Hacker’s parents sentenced for selling his cryptocurrency

All you brilliant kids who use your fine brains to do idiotic things like, say, hack TalkTalk and the EtherDelta exchange, do yourself a favor: when you wind up in jail, warn your parents not  to “help” you by transferring your stolen cryptocurrency.

That’s what happened to TalkTalk and (alleged) EtherDelta hacker Elliott Gunton, whose parents have both been handed suspended sentences after admitting to having removed some of his ill-gotten cryptocurrency from a hardware wallet.

It was a “misguided” attempt to help him, according to what Judge Stephen Holt told mom and dad, Carlie Gunton and Jason Gunton, on Wednesday. The Eastern Daily Press – a local paper in the Guntons’ hometown of Norwich, in the English county of Norfolk – quoted the judge:

You misguidedly tried to help your son and what you did didn’t help him at all, and I’m sure it’s something you’re regretful about.

History of a youthful, repeat offender

Elliott Gunton, now 20, was convicted in 2016 at the age of 16 for his role in attacking the UK broadband and telecom giant TalkTalk.

In 2017, the UK’s Information Commissioner’s Office (ICO) fined TalkTalk £400,000 for security failings that led to the attack and which allowed customer data to be accessed “with ease”. The attacker accessed the personal information of more than 150,000 customers, including the sensitive financial data of more than 15,000 people (sensitive data that TalkTalk’s CEO, bizarrely enough, had said that the company wasn’t required to encrypt).

In April 2018, police made a routine visit to ensure that Gunton was complying with a Sexual Harm Prevention Order imposed by the court in 2016. They seized his computer, and they found that he was selling people’s stolen personal data for crooks to use for criminal use, such as mobile phone numbers that could be used to intercept calls and texts.

Gunton confessed to five counts, including computer misuse and money laundering, and was jailed for 20 months, released due to time spent on remand, ordered to pay back £407,359, and given a three and a half year community order, which restricted his internet and software use.

Last month, Gunton was again indicted, this time for allegedly hacking cryptocurrency exchange EtherDelta in December 2017, changing the site’s DNS settings, and redirecting traffic to a clone where he and fellow indictee Anthony Tyler Nashatka, of New York, allegedly logged user credentials and then stole customer funds.

According to the BBC, Norfolk police traced and seized £275,000 (USD $339K) worth of cryptocurrency, including Bitcoin, under Gunton’s control.

The indictment against Gunton and Nashatka was filed on 13 August in San Francisco. Gunton was sentenced three days later to 20 months in prison in the UK for selling personal data on the dark web in exchange for cryptocurrency, following his arrest in 2018.

The two are facing five counts each in the US, with maximum prison penalties of up to 20 years, up to three years of supervised release, and a fine of up to $250,000, though maximum sentences are rarely handed out.

Just when you think your crimes are done exploding in your face…

So, about that ill-gotten cryptocurrency.

On Wednesday, as the Eastern Daily Press reports, prosecutor Kevin Barry said that Gunton’s parents would regularly visit Elliott in prison while he was on remand – in other words, in custody, awaiting trial.

Barry said that after one of those visits, in August 2018, police discovered that cryptocurrency was missing from the seized hardware wallet by someone using Jason Gunton’s laptop – £200,000 worth of cryptocurrency (USD $246.82K) had been transferred out.

Not all of the money in the wallet had been determined to have come from crimes, but tens of thousands of pounds of it did.

Police visited both homes of Elliott’s separated parents, and when they searched Carlie Gunton’s recycling bin, they found a scrap of paper with the 24-word password to the hardware wallet written on it.

Barry told the court that Carlie and Jason Gunton hadn’t been looking to profit off the cryptocurrency. Rather, they wanted to help their son, who didn’t know what they were up to. It was his dad who transferred the money, and it was his mom who gave him the password to get at it.

Her story is kind of muddled, the prosecution said. Did her son give her the password during a visit? She keeps changing her account, they said.

Judge Holt told the parents that Elliott is “extremely angry” at what they’d done, given the consequences for him. Namely, he’s been denied bail.

It will be tough for them to visit Elliott in US prison

Carlie Gunton admitted to transferring criminal property. She’s been given a three-month prison sentence suspended for one year. Jason Gunton admitted to the same charge along with perverting the course of justice and was handed a five-month prison sentence, also suspended for one year. Both were ordered to pay £600 costs.

Unfortunately, their error in judgement has left them both with prison sentences and criminal records. As pointed out by Carlie’s lawyer, Matthew McNiff, there’s a “real possibility” that Elliott will be transferred to the US to face charges, and his mother is going to have a tough time getting a visa in order to visit him, given her conviction.

A final bit of past crimes blowing up in a criminal’s face: last week, UK police auctioned off the criminally gotten cryptocurrency they seized from Gunton. It was a first for UK police, and they raised £300,000 ($369,000) – more than market value.