A longtime Miami Beach employee is accused of turning from trusted tech guy to suspected crypto thief after nearly $1.9 million in Bitcoin allegedly vanished from his former employer’s hardware wallet. Investigators say the missing coins were shuffled through a maze of wallets, exchanges and bank accounts in what they describe as a calculated effort to hide where the money came from and where it ended up. The suspect is currently being held at a county detention center while detectives keep digging into the case.
Arrest report lays out alleged scheme
According to an arrest report, the victim first spotted unauthorized outbound Bitcoin transactions from a Trezor hardware wallet in 2020, when Bitcoin was trading near $115,363 per coin, resulting in an estimated loss of roughly $1.9 million. Investigators identified the suspected former employee as Nahum Reynaldo Castro, an information-technology specialist the victim had trusted since 2013. The report states Castro was one of only two people known to have the wallet’s seed phrase.
Detectives said the victim and witnesses provided consistent transaction data during interviews and that the transfers were structured to hide the “nature, source, ownership and control” of the proceeds. Jail records show Castro was taken into custody on May 25 and faces charges including money laundering, unlawful use of a communications device, offenses against computer users and first-degree grand theft; bond is listed as “to be set,” according to WPLG Local 10.
Why a seed phrase hands thieves access
A hardware wallet’s recovery or “seed” phrase is the backup that restores access to funds. Anyone holding those words can recreate the wallet and spend its coins without the physical device, Trezor explains. Once that phrase leaks, the clock starts ticking.
Security incidents have shown how quickly exposed seeds can be abused. In February, officials said roughly $4.8 million disappeared after a government agency inadvertently exposed a seized wallet’s mnemonic, according to reporting by BleepingComputer. On a broader scale, Chainalysis’ recent analysis shows crypto theft and on-chain laundering have surged, with illicit addresses receiving at least $154 billion in 2025, underscoring how fast stolen coins can be moved and mixed across platforms (Chainalysis).
Exchange records and bank trail
Investigators say records from the Bitstamp exchange included copies of Castro’s driver’s license and a selfie-style verification video, tying him to accounts that allegedly interacted with the stolen funds. According to detectives, linked JPMorgan Chase deposits originated from Bitstamp accounts connected to those cryptocurrency transactions.
They allege those deposits, along with intermediary wallet transfers, were part of a broader laundering pattern intended to frustrate efforts to trace and recover the Bitcoin, according to WPLG Local 10.
What’s next for the case
Castro remains in custody at the Turner Guilford Knight Correctional Center; bond was listed as “to be set” and no court date had been posted publicly at the time of the report. The Miami-Dade Corrections and Rehabilitation Department notes TGK is the county’s primary intake and booking center for arrests in the area, where inmates are processed while cases move through the court system (Miami-Dade Corrections and Rehabilitation Department).
Detectives told investigators the victim provided transaction logs and witness statements that formed the basis of the pending criminal investigation. Prosecutors will decide whether to file formal charges beyond the current booking information as the case proceeds.
