It started with what looked like an ordinary DocuSign request, seemingly sent by the boss, about a deal no one else was supposed to know about. Federal prosecutors said that first step, followed by AI-generated voices and faces of real executives and real lawyers, let three men take at least $129 million from hospitals, banks and other businesses.
The three foreign nationals are charged in an indictment unsealed Thursday in the Southern District of New York. According to prosecutors, the scheme went after thousands of companies around the world, and staff were fooled into wiring money for confidential deals that never existed.
How the fake deal worked
Most targets worked in accounting and had the authority to sign off on a large wire transfer. The indictment says first contact often arrived through an electronic signature service such as DocuSign, in an email that appeared to come from the employee’s chief executive and asked for help with a secret financial transaction.
An employee at an unnamed major New York investment bank received one message that read, “We need to loop you into a deal we’ve been working on. The companies involved require you to sign an NDA,” then “see attached.” Once the nondisclosure agreement was out of the way, the employee was told to reach out to a lawyer and arrange a compliance call.
The AI was used at this stage. Prosecutors allege the conspirators used it on later phone or video calls to copy the executive’s voice and, in some cases, their appearance. The fake executive would then pass the employee to a fake attorney, who often took on the identity of a real lawyer in the European office of one of the world’s 50 largest law firms.
This “lawyer” laid out a confidential transaction, often an acquisition, and gave instructions on where to send the funds. That account belonged to the conspirators, prosecutors said. After the money arrived, it was turned into crypto and split among the participants.
A handwritten script and a boast
According to the indictment, Jacob Soall, 41, of Marbella, Spain, and the United Kingdom, mostly posed as U.K. attorneys and kept a handwritten “Lawyer Call” script. The script brought up confidentiality and insider-trading concerns so employees wouldn’t discuss the supposed deal with co-workers.
Sharon Hazan, 54, of Israel, and Guy Sheetrit, 42, of Israel and the United Arab Emirates, are the other two defendants. Prosecutors said the pair took care of the money laundering.
Hazan allegedly bragged that he had been laundering money since 1994, had laundered more than $400 million in just the previous three years and was “number one all over the world” among professional money launderers. He was convicted of conspiracy to commit bank fraud in 2008 in the same Southern District of New York, according to prosecutors.
Bragging of this sort has caught people out before. In March, John Daghita, the son of an executive at a contractor that stored seized crypto for the U.S. Marshals Service, was arrested on allegations that he stole more than $46 million from those holdings. Blockchain investigator ZachXBT connected Daghita to the theft after a Telegram account linked to him displayed control of a wallet tied to the stolen funds while arguing with another user about who held more crypto.
Who lost money, and who didn’t
The victims aren’t named in the charging documents, but the alleged losses span several industries. A Missouri hospital system lost about $4.83 million in November 2024, prosecutors said, and a Rhode Island bank lost about $2.68 million that same month. In December 2024, a California hospital system allegedly lost roughly $2.97 million.
A U.K. financial technology company accounts for the largest single loss on the list, about $11.58 million in March 2025. The indictment also lists approximately $4.64 million taken from a Massachusetts mutual fund company in April 2025 and about $5.24 million from a Florida pet food company in June 2025.
The New York investment bank escaped. In the October 2024 attempt, its employee approved the roughly $2.85 million payment, but prosecutors said the bank’s back office halted the wire before it was sent.
According to the indictment, the conspiracy ran from at least about July 2024 to at least about February of this year.
Seven counts each
All three defendants face the same seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The wire fraud and money laundering charges carry a maximum of 20 years each, and each aggravated identity theft count carries two years. If the men are convicted, a judge would determine any sentence.
Spanish authorities arrested Soall on June 17 and Hazan on Aug. 5. Sheetrit was arrested in the United Kingdom on Sept. 7. Extradition requests are still pending, and all three are presumed innocent unless and until proven guilty.
“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities,” FBI Assistant Director in Charge James C. Barnacle, Jr., said in a statement.
In the announcement, U.S. Attorney Jamie McDonald used “super intelligence” (SI), the term President Trump prefers, although the indictment itself says “artificial intelligence.”
“SI technology offers tremendous potential. But the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” McDonald said.
Crypto has seen this playbook for years
Crypto has dealt with fake executives and fake recruiters for a long time, with phony job interviews used to infect computers, steal funds or break into company systems. The roughly $625 million Ronin network hack in 2022, which the FBI attributed to North Korea, reportedly started when a developer was contacted on LinkedIn and, after several rounds of interviews, sent a job offer laced with malware.
Google-owned cybersecurity firm Mandiant has documented a scam in which attackers hijacked a crypto executive’s Telegram account and arranged a meeting on a counterfeit Zoom interface. Staged audio problems gave them a reason to have the target run troubleshooting commands, which installed malware. Crypto security group the Security Alliance has described similar campaigns in which hijacked accounts are used against their owners’ contacts through fake Zoom or Microsoft Teams pages.
In a January X post, Braiins Chief Marketing Officer Kristian Csepcsar described the same method. “More than 10 of my bitcoin friends got hacked in the past month. All had 2FA enabled. It didn’t help,” Csepcsar said. He said the attack begins when “Someone from your contacts messages you to schedule a call. This is already a stolen account.”
Patrick Hillmann, who was Binance’s chief communications officer in 2022, said that year that scammers had used a deepfake of him in video meetings with crypto project teams about potential token listings.
Binance now says a fake hiring process was at the center of the attack that drained approximately $6.3 billion from the exchange last week. Its initial incident report, released Tuesday, said a person posing as a project director approached an engineer in September through a legitimate job-hunting platform. A fake human resources representative then conducted a video interview and shared social media photos and videos to win the engineer’s trust.
Next, a second interviewer who claimed to be chief executive of a fictitious company told the engineer to download an assignment with malicious code onto his work computer. According to Binance, the attackers used that machine and an internal AI tool to get into other engineers’ systems before reaching wallet-signing operations. The exchange described it as a multistage campaign, not a single phishing incident.