Numbers like #1056 open that message in the published chat. Chat times are UTC-8; in Sweden, where Nayiem lived, it was about 9 hours later. Apart from a few messages in 2025 and 2026, events before July 2019 and after October 2021 are outside the chat. For those, the source is given as a link, or the entry says it is Nayiem's own account.
This timeline mixes three kinds of source: messages in the chat, public records, and Nayiem's own memory. Each entry says which. Nayiem believes that "Mike" is Paul Vernon and that Mike took the Altilly funds. These are beliefs. No court or authority has confirmed either one. A "Michael O'Sullivan" appears in several records below. Nayiem believes it is an alias Mike used. That may also be a real, separate person whose name was used, and nothing here accuses such a person.
Before Altilly: Cryptsy and Paul Vernon (2013-2019)
2013-2015
Paul E. Vernon runs Cryptsy, a crypto exchange, through his company Project Investors Inc. The US Department of Justice later alleges that he took more than $1M from customer wallets between May 2013 and May 2015. It also alleges that he hid a 2014 breach and told staff a false "hack" story around 29 July 2014, and that he moved to China around November 2015. These are allegations from an indictment, not findings. (DOJ/IRS-CI release)
January-April 2016
Vernon discloses that Cryptsy lost a large amount of BTC in the 2014 breach. Customers file a class action (Leidel v. Project Investors Inc., S.D. Florida). In April 2016 the court appoints a receiver and freezes assets. The indictment later alleges that in April 2016 he remotely hacked Cryptsy's servers and destroyed its customer database. (SiliconANGLE)
27 July 2017 (key)
Judge Kenneth Marra enters an $8.2 million default judgment against Vernon in the Cryptsy class action, after he does not defend it. The order says more than 11,000 BTC are owed to customers. This is a civil court finding. (CoinDesk)
January 2018
Nayiem starts Qredit (XQR). (Nayiem's account.)
August 2018
A person called Mike offers Qredit a free listing on the Altilly exchange, and Nayiem accepts. Nayiem later helps Altilly with front-end design and marketing. As he remembers it, Mike suggested in late 2018 that Nayiem become Altilly's CEO and public face, with XQR as the exchange's own coin, while Mike ran development from the background. That conversation was private and is not in the chat. (Nayiem's account.)
18 December 2018
The Altilly coin announcement on Bitcointalk names "Michael Osullivan" as the developer. (Bitcointalk)
15 August 2019 (key)
A sealed 17-count federal indictment against Vernon is filed in Florida (case 1:19-cr-20509): wire fraud, money laundering, computer fraud, destruction of records and tax evasion. On 16 September 2019 the court places him in fugitive status. He has not been convicted, and no filing in the case mentions Altilly or Xeggex. (CourtListener docket)
Running Altilly (2019-2020)
8 July 2019 (key)
Chuck creates the management group. Its first members are Chuck, Nayiem and an account now shown as "Deleted Account" #2 #4. Chuck says Mike "should be back tomorrow sometime" #10 #16. In the export, Mike appears as "Deleted Account".
12 July-25 August 2019
Listing fees and competition fees are charged in XQR #183 #583.
15 July 2019
Asked about outside audits, Mike writes "we are too small to worry about audits yet" and "too small to even start moving to safe storage" #215 #216. Nobody insists otherwise.
4-5 September 2019
Nayiem plans to remove some mentions of Hodler Enterprises from the site. Chuck wants to keep a line saying Altilly is a Hodler Enterprises company "for trust reasons" #702 #705. Nayiem says Altilly operates out of Sweden but is "still incorporated in Hongkong, until I have the things sorted here" #759. In December 2020 Mike says the Hong Kong company was never formed #1776 #1778.
15 September 2019
Nayiem flags 38 pending withdrawals to Mike, who runs the servers #790.
2020
A quiet year in the chat. Chuck relays that another exchange, Crex, was hacked #884.
11 December 2020 (key)
Nayiem incorporates Qredit Ltd (company 13077371) in the UK, at a London formation-agent address. The register lists him as sole director and as the only person with significant control, holding 75% or more of the shares. Mike does not appear on it, and he appears on no other company register found for this site. This is 12 days before the incident starts, and before any formal acquisition of Altilly. (Companies House)
Nayiem says the plan was that he would be CEO and take ownership of the whole project once he had set up the company. No message in the chat records a transfer of ownership, and the chat never mentions Qredit Ltd; it also has no messages between 2 and 18 December 2020 #998 #999. (Nayiem's account.) Willems Ventures Ltd was incorporated the same day. Nayiem says it was the company for his tourist resort, Voyager Park, not for Altilly #1579 #1583.
The incident (23-26 December 2020)
23 December 2020 (key)
Users start reporting failed withdrawals and zero balances. (Nayiem's account; the calls he remembers are not in the chat.) Mike later says a suspicious login on the 23rd ran from 18:00 to 22:00 UTC #2899 #2900.
24 December 2020 (key)
- Nayiem's first message already calls it "the hack" #1031.
- Mike's first report, forwarded under Chuck's name, blames "an insecure recue port" and says three machines are affected #1033 #1034.
- EXMO and Livecoin were also hacked that week #1053 #1088. Mike calls it "state sponsored for sure" #1054.
- Nayiem asks, "Is it really under 10k Mike?" #1056. Mike: "might be 15", "wont know for sure until i get everything moved" #1059 #1060. The message just before Nayiem's question is missing from the export.
- Mike suggests telling users "we are still investigating the outage, and we have full control of our systems" #1057. He drafts a line about removing data "due to the suspicious outage", and Nayiem works on the wording with him #1065 #1072.
25 December 2020 (key)
- Mike: "somebody hacked into their systems. deleted all the servers" #1103. The host is Cherry Servers. All backups are gone #1108.
- Cherry's first email blames non-payment. Mike: "there were no overdue invoices, so thats a lie" #1110 #1111. He says he "was still in the process of moving stuff" to a new host #1121.
- Mike suggests a change he made kept the attackers out, "so i guess they got pissed off and just deleted everything" #1132.
- Nayiem wants to tell users the hackers could not reach the funds. Mike replies "we don't know this" #1180 #1183.
- Nayiem writes and posts the public notice: the system "was hacked above OS level", and "We are not sure yet if funds are lost" #1232. The notice says the domain was lost, while Mike is repointing that same domain #1206.
26 December 2020 (key)
- Mike says the attacker got in through an old email still attached to the hosting account #1289.
- He writes the address [email protected], then "history on that domain probably has my name" #1326 #1328. The messages just before it are missing from the export.
- Without the config files, the saved data cannot be decrypted #1353.
- Nayiem says he never had access to those servers: "Mike didn't allow me, because I break things" #1492 #1493.
- Mike says the old email had no 2FA and that Cherry told him the deletion request came from it over a Tor IP #1504 #1508.
In 2026 Nayiem found that satotechltd.com, one letter off, is registered to Paul Vernon / Project Investors Inc. #7577. He reads the missing letter as a typo. That reading is his, not a finding.
Claims and refunds (2021)
27 December 2020
Mike estimates the loss at "around 31 bitcoins, the rest i have no idea" #1600. Nayiem asks the team to commit to repaying about $1 million #1626 and estimates the loss at $1 million or more #1677. Mike posts a wallet balance sheet #1719 and a list of 137 saved assets #1757. Mike says the host's login history "only went back 5 days" #1749. No login records are ever posted.
27 December 2020: the XQR loss (key)
Chuck asks, "is XQR safe?" Nayiem: "Nope", "All lost" #1731 #1732 #1733. He adds that it happened "right before a swap" and that he knows most Qredit holders #1734. XQR was Altilly's own fee coin, and Nayiem says he had moved his own XQR to Altilly because he trusted its setup. With those coins gone, he says, Qredit Ltd never traded, which is why it never filed accounts. (Nayiem's account.) He believes Mike took the XQR along with the rest. That is a belief. The chat shows only that the XQR was lost.
27 December 2020-3 January 2021
Nayiem's address is public through his company registrations #1579. Threats follow #2155–#2160 #2385. On 3 January two people run through his garden with flashlights, and he calls the police #2471.
28 December 2020-9 January 2021
The claim form goes up on the website on 28 December #2029, first with 60 days to claim, as Mike suggested #1973. Chuck suggests asking for deposit-confirmation emails, which become the main check #2146. On 3 January Nayiem cuts the claim window, and the notice sets a final date of 9 January #2438 #2443. Chuck thinks changing the date is a mistake #2444.
8 January 2021
A seller offers a copy of the Altilly database. Mike sends about $1k as a deposit #2925. Nayiem asks what to tell people about the database, and the team discusses saying they "recovered an sql dump" rather than that they bought it #2967 #2968 #2972. The seller disappears with the deposit #3037.
27 January 2021
Chuck asks Mike to remove the claim form from the website, post that the claim period has expired, and make a new link that "only us 3" know about, for "special circumstances only" #3355–#3358.
28 January 2021
Nayiem: "anything between 50-200 usd I don't check at all" #3564; he only checks that each coin's total claims match what is left in its wallet #3558. At Chuck's request he removes the dated repayment promise from the site #3418 #3421.
19 February 2021
Nayiem tells Chuck to refund a pushy user from a country on the banking partner's 139-country high-risk list (not a sanctions list) "but not by email and remove all traces" #4028 #4029, and describes putting another user on a separate list and deleting the messages #4032. (Nayiem says the users on that list were paid.) The same day he confirms the BTC, ETH, DASH and DOGE wallets are gone #4094 #4095.
9 March 2021
Nayiem shares Cherry Servers' liability notice #4349 and says it contradicts an earlier email in which Cherry "clearly stated it was their fault" #4350.
1 April 2021
Mike brings up the stolen Cryptsy bitcoin: "we had noticed they hadn't moved years ago" #4525 #4529. His "we" may simply mean people who were watching the coins; it is not proof of anything.
1-3 April 2021 (key)
Mike sends saved-asset refunds from the recovered wallets, about 60 coins one after another #4613–#4903. Some fall short: the MRX wallets hold zero #4849.
15 May 2021
Chuck offers to "drag it out forever", and Nayiem replies "Go for it." #5017 #5020 The next day Nayiem sets out a refund-token plan #5201–#5203, to be bought back on the new exchange; Altfenix never launched.
16 May 2021
Mike says he has "moved half my stuff to new house today" #5094. Chuck posts a video of a large indoor pool under construction, which they call Mike's "tub" #5103 #5106 #5107, and Mike posts videos of the garden and a room #5114 #5115 #5125. In the following weeks he says he is selling his other house, which he says was bought about nine years earlier #5471 #6163–#6166. Nothing in the chat shows how the new house or its renovation was paid for.
17-18 May 2021
Nayiem and Mike plan a new exchange, Altfenix #5235. Nayiem pushes for cold wallets and manual withdrawals #5666. He tells Mike, "I trust you with the hosting panel. It's not like something bad ever happened before." #5658 Mike says he can "probably get that 10k by the end of the week" #5728.
26 June 2021
Nayiem tells Chuck to price claims at the lower of the open and close values, "the most beneficial for us". Chuck adds to pick 25 or 26 December, "Whichever is better for us", and Nayiem agrees #6842 #6846 #6847. Nayiem says altcoin prices were spiking around the hack, and they did not want a one-day spike to set the value.
September 2021
The refunds are not finished. Chuck is still building the non-saved asset sheets #7426 and a BTC claim page #7517. Altfenix has not launched #7428.
The Revolut card (February-March 2021)
2 February 2021
Nayiem, as admin of his Revolut Business account, invites Chuck and Mike #3625 and sets up Mike's accounts #3638 #3644. Mike asks whether Revolut sends cards to China #3639, and Revolut shows him that its service is not offered in his country #3646. Nayiem says to send the card to his own address and he will forward it #3647. Mike registers and orders the card #3693.
4 February 2021 (key)
Nayiem posts a photo of the card envelope, addressed to "PAUL Vernon": "That was really quick." #3833 He forwards it, and Mike receives it on 19 February #3960. Nayiem says he searched the name and found only a British musician #7585 #7595. He did not act on it.
25 March 2021
Asked to complete an identity check, Mike says, "my passport is at the china visa office" #4414 #4415.
The end of the chat (October 2021)
20-21 September 2021
Mike says people may buy his current house, then "A deal was made", and that he expects to move in to the new one within a couple of weeks #7535 #7544 #7558.
26 October 2021 (key)
Mike's last message in the group: "yes, the dev got the whole thing" #7570 #7571. The chat then goes silent until February 2025. Nayiem kept working with Mike in other channels into 2022.
Late 2021 onwards
Nayiem says that from late 2021 he paid refunds himself, mainly from his share of the 2022 sale of his mining businesses after the investors were paid. He says all of that share went to refunds except about $25,000 for personal debt, about $900,000 in total by his count. He has statements for some of the payments, not a full ledger, and the figure cannot be verified from this site. Treat it as his claim. (Nayiem's account.)
1 March-17 May 2022
Companies House gives notice on 1 March 2022 that Qredit Ltd will be struck off. On 17 May 2022 the company is dissolved by compulsory strike-off. It never filed a confirmation statement or accounts. (Companies House filing history)
2022-2023: refunds wind down
Nayiem says he stopped paying refunds around 2022/2023 and made only a handful after that. He estimates the unpaid claims left at around $50,000–60,000 in total, but they are now close to impossible to check: many of the coins' chains no longer exist, including the old Qredit chain, and the Altilly database was lost. He says many of the last claims he received were fake. He also says he lost the energy to go on once he came to believe who Mike was, and saw Xeggex carry on. No further refunds are promised. (Nayiem's account.) See Refunds.
Xeggex and Dokdo (2021-2022)
31 August-20 September 2021
The xeggex.com domain is registered (31 August), and the Xeggex GitHub organisation is created (20 September). Both dates are months before Mike tells Nayiem about Xeggex.
Early 2022
Mike tells Nayiem that an exchange called Xeggex wants to list Qredit for free and that he has checked it. About a month later he says "Karl from Xeggex" might sell the exchange. Mike proposes that he and Nayiem work on Xeggex together and approach Karl, and introduces him. (Nayiem's account.)
6 June 2022 (key)
A Xeggex notice posted by "Karl" says Xeggex will be acquired by Dokdo UAB, a Lithuanian company. Dokdo was Nayiem's company, and he announced the plan publicly, on the condition of full KYC/AML compliance. Archived copies of the Xeggex site from 6 June 2022 and from September to December 2022 call it "a service of Dokdo Global". (Wayback Machine) Nayiem says he asked for the backend and wallet code for an audit and received only the frontend. This deal is why people later linked him to Xeggex.
Around November 2022 (key)
Nayiem cancels the Dokdo acquisition. He says that at about the same time as the Solar incident below, he came to believe that Mike was running Xeggex himself, that "Karl" did not exist, and that Mike was Paul Vernon. These are beliefs. No authority has confirmed them. (Nayiem's account.)
The Solar SXP incident (November 2022 onwards)
29 November 2022 (key)
Solar Network, a project Nayiem led as CEO, detects unauthorised swaps. According to Solar's statement of 30 November 2022, "a series of unauthorised swap transactions were detected which took place between 12th August 2022 and 29th November 2022, exchanging non-existent BEP20 SXP tokens for mainnet SXP coins", and "In total, 1,878,477 SXP was fraudulently swapped during this time resulting from a vulnerability detected in the BSC nodes used to provide API data to the swap service."
The same evening, at 22:45, Nayiem writes to Mike on Discord: "Why did you do it Mike?" (Nayiem's Discord screenshots, from his February 2025 write-up; his own evidence, not an official record.)
30 November 2022 (key)
Solar posts a statement in the Solar validator group on Discord, titled "UNAUTHORISED BEP20->SXP SWAP TRANSACTIONS" (not on its public Telegram channel, blog or Twitter):
It says the incident "was not due to a hack or breach of security of the Solar mainnet or Solar Core", that "user funds were never at risk", and that it did "not" result "in the creation of new SXP coins". It also says: "The identity of the perpetrator is known, and the necessary recovery processes are now in motion which cannot be discussed further for legal reasons." The statement does not name Mike or anyone else.
That the perpetrator was Mike comes from Nayiem's Discord screenshots, not from the statement. At 00:17 on 30 November Nayiem wrote: "We are not going to say anything if you can return the funds in 24hrs." At 05:43 MikeO replied: "sorry man. ya i fucked up… original plan was to earn some money from trading… liquidated out of my positions on the ftx crash… only thing that is possible is to return it as i can get it." None of this has been confirmed by any authority.
3 December 2022
MikeO asks, "should I start removing references to Dokdo on Xeggex?", and Nayiem answers, "Yes, please." The same day MikeO writes: "I had nothing to do with the altilly hack." (Nayiem's Discord screenshots.)
1 December 2022-19 March 2024: repayment (key)
By Nayiem's account, Mike repays the full 1,878,477 SXP in 12 payments between 1 December 2022 and 19 March 2024, back to the Solar swap wallet involved in the theft. The final payments can be checked on the Solar blockchain. The dates, amounts and transaction IDs are in the Solar repayment ledger in My story. This money was for the Solar incident, not for Altilly.
Nayiem did not warn Xeggex users during this time. He says he had no proof that Mike ran Xeggex, was afraid of him and expected not to be believed, that his only contact with Mike after the business relationship ended was about getting money back, and that he put getting the money back first.
The end of the relationship (2022-2024)
After the Solar incident
Nayiem says the business relationship ended in late 2022 and he stopped trusting Mike. After that, he stayed in contact with Mike for one reason: getting money back. First the Solar funds, which Mike repaid in full by 19 March 2024, and later a promise Mike made to fund the remaining Altilly refunds for non-saved assets and to pay Chuck. Mike never followed up on it. In 2025 Nayiem wrote that after the repayment "we never spoke again"; the account here is the more complete one. (Nayiem's account.)
December 2022-January 2023: Hetzner and Xeggex
While they worked together, Mike had his own project inside Nayiem's Hetzner account, with its own API key. He could create and manage servers in that project #5937 #5941 #6040–#6042, but had no access to the rest of the account. That is how Altilly's new servers were set up in 2020 #1119 #1121 #2586. After they split up in late 2022, Nayiem found out that Mike was also using that project for Xeggex, including a Solar node for Xeggex. Nayiem told him to move everything out of it. Mike finished in January 2023, and Nayiem deleted the servers. (Nayiem's account; the chat ends in 2021.)
2023-2024: records around Xeggex
- UK Companies House lists a director registered as Michael O'Sullivan for XEGGEX SOFTWARE SERVICES LTD (incorporated 2 June 2023, dissolved 31 December 2024) and XGX SOFTWARE LTD (incorporated 18 March 2024, dissolved 26 August 2025). The register does not verify identities. (Companies House)
- On 1 April 2024 the GitHub account mrmikeo ("MikeO"), which Altilly used for development, makes a commit to Xeggex's official GitHub organisation. (commit d1479b80)
The Xeggex collapse (February-June 2025)
2-3 February 2025 (key)
Xeggex halts withdrawals, saying its CEO's Telegram account was hacked, and later blames a corrupted database. Blockchain analysts report outflows from its hot wallets on 2-3 February, before the announcement. People start accusing Nayiem because of the Dokdo deal, and threats follow.
7 February 2025
A Change.org petition by Xeggex users names the Telegram user "MrMike_O" as Xeggex's business director and links him to Altilly. It does not name Vernon. (petition)
8-11 February 2025 (key)
Nayiem posts "Xeggex 'hack'" on Reddit (8 February) and then a longer write-up, "Follow-Up on the Xeggex Story", which he shared with investigators and initially posted on Reddit. Its content is now on this site, corrected against the chat where it was wrong. He wrote it quickly and from memory. It has wrong dates and other errors, including that Vernon had "never been criminally charged", and it states some beliefs as facts. It also names a private person linked to Mike's postal address, links a property listing, and says he would share Mike's personal details "if there was a 100% guarantee that people would visit his location". My story lists the corrections, including these. In the same days he replies to old messages in this chat #7572 #7574.
In early 2025 he also reports what he knows to the FBI and the US Marshals Service. The write-up says "a two-way dialogue was officially opened" with the Marshals; he says a two-way dialogue was opened and a tip reference number (777-W77728) issued, but the Marshals never responded in it beyond that.
5 March 2025
Rekt News publishes "Plant a Red Flag". It repeats the community claim that "Karl" is Paul Vernon, with no evidence of its own. (Rekt)
27 June 2025 (key)
Xeggex announces that it is shutting down and filing for bankruptcy. No court case or administrator has been made public. No law-enforcement action about Xeggex has been reported.
Ownership and publication (September 2026)
27 September 2026
Nayiem asks Chuck for ownership of this group #7576. Until then he had no admin rights here and could delete only his own messages. He posts the WHOIS record for satotechltd.com #7577.
28 September 2026 (key)
Chuck transfers ownership to Nayiem #7578.
29 September 2026 (key)
- Nayiem announces that the group will become public and read-only #7579. In the end the Telegram group stays private: the redacted chat is published on this site instead, and the unredacted chat, including deleted messages, is available to any authority that asks (Telegram @nayiem).
- He removes customer data and third-party data from the export #7598.
- He adds notes to old messages, for example #7585, #7587 and #7595. Some of them state his beliefs as facts ("Mike/Paul"). Please read them as beliefs.
- He posts in the old public Altilly Telegram group that he believes the Altilly "hack" was an inside job by a developer, and that he will publish this website and the chat.
30 September 2026
This website goes live, with the chat published read-only.