Early next spring, the Crown Prosecution Service will begin trying to recover the criminal cryptocurrency profits of a University of Kent student involved in more than £100 million worth of fraud.
The student, 21-year-old Ollie Holman, who was studying electronic and computer engineering, was sentenced to seven years in prison on 23 July 2025 for creating and selling online “phishing kits” – ready-to-deploy digital scamming kits to steal money, with instructions for inexperienced scammers. The sentencing date may be important but we’ll come back to that later.
The Crown Prosecution Service believes that he began selling his kits in 2021, the year he became a student at Canterbury. Holman sold his phishing kits through the dark web, and distributed through Telegram.
“Calculated and ruthless” – trial and charges
The trial attracted international attention, not simply because of the scale of the frauds committed, or because the defendant was clearly a highly intelligent undergraduate.
The sheer audacity of the offences committed via the dark web provided a vivid indication of the ever-growing threats all of us face from internet fraud, as the trial swung a spotlight on the very real vulnerabilities in digital ecosystems.
Judge Rebecca Trowler, when sentencing Holman, described his actions as “calculated and ruthless”, and spoke of the devastating effects on victims who lost their life savings.
Holman, whose home is in Eastcote in north-west London, had pleaded guilty back in August 2024 to seven charges:
- One count of encouraging or assisting the commission of one or more offences, believing one or more would be committed.
- Two charges of making or supplying articles for use in fraud.
- One charge of transferring criminal property.
- One count of acquiring criminal property.
- And two charges of possessing criminal property.
To put it mildly, that’s quite a record for an undergraduate, though probably not one any would want on their CVs. It also highlights the disregard for the very real pain inflicted on thousands of innocent victims.
Judge Trowler’s sentence of seven years, despite Holman being a first time young offender, indicated the seriousness with which viewed the catalogue of crimes, as well as the need for deterrents.
An adolescent entrepreneur
Holman’s life of crime, however, may well have begun before his arrival in Canterbury and his time as an undergraduate.
According to one specialist website, the Crown Prosecution Service disclosed during the trial how Holman’s criminal activities spanned several years, probably going back to when he was at school.
While still in his teens, the court was told, he advertised his software on encrypted forums, boasting of its effectiveness in bypassing two-factor authentication and other safeguards.
Holman’s phishing kits – contents and costs
Irrespective of when the online crimes began, Holman continued selling his illicit kits from Canterbury until at least the autumn of 2023 – by which time he had sold a total of 1,052 phishing kits to fraudsters around the world.
These kits included websites which often mimicked the genuine websites of charities, banks and even government organisations. They also included built-in scripts, which enabled fraudsters to gather secret information, including account log-ins and bank details.
This led to thousands of victims unwittingly providing personal and financial information, then used to steal money from their credit cards or bank accounts.
Astonishingly, it is estimated that at least £100mn was stolen through Holman’s kits, with one of those kits connected to a fraud of approximately €1mn.
Southwark Crown Court was told the kits were used to defraud 69 financial institutions and large organisations, including government bodies and charities, across 24 countries.
After the trial, Sarah Jennings, a specialist prosecutor for Serious Economic, Organised Crime and International Directorate, stated: “by creating and selling phishing kits, Ollie Holman facilitated a widespread fraud which others used to exploit innocent victims on a vast scale.
“Holman acted with greed and profited handsomely from this illegal enterprise, funding his own lavish lifestyle at the expense of countless individuals and businesses who suffered devastating financial losses and emotional harm.”
Student accommodation searched
Holman was first arrested in October 2023, and his student accommodation at University of Kent in Canterbury was searched, following an investigation headed by the City of London Police’s Dedicated Card and Payment Crime Unit (DCPCU). The police search of his room revealed evidence of criminal activity on Holman’s computer, and, with his digital fingerprints, were linked to the creation of the fraudster kits.
The unit first got wind of the Canterbury caper in 2022, following a tip from American-owned cybersecurity firm, WMC Global, whose London headquarters are in Grosvenor Gardens.
They alerted the police to suspicious web traffic patterns tied to Holman’s phishing domains, with the special unit tracing the kits’ impact through blockchain analysis, as well as victim reports. All these linked the kits to multimillion-dollar losses across many institutions.
At the end of the trial, the part played by WMC Global was acknowledged by Detective Sergeant Ben Hurley of the City of London Police, who said the firm played “a vital role in helping to identify Holman”.
DS Hurley claimed Holman had enabled mass fraud on a global scale, stating: “the fraud losses linked to Holman’s actions are in the millions. Furthermore, Holman himself profited massively from the sale of this software, with no thought for how it may cause harm to victims.”
It should also be noted that this was an international effort, with British detectives assisted by overseas police forces and law enforcement agencies such as the Office of the Attorney General of Switzerland, Finland’s Federal Office of Police, plus Europol, as part of an effort to fight cyber fraud, rejoicing under the memorable codename Op PhishOFF.
Covert cryptocurrency spoils
However, after his first arrest, Holman was released before being re-arrested seven months later in May 2024.
During that seven-month period, he continued to stay in touch with his customers on Telegram, offering them tech support and advice.
His international customers paid him through cryptocurrency, notoriously difficult to trace but easy to hide. The Crown Prosecution Service believe Holman received $405,000 between 2021 and 2023, and has around £300,000 salted away in cryptocurrency wallets.
And it is that £300,000 which the CPS is going after at the proceedings, which begin on 4 March 2026, at Southwark Crown Court.
Whether or not the barristers succeed in confiscating those ill-got funds, tucked away in various cryptocurrency wallets, we will discover next Spring. Although for Holman, whether or not he cooperates may well determine when he is released from prison.
But, and this is a very big BUT, is the total amount of illicit funds Holman has stashed away as little as £300,000?
Holman’s money stash – more than £300k?
According to WPN, Holman was flogging his criminal kits at bargain basement prices, often under $100 a time, making them accessible to a wide array of customers, from lone hackers to organised crime syndicates.
It is almost as though this university student was applying the old supermarket adage, Pile High Sell Cheap. But, if that’s true, then it is yet another astonishing aspect of how Holman operated.
So, let’s look at the maths.
He had a large number of criminal clients to whom, according to the CPS, he sold a total of 1,052 phishing kits.
Probably only Holman knows for sure how much he charged for each criminal kit, but that software was obviously valuable, and it seems more than a little odd if he sold it off on the cheap.
Curiously, if you take the CPS figure of £300,000, then divide it by the total number of kits sold, that would work out at roughly a modest £300, or maybe $300, per sale.
Well, try buying a legitimate, tailor-made website for a mere £300, let alone a fraudulent site specifically designed to harvest bank and credit card information.
Tagged up or locked up
When sentenced to seven years in July, Holman also had a Serious Crime Prevention Order (SCPO). These are imposed on people involved in serious crime, and can include a range of restrictions on their activities once out of prison
Which means that, when released, Holman will be subjected to fairly severe limits, including having to wear an ankle tag to monitor his movements. Breaking any of the restrictions is itself a criminal offence, punishable by up to five years imprisonment plus an unlimited fine.
SCPOs can last for up to five years, which is far longer than young Mr Holman is actually likely to be behind bars.
Will Holman be locked up for seven years?
The headlines told the world that, last July, a 21-year-old student had been put inside for seven years. But unless he gets into more trouble while still inside, Holman could well be released by mid-April 2027.
That is because all seven of his offences are eligible for either the Standard Determinate Sentence 40% (SDS40) scheme, or the Home Detention Curfew (HDC). Both of those are early release measures for prisoners serving standard determinate sentences, although they work differently.
SDS40 reduces the automatic release point from 50% to 40% of the sentence, to address prison capacity issues.
Meanwhile, the Home Detention Curfew allows some prisoners to be released early on an electronically monitored curfew, via leg tag, if they pass a risk assessment.
Holman was sentenced to seven years and that, if you ignore leap days, is 2,555 days. Forty percent of 2,555 days is 1,022 days.
The prison service would then take into account that, before being sentenced, Holman was on remand for 390 days. All of which are deducted from 1,022, leaving a total of 632 days to serve from the time he was sentenced.
He was sentenced on 23 July 2025, so 632 days on from that should mean Holman is looking to be released somewhere around Friday 16 April 2027.
Accountability and cooperation
Whether he is released as early as that, though, clearly depends on Holman’s response when back in court next spring.
There he will be facing law-enforced demands to hand over his cryptocurrency wallets and the £300,000, which the CPS describes as “his ill-gotten gains”.
If he refuses to cooperate, then his early exit from prison looks set to disappear.
University of Kent statement
After his release, there is a possibility Holman could resume his studies, though with certain safeguards in place.
This was confirmed to Kent and Surrey Bylines by the University of Kent’s senior press officer, Olivia Miller, who explained: “We wouldn’t bar his return as such, as we believe everyone with the potential and ambition to go to university should be able to succeed and make a positive contribution to society.
“However, we would need to give it appropriate consideration depending upon what course of study he was looking to follow, as a number of our courses require DBS (Disclosure and Barring Service) checks.”
