The FBI, Australian Federal Police (AFP), and Western Australia Police Force have dismantled an alleged international cybercrime operation known as TeamPCP, which authorities say laundered cryptocurrency proceeds from global software supply-chain attacks.
On Aug. 26, Australian prosecutors filed a combined 14 charges against 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler. The men appeared before Perth Magistrates Court on Aug. 27 after coordinated searches in Cottesloe, Hamilton Hill and Mandurah. Both are accused of embedding malicious code into trusted open-source software components. That code allegedly compromised more than 1,000 organizations, exposed over 500,000 user credentials, and extracted at least 300 gigabytes of data from downstream customers across government, academia and the private sector.
According to the AFP, the joint investigation began in April after cybersecurity companies supplied intelligence about malicious software distributed through an open-source repository. Investigators allege TeamPCP sold access to compromised networks through underground marketplaces, with buyers completing payments using cryptocurrency. The group is accused of moving proceeds through cryptocurrency mixers and multiple wallets to obscure transaction histories. However, blockchain records helped authorities trace payments across wallets, trading platforms and national jurisdictions.
Authorities have not disclosed the value of seized cryptocurrency or a confirmed laundering total. The official AFP release did not identify the cryptocurrencies involved, wallet addresses, transaction hashes, mixers or exchanges. It also stated that electronic devices and other items were seized, but did not assign a digital-asset value to those items. Reports claiming large crypto balances and expensive property were seized go beyond the official announcement.
Thomson also faces an Australian charge of dealing with money or property worth at least 100,000 Australian dollars that authorities allege represented criminal proceeds, an offence carrying a maximum 20-year prison sentence. In the United States, a federal grand jury indicted Thomson for conspiracy to violate the Computer Fraud and Abuse Act and obtaining information from a protected computer. U.S. prosecutors allege TeamPCP used stolen information to make ransom or extortion demands. Each U.S. offence carries a maximum five-year prison term and a fine of up to $250,000, or twice the alleged gross gain or victim loss. No corresponding U.S. indictment against Gaebler has been announced.
Officials estimate remediation costs for affected organizations could total hundreds of millions of dollars. Investigators are examining seized data and electronic devices, and have not ruled out further arrests or charges. The case produced no verified cryptocurrency market reaction and concerns the alleged use of digital assets for payments rather than a vulnerability in any blockchain or cryptocurrency protocol.
