A group of people exploited a vulnerability in a cryptocurrency exchange’s system to illegally obtain more than £20 million worth of crypto assets.
After pulling it off, they went on a spending spree. One bought a car for a stranger he’d met in a bar; another handed out gift cards to passersby on the street. One even gave a stranger a gift card worth £5,000.
But what exposed the entire criminal gang was, of all things, a family dispute.
The story begins in 2017.
James Parker, from Blackpool in the UK, discovered a system vulnerability in an Australian cryptocurrency exchange.
He quickly found a way to exploit the vulnerability, generating account credit on the platform that he was not supposed to have, then using it to withdraw cryptocurrency.
From October 2017 to January 2018, Parker exploited this vulnerability to illegally obtain cryptocurrency worth approximately £15 million.
His accomplices, Kelly Caton and Jordan Robinson, later joined in, obtaining a further approximately £4.4 million.
The gang illegally acquired assets worth more than £20 million in total this way.
The money came so easily that they didn't even know what to do with it.
Parker started buying cars for strangers he'd just met in bars, and £5,000 gift cards were handed out casually on the street.
What had seemed like a flawless scam took an unexpected turn after a call to the police.
Kelly Caton reported to the police that her daughter had stolen 15 of her bitcoins.
While investigating this family dispute, police noticed something unusual: how could someone who did not appear to be well-off possess such a vast amount of cryptocurrency?
As the investigation deepened, police gradually uncovered the exchange's vulnerability and how the gang had illegally obtained cryptocurrency.
Ultimately, law enforcement recovered 445 bitcoins, worth approximately £22 million at the time. They also seized assets including luxury cars, watches, property, gold and cash.
However, Parker, the main figure in the case, died in January 2021 before he could be formally charged.
In January 2023, four other people involved in the case were convicted and sentenced for their part in the fraud.
By 2025, three of them had also been ordered by the court to repay more than £23.6 million.
The most dramatic aspect of the case was that a police report originally made over a daughter's theft of bitcoins unexpectedly exposed a cryptocurrency scam worth tens of millions of pounds.
From a vulnerability in the exchange's system, to the illegal acquisition of assets and the squandering of funds, the whole operation was ultimately exposed by a report to the police from someone on the inside.
In the world of cryptocurrency, sometimes the greatest risk is not hackers breaking into a system, but vulnerabilities in the system itself—and the people who have access to it.
