1. The Backlog Glitch

The email arrived at 3:47 AM on a Thursday, and Victor Savoy almost deleted it.

Not because he didn't see the sender address ending in .gov, but precisely because he did. In two years of waiting for the Immigration and Asset Control Bureau to process his skilled worker visa application, Victor had received exactly forty-seven automated messages from that domain. Every single one had been a variation of the same theme: your case remains under review, please do not reply to this message, your patience is appreciated. He had stopped appreciating their appreciation sometime during the first winter, when his savings account dipped below four figures and his landlord started leaving handwritten notes under his door.

This message looked identical to the others at first glance. Same bland subject line. Same formatting. Same polite bureaucratic tone that made him want to punch a hole through his monitor. But something about the attachment caught his attention. It wasn't a PDF of his case status. It was a raw data export with a file extension he didn't recognize.

Victor was an IT infrastructure engineer by training, the kind of person who saw systems where other people saw chaos. He opened the attachment in a sandboxed environment out of habit, running it through a hex editor before letting it anywhere near his actual machine. What he found made no sense at first.

The file contained a complete ledger of seized digital assets held in escrow by the Bureau. Thousands of entries spanning years of immigration enforcement actions. Most were small: a few hundred dollars in cryptocurrency confiscated from travelers who failed to declare them, security deposits held against deportation orders, fines levied on employers who sponsored visa applications improperly. But one entry stood out like a flare in a dark field.

Account number ICE-2021-7842. Status: Frozen Pending Administrative Review. Asset type: Ethereum wallet, smart contract bound. Current value at time of freeze: approximately 4,200 ETH.

Victor checked the current exchange rate three times before he believed the number. The wallet, frozen in late 2021 during a money laundering investigation, had sat untouched for nearly four years while the Bureau's administrative machinery ground slowly through its review process. The suspect in the investigation had since been deported, then died in a car accident somewhere in Eastern Europe. No next of kin had claimed the assets. No lawyer had followed up. The wallet simply sat there, accumulating value as the cryptocurrency market rose around it.

4,200 ETH. Roughly twelve million dollars.

Victor closed his laptop and stared at the ceiling of his studio apartment for twenty minutes. Then he opened it again and ran a trace on the smart contract address. The wallet was a standard multi-signature contract requiring three out of five possible keys to authorize any transaction. According to the Bureau's own records, two of those keys had been lost when the original suspect died. The remaining three had been generated and stored by the Bureau itself as part of the seizure process.

The Bureau had the keys. The Bureau also had a case management system so hopelessly backlogged that it had taken them two years to not process Victor's visa application. The system was a labyrinth of outdated servers, manual data entry, and bureaucratic protocols so convoluted that even the employees navigating it barely understood how it worked.

Victor spent the next three days doing nothing but research. He mapped the Bureau's digital infrastructure from the outside, identifying the third-party contractors who maintained their database systems, the cloud storage provider they used for archived case files, the legacy software that had been end-of-life for six years but still ran on their internal network. He found security vulnerabilities that would have embarrassed a community college IT department. Default admin credentials on a development server. Unpatched exploits in their document management system. An API endpoint that returned far more data than it was supposed to when queried with the right parameters.

The Bureau had built a digital fortress with walls made of paper.

On the fourth day, Victor called Elena Cruz.

They had met at a support group for long-term visa applicants, the kind of gathering where desperate people traded rumors about which immigration officers were most lenient and which lawyers actually returned phone calls. Elena was a former financial analyst from somewhere in South America who had spent three years trying to get permanent residency. Unlike most of the people at those meetings, she actually understood how money moved through systems. She had spent her career tracing illicit transactions for a bank compliance department before her own visa expired and she fell into the same limbo as everyone else.

They met at a coffee shop in the city's warehouse district, a place with unreliable Wi-Fi and no security cameras that Elena had recommended. Victor laid out what he had found on a tablet he had scrubbed clean of any personal data.

Twelve million dollars, he said. Sitting in a frozen wallet that nobody is watching.

Elena studied the ledger data for a long time. Her face revealed nothing.

The Bureau has the keys, she said finally.

They have three of them. The wallet requires three to authorize. But here is the thing: the keys are stored in their digital asset management system, and that system is connected to a network that I can access.

You want to steal the keys.

I want to transfer the assets to a new wallet that we control. The original owner is dead. The Bureau has forgotten the account exists. If the money disappears, their system will flag an anomaly eventually, but by the time anyone investigates, the trail will be cold.

Elena stirred her coffee. Why are you telling me this?

Because I need someone who knows how to launder cryptocurrency into clean fiat. I can get the money out of the frozen wallet. I cannot turn it into something we can actually spend without triggering every financial monitoring system on the continent.

The silence stretched between them. A delivery truck rumbled past outside, shaking the windows.

We need a third person, Elena said.

Victor nodded. He had already identified the candidate.

Remy Keller was a blockchain developer from Germany whose visa application had been denied twice on technicalities. He had spent the intervening years building decentralized finance applications for startups that paid him in cryptocurrency under the table, existing in a gray economy where his immigration status mattered less than his coding ability. He was brilliant, bitter, and completely disillusioned with the system that Victor was proposing to exploit.

They approached him through encrypted channels. The conversation took place over three days, spread across multiple platforms, with each message set to auto-delete after reading. Remy was paranoid in a way that suggested he had been preparing for something like this for a long time.

The smart contract is the key, Remy told them on the second day of negotiations. Standard Ethereum multi-sig wallets have a vulnerability that most people do not know about. If you can access the contract before the transaction confirms, you can embed a secondary execution clause. A time-delayed forward to a second wallet address, hidden inside the transaction data.

A backdoor, Victor said.

A legitimate smart contract feature, Remy corrected, though his tone suggested he found the distinction amusing. The Bureau will see a standard transfer to our wallet. What they will not see is the secondary transfer that executes seventy-two hours later to a completely different address. By the time anyone audits the chain, the funds will have moved twice and we will be gone.

The plan came together over the following week with a precision that surprised all of them. Victor would breach the Bureau's network and extract the three private keys. Remy would write the smart contract that would receive the funds, embedding the hidden secondary transfer. Elena would handle the conversion: a network of cryptocurrency tumblers, shell companies registered in jurisdictions with minimal financial oversight, and finally a series of real estate purchases that would turn digital assets into physical property that could not be reversed or frozen.

They agreed on an equal three-way split. Four million dollars each. They sealed the arrangement with a handshake at a rented co-working space that none of them had ever used before.

On the night of the extraction, Victor sat in his apartment with three laptops arranged in a semicircle around him. One ran the exploit code he had been refining for the past week. One monitored the Bureau's network traffic in real time. The third maintained an encrypted video call with Elena and Remy, who waited in separate locations across the city.

The Bureau's development server was exactly as vulnerable as Victor had predicted. He slipped through an unpatched Apache Struts vulnerability, pivoted to the internal network using credentials he had harvested from a misconfigured Jenkins instance, and located the digital asset management system within twenty minutes of starting.

The private keys were stored in a database table labeled seized_assets_archive, protected by a single layer of AES-128 encryption with a key derivation function so predictable that Victor cracked it in under an hour.

He sent the first key to Remy. Then the second. Then the third.

We have three signatures, Remy confirmed, his voice crackling through the encrypted call. I am initiating the transfer now.

Victor watched the Ethereum blockchain explorer on his second monitor. A new transaction appeared, moving 4,200 ETH from the Bureau's frozen wallet to the smart contract address Remy had prepared. The gas fee was high, the network confirmation slow. Each passing second felt like an hour.

Confirmed, Remy said. The funds are in our wallet. The secondary transfer is embedded. In three days, the money will move to Elena's shell company wallet, and from there to the tumbler network.

Victor exhaled. He closed the exploit, erased his logs from the Bureau's servers, and terminated the encrypted connection. For the first time in two years, he allowed himself to feel something other than frustration and despair.

They had done it.

The celebration was muted and virtual, a few encrypted text messages exchanged in the hours after the transfer. Remy posted a single line of code in their group chat that translated to "we are rich." Elena sent a spreadsheet showing the projected timeline for converting the assets. Victor allowed himself a glass of whiskey and a full night of sleep.

He woke the next morning to a message from Elena, sent at 4:12 AM.

We need to talk about Remy.

Victor called her immediately. Her voice was tight, controlled in a way that suggested she had not slept.

He demanded a larger share, she said. He called me last night, after you logged off. He said the smart contract work was more complex than he had anticipated, that he had taken on more risk by being the one to execute the transfer, that he deserved forty percent.

That is not what we agreed.

I told him that. He said the agreement does not matter anymore. He said the secondary transfer has not executed yet, and he can still modify the contract parameters.

Victor felt cold despite the morning sun streaming through his window. Can he do that?

I do not know. He is the one who wrote the contract. He is the only one who truly understands what he built into it.

The secondary transfer was supposed to execute in seventy-two hours. For the next two and a half days, the money sat in a wallet controlled by all three of them, accessible only with unanimous agreement, which meant that Remy could not take the money without their signatures. But the hidden secondary transfer to Elena's shell company was something only Remy fully understood. If he had built himself a backdoor into the backdoor, they would never know until it was too late.

Victor spent the next day auditing the smart contract code that Remy had written. It was elegant, compact, and completely opaque in several critical sections. Remy had used a custom obfuscation library that Victor had never seen before, rendering portions of the contract unreadable to anyone who did not know the original code structure.

He asked Remy about it directly. Remy's response was casual, dismissive, almost mocking.

You are paranoid, my friend. The contract works exactly as I described. You are welcome to verify it yourself.

But Victor could not verify it, and Remy knew that. The obfuscation made independent audit impossible in the time they had remaining. The secondary transfer would execute in less than thirty-six hours, and Victor had no way of knowing whether it would send the money to Elena's wallet, to Remy's wallet, or to somewhere else entirely.

Elena proposed a solution that night. They met in person at an empty parking garage on the outskirts of the city, standing between cars that belonged to neither of them.

We cannot trust the secondary transfer, she said. Which means we need to access the wallet directly before the seventy-two hours are up and move the funds ourselves.

We need three signatures for that, Victor said. Remy will not agree.

I know.

The silence that followed was different from the silences that had come before. Those had been silences of calculation, of planning, of two people working through a problem together. This was a silence of understanding, of an unspoken threshold being crossed.

Elena spoke first. His apartment has a smart home system. I helped him configure it when he moved in. He never changed the access credentials.

Victor looked at her for a long moment. In the fluorescent light of the parking garage, her face was half in shadow.

What exactly are you proposing? he asked.

I am proposing that we protect ourselves. Remy has already shown he cannot be trusted. In thirty-six hours, he could walk away with twelve million dollars that belongs to all of us. We need to make sure that does not happen.

How?

Elena pulled out her phone and opened an application Victor did not recognize. The interface showed a floor plan of an apartment, with icons indicating door locks, climate controls, security cameras, and something labeled "gas valve."

I can access his entire home from here, she said. The security cameras, the door locks, the environmental controls. Everything.

Victor stared at the screen. The implications of what she was showing him cascaded through his mind like a chain of logic he could not stop following. Remote access to a smart home meant remote access to everything inside that home. Including the occupant.

We are not killers, he said.

We are not anything yet. But Remy has made his position clear. He wants more than his share. He is willing to threaten us to get it. We have twelve million dollars on the line. The question is simple: what are we willing to do to protect what is ours?

Victor looked at the phone screen again. The gas valve icon blinked steadily, waiting for a command.

I need to think, he said.

Think quickly, Elena replied. The clock is ticking.

Victor drove home through empty streets, his mind churning. The city lights blurred past his windows, and for the first time since he had opened that email from the Bureau, he felt the full weight of what they had set in motion. The money was not free. It never had been. The price was just becoming visible now, and it was higher than he had imagined.

He arrived at his apartment at 2:33 AM. As he unlocked his door, his phone buzzed with an email notification from the Bureau. His heart stopped for a moment before he realized it was the standard automated message, the same one he had received forty-seven times before.

Your case remains under review. Your patience is appreciated.

But below the standard text was something new. A postscript that should not have been there.

P.S. We see you, Mr. Savoy. We have always seen you. Enjoy the next thirty hours. They may be your last.

Victor stared at the message for a full minute. Then he began to run.