential of cyber operations often centre their arguments on the underlying vulnerability of cyberspace and its implications for national power. Owing to its complexity, it is impossible –and in some cases undesirable– to completely secure this environment.[3] Moreover, this complexity limits our ability to predict where compromises can occur and what their consequences are.[4] This state of insecurity encourages exploitation by states as a means of shaping the environment in their favour, a cyber fait accompli.[5] While accurately depicting the vulnerability of this human-made environment, the paradigm does not account for the complexity and effects of these operations.

While it has become easier to acquire the skills required to inflict damage through cyber means, tactical and strategic effects remain a function of the resources invested.[6] Several scholars readily acknowledge that consequential operations are limited to a handful of states with the necessary technological, organisational and economic resources.[7] This is not to say that smaller powers are to be dismissed; instead, less complicated disruptive operations (eg, web defacement) are unlikely to result in strategic gains. Paradoxically, if this is the case, does Russia not have the capability to conduct more advanced operations than those seen thus far? While possible, the complexity of cyber operations, their consequences and their escalatory potential must be considered.

Operational success is not simply a function of technical prowess. As illustrated by Stuxnet, complex operations require careful coordination across different entities.[8] While there is as yet no evidence of operational planning in Russian cyber operations, it could be posited that intelligence failures and a lack of coordination may indicate organisational or cultural practices that inhibit the coordination necessary for effective cyber operations. Alternatively, it could also be asserted that the Russian leadership recognised these challenges and opted for conventional means (eg, it is simpler to bomb a power station than to hack it) that are far easier to deploy in a shorter timeframe.

Relatedly, cyberspace is a resilient domain. Inflicting damage to cyber infrastructure is often resolved in hours –as in the case of the Russian operation targeting the Ukrainian power grid in 2015–.[9] Unsurprisingly, the acknowledged vulnerability of cyberspace encourages coordination and preparation involving both the private and public sectors, blunting the effects of offensive operations. In the current conflict, Russian behaviour since 2014 and support from state and non-state actors outside Ukraine continue to hinder malicious Russian activity.[10]

Finally, even if the above constraints are addressed, there remains the question of escalation. The lack of a documented case of escalation serves to assuage the concerns of some. Fischerkeller & Harknett noted that constant interaction in this space results in a tacitly agreed-upon range of acceptable action.[11] Maness & Valeriano posit that long-standing rivalries define the status-quo and its corresponding behaviour, deviations from which could signal possible escalation.[12] However, operations levelled against Ukraine thus far do not differ significantly from those prior to militarisation.

Arguments that Russia may simply be incapable of more complex operations are easily dismissed given its past actions.[13] Alternatively, restraint may be an effort to prevent adversaries from misconstruing this as an intent to escalate. While this may seem counterintuitive, since hostilities have already broken out in the conventional space, evidence from wargames suggests that elites continue to perceive cyber operations as escalatory even in the context of increasing physical violence.[14] In another wargame, participants do not perceive cyber operations as substitutes for conventional capabilities but as supporting other means or as a complementary option to generate other effects. Given the continued prominence of information operations, the latter may explain the nature of operations thus far.

Considering the points above, contemporary commentary attributes limited Russian cyber operations to: (1) the ease with which conventional operations may be used to achieve the desired effect; (2) the transient nature of damage inflicted through cyber means; and (3) the desire to avoid potential escalation and instead employing cyber capabilities to achieve other, complementary effects. Suppose these factors drive Russian decision-making regarding the use of their cyber capabilities. In that case, scepticism regarding the strategic value of these tools may be warranted even under conditions of interstate war.[15] However, this is contingent on the ability of Russian decision-makers to objectively recognise the limitations of cyber operations and the possible reaction from Ukraine and its benefactors should Russia decide to engage in more aggressive operations. This assumes the objective interpretation of the strategic and technological environment.

Beyond material and structural factors

The seemingly limited ability of Russian decision-makers to correctly evaluate the strategic environment is an observation that most commentators have agreed upon over the past few months. While the poor performance of Russian forces during the opening days and weeks of the conflict may be attributed to intelligence failure, the slow pace with which they adapted and the continuation of certain practices hints at a profoundly ingrained pathology.[16] In his book Painful Choices, David Welch asserts that decision-makers stubbornly hold on to established beliefs so long as the consequences of doing so do not generate enough cognitive dissonance or emotional stress to encourage a re-assessment.[17] While political and cognitive psychology over the past three decades provides enough evidence to support this argument, the nature of these beliefs and how they shape preferences are less clear. Furthermore, the extent to which they influence the exercise of cyber capabilities determines whether decision-makers recognise structural and technological limitations or interpret them in the context of established beliefs.

Scholars of international relations, particularly those that identify as neoclassical realists, recognise that decision-makers contextualise the strategic environment using ideas and beliefs which may not adequately capture the reality they face.[18] To paraphrase Rose,[19] policymakers see the world ‘through a glass, darkly’. In the case of the Russia-Ukraine War, statements made by Putin prior to the invasion appear to reflect the underlying worldview that drives his strategic preferences.[20] This is unsurprising and readily observed in other states as well. However, the extent to which these beliefs shape preferences in cyberspace, a technological environment whose rules define what is possible, is less understood

The earliest mention of how prior beliefs govern strategic preferences in cyberspace can be traced to the work of Valeriano, Jensen & Maness.[21] They suggest the existence of ‘national ways’ in cyberspace. The authors argue that states such as China, Russia and the US employ cyber operations that reflect beliefs pre-dating cyberspace without explicitly stating what these beliefs are. Building on this work, Kari & Pynnöniemi associate Russian threat perception and preferences with Russia’s strategic culture. The authors note that the persistent sense of vulnerability and the narrative of a besieged fortress is cited in documentary sources as driving preferences.[22]

While numerous definitions abound, this paper treats strategic culture as a ‘set of beliefs held by elites concerning strategic objectives and the most effective method of achieving them’.[23] Suppose cyberspace is perceived as a novel means for attaining strategic objectives. It could be argued that prior beliefs that shape the means towards these objectives contribute to preference formation. For instance, if a state views information operations as enabling a favourable strategic environment, then dependence on such a belief would see decision-makers gravitating towards means with which this preference may be realised. Unsurprisingly then, this logic raises questions about whether decision-makers are bound to adhere to these beliefs or whether agency exists to assess its suitability considering circumstances that enable and constrain state behaviour.

Most political psychologists would agree that rationality exists in a gradient. Depending on the environment in which they operate, decision-makers may exert greater or lesser cognitive effort when formulating strategic preferences reflected in observed behaviour. In the case of cyberspace, uncertainty relating to the effects of operations and the pervasive lack of expertise is shown to increase reliance on cognitive structures such as beliefs. The situation is further compounded by latent uncertainty within the international system that decision-makers would have to contend with. Experiments and simulations over the past decade confirm this phenomenon.[24]

Results from an ongoing cross-national wargame show up the conditions in which decision-makers are likely to undertake a greater effort of cognition to develop an appropriate policy response during a crisis.[25] The wargames conducted in Taiwan, the Philippines, the US, Singapore and Switzerland involving cybersecurity, policy and military experts highlight the tendency to move by default to nationally-distinct practices associated with underlying strategic cultures. Singapore, for instance, opted for policies that demonstrated its resolve while simultaneously pursuing a diplomatic option, reflecting its preferences given its historical experience and unique geographic features. Similarly, Swiss participants gravitated towards policies that avoided further aggravating the situation and granted them flexible diplomatic options. As one participant notes, their choices were governed by their Swiss identity and the expectations that flowed from it.

However, this tendency to rely on beliefs and prior preferences was moderated by the need to avoid policy failure. Participants who assumed that incorrect policy choices would result in severe consequences were motivated to assess the situation carefully and were open to deliberative strategies that challenged prior beliefs. In effect, the wargames demonstrated the tendency of individuals to slip ‘between policy-guiding mental representations of reality and reality itself’.[26]

Consequently, both the wargames and preceding research call for caution when advancing claims regarding the choices made by states vis-à-vis cyberspace. While there is less doubt that strategic effects from the independent use of cyber operations are limited, it cannot be concluded that decisions surrounding the exercise of power in and through cyberspace are the sole function of the objective interpretation of the strategic environment. The preference of Russian decision-makers to engage in low-level disruption and influence operations may have as much to do with their realisation of the limits of this new environment as it does with their established beliefs as to how best to meet their strategic objectives.

Conclusions

Reassessing choices and the future of cyber conflict

While the Russia-Ukraine War tells us much about the limits of cyber operations, it is less informative as to why states act the way they do. On a positive note, this situation sheds light on the need to investigate further the mechanisms that govern the decision to use cyber capabilities. Specifically, it calls for greater attention towards immaterial factors such as beliefs that may serve as the lens through which decision-makers interpret the strategic environment resulting in behaviour-shaping preferences.

That being said, our attempts to understand the future of cyber conflict must extend beyond debates surrounding the efficacy of cyber operations. While this does not imply surrendering to calls of technological exceptionalism, it requires a greater effort on the part of scholars and policy experts alike to consider the underlying decision-making processes. Consequently, this not only requires accounting for the consequences of operations, but also considers how policymakers and public opinion alike perceive these activities. Although cyberspace is unquestionably enabled by technology, actions within and through it are shaped by individuals who remain far more unpredictable than the technologies they use.

*About the author:  Miguel Alberto Gomez

Source: This article was published by Elcano Royal Institute

[1] Erica D. Lonergan, Shawn W. Lonergan, Brandon Valeriano & Benjamin Jensen (2022), ‘Putin’s invasion of Ukraine didn’t rely on cyberwarfare. Here’s why’, The Washington Post, 7/III/2022.

[2] Jacquelin Schneider, Benjamin Schechter & Rachael Shaffer (2022), ‘A lot of cyber fizzle but not a lot of bang: evidence about the use of cyber operations from wargames’, Journal of Global Security Studies, vol. 7, nr 2, June, ogac005.

[3] Myriam Dunn Cavelty (2013), ‘From cyber-bombs to political fallout: threat representations with an impact in the cyber-security discourse’, International Studies Review, vol. 15, nr 1, March, p. 105-122; Jon R. Lindsay (2017), ‘Restrained by design: the political economy of cybersecurity’, Digital Policy, Regulation and Governance, 11/IX/2017.

[4] Charles Perrow (1999), Normal Accidents: Living with High-risk Technologies, Princeton University Press, Princeton NJ.

[5] Michael P. Fischerkeller & Richard Harknett (2020), ‘Cyber persistence, intelligence contests, and strategic competition’, Texas National Security Review, 17/IX/2020.

[6] Adam P. Liff (2021), ‘Cyberwar: a new “absolute weapon”? The proliferation of cyberwarfare capabilities and interstate war’, Journal of Strategic Studies, vol. 35, nr 3, May, p. 401-428.

[7] Erica D. Borghard & Shawn W. Lonergan (2017), ‘The logic of coercion in cyberspace’, Security Studies, vol. 26, nr 3, May, p. 452-481; Allison Pytlak & George E. Mitchell, “Power, rivalry, and cyber conflict: an empirical analysis”, in Karsten Friis and Jens Ringsmose (Eds.) (2016), Conflict in Cyber Space: Theoretical, Strategic and Legal Perspectives, Routledge, London, p. 65-82; Rebecca Slayton (2017), ‘What is the cyber offense-defense balance? Conceptions, causes, and assessment’, International Security, vol. 41, nr 3, January, p. 72-109.

[8] Jon R. Lindsay (2013), ‘Stuxnet and the limits of cyber warfare’, Security Studies, vol. 22, nr 3, August, p. 365-404.

[9] Kim Zetter (2016), ‘Inside the cunning, unprecedented hack of Ukraine’s power grid’, Wired Magazine, 3/III/2016.

[10] Erica Lonergan & Keren Yarhi-Milo (2022), ‘Cyber signalling and nuclear deterrence: implications for the Ukraine crisis’, War on the Rocks, 21/IV/2022.

[11] Michael P. Fischerkeller & Richard J. Harknett (2017), ‘Persistent engagement, agreed competition, cyberspace interaction dynamics and escalation’, Orbis, vol. 61, nr 3, Summer, p. 381-393.

[12] Ryan C. Maness & Brandon Valeriano (2015), ‘The impact of cyber conflict on international interactions’, Armed Forces & Society, vol. 42, nr 2, March, p. 301-323.

[13] Brandon Valeriano, Benjamin Jensen & Ryan C. Maness (2018), Cyber Strategy: The Evolving Character of Power and Coercion, Oxford University Press, New York.

[14] Jacquelin Schneider (2017), Cyber and Crisis Escalation: Insights from Wargaming, US Naval War College.

[15] Schneider et al. (2022), op. cit.; Nadiuya Kostyuk & Yuri M. Zhukov (2017), ‘Invisible digital front: can cyber attacks shape battlefield events?’, Journal of Conflict Resolution, vol. 63, nr 2, November, p. 317-347.

[16] Boris Kormych (2022), ‘Putin’s miscalculations’, Wilson Center, Kennan Institute, 9/III/2022.

[17] David A. Welch (2011), Painful Choices: A Theory of Foreign Policy Change, Princeton University Press, Princeton NJ.

[18] Brian Rathbun (2008), ‘A rose by any other name: neoclassical realism as the logical and necessary extension of structural realism’, Security Studies, vol 17, nr 2, June, p. 294-321.

[19] Gideon Rose (1998), ‘Neoclassical realism and theories of foreign policy’, World Politics, vol. 51, nr 1, October, p. 144-172.

[20] Bloomberg News, Transcript: ‘Vladimir Putin’s televised address on Ukraine, February 24, 2022’.

[21] Brandon Valeriano, Benjamin Jensen & Ryan Maness (2018), Cyber Strategy: The Evolving Character of Power and Coercion, Oxford University Press, New York.

[22] Marti J. Kari & Katri Pynnöniemi (2019), ‘Theory of strategic culture: an analytical framework for Russian cyber threat perception’, Journal of Strategic Studies, September, p. 1-29.

[23] Yitzhak Klein (2007), ‘A theory of strategic culture’, Comparative Strategy, vol. 10, nr 1, September, p. 3-23.

[24] Schneider (2017), op. cit.; Miguel Alberto Gomez (2019), ‘Past behavior and future judgements: seizing and freezing in response to cyber operations’, Journal of Cybersecurity, vol. 5, nr 1, September, tyz012; Miguel Alberto N. Gomez (2019), ‘Sound the alarm! Updating beliefs and degradative cyber operations’, European Journal of International Security, vol. 4, nr 2, March 2019, p. 190-208.

[25] M.A. Gomez & Christopher Whyte (2022), ‘Unpacking strategic behavior in cyberspace: a schema-driven approach’, Journal of Cybersecurity, vol. 8, nr 1, April, tyac005.

[26] J.M. Goldgeier & P.E. Tetlock (2001), ‘Psychology and international relations theory’, Annual Review of Political Science, nr 4, June, p. 79.

Elcano Royal Institute

The Elcano Royal Institute (Real Instituto Elcano) is a private entity, independent of both the Public Administration and the companies that provide most of its funding. It was established, under the honorary presidency of HRH the Prince of Asturias, on 2 December 2001 as a forum for analysis and debate on international affairs and particularly on Spain’s international relations. Its output aims to be of use to Spain’s decision-makers, both public and private, active on the international scene. Its work should similarly promote the knowledge of Spain in the strategic scenarios in which the country’s interests are at stake.

The Race Is On to Fight a Cyber Threat That Doesn’t Exist

Saturday, 16 July, 2022 -
Tim Culpan

The cybersecurity community was set alight last week by the announcement of new cryptographic algorithms designed to protect our digital futures. Now the race us on to roll out software and hardware that will secure computers against a threat that still only exists in theory.

After a six-year search, the US Commerce Department’s National Institute of Standards and Technology on July 5 announced it had found four algorithms “that are designed to withstand the assault of a future quantum computer” that will be included in its set of official standards. Another four remain under consideration and may be included in the list later. The final standards, which will include parameters and implementations of the algorithms, will be finalized over the next two years.

An algorithm is a mathematical recipe for taking one set of information and converting it into another form. In cryptography, such algorithms are deployed to make messages hard to read by an external party, or to verify the legitimacy of data such as a signature or password. Many of those examined by NIST have been around for decades, meaning there’s plenty of time for researchers to break the algorithms — some were shown to be insecure during the selection process.

It’s a common misunderstanding that secure cryptography is impossible to break. Instead, computer scientists use the term infeasible — meaning an encrypted message can be reverse engineered, in theory, but it would take an extremely long time to do so.

Current security approaches hold because modern computers use binary units — bits — to reduce all numbers to 1s and 0s, and then perform calculations. But quantum computers can function on more than two binary bits at a time (they’re known as qubits), meaning they can crunch huge amounts of data faster. What might take years on a classic computer could take hours or even minutes with a quantum computer. That makes everything we keep secure — from encrypted messages to cryptocurrencies — vulnerable to quantum attack.

The caveat is that no such quantum computers exist. Scientists have been rushing to master related concepts such as quantum entanglement, but no one has yet worked out how to create a system that is stable, accurate and reproducible. Simply knowing that such a breakthrough will come is enough to force governments to start preparing now.

The last time the world was united around such a huge digital task was a quarter century ago. A bug, known as Y2K, occurred because many digital calendars only accounted for two digits. As a result, the one-year shift from 1999 to 2000 would be incorrectly viewed as a 99-year jump backwards. Everything from banks to aviation systems to traffic lights were considered vulnerable, so software was rewritten to handle the error.

Now it’s time to prepare for the post-quantum era.

“It’s kind of like the Y2K problem, except that we don’t actually know the date,” said Nicolas Roussy Newton, Taipei-based co-founder and Chief Operating Officer of BTQ, which is developing post-quantum software and semiconductors. “There’s the threat that data stolen today could be decrypted in the future by quantum computers.”

In May, US President Joe Biden ordered all federal departments to develop plans to safeguard against the looming threat ahead of NIST choosing its recommended algorithms. Germany and France had already announced their choices, giving them a small head start.

NIST’s announcement serves as the starter’s gun for government and civil-society organizations to make preparations. Some of it will be pretty straightforward because even though the final standards aren’t decided, the broad approaches are already known. Semiconductors and computers will take longer.“If you do anything in software, you can start migration immediately,” said Andersen Cheng, London-based chief executive officer of Post-Quantum, a startup which developed software to survive quantum-computing attacks, including a virtual private network and biometric identity systems. “But if you do it in hardware, it takes time for parameters to be decided, which could take another 18 months.”

The rollout won’t come all at once, and could take decades. Those organizations with more money and a greater need for secrecy will start first — likely the Central Intelligence Agency and National Security Agency — before trickling down to banks and communications providers. Within 20 years even email services and webcams will have post-quantum algorithms built in to ensure security.

The road to a post-quantum world is a long one. Unfortunately, we don’t know how long. But at least preparations have begun.

CRIMINAL CAPITALI$M

How ‘Baby Al Capone’ Pulled Off a $24 Million Crypto Heist


Alex Morris
July 8, 2022

ROLLING STONE

HiRes_RS_EF_003 - Credit: Evelyn Freja for Rolling Stone

LONG READ

The break-in happened around 4 a.m., on a leafy street in the otherwise sleepy and sleeping village of Irvington, New York. Four men wearing ski masks and gloves, armed with knives, rope, brass knuckles, and a fake 9 mm, crept around the back of the large suburban home, their ghostly forms captured by its security-camera footage. As would later be alleged in court proceedings, the rope was intended to tie up the family. The knife was to torture them until the oldest son told them what they wanted to know. The gun was for show: A fake gun can evoke the same amount of fear as a real one but leads to lesser charges. These men knew what they were doing. And they apparently knew exactly what they wanted to find.

A bedroom community 20 miles up the Hudson River from New York City, Irvington’s whole point is to be a place of calm, not calamity, a place where white-collar families can disperse themselves sparsely in well-appointed homes with river vistas and two-car garages. There are good public schools. There is a historic Main Street that runs up from the water, a parade of American flags suspended from buildings that look as though they were plucked from a Christmas village. The town is named for former resident Washington Irving, whose Rip Van Winkle is cast in bronze, forever waking from his long slumber in the yard beside Town Hall, oblivious to the soccer moms in Lululemon and the teenagers in Ivy League sweatshirts who saunter by throughout the day. Beyond Main Street, tended lawns extend up into the hills, deliberately at a peaceful remove from the crime and grime of urban life.

More from Rolling Stone

Jay-Z, Jack Dorsey Launch 'Bitcoin Academy' Program in Marcy Projects


Why Did An Anonymous Donor Give Alex Jones $1 Million in Bitcoin?


Did Melania Trump Place the Winning Bid in Her Own NFT Auction?


And yet, Ellis Pinsky had feared that something dangerous and violent was headed toward Irvington. He’d feared it for weeks now. He’d sat in his 12th-grade math class and pondered the various means by which calamity might befall him, how it would arrive, what form it would take, what he might do to defend himself. His answer to that last concern was a shotgun, which he had stored in a drawer by his bed, near the chess trophies he’d won when he was younger, when the games he played stuck to their borders. At Blueline Shooting Sports a couple of towns over, his slender, studious form had drawn looks from the rougher types who spent their afternoons aiming assault weapons at targets next to a store full of tactical supplies. He ignored the stares, drawn the shotgun up to his smooth, handsome face under its shock of black hair, trained his brown eyes on a point in the distance, and pulled the trigger.

He’d been right to prepare. On May 23, 2020, a broken window set off the alarm that woke Pinsky’s family. An unknown man dropped down into their unfinished basement, his own gaze trained in the direction of a safe that had been installed by a previous owner.

In the floors above, Pinsky loaded the shotgun and met his mother in the hallway outside his bedroom. She directed him to the adjacent room where his three younger brothers were gathered, terrified and tearful. Pinsky hustled them behind something — a chair, a mattress; he can’t remember now — closed the door and backed away from it, the shotgun raised to his shoulder, his finger on the trigger, his eyes on the doorknob. Then he waited. From somewhere downstairs, there was yelling. One of his brothers whimpered. The gun metal grew warm in Pinsky’s hands.

He knew — or, at least, was pretty sure he knew — why the men were there, breaking into his family home at 4 a.m. Two years earlier, on Jan. 7, 2018, when he was 15 years old, Pinsky had pulled off a heist of $23.8 million, one of the largest cryptocurrency hacks of its kind ever executed. Two weeks before the break-in, a lawsuit had been filed against him, and news stories had circulated connecting him to the hack. He knew that the thieves wanted this money, the millions and millions of dollars he had stolen. He also knew that he couldn’t give it to them. He didn’t have it. Not anymore. The only thing in the basement safe at that particular moment was a pair of his mother’s Uggs.

In the two years since Pinsky’s case became public, he has remained an enigma. He did not speak to the media, who portrayed him as a mini mastermind, a suburban teenage sociopath. When I finally meet up with him on a chilly day this spring, he is no longer a kid. He is an anxious young man in Invisalign braces. “I just feel it’s important for my side of the story to be heard,” he says after hugging me in greeting. “There should always be two sides.”

Over the course of the next few months, we meet periodically at a series of coffee shops and cafes not far from his university dorm. Often, we forgo the establishments’ bustling interiors and sit bundled up outside, in the privacy of empty tables and preoccupied passersby. Pinsky doesn’t want me to know exactly where he lives and is clearly nervous about the repercussions of speaking to the press. His voice and affect are mellow, but there is a spring-loaded nature to his physicality, a nervous energy that hums below the suave surface. When he concentrates on how to answer a question I’ve asked, he blinks quickly. He takes long pauses. He favors black corduroy pants and a black sweater, and mentions several tattoos he is considering getting. He is affable, though sometimes I can sense him emotionally retreating. He shows up with notes of what he wants to say typed out on his phone. His approach is methodical. He wants to start at the beginning. “Everything’s important,” he says of the details of his story.

As he explains it, moving to the suburbs in fifth grade had seemed like a win to 11-year-old Pinsky. Gone was the cramped apartment on Manhattan’s Upper East Side, where his younger brothers slept in cribs in the living room and his overworked mother left him in the care of her aging parents, emigrés from the former Soviet Union, who carted him to meetings with a punishing chess coach and plied him with food that made him pudgy. In Irvington, his mother called him to breakfast from an entirely different floor of the house, as if he were some kid in a sitcom. In Irvington, he found himself possessed of the digs any tween would dream of: his own room painted blue, his own TV, and his own Xbox One, to which he applied his obsessive personality to the mastery of both Call of Duty: Ghosts and to the social posturing of the online lobbies of Xbox Live. He learned the art of trash-talking. And, as with anything he set his mind to, he learned it well.

Still, it all seemed like a game because that’s all it was. Then one day, in the midst of spouting verbal abuse into a flimsy headset, a simple question in one of his trash-talking chats stopped him in his tracks: “How’s the weather in Irvington?” The weather in Irvington was fine. What wasn’t fine is that someone, somewhere — a person who up until that moment had been merely an avatar, a disembodied voice floating on electrical currents — well, that person knew where he lived. And was breezily threatening him with that information.

He immediately logged off. But he almost as immediately realized that this was the next level of the game. This was leveling up. Asking around to other gamers, he soon learned that a free program called Wireshark could be installed that “sniffed out” incoming network connections and identified their internet protocol addresses. A quick Google search of an IP address would tell you approximately where it was coming from. It seemed a revelation to Pinsky. “That’s when it really clicked at the age of 12 or 13: ‘Wow, I’m this little kid, but I can really wield this power,’” he says. The internet held such secrets. All he had to do was uncover them.

As he soon found, there were plenty of people working to uncover them all the time, and willing to share their methods — for a price. The most highly regarded of them, at least among the more sketchy gamers with whom Pinsky started associating, went by the username Ferno. Pinsky DM’d him on Twitter, saying he wanted to learn his skills. Ferno responded, if tersely, as Pinsky recalls. He would tolerate Pinsky, teach him, mentor him on how to uncover the powerful secrets the internet held, if Pinsky would then use the methods he’d learned to track down information for Ferno. He didn’t explain to Pinsky what he was doing with these addresses, these Social Security numbers, these other details — nor did Pinsky ask. It didn’t matter. It was just part of the game, one with tokens and everything. “His avatar was a little gold coin,” Pinsky explains. “Which I came to be familiar with as bitcoin.”

Pinsky had learned on his own how to do distributed denial of service, or DDoS, attacks, flooding servers with such a volume of requests that it overwhelmed the system and shut them down. In their rudimentary forms, DDoS attacks can be a kind of mischief helpful to a gamer who might want to boot another player from the game. But Ferno also introduced him to ISP doxxing, a method that involved calling up an internet service provider, pretending to be a member of the tech-support team, and using someone’s IP address to try to get a real employee to share the confidential information attached to it — a form of interpersonal “hacking” known as social engineering. “It’s basically manipulating someone to give you information or do a certain thing,” Pinsky says. “At the age of 13, this was really my first experience with that.”

Even as he was helping Ferno track down other people’s identities, Pinsky, who went by the username Pie, knew little of Ferno’s. Pinsky guessed the more senior hacker to be about 18. He says he suspected that Ferno had ties to Lizard Squad, a group of hackers who had gained notoriety by using DDoS to take down Xbox Live’s servers one Christmas. Though the event had made headlines, Pinsky soon realized that most of Ferno’s connections were little more than “script kiddies,” would-be hackers who simply used programs created by others to carry out their hacks. Nothing they were doing was technically that difficult; it just took a questionable moral compass and a desire to wreak havoc. Pinsky lost interest. By the time he was 13, he again wanted to level up.

If Ferno had revealed little of himself, what he had revealed was the fringes of a secret cyber world of mischief and mayhem, one with, if not allegiances, at least collaborations and a certain type of criminal hierarchy inherent in the common knowledge of who could pull off what. OGUsers, a forum around which such hackers coalesced, offered an array of new methods to glean confidential information, which was then often used to hack accounts and steal cool usernames — the shorter and simpler the name, the more prestige it conferred. The forum seemed to have a few hundred users, overwhelmingly young and male as far as Pinsky could tell, and sometimes fairly flush. Desirable Twitter or Instagram usernames — or ones belonging to celebrities or influencers — could be sold for hundreds to even thousands of dollars. Pinsky got to where he could sometimes gain control of one in minutes.

Soon, he says, he was making his way up the ranks of the OGUser community, finding that his skills would quickly surpass those of whatever mentor he took on. “I’ve always been an autodidact, always been very persistent,” he tells me. He was adept at social engineering — personable and clever, with a voice like he knew his way around Cupertino — but he also had an ease with the more technical side of hacking. Realizing that a lot of the information social engineers used came from hacked databases, he began teaching himself to program, particularly to do the Structured Query Language injections and cross-site scripting that allowed him to attack companies’ database architecture. The terabyte upon terabyte of databases he extracted, traded, and hoarded made him valuable to OGUsers as well as to others, like the Russian hackers he was able to converse with thanks to his fluency with his mother’s native language. Sometimes he’d see their names in headlines, connected to successful hacks of companies like LinkedIn. By the time he was 14, he tells me, “I think it’s fair to say I had the capabilities to hack anyone.”

“It really clicked at 12 or 13,” Ellis Pinsky says of his early hacking skills. “‘I’m this little kid, but I can wield this power.’” - Credit: Evelyn Freja for Rolling Stone

Still, he maintains that the practical implications of the game he was playing seemed far removed, even if he sometimes had awareness of the strangeness of the double life he was leading, attending high school by day and extracting the source code of major corporations by night. Online, he says, “I think I had a reputation of someone who had these digital skills that they could wield, someone who was knowledgeable and powerful. At that point, I was toward the top of the food chain, and the people who were up there with me were people who really did this professionally, as opposed to a game.”

Yet as far as anyone in Irvington could tell, Pinsky was simply a well-liked, well-rounded kid who was “so smart it was stupid,” as one of his classmates put it. Perhaps he did have a quality of being a little set apart, a little more worldly than his Irvington peers. One of his friends tells me that if she’d had to guess which of her classmates had a secret life, she would have guessed it was him. Yet no one did guess. His friends on his soccer team knew he was skilled with computers — if someone happened to forget a password to an account, he could always help them recover it — but, he says, he confided in no one IRL. He was 14 years old and taken with the thrill of possessing a hidden superpower, of spending his nights secretly tapping into an underground world where he was esteemed and even feared. And then, in the morning, being called downstairs to breakfast.

By 2016, when President Obama wrote an op-ed in The Wall Street Journal talking up the importance of two-factor authentication for cybersecurity, hackers were hard at work trying to figure out how to get around it. This is how Pinsky first heard of a new and intriguing method called “SIM swapping” or a “port-out scam.” It involved persuading employees at wireless carriers to remotely switch a SIM card from a target’s phone to one controlled by the hacker so that when the two-factor-authentication text came through, it would be the hacker who received it. Controlling someone’s phone gave Pinsky control of their entire digital identity — at least for a time — a prospect so enticing that he began to seek a more efficient way to go about it than tricking guileless employees at Verizon or AT&T. He wrote a Python script to comb through social media networks and seek out any mentions of working for a carrier. Then he’d reach out with an offer of compensation for helping him with a task. Every fifth or sixth person — underpaid and often working a short-term contract — would say they were game, as Pinsky tells it. For a couple hundred dollars’ worth of bitcoin, they’d be willing to do a SIM swap, no questions asked. Eventually, Pinsky says, he had employees at every major carrier also working for him.

Then the stakes got even higher. It was only a matter of time before OG hackers, known to each other as “the Community,” realized that if they could use the SIM-swapping method to steal usernames, they could just as easily use it to steal cryptocurrency. Suddenly, nerdy kids who had never worked a real job and who had grown up in a virtual world full of virtual tokens and virtual friends, were using a rip in the fabric of the internet to access the type of wealth most people could only dream of having at an age when their frontal lobes hadn’t even fully developed. With one hack and one good target, they could potentially make not thousands, but millions.

In early 2018, someone with the username Harry reached out to Pinsky and asked if he could hack an AT&T phone, which, of course, he could. According to Pinsky’s account, Harry said he had a target he thought was good. Michael Terpin, then 60, was a heavyweight in the crypto world. An early tech enthusiast, he’d helmed a PR firm that repped America Online and launched the Motley Fool, Match.com, and Earthlink. He’d then started the first internet-based press-release distribution company, sold it for $35 million, and co-founded BitAngels, the first angel-investment group for startup cryptocurrencies. Working in PR for new coins, he’d ask to be paid in the coin itself: The more he could convince people that a coin was about to take off, the more likely it was to actually do so — and the more his own coins would be worth. He was very good at his job.

Or so it seemed to Harry. Pinsky says Harry gave him a phone number and an email address, and they decided they’d try to pull off the hack the next day.

On the evening of Jan. 7, Pinsky sat at his desk — a folding table from Costco lined with $20 LED lights — and started the process. Over Telegram, he contacted his employee at AT&T and had him port Terpin’s SIM to the phone of an online acquaintance he’d recruited for the task, hoping to leave no physical trace that would connect the hack back to him. Then, he says, he and Harry — joining in from Skype — reset Terpin’s email and made a new password. Pinsky ran a script to search the emails for certain keywords that might contain electronic keys to crypto wallets, software programs where crypto coins are stored. There was evidence that Terpin had crypto — subscription emails and the like — but nothing that would get them in. Harry was about to give up when Pinsky started searching for email accounts with other providers and resetting the passwords to those. Finally, an Outlook account turned up the type of file they’d been hoping to find. “It was called ‘Passwords’ or ‘Keys,’” Pinsky recalls. “At that point, it was like, ‘Holy shit.’ We open that file, and see that there’s just a bunch of keys to various wallets.”

At this point, they were racing against the clock: It wouldn’t take Terpin long to realize that his phone had gone dead, that he couldn’t access his email, and that he needed to lock accounts down. Pinsky says he was able to see the balance for a wallet holding the cryptocurrency Ethereum — “The balance we saw was around $900 million; we were like, ‘Holy crap. That’s crazy’” — but the interface required an additional password, which he couldn’t find (Terpin denies that he ever had anywhere near $900 million in cryptocurrency and argues that Pinsky has fabricated this amount to make his crime seem less financially devastating). Adrenaline racing, they tried a wallet from a company called Counterparty and were able to unlock it with a 12-word seed phrase — a series of words that serves as a kind of password on steroids. Inside were roughly 3 million coins of a currency called Triggers, which Pinsky had never heard of. His first instinct was that it was probably close to worthless, valued at a penny, if that; but he went to CoinMarketCap, the Nasdaq of cryptocurrencies, just to be sure. He’d been wrong: On that day, Triggers was worth more than $7 a coin. Pinsky quickly did the math in his head and then did it again to be sure — he was still in algebra, after all. The math checked out. The account, the very one he now controlled, was worth close to $24 million. He’d won the game. And he hadn’t yet turned 16.

There have been perfect hacks, ones where the hackers made not a single error. Pinsky’s wasn’t one of them.

Part of that has to do with the enormous sum — it is known to be the largest SIM-swapping hack pulled off by an individual (as opposed to, say, a government like North Korea, which has also gotten in on the crypto-heist game). The sheer volume of crypto — and the limits crypto exchanges put on daily transactions — meant it would take more people to launder the coins. And more people meant more loose ends, more chances that someone would talk.

Quickly, Pinsky needed to get the Triggers converted to bitcoin on a cryptocurrency exchange like Binance, which allowed for such conversions. He created a Twitter post asking if anyone had a Binance account, or knew someone who did. Once he’d rounded up as many people as he could — six or seven, as he recalls — he began directing the Triggers coins into their accounts, having them exchange them for bitcoin, and then divert the bitcoin (minus $20,000 to $50,000 as payment for their “services”) into an account Pinsky and Harry controlled. But first — and against his better judgment — Pinsky sent a small amount from Terpin’s account to his own, just to make sure it was real. It was. That also left a footprint.

Throughout this process, Pinsky says, millions of dollars worth of cryptocurrency were lost. Terpin’s 3 million Triggers represented about 10 percent of the Triggers market; as Pinsky’s money launderers were converting it, the market was crashing in real time. There were also fees associated with such large transactions. And — no honor among thieves — not all the bitcoin that was meant to make its way into Pinsky and Harry’s account actually did so. Notably, after sending a half-million-dollar test to a guy with the username @erupts, Pinsky sent him another million to launder. Instead, Pinsky claims, @erupts kept the million for himself. Pinsky also claims that Harry was so pissed off at the theft of stolen crypto he floated the idea of putting a hit on @erupts. “He wanted to get some, in his word, ‘thugs’ to take care of it or something like that,” Pinsky explains, though he says that idea was quickly nixed. In real life? “That’s just crossing the line.”

Eventually, Pinsky and Harry split the spoils, with Pinsky taking a larger share, as he’d done most of the technical work, as he tells it. When all was said and done, Pinsky says, he ended up with 562 bitcoins, worth close to $10 million at the time. At some point in the night, he finally went to sleep. He had school the next morning.

After that, Pinsky says, his life didn’t change much. At least not at first. For a while, he half-expected the FBI to knock on his door at any moment, just like in the movies; but as time passed, he grew less anxious. He spent $50,000 worth of bitcoin on a Patek Philippe watch and took out about $100,000 in cash, which he kept under his bed in a $40 safe he’d ordered on Amazon. On a trip back from Chicago with his mom, he paid $870 for them to take an empty leg flight on a private jet. But mostly, Pinsky says, he didn’t think too much about his riches. “It made me a little more bored in my history class,” he recalls. “That’s about it.” He’d wanted to win the game, and now he had. “I felt like I sort of went to the highest level,” he tells me. “After this Terpin event, obviously, the money was there, but also I had this feeling that I was sort of done with that life. It wasn’t attractive to me. That was it.”

He says he moved on to learning different types of programming. He ran a sneaker business that used bots and scripts to snap up limited pairs then flip them: “Like Yeezy’s and all that. It’s a legit thing.” He went to soccer practice. He and his friends had started hanging out with girls on the weekend, driving down to the docks where you could see the glowing lights from the Tappan Zee Bridge. Pinsky was socially awkward in large groups, but one-on-one he was good at cultivating intimacy, which had secured him a spot in a more popular group at school. After he turned 16, his parents let him drive around Irvington in their Audi, passing himself off as an average, lucky teen rather than a crypto millionaire whose ruthlessness online was so extreme that one kid placed a report with his local police alleging that Pinsky “made threats about having me and my mom killed.” In trying to launder Terpin’s crypto, the kid apparently had sent some of it to the wrong account.

Then one day he got a message from @erupts, the hacker who he alleged had disappeared with that $1 million from the Terpin hack. As it turned out, @erupts’ real name was Nick Truglia, he was 20 or 21 years old, and he lived in Manhattan. He wanted to meet Pinsky, to take him for a night out in the city. From what Pinsky could tell, Truglia seemed to view him as a legendary figure, a kid who could pull off anything — and Pinsky figured Truglia probably wanted in on whatever he might cook up next. As for the missing million, it’s not like Pinsky could really point fingers, anyway. Truglia was persistent, and though Pinsky was suspicious, he agreed to meet up.

In his account of how that Friday night went down, Pinsky and a high school friend he’d recruited for the trip disembarked from a Metro North train to find Truglia waiting for them in Grand Central Station, wearing a baseball cap, a sparkling Audemars Piguet watch, and a wide grin. He told them he was going to show them a good time, then whisked them from an Uber to his apartment in a high-rise luxury building called Sky on West 42nd Street. Inside, Pinsky claims, there were sleek lines and stacks of cash, which Pinsky gauged to be tens of thousands of dollars, and which seemed to be left there conspicuously. Pinsky wasn’t impressed with the money, but Truglia had plenty of other enticements on offer, starting with the two models who showed up at his place shortly after the high school kids arrived, followed by dinner at some fancy Italian restaurant and a brief hang at the swanky SoHo pad of a real estate billionaire’s son. Before long, Pinsky and his friend were being surrounded by models outside of a club called Up&Down, where Rich the Kid was performing and where they were shuffled inside among the distracting camouflage of clavicles and cheekbones. By the time Truglia threw down a platinum Amex and bottles of $2,000 tequila started materializing, Pinsky could tell from the look on his friend’s face that this moment was meant to be epic, that they would forever be legends at Irvington High School for managing to pull off this one night. They sent a Snapchat to their friends from the VIP area to make sure the moment was documented. “Everyone was like, ‘How’d you get in? It’s crazy!’” he says.

Nick Truglia was convicted in connection to the SIM-card hacks. - 

Credit: NICK TRUGLIA/TWITTER

Still, as far as Pinsky was concerned, it wasn’t all as great as it appeared on social media. It was weird hanging out with people who were actual adults and who he didn’t really know, and to the extent he did know Truglia, it wasn’t for a great reason. It made him nervous that people in Truglia’s orbit seemed familiar with who he was. At 6 a.m., Pinsky and his friend took an Uber home, each telling their parents that their sleepover at the other’s house had ended early. In pictures from that night, he says, “if you look closely, you can see I’m not having the best time. It’s a little awkward.”

Pinsky was right to be unsettled by Truglia (who, through his lawyers, declined to comment). On Nov. 14, 2018, members of the Regional Enforcement Allied Computer Team (REACT) high-tech task force arrested Truglia at his Manhattan apartment after a $1 million SIM-swapping heist he’d helped conduct a few weeks earlier. While searching his iCloud backup file, investigators found evidence that he’d also been involved in stealing Michael Terpin’s $23.8 million, including messages sent the day of the heist telling friends that “today my life changed forever” and “I’m a millionaire. I’m not kidding. I have 100 bitcoin.” Beforehand, he’d been texting his dad to ask for money; now he was offering to hire “porn star escorts” and take his friends to the Super Bowl. Acquaintances online and otherwise knew about his dealings with Pinsky. It wasn’t long before people started talking. Some of what they said was even true.

Over the years, Pinsky tells me, strange things had happened that he assumed were connected to his activity online, hints he should have picked up on that the so-called game could potentially bleed into real life. Once, someone had called and said there was a car bomb in his house. Another time, a stranger showed up at the front door asking for Pinsky, though he wasn’t home. He told his mom and stepfather that these were gamer pranks, and he says that they seemed to believe him. They also knew he dabbled in cryptocurrency. In August 2019, nine months after the Terpin heist, Pinsky says his father randomly emailed him an article about how Terpin was suing AT&T for $224 million for gross negligence in his SIM-swapping case. Pinsky replied, “Why are you sending this to me?”

Law-enforcement officials confirm that the parents of SIM swappers are often clueless, easily convinced that their children’s newfound wealth is from early investments in bitcoin — or not even aware that the wealth exists at all. “The reality is, there are [lots of] parents who don’t know that their teenagers are technically many times wealthier than they are on paper,” says Brian Krebs, a cybersecurity analyst and author of Spam Nation. “Certainly, if they start driving Ferraris, then you’ve got to ask some hard questions” — one SIM swapper did use crypto to buy a McLaren — “but in a lot of cases,” he says, “the parents are just kind of oblivious.”

Pinsky maintains that his parents definitely were. On New Year’s Eve 2018, his mom received an email from Terpin’s lawyer, famed trial attorney Pierce O’Donnell (once referred to as “the new Perry Mason in Hollywood”) that spelled out many of the details of the heist and argued that her son was the mastermind. Panicked, she forwarded Pinsky the email and said, “We need to talk,” which they did later that night around the kitchen table. “I was terrified,” Pinsky says. “This was the first time, at 16 years old, I sort of realized this video game that I’ve been living in for several years just got real. And I need to address this.” He recalls that he gave his mom just enough information for her to quickly realize that he’d need a lawyer, and in early January, they took the train down to 500 5th Avenue to the law offices of Lankler Siffert & Wohl, where they met in a conference room with Siffert himself. It was the first of many trips Pinsky would take to the office that year, the first of many times he’d be asked to go through the details of the past few years of his life.

And it was the beginning of what can properly be described as a legal shitshow, on par with — and in fact directly related to — the extreme volatility of crypto. Pinsky and his legal team preempted his arrest by contacting the U.S. attorney directly and offering his cooperation. In February 2020, he voluntarily returned every last thing he says he got from the Terpin heist: 562 bitcoins, the Patek watch, and the cash he’d stored in the safe under his bed. He knew it would be an admission of guilt, but says he was fine with that — he was guilty, after all — and he hoped returning everything would be viewed as an act of good faith. Terpin viewed it far less generously. He’d lost a fortune, much of which had ended up in Pinsky’s possession. On the night of Jan. 7, 2018, 562 bitcoins had been worth about $10 million; on the day they were returned, they were worth less than $2 million. Multiple rounds of settlement negotiations confirmed that Terpin wanted more.

Actually, he wanted much more. He wanted $71.4 million, and he believed he was entitled to it under the RICO Act, which allows for treble damages in cases of organized crime. Terpin has long argued that that is what cyber gangs are. “You know, in a bank robbery, you got a guy with a gun, a guy who cases the joint, a guy in the getaway car,” he says. “Everybody’s got a job. Same thing in a SIM-swap gang. Once they get control of your cell, they go in and have a gang of programmers.” He also doesn’t understand why Pinsky has never been criminally charged. “I’ve been told that it’s because he was a minor. They have a hard time figuring out what to do with minors,” he says. “But these kids basically learn this thing from other kids and they get away with it until the age of 18, and then they stop and are pretty much rewarded for life. I mean, had [Pinsky] stopped one before me, nobody would have ever known.”

Terpin tells me this over Zoom one day this spring, wearing chunky glasses and a sleeveless T-shirt, and sitting in front of what appears to be a harbor, a virtual background that he says was an image of his real background (“It’s actually even sunnier today”). He says that he was the first of the big crypto guys to make the move to Puerto Rico, taking advantage of the island’s tax exemption for tech, which he discusses at length. He also talks about his days as an early adopter of cryptocurrency, back when bitcoin went for $120 a coin and he was kicking himself for not getting it at $4. “I’m a non-geek, but I understand tech, and I’ve tried to just basically go and find industries that interested me personally and that I thought were growing at a faster speed than the economy,” he says. When it came to blockchain technology, “I was like, ‘This is the next internet.’ I totally got it right away.” He does not refer to the currency that Pinsky had stolen as Triggers, but rather as an “altcoin,” and this is possibly intentional: He has been listed as a partner at Triggers, which has since crashed and been de-listed from the crypto exchanges. Its value went up roughly 800 percent the month before Pinsky stole it, and Terpin tells me he’d been in the process of slowly selling it off because its value was peaking. “They actually picked the peak day of the market to hack me,” he says. “Most altcoins, as they call them, never got higher than that day.”

Nevertheless, even if the value of what he stole was highly inflated, even illusory, Pinsky stole it. And Terpin wanted to make an example of him. He started reaching out to those he thought might have been involved and offering them money for information about the hack (Terpin does not dispute this, but says that he has “not paid anything to date, let’s put it that way”). Soon, the calls were rolling in. “My wife’s joke,” he tells me, “is that every Saturday morning, we would get some kind of call from somebody using Auto-Tune to disguise their voice.”

Some of those people, Terpin thinks, must have had a grudge against Pinsky. Some were clearly trying to squirm out of trouble themselves. But the calls solidified Terpin’s belief that he was dealing with a teenage villain, a “Baby Al Capone,” as he puts it. Terpin became convinced that Pinsky was hiding money — from other heists if not his own — that he was going on lavish trips, buying costly watches, and otherwise trying to pull one over on Terpin.

Crypto impresario Michael Terpin wants Pinsky charged under RICO. “In a bank robbery, you got a guy with a gun, a guy who cases the joint, a guy in the getaway car,” he says. “Everybody’s got a job. Same thing in a SIM-swap gang.”

 - Credit: XAVIER GARCIA/BLOOMBERG/GETTY IMAGES

That is all possible. “A big part of these cases is trying to recover the funds, and there’s no way of knowing if you’ve gotten them all,” says Erin West, the deputy district attorney for REACT, the high-tech task force that arrested Truglia. Bitcoin offers anonymity by design. The factors needed to access bitcoin funds could be memorized and exist only in the mind of their owner, or written down in the margins of a random book, or stored on a buried hardware wallet. Investigators comb through houses, looking for papers that might contain seed phrases or passcodes or keys. They read defendants’ mail in the hopes that they’ll uncover clues. They listen in on their calls. And they know that they don’t find everything. For some of her cases, says West, “We went through the numbers and we went through the numbers and we went through the numbers, and there is money missing.”

Yet Pinsky has a clear rebuttal to the idea that he’s hiding millions: He’s not in prison. Terpin’s case is a civil one, not a criminal one. In part, that has to do with Pinsky’s age at the time of the heist, but it also has to do with the fact that, as he states plainly, “I cooperated and was completely forthcoming with law enforcement.” (The FBI declined to comment on an “ongoing matter.”) Pinsky’s not sure how he’s supposed to prove to Terpin that he isn’t hiding some crypto fortune — “It’s hard to prove a negative” — but says he has spent much of the past two years trying. He imagines that the government may monitor him for the rest of his life to make sure his lifestyle is what it seems it should be. When I ask if he has also worked with the FBI to help bring down other hackers, he blinks quickly and then changes the subject.

One day in late April, Pinsky wants to go for a walk. Spring is here, and the city seems to have come alive, teeming with sundresses and good will. As he meanders past the fish stalls of Chinatown and the sidewalk cafes of SoHo, he blends into the crowd, a compact coed in a T-shirt and cords. Today, the 562 bitcoins he’d returned to Terpin happens to be worth $24,539,814, though who’s to say whether he is keeping track. He considers shelling out for some ice cream. It is a good day for simple delights.

Blending in has done Pinsky good. His senior year of high school was a travesty of notoriety after a round of settlement agreements fell through in 2020 and Terpin started publicizing the heist and Pinsky’s role in it. Most of his friends’ parents no longer wanted their kids hanging out with him. At graduation, he received thunderous applause, but he knew the cheers were ironic, offered only because, as he puts it, “I had become this person of interest in my town, but for all the wrong reasons.”

He had also become someone who was constantly looking over his shoulder. His family’s home invasion had occurred only a few weeks before graduation. Police had arrived in time to apprehend two of the four men who were attempting to break in. One was found in the basement, and was led out of the house in handcuffs while Pinsky’s mom screamed, “Who sent you? Who sent you?” The two men were sentenced to 60 months jail time on counts of Hobbs Act Robbery, but Pinsky knows that their partners are still out there somewhere. Maybe they still think Pinsky is hiding a fortune. Maybe others do. “The scariest part about it all is that I didn’t have it,” he says of the money. “And so, what would it take for them to believe that?” After the break-in, Pinsky says, his family got an assault rifle, and he started taking his mom along to the shooting range. He admits that being around her is hard now: As supportive as she’s tried to be, she moves through the world with a fear she never had before, and he knows that’s his fault. (Pinsky’s mother and stepfather declined to speak for this article.)

Often, Pinsky says, he wishes he could just sit down with Terpin and talk things through. Even outside the Triggers heist, he knows that a lot of the things he did were ugly. There were other accounts of Terpin’s that Pinsky got into with lesser degrees of success. There was money he tried to move even days later, sending instructions for how to launder it in the breaks between his classes at school. There were people he threatened, and people who feared him. He’s aware that when he got behind a computer, he became a kind of monster, and that the monster is all that Terpin knows. “I can see where they’re coming from,” he says. “We were all doing this sociopathic crap. I would not hang out with a 15-year-old Ellis. I would run away from him. Even at 16, I would run away from him. Even at 18, I would run away from him. Probably not as fast.”

Much of what is in this article, much of what Pinsky tells me over the course of our time together, is verifiable through legal documents, photos, texts, emails, and other sources. There is no doubt that the SIM-swapping crime happened; Pinsky’s and Terpin’s versions of the particulars mostly align. (For matters such as the contents of the safe and the itinerary of the night out with Truglia, I am relying on Pinsky’s account.) What can never be verified is what is or was in Pinsky’s head — the way he felt or didn’t feel in certain moments, his motivations or lack thereof, his view of the crime as a game.

I point out that people who get caught are the ones who tend to see the error of their ways, and he doesn’t dispute that. But, he says, he looks at it differently: Who would he be if he hadn’t gotten caught, if he hadn’t gotten this crash course in “What’s right and wrong from my lawyers, books, my therapist”? He speaks of morality as though it were an academic pursuit, something one could steep oneself in and internalize. He’s read Crime and Punishment, Extreme Ownership, Letters From a Stoic. Sometimes, he’s found himself watching a video of Terpin recounting the hack. “And he spoke about it rather matter-of-fact, but hearing in his words how methodical and calculated this was, I felt very, very ashamed,” Pinsky says. “It added a human element to what was, back then, this completely online thing for me. I feel like shame is not the most useful feeling, but I have accountability. Certainly, I don’t feel good about what I’ve done.” He’s talking to me because he “wants people to recognize that.” He wants people to know that “things change, and in my life, things have changed for the better.”

He says that college has helped with that. He was sure that he wouldn’t get in, but then, miraculously, just a few days before Terpin’s lawsuit was filed, he got his acceptance letter to a university he asks me not to name. He also says he got a free ride and that not paying tuition has helped his family cover legal fees, though they can’t be paid forever. Pinsky is coming to terms with the likelihood that the settlement negotiations will not go his way.

What he can’t come to terms with is the idea that something he did when he was 15 years old might be the main thing that ever defines him. He’s majoring in computer science and economics, and wants to be an entrepreneur, a field that doesn’t necessarily require a pristine backstory and that might even value a bit of a renegade one. He’s developed an app called Rentr that connects people who need things to people who own them (at the time of this writing, you can get a Canon printer, an electric scooter, a hookah, and a wedding tent, among other items). He wants to add value for a change, he says, “to eventually try to be useful.” It’s the language of disruption mixed up with the language of remorse.

When he moved into his dorm last year, he’d surprised his suitemates by pulling down his name from the front door and barricading himself in his room each night. Sometimes he wanted to tell them why — that he’d done something very bad and that people who thought he had lots of money might try to come after him — but he could never quite bring himself to do so. Since then, however, things have gotten less fraught. He’s made a few close friends. Over time, he’s told them what he’s done, and they’ve kept being friends with him anyway. He spent last fall studying abroad in Florence, Italy. The farther he gets from Irvington, the easier he says it is to distance himself from what he did there.

These days, Pinsky rarely goes back to Irvington. He avoids the blue bedroom, the picturesque Main Street, the far-off lights of the Tappan Zee Bridge. He avoids the places where he can’t even attempt to blend in. Irvington was meant to be a place of calm, not calamity, but Pinsky could have gotten his family killed there. Going home is too much of a reminder of everything that went wrong. “I think about what I’ve put them through, and I feel really, really bad and selfish,” he says. It’s a moment of clarity that can make things a little too clear.

At the end of our walk, Pinsky and I finally end up in a park. Musicians are busking, and people are lounging on the grass, sunglasses on, faces tipped back toward the late-afternoon sky. There is a carefree element that he hopes he can one day share. “I deeply want to distance myself from all of this stuff,” he tells me. “It is so ugly, so bad, so gross. There’s nothing more than I want to do than move on.” For now, moving on may be more of a mental exercise than a material one, but it’s the next level up. Pinsky will do whatever it takes to get there.

Pink Floyd Star Roger Waters Says He's 'Far, Far More Important' Than Drake & The Weeknd

He took aim at the Canadians after his recent shows in Toronto.

Tristan Wheeler
Trending Staff Writer
July 15, 2022, 


Roger Waters performing. Right: Drake laughing.
Bdingman | Dreamstime, @champagnepapi | Instagram

Pink Floyd co-founder Roger Waters had some choice words for two major Canadian artists following his two recent shows in Toronto.

Waters — who is currently touring North America on his This Is Not A Drill tour — slammed both Drake and The Weeknd in a recent interview with the Globe & Mail, claiming to be "far, far more important" than the Canadian icons.

The 78-year-old began by calling out the lack of media coverage his shows got on July 8 and 9 in Toronto.

After the interviewer chalked it up to The Weeknd's show being on the same night, Waters bemoaned that he had two shows that weren't reviewed by any Toronto publications — even after The Weeknd's show was cancelled.

"I have no idea what or who the Weeknd is because I don't listen to much music," said the classic rocker. "People have told me he's a big act. Well, good luck to him. I've got nothing against him."

Waters followed up on this comment by name-dropping another Canadian artist, Drake.

"And, by the way, with all due respect to The Weeknd or Drake or any of them," continued Waters, "I am far, far, far more important than any of them will ever be, however many billions of streams they've got."

On Spotify, Waters himself has a monthly listenership of 550,206 while his former band, Pink Floyd, has 15,452,665.

This is opposed to Drake, who has a monthly Spotify listenership of 67,485,161 and The Weeknd with 75,529,268.

Despite the widespread Rogers outage that took place on July 8, Waters' two Toronto shows were able to take place.

However, The Weeknd's show had to be cancelled due to the outage, which disappointed both the artist and the droves of hometown fans hoping to see his concert.

This isn't the first dust-up with Canadians that Waters has had.

The Pink Floyd bassist and singer famously spat on a rowdy fan in Montreal back in 1977. This incident later became one of the driving forces behind the 1979 Pink Floyd album The Wall.

This article's cover image was used for illustrative purposes only.