> ## Content Index
> Fetch the complete content index at: https://www.russianhackers.co/llms.txt
> Use this file to discover other available public pages before exploring further.

# The $3 Billion Click: How a Programmer Robbed the Darknet and Lost It All to the State
- URL: https://www.russianhackers.co/the-3-billion-click/
- Published: 2026-07-12T18:33:50.000Z
- Updated: 2026-07-15T16:30:22.000Z
- Description: The James Zhong case shows that blockchain anonymity is an illusion, and that bugs in code have no statute of limitations.
- Author: Martin
- Tags: Breaches, Hackers

In November 2021, the U.S. Internal Revenue Service (IRS) seized 50,676 bitcoins worth roughly $3.36 billion from James Zhong, a resident of Georgia. It was the largest cryptocurrency seizure in history at the time, and the culmination of a scheme set in motion almost a decade earlier.

## How the theft worked

In the autumn of 2012, Zhong found a vulnerability in the withdrawal system of Silk Road, the darknet marketplace that traded illegal goods for bitcoin. The platform failed to correctly check an account balance during rapid, repeated requests: several withdrawals fired milliseconds apart were all treated as valid, and the balance was effectively doubled.

According to the U.S. Department of Justice, the actions were deliberate. Zhong created about nine fake seller accounts without ever listing anything for sale, funded each with between 200 and 2,000 BTC, and triggered a flood of instant repeated withdrawals. Over a few days he pulled roughly 50,000 bitcoins off the platform, worth about $700,000 at the time.

## A decade of waiting

After Silk Road was shut down in 2013, the funds sat untouched for seven years. During that time the price of bitcoin climbed many times over, and by 2020 Zhong's holdings were worth approximately $3.3 billion.

His bet that the theft had been forgotten proved wrong. By court order, all bitcoins that had passed through Silk Road were subject to forfeiture to the state; investigators were simply waiting for the owner to slip.

## Deanonymization

The decisive blunder came down to the nature of the blockchain as a permanent, public ledger. Alongside the "dirty" coins, Zhong also held legally mined funds that he had sold on an exchange under his real name. While reorganizing his assets, splitting 10,000 coins across ten wallets, he linked that legitimate chain of transactions to the stolen funds. Blockchain analysis established his identity, which gave grounds for a warrant and a search.

![An IRS Criminal Investigation agent recovers a single-board computer hidden in a popcorn tin during the search](https://storage.ghost.io/c/74/2d/742d367f-964f-4026-ae71-475851ace958/content/images/size/w1200/format/webp/2026/07/a1-raid.png)

A single-board computer holding the keys, hidden in a popcorn tin in a bathroom cabinet, alongside cash and gold bars. (Dramatized illustration.)

## The search and the sentence

During the search in November 2021, the bulk of the assets was found on a single-board computer hidden inside a popcorn tin in a bathroom cabinet. Investigators also seized cash, gold and silver bars, and physical Casascius coins.

At first, investigators did not have the access key (the seed phrase) to the wallet, which Zhong kept in his memory. After several months he agreed to cooperate, and in March 2022 the assets were moved to a Department of Justice address.

Given his cooperation, Zhong was sentenced to a year and a day in prison (the sentence was handed down in 2023, and he was released in 2024). All of the assets, both stolen and later acquired, were forfeited to the state.

## Takeaways

The case illustrates three principles that matter for information security and crypto assets:

- **Vulnerabilities have no statute of limitations.** A bug in 2012 code produced consequences a decade later.
- **The blockchain does not provide anonymity.** A public ledger turns deanonymization into a matter of a single mistake when linking addresses.
- **Time cuts both ways.** It multiplied the value of the assets many times over, and it also gave investigators long enough to identify their owner.

*Source: U.S. Department of Justice, IRS Criminal Investigation.*