Riot Games’ Millionaire Founder Defrauded In $5 Million Amazon Cloud Cryptocurrency Mining Scam, DOJ Says

Marc Merrill BAFTA Honours Riot Games with Special Award
Vivien Killilea/Getty Images for BAFTA Los Angeles

Marc Merrill, the cofounder of Riot Games, was the victim of a massive fraud that started in November 2014, when his American Express credit card information was used to buy up cloud computing power from Amazon, Google and others, according to a just-unsealed court filing discovered by Forbes.

The man accused of stealing Merrill's identity, Singaporean national Matthew Ho, was said by investigators to have used Amazon and Google servers to mine various cryptocurrencies, including Bitcoin and Ether. Before it was eventually noticed in January 2018, Ho had racked up bills totalling $5 million with Jeff Bezos’ tech giant, according to the government’s allegations. At least one payment of that bill, for $135,000, was made on Merrill’s Amex card in December 2017. (Court documents didn’t clarify whether the full $5 million bill had been paid, though the DOJ did say “some” were). The same card had been used to pay for Riot Games’ actual Amazon Web Services cloud computing products.

Thought the charges against Ho were revealed by the Department of Justice in October, the victim (Merrill) had not previously been revealed. Riot Games declined to comment as there was an ongoing investigation. It’s unclear how his personal information and credit card data were pilfered.

Ho tricked Amazon into believing he was Merrill, the co-creator of the massively popular, $20 billion-making League of Legends title, in various ways, as per a search warrant for the accused’s Facebook account. He’d created a fake Californian driving license that carried Merrill’s name and used an email address that appeared to be a legitimate Gmail for the Riot Games co-chairman, according to the court filing. For further “proof” of identity, he presented Amazon with one of Merrill’s real home addresses, the feds said.

Because Merrill was an established Amazon customer, Ho was given “access to substantially elevated levels of cloud computer services,” investigators wrote, though they didn’t disclose exactly what those priveleges were.

Ho used the same Gmail address to contact Google and sign up to its cloud services, which he would again use for mining cryptocurrency, according to the search warrant. A total of 16 separate payments were made by the fraudster to Google on Merrill’s Amex card, which he shared with his wife, authorities said, charging a total of $240,000. But “nearly all” of that was returned to the account or declined by the issuing bank.

Neither Amazon nor Google had responded to a request for comment at the time of publication.

Once he’d mined cryptocurrency, Ho sold it on localbitcoins.net. But eventually, thanks to data like IP addresses and login information provided by Amazon, Google, Facebook and others, police were able to pin down Ho as the chief suspect. He was arrested by Singapore Police Force on September 26 and is being investigated for various alleged offenses committed under Singapore law. A 14-count indictment was unsealed in the U.S. last month, which detailed other victims, including an unnamed Texas resident and an Indian tech company founder. But the defendant does not yet have counsel in the U.S. It’s possible he could be forced to face charges in the U.S., as America has an extradition treaty with Singapore.

He remains innocent until proven guilty.

">

Marc Merrill, the cofounder of Riot Games, was the victim of a massive fraud that started in November 2014, when his American Express credit card information was used to buy up cloud computing power from Amazon, Google and others, according to a just-unsealed court filing discovered by Forbes.

The man accused of stealing Merrill's identity, Singaporean national Matthew Ho, was said by investigators to have used Amazon and Google servers to mine various cryptocurrencies, including Bitcoin and Ether. Before it was eventually noticed in January 2018, Ho had racked up bills totalling $5 million with Jeff Bezos’ tech giant, according to the government’s allegations. At least one payment of that bill, for $135,000, was made on Merrill’s Amex card in December 2017. (Court documents didn’t clarify whether the full $5 million bill had been paid, though the DOJ did say “some” were). The same card had been used to pay for Riot Games’ actual Amazon Web Services cloud computing products.

Thought the charges against Ho were revealed by the Department of Justice in October, the victim (Merrill) had not previously been revealed. Riot Games declined to comment as there was an ongoing investigation. It’s unclear how his personal information and credit card data were pilfered.

Ho tricked Amazon into believing he was Merrill, the co-creator of the massively popular, $20 billion-making League of Legends title, in various ways, as per a search warrant for the accused’s Facebook account. He’d created a fake Californian driving license that carried Merrill’s name and used an email address that appeared to be a legitimate Gmail for the Riot Games co-chairman, according to the court filing. For further “proof” of identity, he presented Amazon with one of Merrill’s real home addresses, the feds said.

Because Merrill was an established Amazon customer, Ho was given “access to substantially elevated levels of cloud computer services,” investigators wrote, though they didn’t disclose exactly what those priveleges were.

Ho used the same Gmail address to contact Google and sign up to its cloud services, which he would again use for mining cryptocurrency, according to the search warrant. A total of 16 separate payments were made by the fraudster to Google on Merrill’s Amex card, which he shared with his wife, authorities said, charging a total of $240,000. But “nearly all” of that was returned to the account or declined by the issuing bank.

Neither Amazon nor Google had responded to a request for comment at the time of publication.

Once he’d mined cryptocurrency, Ho sold it on localbitcoins.net. But eventually, thanks to data like IP addresses and login information provided by Amazon, Google, Facebook and others, police were able to pin down Ho as the chief suspect. He was arrested by Singapore Police Force on September 26 and is being investigated for various alleged offenses committed under Singapore law. A 14-count indictment was unsealed in the U.S. last month, which detailed other victims, including an unnamed Texas resident and an Indian tech company founder. But the defendant does not yet have counsel in the U.S. It’s possible he could be forced to face charges in the U.S., as America has an extradition treaty with Singapore.

He remains innocent until proven guilty.

Follow me on Twitter. Check out my website. Send me a secure tip.

I'm associate editor for Forbes, covering security, surveillance and privacy. I’ve been breaking news and writing features on these topics for major publications since

...