US authorities have arrested a British cybercrime suspect accused of selling stolen data from major US firms — by convincing him to accept payment in Bitcoin.
Kai West, a 20-year-old cybersecurity student from the UK, was charged in the Southern District of New York this week with conspiracy to commit computer intrusions, wire fraud, and the sale of sensitive personal and corporate data.
Operating under the alias “IntelBroker,” West allegedly led a hacker collective known as CyberN\[——] and posted offers to sell stolen data on dark web forums at least 158 times between 2023 and 2025.
But for all his technical sophistication, West made a single, critical mistake: he agreed to a Bitcoin payment.
According to court documents released on June 25, West had insisted on using Monero — a “privacy coin” designed to obscure transaction details — for all illicit sales.
But in January 2023, an undercover FBI agent persuaded him to accept a $250 payment in Bitcoin in exchange for access credentials — login details connected to a software interface, known as API, the hacker had previously breached.
That payment became the thread that unraveled the operation.
The Bitcoin wallet West provided had been funded via another wallet, which had in turn been seeded by an account at Ramp, platform that covers between fiat money like British pounds and cryptocurrencies like Bitcoin. The platform requires identity verification.
Investigators discovered that the Ramp account was registered to Kai West, using a UK driver’s licence. The same ID had also been used to open a Coinbase account under the alias “Kyle Northern”, which further linked West to the transaction trail.
Unlike Bitcoin, where all transactions are permanently recorded on a public ledger and can be traced with sufficient blockchain analysis, Monero employs cryptographic methods like ring signatures, stealth addresses, and confidential transaction amounts to obscure the sender, recipient, and value involved.
This makes it extremely difficult — even for sophisticated forensic tools — to link transactions to specific individuals or wallets. As a result, Monero has become the preferred medium of exchange in illicit markets where anonymity is paramount.
The European Union is looking to ban crypto assets like Monero’s native cryptocurrency XMR. Several crypto exchanges, including Binance, OKX, and Kraken last year delisted XMR across multiple jurisdictions, which resulted in the cryptocurrency’s low liquidity.
$25m in damages
Investigators traced overlapping IP addresses, email accounts, and even YouTube watch histories to catch the suspect.
West’s personal Google account was found to have watched several videos that were subsequently posted by IntelBroker on the forum Forum-1. His Coinbase and email activity used the same names, IP addresses, and even passwords associated with forum logins.
Despite efforts to present himself as a Russian or Serbian-speaking operator in one media appearance, West was in fact a native English speaker living in the UK and studying cybersecurity at an unnamed university, the FBI said.
Prosecutors allege he used his alias to leak or sell data from telecom providers, healthcare systems, and government-related entities — often attaching samples to boost his reputation among peers.
The US Department of Justice said West’s activities had caused an estimated $25 million in damages, with stolen data covering everything from internal corporate marketing documents to the health insurance information of more than 50,000 Americans.
West is expected to appear before a US magistrate judge later this month. If convicted, he faces decades in prison.
