Kai Cenat, a popular Twitch streamer and YouTuber with 16 million followers, had his accounts hacked by a group called "Sava." They changed his Twitch username to "savawuzhere" and promoted their Discord server during a live stream. The hack was allegedly in retaliation for Cenat getting their Discord suspended. This is the second attack by "Sava," after they hacked his TikTok in February 2025, deleting videos and erasing over 130 million likes. Cenat’s Twitch account has been deleted, and his YouTube channel remains compromised, with no public statement from him or his AMP group.

@thecomcast has identified the individual behind "Sava", and will be revealing their identity exclusively through this channel in the next few days.

The person known as "Sava" can be found here; https://t.me/kaicenathacker.

Turns out, he's in High School.

In recent weeks, there have been rumors of multiple arrests involving "high-value" threat actors. Some of the individuals reportedly involved include:

KT: His Telegram account (@doxer) has been behaving unusually, and his TLO service, Neko TLO—which he owned—had its bot and developer account unexpectedly deleted.

Operator/Clark/Miku: A key member of the ransomware group Scattered Spider, which consists of a diverse mix of individuals involved in SIM swapping and phishing. The group is an amalgamation of several key organizations, including Infinity Recursion (owned by Operator), True Alcorians (owned by earth2star), and Lapsus, which have come together to form a single collective.

Recently, two key handles from Operator's inactive TON wallet (@loli and @egirl), which hadn't been used for almost a year, became active again. They appeared on the Telegram account (1098017901), claiming not to be Operator or Paula. The last time these handles were used, they were controlled by his then-girlfriend, Paula/River.

Do you think these are just rumors, or is it more than a coincidence that both individuals disappeared around the same time, along with a few others?
Stay tuned.

Yesterday, the assets from Operator's TON wallet were transferred to a new wallet after nearly a year of inactivity. Is this a case of Operator moving his assets, or has he met the same fate as his friend Jared, also known as ky$? Last July, Jared was arrested, and all his TON-related assets were moved to a new wallet, which has remained untouched since.

Operator: https://tonviewer.com/UQAJM6XJJOPMiN-2fiClfP569VB1sWK0QpAjOXrIbSmVRYWF
Jared: https://tonviewer.com/UQB--FyZ-6_TgxsZUZy_jKvjV17JMyWbE0BGSsJOaON1s-p8

Is this just another coincidence amidst all the other strange events of the past few weeks? Stay tuned.

Update:
A user pointed out a key factor we missed, just minutes before all assets were transferred from the Operator's TON wallet, they sent 1 TON to (ritual.t.me), a known middleman (@ritual). Ritual typically verifies ownership of foreign accounts by requesting a 1 TON payment from them.

However, the handles have not yet been posted in his public channel (@hightier) that he runs with @cupid & @plug. Stay tuned for further updates.

Update:
This was posted earlier by @Ritual in @HighTier. Looks like Operator is slowly cashing out his TON assets and may not be arrested, despite his strange behavior as of recent.

About 15 minutes ago, Operator shared what he alleges to be Paula’s real Address and Passport to back it up on the official Doxbin Telegram channel, which he manages alongside his friend CD—formerly known as ‘Batman’ on-site to hide his identity. It appears that this move is Operator’s form of retaliation after Paula leaked his address while she was dating Javin.

It has since been deleted. Stay tuned for more updates.

Update:
Operator has once again shared private information about Paula in the official Doxbin Telegram channel. This time, it's an image of what appears to be Paula's RedotPay monthly statements. RedotPay is a well-known service that allows users to deposit cryptocurrency onto a card that can be used like fiat currency.

In the post, he states that he wants Paula to message him directly and "make a deal." Is Operator really that much of a cuck that he’s willing to let his girlfriend leave and date Javin, just to try to win her back? or is he out for revenge. Stay tuned for further updates.

You've been a naughty boy Operator—accumulated a staggering amount near $16 Million USD worth of XMR from your ransomware-related schemes with Scattered Spider.

It’s wild how fragile your ego must be if you felt the need to flex that much money just to prove a point.

You even moved a million—literally—just to show your illegal money was real.

• TX ID: 530285613d21e582b3d21963b4f5d7f03a4350a9b8b30dfaa0f7c05ad348ae08
• TX Secret: 579570752506a983e2712671014aa2435040ef4b111cb9bd67455ca9e1c2bb02
• Address: 8BjvBLiirRmeVR7PqDKBxvcVgdiHi1xNdbg65Ju6nM3h4PrJLDK9zsfAsYre3gyfPHYfX8r9DfMhcTeWRt3cR8EHKywo9wn


P.S. We'll be setting up a submissions account soon where anyone can anonymously send us information. Stay tuned.

Batman couldn't beat me into posting an edit like this

Just over a year ago on April 1st, 2024, Operator publicly flexed nearly 100,000 XMR—now valued at over $20 million USD.

Exodus TXID: 54eefa0f5579e2310bf8b3ca2f168c8de4e5398f84506b31be6421d0ee5a9347

Don't do this people. . .

Let’s not forget the staged kidnapping and beating that Operator orchestrated himself—was it meant as a detrace? A way to disappear? Who knows. Either way, it was all fake. Stay tuned.

No amount of money in the world can make up for you looking like this brother

Operator used his Instagram account (instagram.com/lonely) to share messages in a group chat with his friends, describing in detail the disturbing things he did to his ex-girlfriend, day by day.

Have anything you'd like to share about Operator/Clark/Miku? We'd like to talk to you AnoMessBot.t.me?start=STHMehu

To think Operator would remain undoxed and be $15 mil richer if he just didn't edate LMAO

Operator has requested this picture to be included, he must be proud of it. Enjoy!