How We Tracked ‘Woodberry’ Via iPhone, WhatsApp, Bitcoin Transactions – FBI Reveals

Olalekan Jacob Ponle, popularly known as Woodberry, was nabbed through details accessed from his WhatsApp, iPhone and Bitcoin transactions, court documents obtained by PREMIUM TIMES reveal.

Mr Ponle, alongside Ramoni Igbalode, also known as Hushpuppi, was arrested in the United Arab Emirate on June 10 for multiple fraud charges after a raid by operatives of the Dubai crime unit.

The duo were then extradited to the United States on July 2.

Mr Ponle, 29, is currently facing charges bordering on wire fraud conspiracy at a United States District Court sitting in Illinois.

The court had since June 25 issued an arrest warrant to the Federal Bureau of Investigation (FBI) regarding Mr Ponle’s case after a criminal complaint was filed.

His first appearance in court was on July 3, after which the preliminary hearing was set for July 16 before Judge Jeffrey T Gilbert.

However, as provided by a section of the U.S. laws on the release or detention of a defendant pending trial, Mr Ponle will be remanded in custody until a further order of the court.

If found guilty, he is liable to a jail term ranging from 20 to 30 years.

Page Pate, a U.S. law firm, stated on its website that penalties for wire fraud include a prison sentence of up to 20 years (30 years if the case involves federal disaster relief funds or a financial institution), restitution to any victims and a fine set by the judge.

How he was tracked

Ali Sadiq, a Special Agent with the Federal Bureau of Investigation (FBI), chronicled how the bureau tracked down through his online activities.

He said this in a criminal complaint document filed at the court and obtained by PREMIUM TIMES.

He stated that Mr Ponle, who often adopted a pseudonym Mark Kain, has defrauded several United States-based companies through Business Email Compromise (BEC) schemes.

This scheme compromises legitimate business email accounts through computer intrusion techniques or social engineering and uses those accounts to cause the unauthorised transfer of funds.

Techniques for perpetrating these schemes include phishing, spear phishing, identity theft, email spoofing, and the use of malware.

“Beginning no later than January 2019 and continuing until at least September 2019, OLALEKAN JACOB PONLE conspired with others to engage in BEC schemes to defraud several United States-based companies. These schemes resulted in attempted and actual losses to victim companies in the tens of millions of dollars,” the criminal complaint document read.

As part of the scheme, he reportedly directed ‘money mules’ in the United States to open bank accounts in the names of victimised companies.

According to Mr Sadiq, proceeds from BEC schemes, “ranging from hundreds of thousands of dollars to millions of dollars”, were then wired by unwitting employees to the bank accounts opened by Mr Ponle’s mules.

Mr Ponle then instructed the mules to convert the proceeds to bitcoin (virtual currency) and to send the proceeds of the BEC schemes to a bitcoin wallet that he owned and operated.

Bitcoin, a type of cryptocurrency, is generated and controlled through computer software operating on a decentralised peer-to-peer network.

Its transactions are recorded in the Bitcoin blockchain which makes it hard to trace because the identities of individuals are partially anonymous.

Massive scheme, more findings

In fact, one of those BEC schemes involved two Chicago-based companies. One was defrauded of $2.3 million and the other, sent wire transfers totaling $15.3 million.

Preliminary blockchain analysis done by the FBI indicated that the 29-year-old received at least 1,494.71506296 bitcoin related to these BEC schemes, valued at over $6 million dollars at the time he received the proceeds.

Finding also revealed that the money mules in the United States were approached by a person they knew as “Mark” or “Mark Kain.” Mark later directed them to open bank accounts in the names of these companies.

Those accounts received proceeds from the BEC schemes, and on Mark’s instructions, the money mules converted proceeds to bitcoin and sent proceeds to Mark.

According to Mr Sadiq, “Mark Kain” contacted Individual B using telephone number (323) 985-4088 (“the 4088 phone number”).

Mr Sadiq noted that these telephone details were records obtained from Dingtone, a messaging and voice call application.

He added that his review of the chat transcripts from online messaging applications like WhatsApp showed him how Mr Ponle and his mules transact.

“Mark instructed Individual B and Individual A to send money to the bitcoin wallet 16AtGJbaxL2kmzx4mW5ocpT2ysTWxmacWn (“the 16AtGJ BTC Wallet”) on at least nine occasions.

“Records obtained from Bitpay, a processor of cryptocurrency transactions, indicated that between approximately September 18, 2015 and November 29, 2016, the 16AtGJ BTC wallet made five purchases associated with the Gmail account hustleandbustle@gmail[.]com (the “hustle Gmail account”).

“Based on records obtained from Apple, an iCloud account (Subject Account 1) was subscribed to by Jacob Olalekan, listing the 7890 phone number, the hustle Gmail account, and a physical address in Johannesburg, South Africa.

“Based on my review of records from Apple, Subject Account 1 contained several identity documents and photographs of PONLE. These included a photo of a Nigerian passport with a photo of an individual named Olalekan Jacob Ponle, born in May 1991 in Lagos, Nigeria, a photo of a United Arab Emirates visa with a photo of an individual named Olalekan Jacob Ponle with the profession ‘marketing’,” the document read.

The FBI agent insisted Mr Ponle and his accomplices, gained access to emails and financial records of these companies to perpetrate fraud.

“Based on the above information, there is probable cause to believe that, beginning no late than January 2019 and continuing until at least September 2019, at Chicago, in the Northern District of Illinois, Eastern Division, and elsewhere, PONLE conspired to commit wire fraud, in violation of 18 U.S.C. § 1349,” Mr Sadiq said.

***

Source: PREMIUM TIMES