Riga Cafe Slip: How TrickBot's $1.4B Dev Doxxed Himself in 47 Minutes

A cold Wi-Fi ping at a Riga cafe ended seven years of hiding for TrickBot's lead developer. Denis Volkov spent seven years and eleven aliases building banking trojan code blamed for $1.4 billion in losses, including the 2020 ransomware attack that crippled the University of Vermont Medical Center. Latvian counterintelligence spent 19 months tracking him through Riga's cafe district, but it took a leaked Conti chat log, a messy divorce, and one 11-second VPN failure to finally confirm his real identity inside the Blue Cat espresso bar. Inside the 47 minutes between his coffee order and arrest, FBI liaison officers and Latvian tactical teams closed in on a man who never saw it coming. What they found on his seized phone exposed 2,847 compromised US bank accounts and a 340-wallet Bitcoin ledger worth $890 million. This is the declassified account of the surveillance operation, the device-fingerprint pipeline that cracked it, and the one ordinary afternoon that ended a major node of one of the decade's most damaging cybercrime networks. #FBI #TrickBot #CyberCrime #TrueCrime #bitcoin Subscribe for more federal investigations