They were smart investors, clever enough to master the mysteries of digital currencies like bitcoin and ether. But according to California prosecutors, dozens of them were ripped off by a 20-year-old college student, a Boston Public Schools valedictorian who used cunning and technical skill to siphon off millions in digital money.
Joel Ortiz, a UMass Boston student from Allston, was arrested in California in July and accused of running a complicated scheme that allegedly involved taking control of his victims’ cellphones and then hacking into their cryptocurrency accounts and draining them of $5 million.
Santa Clara County authorities said Ortiz had $250,000 in cryptocurrency when he was arrested at Los Angeles Airport July 12 while en route to Europe, and had blown $150,000 on a spree that seemed like a scene from the TV show “Entourage”: parties in rented mansions and an accumulating wardrobe of designer merchandise.
A high school classmate, Panos Yiotis, was on the school robotics team with Ortiz and recalled him as being “very tech savvy.” Yiotis said he had reached out to Ortiz recently for advice on cryptocurrencies.
“I remember asking Joel a few months ago for tips on how to get into bitcoin and cryptocurrency trading,” Yiotis said in an interview this week. “I would see his snaps [Snapchat postings] talking about it and how he’s made so much money off of it but I never knew or thought he was doing this illicitly.”
Ortiz is being held on $1 million in bail in California, charged with 28 counts of computer hacking, identity theft, and grand theft. He is due back in court Aug. 9.
The attorney from the California public defenders office representing Ortiz did not respond to requests for comment. At his Commonwealth Avenue apartment, a woman who identified herself as Ortiz’s mother declined to comment.
The University of Massachusetts Boston confirmed Ortiz is a student, majoring in information technology.
In 2016 Ortiz was named valedictorian of Another Course to College, a small Boston pilot school now located in Hyde Park that specializes in college prep classes. Boston Public Schools said college acceptance is a graduation requirement.
At the time of his honor, Boston Public Schools noted in a press release that Ortiz “loves science and technology” and said he was instrumental in the success of the school’s “robotics team as the lead robot software programmer. He has taught the basics of software coding to students and has led efforts to teach computer science.”
He was photographed with Mayor Martin J. Walsh and former school superintendent Tommy Chang at a luncheon honoring that year’s Boston school valedictorians.
Boston Public Schools declined to comment Tuesday.
The alleged theft involves cryptocurrency, which typically uses a complex software technology called blockchain to generate digital assets that are stored and tracked by various exchanges. People can buy bitcoin and other digital money using hard currencies. But they are not backed by any real assets or government endorsement, and are prone to wild swings in price that have made some very rich — on paper.
Ironically, one main selling point of cryptocurrencies, according to proponents, is that the technology creates secure online transactions while minimizing fraud.
Investigators’ records filed in Santa Clara County say Ortiz used a technique called “SIM swapping” to steal victims’ identities. Authorities said someone impersonating the victims went to cellphone carriers such as AT&T and persuaded the carriers to assign the victims’ phone numbers to him. In several instances, authorities said, the thief appeared in person at a carrier’s store, including one in Georgia, and presented identification, such as a Social Security number.
With the victims’ phone numbers under his control, authorities said Ortiz used his access to their incoming calls and text messages to change the passwords to their social media and financial accounts. Then, armed with new passwords, Ortiz allegedly withdrew funds from some of the victims’ accounts.
In several incidents, authorities alleged, Ortiz impersonated his victims, contacting friends or family members. In one case, Ortiz allegedly stole $10,000 from a veteran tech executive in California, and then tried to get even more, phoning the victim’s wife and sending a text to the victim’s daughter: “TELL YOUR DAD TO GIVE US BITCOIN.”
In another he allegedly tricked the friend of one victim into “lending” Ortiz about $100,000 of digital currency, according to victim statements filed by California authorities.
Erin West, deputy district attorney of Santa Clara County, said investigators have located 40 victims, about half of whom live in California. She also appealed for other victims to come forward.
The victim statements filed in the case indicate that many of the targets of the theft were veteran technology entrepreneurs and executives of cryptocurrency ventures. Several were attending the same cryptocurrency conference in New York in May when they realized their cellphone accounts had been hijacked.
West said Ortiz was arrested when investigators learned he was planning to return to Boston and then fly on to Europe. Detectives “were aware he was planning to go to an electronic music festival in Belgium,” West said. “He missed it. He can’t be happy about that.”
An affidavit filed by Caleb Tuttle, the investigating officer in the case, said Ortiz admitted to having spent $150,000 in Los Angeles over several weeks leading up to his arrest. Police also seized an additional $250,000 in cryptocurrency from Ortiz. Tuttle said that Ortiz spoke of working with coconspirators who “likely have access to millions of dollars in cryptocurrency.”
Hiawatha Bray can be reached at firstname.lastname@example.org. Follow him on Twitter @GlobeTechLab.