The 23-year-old Powell was living alone on the North Shore despite having no legitimate income, according to federal court records obtained by the Tribune. He had a $150,000 BMW in the garage but rarely went out. One day, a letter carrier found six grand in cash in Powell’s mailbox. Powell allegedly told police it was how he paid his rent.

Federal investigators suspected Powell, originally from Elkhart, Indiana, was the leader of an elaborate cyber scheme that bilked PayPal users of more than a million dollars nationwide, according to an FBI search warrant affidavit filed in 2021.

Powell was also believed to be involved with a violent Indiana-based gang known as the “ChoppaBoyz,” whose founding members were under indictment in a drug-related home invasion in South Bend and also were accused of robbing two of Powell’s associates in Utah as they carried a quarter of a million dollars in fraud proceeds back to Indiana, the affidavit stated.

But the only charge that ever surfaced against Powell was a misdemeanor gun count filed in Lake County.

Until now.

Three years after the March 2021 raid, Powell, now 26, has been accused of helping pull off a much larger heist, one that seems ripped from the pages of some cyber-security pulp thriller: The $400 million hack of FTX, the failed crypto currency exchange headed by convicted fraudster Sam Bankman-Fried.

As the Tribune first reported, Powell was arrested at his home on Museum Drive last month on a federal indictment filed in Washington, D.C., charged with participating in a sophisticated “SIM swap” scheme with two out-of-state associates that allegedly siphoned at least $400 million in virtual currency from a single company and millions more from other individual victims.

While the indictment referred to the company only as “Victim Company 1,” the alleged hack occurred Nov. 11, 2022, the same day that FTX collapsed into bankruptcy. Bankman-Fried was later convicted of a massive fraud on investors and is awaiting sentencing next March in New York. Sources have confirmed to the Tribune that Victim Company 1 is FTX.

At the time, speculation was rampant that the hack was an inside job, but the details of how it went down had remained a whodunit.

While Powell has now been outed as one of the alleged FTX hackers, the investigative records obtained by the Tribune only deepen the mystery of how he could have pulled off the massive theft from such a high-profile target while he was already on the FBI’s radar.

In fact, the 2021 affidavit indicated the feds were aware at the time that Powell was moving on from PayPal to more sophisticated SIM swap schemes, which use stolen identities to get cellphone carriers to switch over a number to a new device, allowing the hacker to loot a victim’s virtual accounts.

On Nov. 11, the day of the bankruptcy filing, Powell allegedly directed co-conspirators to execute a SIM swap against an employee of FTX, the indictment alleged.

A co-schemer sent associate Emily Hernandez, of Colorado Springs, Colorado, a fraudulent identification document that had the victim’s personal information but Hernandez’s photo, according to the indictment. Hernandez then used the phony ID at a mobile phone service store in Texas, where she convinced them to port over the victim’s information to a new device.

Within hours, the co-conspirators had drained more than $400 million worth of virtual currency from FTX accounts, according to the indictment.