Hacker Shane Stephen Duffy’s house, car seized amid claimed link to French Bitcoin heist

A Queensland man previously convicted of hacking a US gaming giant has had assets related to him – including a mansion, luxury car and Bitcoin worth a combined $4.5m – seized after a federal police-led investigation.

Austrac was contacted by Luxembourg law enforcement partners in 2018, following an investigation of suspicious Bitcoin transactions, which were linked to Queensland man Shane Stephen Duffy.

A waterfront mansion, luxury Mercedes Benz and Bitcoin worth a combined $4.5m has been seized after an Australian Federal Police-led taskforce investigation, relating to a Queensland man previously convicted of hacking a US gaming giant.

The Criminal Assets Confiscation Taskforce (CACT) seized the items, with the District Court ordering the assets be forfeited to the Commonwealth under the Proceeds of Crime Act.

It followed a years-long investigation involving international law enforcement agencies into stolen cryptocurrency, after the theft of 950 Bitcoin from a French cryptocurrency exchange in 2013.

Austrac was contacted by Luxembourg law enforcement partners in 2018, following an investigation of suspicious Bitcoin transactions, which were linked to Queensland man Shane Stephen Duffy, who was previously convicted of hacking in relation to gaming giant Riot Games in the United States.

The AFP said the CACT investigation identified suspected links between the man and the theft of the 950 Bitcoin from the exchange in 2013. However they said their investigation did not lead to charges. At today’s current prices, the 950 Bitcoin would be worth approximately $150m.

Despite criminal charges not eventuating, federal laws allow the taskforce to restrain suspected proceeds of crime.

The beachside mansion seized among the suspected proceeds of crime. Picture: AFP

The taskforce obtained restraining orders over a Beachmere home linked to Duffy, the 2019 Mercedes and 24.99 Bitcoin in July 2023, saying it was done so on the basis it was “reasonable to suspect they were the proceeds of crime, noting they were not commensurate with identifiable legitimate earnings”.

The taskforce successfully applied to the court to have the assets forfeited in April this year, after the operation codenamed Gouldian investigated stolen cryptocurrency and cyber hacking.

When he was sentenced 2016, the District Court in Brisbane was told Duffy had a copy of personal data of millions of League of Legends inactive users in 2013 and made $32,000 selling access to some of their accounts.

There was no evidence he hacked the database but he had a copy of the lists.

Duffy and an associate also launched attacks against other players to affect their gameplay, by flooding servers with data, the court was told.

Duffy also hacked into the Twitter account of the Riot Games president Marc Merrill so Duffy could publicise his business, the court was told.

His family were contacted after the confiscation proceedings this year, but did not respond.

AFP Commander Jason Kennedy said the AFP and its partners remained committed to targeting and confiscating alleged proceeds of crime to disrupt criminals, including those involved in cybercrime.

A Mercedes-Benz similar to this one was seized. File picture: AFP

“The Proceeds of Crime Act provides law enforcement agencies with unique powers to restrain and forfeit instruments and proceeds of crime,” he said. “Criminals are driven by greed at the expense of honest Australians and businesses who are losing their hard-earned money to cyber criminals. The profits derived from criminal activities are also often used to fund further criminal acts, which is why the AFP works closely with our partners in the CACT to target the proceeds of crime and ensure they are re-invested in the community.”

Figures from CACT show that since July 2019, it has restrained more than $1.2bn in criminal assets, which it says includes houses, cars, yachts, cryptocurrency, fine art and luxury goods.

The CACT includes members of the AFP, Australian Border Force, Australian Taxation Office, Australian Criminal Intelligence Commission (ACIC) and Austrac. Members include police, financial investigators, forensic accountants, litigation lawyers and partner agency specialists.

Restrained assets are liquidated on behalf of the Commonwealth by the Australian Financial Security Authority (AFSA), with proceeds placed in the Commonwealth Confiscated Assets Account (CAA).