FBI Traced IntelBroker to UK Citizen Using Email, Crypto Wallet, and YouTube Clues

The shadowy figure behind the “IntelBroker” moniker, responsible for a string of high-profile data breaches causing over $25 million in damages, has been unmasked as 25-year-old British national Kai West. His arrest in France in February, and ongoing extradition proceedings to the United States, mark a significant victory for law enforcement, achieved through meticulous digital detective work that leveraged clues from email, cryptocurrency transactions, and even YouTube viewing habits.

For years, IntelBroker operated with apparent impunity, breaching systems of major corporations like Nokia, HPE, and AMD, as well as sensitive targets including a health insurance marketplace for U.S. lawmakers. Stolen data, ranging from customer lists to patient health records, was then offered for sale or freely distributed on notorious cybercrime forums like BreachForums, where IntelBroker had risen to a position of prominence, even serving as an administrator.

However, the FBI’s investigation, detailed in newly unsealed court documents, reveals the operational security lapses that ultimately led to West’s identification. A pivotal moment came when undercover agents purchased stolen data from IntelBroker using Bitcoin. The transaction was meticulously traced to a cryptocurrency exchange account registered under West’s real name, linked by his UK driver’s license.

Further investigation revealed that this same personal email address, used for the crypto account, was also tied to other online activities. Crucially, the FBI discovered that West used this email to repeatedly watch YouTube videos. These videos included not only general content but also news clips and discussions specifically about IntelBroker’s own exploits and victims – some of which West then proceeded to share on BreachForums. This seemingly minor detail provided a direct, irrefutable link between the real-world individual and the online persona.

The FBI also established connections through shared IP addresses used for both West’s personal accounts and IntelBroker’s profiles. While West often boasted of his anonymity and even attempted to mislead investigators by claiming to be in Eastern Europe, these digital breadcrumbs painted a clear picture.

West faces multiple charges in the Southern District of New York, including conspiracy to commit computer intrusions and wire fraud, with potential sentences of up to 20 years in prison. His arrest, alongside other suspected BreachForums administrators, highlights the increasing effectiveness of international cooperation in dismantling sophisticated cybercrime operations and underscores that even seemingly anonymous online activities can leave a traceable trail.