Overview of Darknet Diaries: 181: Ricky
This episode follows Ricky Henshoemaker, a talented athlete and gamer from Florida who drifted from harmless competitive cheating in Halo 3 into a lucrative criminal career built on social engineering, account takeovers, SIM swapping, and crypto theft. What starts as frustration over losing video games evolves into stealing Xbox gamertags, Instagram handles, email accounts, and eventually cryptocurrency wallets—bringing in millions while he lived a seemingly normal life with his mom, girlfriend, and day job. The episode also includes the perspective of one of his victims, Mark, whose SIM-swap attack led to a major crypto loss and long-lasting paranoia.
How Ricky Got Started
From sports kid to gamer
- Ricky was a competitive, athletic kid who played baseball, football, and basketball.
- He also loved gaming, especially Halo 3 on Xbox Live.
- He discovered that cheaters could knock opponents offline with DDoS attacks, and instead of just being frustrated, he decided to learn how it worked.
First exposure to cybercrime
- Ricky started browsing forums and learning about booter services and DDoS tools.
- He used those tools against other players to gain unfair wins.
- That experience shifted his mindset from “playing the game” to “breaking the rules.”
From Gamertags to Instagram Handles
Stealing Xbox accounts
- Ricky learned how to socially engineer support agents into revealing account details.
- His method often involved:
- calling one support line to get a reference number,
- calling another line with that number,
- using weak recovery questions and easily discoverable personal data to reset passwords.
- He stole his first major gamertag, Wolverine, and began selling stolen names for Bitcoin.
Scaling up to Instagram
- He realized Instagram handles could be worth far more than Xbox gamertags.
- He exploited weak account recovery flows and parent-linked AOL accounts to take over valuable usernames.
- Instead of deleting accounts, he would rename the stolen account and swap in a fresh account to claim the handle.
- Some verified handles sold for thousands of dollars; one account reportedly sold for $8,000.
The SIM Swap Playbook
Why SIM swapping mattered
- When password resets stopped working, Ricky moved to SIM swapping.
- By convincing carriers to transfer a victim’s phone number to his device, he could intercept verification texts and reset passwords.
How he did it
- He used a mix of:
- support-line deception,
- insider help at carrier stores,
- people-search databases,
- and knowledge of weak identity verification.
- Often he only needed fragments of information:
- last digits of a phone number,
- partial personal details,
- or a Social Security number he could buy cheaply from data broker sites.
The deeper attack chain
- SIM swap the number.
- Use the number to reset email.
- Search the inbox for crypto exchange accounts or wallet clues.
- Reset exchange passwords or recover private keys/seed phrases.
- Drain the funds into fresh wallets controlled by his crew.
The Crypto Heists
Finding victims
- Ricky and his crew targeted people who were public about owning crypto.
- He says the easiest targets were people who:
- posted about coins online,
- spoke publicly about investing,
- or stored sensitive wallet data in email/photos.
Looting wallets
- Once inside an inbox or cloud account, they searched for:
- exchange confirmations,
- wallet backup phrases,
- private keys,
- screenshots of sensitive info.
- They also checked if victims had accounts on exchanges like Coinbase and used recovery systems to seize them.
Money and laundering
- The thefts brought in serious money—sometimes thousands, sometimes millions.
- Ricky used local Bitcoin cash-out contacts and cash-in-the-mail arrangements to launder the proceeds.
- He described living a double life:
- normal county job,
- girlfriend and child at home,
- expensive toys and vehicles bought with stolen crypto.
The Victim’s Perspective: Mark’s SIM Swap
What happened to Mark
- Mark, a crypto holder and founder of a mobile-security business, lost phone service while driving through the Arizona desert.
- Within minutes, multiple password-reset alerts started arriving.
- By the time he got service back, attackers had already:
- accessed his email,
- reset accounts,
- and stolen his crypto.
The damage
- He lost 2.2 Bitcoin and spent months sleeping poorly, checking his phone repeatedly, and fearing another takeover.
- He traced the attack back to an insider at a third-party carrier store who ignored his account protections.
- The episode highlights how vulnerable even careful users can be when carrier processes are weak.
Arrest and Consequences
The crackdown
- Ricky’s circle started unraveling as other SIM swappers got arrested.
- After one associate’s arrest, police arrived at Ricky’s home.
- He was detained, then later charged with:
- grand theft,
- money laundering,
- computer misconduct,
- and conspiracy to commit wire fraud.
Sentencing
- He pled guilty and received:
- 4 years in federal prison
- $7.6 million in restitution
- He served just over two years and was released in 2024.
Family impact
- His mother, Debbie, was devastated.
- She had believed he was just making money from crypto investments.
- The episode shows how a hidden criminal life can wreck an entire family, not just victims.
Key Takeaways
Social engineering beats technical defenses
- The episode’s core message is that most hacking is really about manipulating people and weak processes.
- Support agents, carrier stores, and recovery workflows are often the softest targets.
Small bits of data can be enough
- Last digits of a phone number, a ZIP code, or a weak security question can be enough to unlock much bigger compromises.
- Information brokers and public oversharing make attackers’ jobs easier.
Crypto makes theft fast and irreversible
- Once funds are moved, there’s often no rollback.
- That makes identity compromise especially dangerous for crypto holders.
Criminal success is short-lived
- Ricky made millions, but the end result was prison, restitution, broken trust, and missed time with his child.
- He says the biggest cost wasn’t money—it was the innocent lives affected.
Where Ricky Is Now
- Ricky says he wants to use his experience for good.
- He’s begun speaking at security events and anti-fraud discussions.
- He’s also trying to build a legitimate security/pentest business with fellow former SIM swapper Joseph Harris.
- The episode ends with the idea that people with strong offensive skills can sometimes be redirected into defensive work before they go too far down the wrong path.