News on Relevant Science: Bitcoin!

Iceland’s Big Bitcoin Heist | Vanity Fair

Someone was targeting the security guard.

He felt he was being followed. His dog barked in the middle of the night. His wife saw fleeting figures lurking around their home. One night he awoke to find his front door open.

And now, to top it off, he was sick. Nausea rose up within him in waves as he made his rounds. He worked the night shift, which meant intermittent inspections from dusk to dawn, patrolling the grounds for any signs of trouble. The result was always the same: nothing.

He was the lone guard at the Advania data center, housed in a former U.S. naval base not far from the Reykjavík airport in Iceland. His job was to keep watch over two hangar-like buildings that held rows of small, box-like computers, the size of two cartons of cigarettes, stacked in towers as far as the eye could see. It was a hot, constantly blinking trove of devices, lashed together with tangles of cables and wires, all dedicated to a single job: mining the cryptocurrency known as Bitcoin.

Working around the clock, seven days a week, the computers were part of the largest concentration of Bitcoin mining power in the world. By solving and packaging complex “blocks” of encrypted data, the machines helped secure and expand the worldwide network of digital currency. And in return for their work, they generated vast fortunes for their owners. The Advania network alone, operated by Iceland’s largest IT provider, pulled in what’s estimated to be millions a year.

The night shift at the data center was the worst, the country plunged into darkness 19 hours a day by a stingy sun. Braced against the arctic cold on this January evening, the security guard was feeling sicker by the minute. Finally, around 10 p.m., he jumped into his car and sped home, rushing straight to the bathroom. “Diarrhea,” an attorney would later explain. When he emerged, he was too weak to walk. So he lay on the couch—just for a minute!—and immediately fell asleep.

Jolted awake just before seven the next morning, he rushed to his car to return to work, only to find that someone had slashed his tires. He called headquarters and was told to wait for backup. Just after noon, the guard, who had gone back to sleep, awoke to the sound of police officers pounding on his door.

While he was sleeping, someone had broken into the data center and stolen 550 Bitcoin computers, along with motherboards, graphics cards, and power accessories—a haul worth $500,000 for the hardware alone. It was the fifth cryptocurrency data center in Iceland to be hit in two months. The total take: $2 million in tech gear.

But the true value of the computers was far greater. If the thieves knew how to operate them, the machines could be used to mine Bitcoins—an operation that would churn out a continuous stream of virtual money for the burglars, all of it encrypted and completely untraceable. The criminals weren’t robbing banks, or even Fort Knox. They were stealing the digital presses used to print money in the age of cryptocurrency.

CASH MACHINES
Genesis Farming, one of the world’s largest Bitcoin mines, in the data center near Reykjavík.

Photograph by Halldor Kolbeins/AFP/Getty Images.

It is a freezing winter evening and I am sitting in a Reykjavík steak house, awaiting the arrival of the man charged with masterminding what has become known in Iceland as the Big Bitcoin Heist. Suddenly, the restaurant’s front door blows open and Sindri Thor Stefansson enters, accompanied by a burst of frigid air and a gust of snow.

“Cold,” he says, removing his heavy woolen cap and shaking the snow out of his thick beard before sitting down for a hunk of Icelandic beef.

At 32, Stefansson is the most famous thief ever to emerge from this polite and friendly island, ranked by the Global Peace Index as the world’s most peaceful nation. Major crime is almost nonexistent; in 2018, there was only one murder in all of Iceland. Police question suspects in cozy “conversation” rooms decorated with soothing photographs of swans. The total prison population for the entire country seldom rises above 180.

“It’s the biggest burglary in the history of Iceland,” Stefansson boasts of the Bitcoin heist. “So I guess it’s my biggest yet.”

He speaks in a guarded growl, still wary of saying too much after being sentenced to four and a half years in prison. In a country known for its niceness, Stefansson was naughty from the start. Born and raised in the small town of Akureyri, he committed his first breaking and entering in kindergarten, smashing a window at school and reaching inside to open the door. In that moment, he says, he experienced the adrenaline high he would spend his life chasing.

“I was a naughty boy,” he recalls. “Screaming, yelling, stealing, biting.” Around the age of six, he met his best friend and partner in crime, Hafthor Logi Hlynsson. “The first memory of us is going behind the counter at a shopping mall,” Stefansson says. “We stole a purse from an old woman who was working there.” Hlynsson, who was convicted of joining his childhood friend in the Bitcoin heist, has grown into a muscular, tattoo-covered drug smuggler and money launderer known as Haffi the Pink.

In his teens, Stefansson graduated to drugs: pot, speed, cocaine, ecstasy, LSD. By the time he turned 20, he was growing cannabis. His rap sheet soon included 200 cases of petty crime. He broke into people’s homes to steal TVs and stereos, and somehow managed to extract $10,000 from some slot machines in a Reykjavík bar.

Then, during a 10-month stint in prison with Hlynsson, he managed to get clean. Determined to turn his life around, he got married, took a job driving a postal truck, and graduated with a degree in computer science from the University of Iceland, where he was voted Prankster of the Year. He started a string of businesses: creating websites for car rental companies, selling protein pills online, even leasing warehouses to expand his marijuana crop. But he was deep in debt and unable to support his three children. “I was failing as the provider for my family,” he would later say. “I just needed more.”

The answer, he decided, lay in the unsecured buildings at the old naval base, packed with zillion-dollar money machines. “I wanted to start Bitcoin mining,” he says, “because it is very similar to growing cannabis. Everything is related: electricity, air, heat, cooling systems. So I started asking around on the internet.”

It was cryptocurrency, ironically, that helped save Iceland after the bankers bankrupted it. For years, the country’s economy was centered around fishing and aluminum smelting. Then, in the new millennium, Iceland’s three biggest banks found a way to get rich quick off of foreign debt. Flooded with cash, the banks grew nearly seven times larger than the national economy. They plowed their paper profits into foreign assets—real estate, fashion brands, soccer teams—only to go bust in the global financial crash of 2008. When the banks defaulted on $85 billion in debt, Iceland’s currency collapsed and unemployment soared. The International Monetary Fund pumped $2 billion into the economy to stave off an even greater disaster.

Six years later, in 2014, a new bonanza arrived in the form of Bitcoins. One wintry day, a German cryptocurrency entrepreneur named Marco Streng stepped off a plane at Keflavik International Airport. Like most German kids, he recalls, he had only seen Iceland on TV, which glorified the frozen nation as “something from another planet.” Now, driving from the airport to the old naval base at Asbru, he encountered a “ghost town” pockmarked by “car rental places and trash yards.” To Streng, it looked like the new cryptocurrency frontier.

Iceland was rich in everything that Streng needed to mine Bitcoins. There were plenty of empty warehouses to house his computers at absurdly low rents. There was cheap geothermal energy, literally rising from the earth, to power them. There was what he calls “the most important part of the Bitcoin world”—a consistently cold climate to keep the machines from overheating as they mine cryptocurrency 24/7. And in a country with almost no crime, there was little need to spend money on extensive security measures.

Within six months, Streng transformed an abandoned building on the former base—an old U.S. military lacquering garage—into Iceland’s first Bitcoin mine. Every time someone in the world made a purchase using a Bitcoin, Streng’s operation joined a global network of computers that raced to verify and secure the transaction with an encrypted algorithm. Whoever cracked the code first received a Bitcoin in return—a payment, at its peak, worth $17,000 for just a few minutes of computing time.

The success of Streng’s operation, which grew into the world’s largest Bitcoin company, attracted other miners to Asbru. “Suddenly,” Streng says, “there were fans on the roofs of other buildings down the road”—a sure sign of mining operations. Commercial miners arrived from Asia and Eastern Europe. Today, Bitcoin mines consume more energy than all of Iceland’s homes combined.

But wherever there is money, crime is sure to follow. One night at his keyboard, in the summer of 2017, Stefansson says he made a connection that would transform both him and his country. He won’t say who it was or how they met—only that it came through a “messenger somewhere.” The man, a mysterious and dangerous international investor who became known as Mr. X, told Stefansson that his plans were crap. “Why go to all of the expense and effort to start your own Bitcoin mine,” Mr. X asked, “when you can get a head start into the business by stealing computers from the competition?”

Mr. X told Stefansson that he would give him 15 percent of the profits from as many Bitcoin computers as he could steal from data centers across Iceland. The total take, Stefansson calculated, could be as much as $1.2 million a year—“forever.” Because, with the stolen computers, Stefansson and Mr. X would establish their own Bitcoin mine.

“It’s just amazing that there are computers that make money,” he says. “Regular people don’t comprehend all it does. They just don’t get it.” But Stefansson saw it for what it was: the perfect crime. “You’re stealing machines that make money,” he remembers thinking. “Making money while you sleep.”

“It just has to be done,” he told himself. “I’m ready to go to prison for this. It’s a once-in-a-lifetime thing.”

CYBER PUNKS
Sindri Stefansson (top), the gang’s leader, and his childhood friend, Hafthor “Haffi the Pink” Hlynsson.

Top, from Iceland Monitor; bottom, from Fréttabladid.

To pull off the heist, Stefansson says, Mr. X assembled a motley crew of Icelandic men in their 20s, all of whom happened to know each other. (“It’s a small island,” Stefansson observes.) They met at a friend’s house in Reykjavík to go over the plans. First there was the brawn: Matthias Jon Karlsson, a quiet, husky guy who worked in a home for special-needs kids, and his younger brother, Petur Stanislav, nicknamed “the Polish.” Next, the beauty: Viktor “the Cutie” Ingi Jonasson, a good-looking guy with a degree as a systems administrator. None of them had a significant police record.

Then, according to police, there were the brains: Stefansson’s childhood friend and brother-in-crime, Haffi the Pink, a seasoned drug smuggler with a long rap sheet, who helped organize the jobs from where he was living in Thailand and Spain.

Finally, there was the boss of the operation—although who, exactly, that was remains a matter of dispute. While the courts have concluded that Stefansson organized the heist, he insists that he was directed by the shadowy Mr. X. “You don’t say no to this guy,” Stefansson says. “It was not like the old days, when I was younger and doing it for fun, adrenaline. It was like an assignment.”

Together, the five men were an Icelandic version of the “Ocean’s 11 gang,” says Alla Ámundadóttir, who covered the case for the country’s major newspaper, Frettabladid. “I’ve never seen violence in them. This is why I can call it my favorite case. It’s difficult not to root for them.”

By July 2017, Stefansson had a Bitcoin wallet, burner phones, 10 tracker devices to attach to security vehicles, and rings of duct tape to silence any mouthy witnesses. He communicated with his team via Telegram, a service that enables encrypted, self-destructing messages. They also conversed on a Facebook page called Foruneytid, Icelandic for “the Fellowship,” a reference to Lord of the Rings. A prosecutor later insisted that the page was proof of an organized crime ring, possibly international in scope—a claim that cracked the guys up. “It’s just a Facebook group,” they told someone they knew, laughing. “It doesn’t make us Mafia.”

Stefansson began driving nearly six hours from his home in Akureyri to the old naval base outside Reykjavík to scout the premises. There wasn’t much to see. On the day I visited, several stern guards sat before giant split-screen security monitors, watching over every inch of the facilities, inside and out. But at the time of the Big Bitcoin Heist, no one was there. “There was no security,” a guard tells me. “I shouldn’t say no security,” he adds hastily. “There was a contract security service, but they didn’t walk around.”

On the night of December 5, 2017, as flurries of sleet and snow buffeted Iceland, Stefansson and his crew broke into the Algrim Consulting data center at Asbru. They stole 104 Bitcoin computers, along with power sources, graphics cards, and assorted supplies. Five days later, on December 10, the Borealis Data Center told police that someone had tried and failed to break into their facility at Asbru, attempting to disable the alarm by gluing the security sensors.

The police seemed slow to investigate, and the burgled companies preferred that the crimes stay quiet. “The data centers didn’t want this getting out, because it could affect their talks with foreign investors,” says one observer. Iceland had become the world’s leader in Bitcoin mining based in part on its reputation of being virtually crime-free. Any talk of a heist would be bad for business.

Stefansson and the rest of the gang might have stopped there. They already had enough computers to set up their own small Bitcoin mine and enjoy the proceeds. But making money in cryptocurrency requires size and speed: It takes a lot of computing power to solve and package data, and the only people who get paid are the ones who crack the complex equations first. In Bitcoin mining, every second counts.

Then Stefansson got a call from someone he had studied computer science with at the university. The friend was working as an electrician in the small town of Borgarnes, on Iceland’s western coast, and he had noticed something strange. The warehouse at the local AVK Data Center suddenly needed more electricity—a lot more electricity—for something called Bitcoin.

“There is a mine in there,” the friend told Stefansson.

Stefansson drove from Akureyri and studied the small metal building in the middle of nowhere. The mine was only six days old. Security? Nonexistent. The alarm system hadn’t yet arrived. The lone police officer patrolling the area had gone home for the night. And a window way up high had conveniently been left open, to let the frigid air cool the red-hot computers. This being Iceland, someone had even left a ladder nearby.

Stefansson asked Matthias Karlsson to buy a vehicle, and the conscientious day care worker came through with a cheap blue van, purchased on the Icelandic version of eBay. Ten days after their first job, Stefansson and Viktor the Cutie drove to the data center, where Stefansson climbed the ladder, slipped through the open window, and landed, catlike, on the concrete floor. Then he and Jonasson stacked 28 brand-new “money machines” into their waiting van and raced away.

In their excitement, they took the fastest route: the Whale Fjord Tunnel, a 3.6-mile passage beneath the icy waters of the Hvalfjörður fjord. A CCTV camera at the toll booth snapped a photograph that showed Stefansson behind the wheel. There was also an image of what police would later claim was Jonasson’s tattooed left forearm. (In court, the Cutie tried to use his love of tattoos as an alibi: A tattoo artist testified that Viktor had spent the entire night in bed with her.)

The next morning, one of the mine’s investors logged in from Germany to check the overnight action from the data center. What came back was…nothing. No data. Not even a connection. In a panic, he called the mine’s owner back in Borgarnes. “Something’s wrong!” he told her.

The woman—a feisty, 66-year-old entrepreneur—had been convinced by her two “computer nerd” sons to give them $50,000 to open the mine. “I’m an old bitch,” she tells me in her thick Icelandic accent, a heavy woolen cap pulled low over her white hair. “I never understood the Bitcoin, never. I’m not going to pretend.” Now, she and her sons raced to the mine. “We opened the door and everything was empty!” she recalls. “We were so surprised! This would never happen in Iceland!”

The owner called the police, who reviewed footage from a CCTV camera at a nearby hardware store. It clearly showed the used blue van Karlsson had bought. The police ran the plates and arrested Stefansson and Karlsson. In their gentle Icelandic style, they placed the suspects in dormitory-style cells in their hometowns, then brought them in for questioning. “We never call it interrogation,” an officer tells me.

Later, I am given a tour of the “conversation room” where Karlsson was questioned. It’s furnished with a comfy couch, a fluffy blanket, and a box of Kleenex in case of a tearful confession. The walls are covered with images of the Northern Lights and the buds of Icelandic flowers poking up through the snowy tundra. “It’s a calm space,” Detective Helgi Petur Ottensen assures me.

Ottensen was impressed with how nice the suspects seemed. Viktor Jonasson was “polite.” Karlsson was “very clean, calm.” The electrician who tipped off Stefansson about the Bitcoin mine was “just a pawn. He had no idea his information would lead to a burglary, and they used him.”

Questioned by police, Stefansson and Karlsson insisted that they had absolutely nothing to do with the burglary. And so, after three days of “conversation,” they were free to leave—told, in essence, have a nice day. “We didn’t have anything else on them,” the detective says, “so they were released.”

But the Bitcoin thieves were far from finished. While being detained in the Borgarnes investigation, Karlsson lost his job as a day care worker. Deep in debt, and with a child on the way, he blamed Stefansson. So Stefansson came up with a solution: He would find a role in another burglary for Karlsson, which would “help him out of this shit.” In fact, they would stage their biggest heist yet. “It was exciting and fun, and we wanted to do another one,” Stefansson recalls. “Just one more, to get a bigger mining facility.”

THE FUGITIVES
The Sogn prison, where Stefansson escaped. He was captured after he and his accomplices posted a photo on Instagram (left).

Large photograph by Andrew Testa/The New York Times/Redux.

On the day after Christmas, cell phone records show, the gang drove together to the former naval base at Asbru to try their luck at hitting the Borealis Data Center a second time. This time they tried to climb through a window. The alarm sounded, and they fled.

But the gang was learning as they went. The electrician in the Borgarnes burglary had worked so well, they decided to seek an insider at another data center—someone who could be persuaded to give them all of the mine’s security details.

One night in late 2017, a man named Ivar Gylfason received a strange phone call. “Are you a security guard at the Advania data center?” the caller demanded.

“Yes,” Gylfason replied. The caller abruptly hung up.

Not long after, Gylfason was contacted by a relative of his ex-girlfriend. The relative, it turned out, owed money to Stefansson’s friend, Haffi the Pink. The gang had presented him with a plan for repayment: Get Ivar to spill security details about the Advania mine and the interest on your debt will be forgiven.

The relative offered Gylfason cash in exchange for information about the mine. When Gylfason declined, he was escorted into a dark Mazda outside his house. He recognized one of the men in the car—Sindri Stefansson—who sat alongside a man wearing a hoodie, and another who spoke in a gruff Eastern European accent.

“Give us the info—or else,” the men demanded. If he did not comply, they told him, he would be hurt.

Over the course of two or three moonlit meetings, Gylfason told the gang everything he knew about the Advania data center: the location of the security cameras, the specifics of the anti-theft systems, how security shifts were organized. He also provided the thieves with guard uniforms and the alarm code.

On January 16, 2018, the job commenced. Stefansson had been tracking the routine of the security guard who would be on duty that night. “I was watching his movements,” he says. “I knew where he lived.” The night of the burglary, Stefansson planned to set off an alarm at a nearby data center to divert the guard. But before he could make a move, the gang got a lucky break: The guard suddenly raced home, diverted by diarrhea, and never returned.

Then came another gift: The motion detectors at the data center weren’t even connected to the alarm system.

“Great, this is perfect,” Haffi the Pink texted.

“We love this,” Stefansson added.

“Best in the fucking world!” Haffi texted back.

With scarves covering their faces, Karlsson and his brother drove up and started loading the computers into their car. Then they were gone, along with 225 Bitcoin computers: enough to open their own mine and embark on a new life in Iceland’s new economy.

“Please allow me to introduce myself, I’m a man of wealth and taste.”

Ólafur Helgi Kjartansson was sitting in his office in Reykjavík, belting out “Sympathy for the Devil.” In his spare time, Kjartansson follows the Rolling Stones to concerts around the world; he considers himself the band’s number one fan in Iceland. But for now, Mick and Keith would have to wait: As one of the country’s most illustrious police chiefs, Kjartansson was in charge of cracking the case of the Big Bitcoin Heist.

At first, police had little to go on. “We couldn’t follow the money,” Kjartansson says. The computers were gone, and there was no way to trace if they were being used to mine cryptocurrency. So he and his team turned to more old-fashioned forms of technology: Using telephone data, rental car records, bank accounts, and wiretaps, they were able to connect the gang with Ivar Gylfason, the security guard they had blackmailed.

Only two weeks after the heist, the arrests began. Gylfason, apprehended at his home, confessed to his role. He told police about Stefansson and the “two other guys” who threatened him. That same day, police arrested Karlsson and his brother. They also descended on Stefansson, who had sold his home and was preparing to move to Spain with his wife and kids. He was arrested in front of his in-laws’ house in Reykjavík, where police found his possessions loaded on a pallet in preparation for his getaway. In a pocket of his jeans they found a crudely drawn map of the Advania data center. They also seized his iPhone, which was shipped to Holland to be unlocked. Rental car forms showed he had rented the second car used in the Advania theft.

This time, with the future of the cryptocurrency industry at stake, police dispensed with the “conversation room.” Gone were the cozy couch and the comfy blanket. Stefansson was thrown in solitary for a month and grilled repeatedly by police, who pressured him to reveal the location of the stolen computers. “They were rough!” Stefansson says. “They were punishing me for not giving up the computers.”

Officers from every police district in Iceland combed the island, searching for the computers. They fanned out in squad cars, boats, and helicopters. They followed leads as far away as China. They raided a Bitcoin mine owned by a Russian couple they suspected of being the thieves. And they descended on buildings where electricity usage spiked to Bitcoin levels. Unfortunately, such power surges are also common in Iceland’s other prevalent industry: pot farming. “The police broke down a lot of doors looking for the computers,” says Stefansson.

Stefansson denied any involvement in the heists. But he had made a critical error. While he had instructed his crew to delete everything from their phones, he hadn’t deleted his own messages. His iPhone, unlocked by police, contained a road map of the crimes. “All the proofs lay on the table,” the chief says.

The case might have ended there, an obscure series of crimes in a cold and remote country. But Stefansson’s next step made headlines worldwide: He used a loophole in the law to escape from prison.

In Iceland, it is not a crime to stage a prison break: The law recognizes that inmates, like all human beings, are naturally entitled to freedom, and thus cannot be punished for seeking it. After his arrest, Stefansson was held for three months as a “resident” in an “open” prison in Sogn, where inmates are housed in private rooms with flat-screen TVs and cell phone privileges. On April 16, 2018, a hearing was held to consider a request by prosecutors to extend Stefansson’s detention for another 10 days prior to trial. “The judge made the decision to think the matter over” until the following morning, Stefansson later observed. But “the judge did not extend the custody temporarily.”

The prison staff advised Stefansson that, technically, he was a free man: The order had expired at 4 p.m. and would not be extended until the next day. He signed a declaration saying he “would spend the night in a prison cell while I waited for the judge to rule on the extension of my custody.” Then he climbed out of the window in his room, hitchhiked 65 miles to the airport, and took a flight to Stockholm in the name of “an old friend.” Since Sweden does not require Icelandic travelers to have passports, Stefansson says he “didn’t have to show any IDs, talk to any staff, nothing.”

By chance, Stefansson was on the same flight as Katrin Jakobsdottir, the prime minister of Iceland, who was sitting a few rows in front of him. (“We did not chat,” Stefansson later said. “I kept my head down as much as I could.”) By the time the alarm was sounded back at the prison, Stefansson was approaching Sweden.

The police, assisted by Interpol, mobilized in an international manhunt. But Stefansson managed to stay one step ahead. From Sweden, he traveled to Denmark, then to Germany by train, and finally to Amsterdam by car. While on the lam he wrote a letter that was published in Frettabladid, detailing what he claimed were human rights violations by the police. (His attorney refers to his interrogation as “torture.”) Residents of Iceland began cheering the Bitcoin bandits, who were well on their way to becoming folk heroes. “I am proud of him for standing up for his rights and protesting that he was illegally held in jail,” says Stefansson’s accomplice, Viktor “the Cutie” Jonasson.

Then, once again, Stefansson screwed up. In Amsterdam, he met up with Viktor the Cutie and Haffi the Pink. The trio brazenly posed for a picture in front of the De Bijenkorf department store wearing triumphant smiles and sunglasses. Haffi posted the image on Instagram and tagged it #teamsindri.

Two hours later, Stefansson was arrested by the Amsterdam police. He spent the next 19 days in a Dutch prison before being extradited to Iceland to stand trial.

On December 5, 2018, to protect their privacy, the suspects entered the courtroom the same way they had entered the Bitcoin mines, their faces covered—in Haffi’s case, by a Louis Vuitton scarf. Only Stefansson chose to show his face to the cameras. After confessing to two of the burglaries, he received the stiffest sentence: four and a half years in prison. Matthias Karlsson confessed to the Advania heist and was sentenced to two and a half years; his brother, Petur the Polish, received 18 months. Haffi the Pink, Viktor the Cutie, and the security guard, Ivar Gylfason, got sentences ranging from 15 to 20 months. The burglars also had to repay the police $116,332 for the legal costs of the investigation. Everyone except Gylfason is appealing their convictions, and all remain free until their appeals are resolved.

And the mysterious Mr. X that Stefansson continues to blame for the crimes? “Many Icelanders believe in elves and trolls,” says Kjartansson, the police chief. “I am not one of them.”

If Mr. X does exist, he remains at large, as do the 550 stolen Bitcoin computers. It’s possible that the machines are blinking away in a warehouse somewhere at this very moment, mining Bitcoin for the young men who stole them. According to prosecutors, Stefansson had leased a former fish-processing factory in northern Iceland. Was it to house the stolen computers and launch his Bitcoin mine?

“Maybe the computers have been running the whole time,” Stefansson tells me. “Maybe I know where they are. Maybe I do, and maybe I don’t.”

“If you were Mr. X,” I ask him, “how would you grade the Big Bitcoin Heist?”

“A masterpiece,” he says. Then he catches himself. “I just wish I had done it.”