Worked example · 2014-10

Moolah / Alex Green (Ryan Kennedy) Exchange Fraud — 2014-10

Loss

about 3,700 BTC reportedly stolen from MintPal, which Moolah's operator had bought; SYScoin separately said 750 BTC were taken from its escrow held at MintPal [sa15]. UK charges allege bitcoin worth over £1 million stolen during 2014 [cd17]. Other totals previously stated in this file ($4M+, $2.5M+) are unverified and removed.

OAK Techniques observed

OAK-T11.005.001 (Fake-CEX / Pig-Butchering Platform — the Moolah exchange and Moopay payment-processor presented as legitimate businesses while the operator diverted customer funds to personal accounts). OAK-T5.005 (Treasury Management Exit — the operator's control over exchange treasury enabled systematic diversion before the platform's public collapse). OAK-T6.001 (Source-Verification Mismatch — the operator operated under a fabricated identity "Alex Green"; the real identity "Ryan Kennedy" was uncovered by community investigation and later confirmed by UK law enforcement). OAK-T8.005 (Operational-Security Procedural Failure — the operator's identity-fabrication trail and prior-fraud history were discoverable through community OSINT investigation).

Attribution

confirmed identity — Ryan Kennedy, operating as "Alex Green", acknowledged that name was not his own and was arrested in the UK in February 2015 [sa15][cd17]. UK police charged him in June 2017 with fraud and money-laundering offences covering 2014 and he pleaded not guilty [cd17][cd17b]. No conviction on those fraud charges is found in the cited sources; his 11-year sentence was for unrelated rape convictions [cd17][cj].

Key teaching point

**Moolah is an early early-crypto-era exchange-fraud case with an identified-and-charged operator (fraud conviction unconfirmed). The operator's pseudonym ("Alex Green") was exposed by the operator's own admission and community investigation (the Mintpal Justice effort traced stolen coins being sold on LocalBitcoins [sa15]) — an early demonstration of the T8.005 attribution primitives that would later scale to professional blockchain-forensics firms. The case established that the pseudonymous-operator defence is penetrable through off-chain investigative work even in the pre-blockchain-forensics era.

Corrected 2026-10-11

Kennedy was arrested in 2015 and charged with fraud in 2017 (pleaded not guilty); the cited sources report no fraud conviction, only an unrelated rape conviction, and the unsourced loss totals, prior-fraud-conviction and Companies House/WHOIS details were removed.**