Operation Washing Machine: How a Barclays phishing text led to an $86M cryptocurrency laundering network

It started with a text message I did not ask for.

A Barclays phishing SMS landed on my phone. I do not bank with Barclays — so instead of deleting it, I followed the link. What I found inside the site's publicly accessible PHP files opened an investigation spanning six months, three criminal layers, and a Litecoin laundering network that has processed over $86 million in documented criminal proceeds.

The full case file has been submitted to the National Crime Agency and the UK Financial Intelligence Unit. What follows is what we can say publicly.

Layer 1: itna1337 and the PHP kit he told people not to steal

The phishing site's files were publicly accessible. Using standard browser developer tools — the same technique documented by CyberArk in their published threat intelligence research — I downloaded and examined them.

CyberArk had previously penetrated itna1337's backend infrastructure when his operational security was weaker. He improved it. Not enough.

The kit used a three-layer obfuscation chain. Layer 1: PHP character pool substitution — reconstructs function names at runtime, producing no readable strings in the raw source. Layer 2: strtr() character remapping combined with base64_decode — produces the AES bootstrap and contains the decryption key. Layer 3: AES-256-CBC encryption — the actual payload, fully decryptable once Layer 2 is resolved.

Cracking all three layers revealed the kit's true purpose: not a ChatGPT impersonation as the phishing site presented, but a Barclays UK online banking credential harvester — with evidence of a prior campaign targeting Huntington Bank in the United States. Same operator, same kit, different targets.

Embedded in plaintext across all four PHP files: the actor alias itna1337, a secondary alias, a Telegram handle, and a contact email — all consistent across every file. A unique author signature hash was present throughout. This is a commercial Phishing-as-a-Service product, sold to other criminals.

The irony is worth recording: buried in the header of a criminal PHP kit sold to fraud operators across the internet, the author had written an instruction to recipients not to steal his work. The kit bore the name he gave his own product portal: Tesseract.

That name became the next pivot.

Layer 2: The Tesseract drug market, its clones, and a live scammer

Searching Tesseract in the context of the investigation surfaced something entirely separate. The name is coincidence — itna1337 does not operate the Tesseract drug market. They share only a name.

Tesseract is a Telegram-based darknet drug marketplace, active in the UK, USA and Canada. The investigation identified both the legitimate Tesseract market and a network of clone sites designed to defraud buyers and vendors on the real platform.

The platform's highest-volume vendor — SocialPharma, with over 10,000 confirmed orders — was prosecuted in December 2025 by SEROCU, supported by blockchain analytics from TRM Labs. Combined sentencing: 47 years. £4.3M in Bitcoin seized.

That prosecution addressed one vendor out of 119 confirmed active shops. One hundred and eighteen remain.

During the investigation a third actor was identified operating within the Tesseract platform: a scammer impersonating legitimate vendors, bypassing the platform's escrow system, collecting direct LTC payments and delivering nothing. A canarytoken deployed during the investigation triggered in April 2026 — confirming the scammer was still actively operating from cloud infrastructure in the Asia-Pacific region via VPN. Their funds traced directly into the same laundering network described below.

Layer 3: The master vault — $86.5M in documented cryptocurrency laundering

Following the LTC payment trails across the real Tesseract market, the clone sites, and the exit scammer led to a single piece of infrastructure: a master hub wallet operating as an automated, industrial-scale Litecoin laundering network.

The operation runs across two parallel inbound streams converging at a single master vault address — details of which are contained within the NCA referral. Stream A processed $61,061,876 across 84,000+ transactions. Stream B — Tesseract platform drug orders — processed $25,417,110 across 62,000+ transactions. Total documented: $86,478,986 across 146,000+ transactions.

Three wallet addresses are proven to receive funds from both streams simultaneously — direct address overlap confirmed from wallet statement data cross-referenced against the traced drug market chain. These linking addresses are contained within the NCA referral.

The laundering mechanism is automated and sophisticated. Individual buyer payments — typically $50–$500 each — are consolidated through 62-input batching addresses that aggregate retail drug payments into large single transactions before routing to the master vault. The vault then cascades outward to 38,564 distinct cashout addresses. The master vault balance stood at $40.1M on 1 January 2025 and $26.1M on 31 December 2025 — $14M successfully laundered into the fiat system in 2025 alone, while new inflows continued throughout the year.

A further obfuscation technique was identified: a self-chaining layer in which a cashout address receives funds from the hub, sends to itself with a fee differential, then forwards to an exchange deposit address — creating a false impression of a value exchange between parties rather than a direct flow-through. A deliberately engineered chain break.

The scale, the automation, the timestamp precision across 146,000 transactions, and the exchange integration patterns point to a professional criminal organisation with significant technical capability that has been operating and evading detection for at least 18 months. Given the scale of funds involved, connections to major organised crime are a reasonable inference.

How Oversight made this investigation possible

This investigation was conducted using the Oversight Labs platform — specifically Argus (continuous monitoring and detection), Aegis (defensive intelligence and response), and the MARL adversarial Arena (our multi-agent red versus blue team environment that trains detection capability against novel attack techniques).

The PHP obfuscation chain itna1337 used is novel — an improvement on the techniques CyberArk documented in their prior research. Cracking it required the same pattern recognition and anomaly attribution capability that underpins our commercial products.

On-chain blockchain data is a temporal dataset. The same infrastructure that detects a discrepancy in a trial balance, identifies an anomalous pension member record, or flags an inconsistency in a remediation case file — normalised to a canonical form, analysed for structural breaks and cross-field relationships — traced the flow of $86M through 146,000 transactions to a master vault and 38,564 cashout addresses. This is Oversight-C applied to criminal financial infrastructure. The same core. A different domain.

Referral and next steps

The complete case file was submitted to the National Crime Agency Intelligence Division and the UK Financial Intelligence Unit on 29 June 2026, including the full blockchain audit trail, official wallet statements, all 38,564 cashout addresses ranked by volume, PHP kit forensic analysis, canarytoken evidence of live operations as of April 2026, and prioritised exchange subpoena targets.

All blockchain evidence is permanently recorded and independently verifiable via public block explorers.

If you are a journalist, law enforcement professional, blockchain analytics firm, or regulated financial institution and wish to discuss this investigation, contact us at info@oversightlab.ai.