~2006 · Age 8, 3rd Grade
The Texas Incident
- Built a DDoS shell and tested it on Texas.gov, timing the website out
- His childhood friend Sam (now a doctor) was sitting right there watching
- The ISP allegedly called his parents to threaten cutting off internet
"Local governments should thank me. If I don't take control an enemy will."
2010 · Age 12
Boy Scout WiFi
- Hacked into the WiFi tower at the 2010 Boy Scout Jamboree
- Didn't steal anything — just reset it because it was slow
- Unauthorized network administration as community service
February 2012 · Age 13
The Awakening
- Got RAT'd (remote access trojan), lost 100M+ RuneScape gold
- Posted "computer hjacked" on HackForums, tried every antivirus
- This was the virus that changed everything — he learned from it
- Two weeks later: "How to ddos" and "how to make or obtain shells"
- Got RAT'd twice total, never again. Doesn't run antivirus anymore.
March 2012
The Arsenal
- Already had "a few hundred shells" for his booter
- Shopping for more on HackForums at age 13
April 2012
TzBooter
- Branded DDoS-as-a-Service with custom banner art
- Gothic font, dripping letters, tagline: "get hit"
- Running a DDoS service before he could drive
May 2012 · Age 13-14
T&Z Hosting
- Launched a hosting company at age 13-14
- $0.50/month to $3.00/month plans with cPanel
- Contact: 88tontos@gmail.com — the T is probably Thomas (his brother)
- Skipped school to drive 6 hours to Rhode Island to win a full Dell server rack at auction
- Stuck it in his parents' minivan, set it up in the family living room
- The T&Z Hosting "data center" was a Dell rack in a New Hampshire living room
High School Era
Campus Operations
- First C++ program: a rickroll trojan that opened Rick Astley in a frame with disabled exit button
- Got admin access to the school laptop deployment system, deployed it during silent study hall
- Earned 3 Saturday detentions
- Gave someone a DDoS shell on a hacked cPanel
- That person set it to attack the school for 200 HOURS
- School thought all their main switches died and replaced them all (thousands of dollars)
- Nicholas got out of some tests. Worth it.
Teen Years
The Roblox Empire
- Built RobloxSharp — a C# to Lua transpiler/cheat library (private repo, 20 commits)
- Industrialized cheating so hard Roblox had to implement anti-cheat
- Built a Build-a-Boat plugin for his brother Thomas: duplicated bases and used tornados to fling others' items
- Thomas earned 18.5M in-game currency "legitimately" via tornado exploitation
- Roblox-Checker — Java tool from 2018 (account credential checker)
- Nicholas never got banned on his main (77tontos). Thomas got banned on everything.
- Also built Minecraft exploits — planted a sleeper OP account "Zenmender" on a server, bought the username later, used it to grief when the owner went rogue
BHF/XSS Era
The Forums
- Active on Best Hack Forum (BHF) and XSS (elite Russian hacking forum)
- Both still active in 2026
"The golden age of clearnet hacking forums is basically dead."
2019
AutoBuy.io
- Founded AutoBuy.io — a digital goods marketplace
- "Delivering over 10,000 products since 2019"
- PayPal partnered, license management, crypto payments
- 5,416+ total shops
- iKonroi/XboxStealth: top merchant (MW2 mod menu legend)
- Processes payments through his own CryptoHarbor blockchain nodes
- Pays the IRS their cut so they don't care
CryptoHarbor
Vertical Integration
- Built his own multi-chain node infrastructure (Docker-based)
- Runs BTC, LTC, DOGE, XMR nodes
- Home server: only Monero node stays running. Others crashed and ignored.
- VPS: all chains running for AutoBuy payment processing
- 100% Monero portfolio. No exceptions. Privacy maximalist.
- Paranoid about quantum computing breaking elliptic curves
Kick Streaming
Schrödinger's Audience
- Runs 24/7 lofi stream on Kick — consistently #1 in Music category
- Built his own view bots — hits 7K-10K viewers
- Gets front page placement on Kick homepage
- Bots his friends' streams so they earn more
"I did it all legit via my own code and bots."
"Top 1% of 0 Viewers" — Instagram
RuneFest 2025
The Friendly Threat Actor
- Private Jagex event, playtested Sailing skill 19 days before public alpha
- Met Mod Ash — photo together
- Photo with Emilyispro
- Received signed OSRS art prints from Jagex covered in Mod signatures
- RS Archive Team uses his decompilation tools with Jagex's blessing
"I only write bots for games I don't like to ruin their economy. I like RuneScape."
The Cruise Ship WiFi Hack
Maritime Penetration Testing
- 15-day cruise from Barcelona with friend Wesley
- Found hidden network without client isolation
- Raspberry Pi + multiple WiFi cards, MAC rotation = infinite free trials
- Bonded with Speedify, proxied through non-isolated network
- Debugged at 1 AM docked in Marseille, France
2026 — Present
The Adversarial Engineer
- @nnickkh on Instagram — verified, 281K followers
- Bio: "Adversarial Engineer (non AI...)"
- 35+ countries in 18 months
- Friends with Ice Poseidon, AdinRoss, madiee, AdrianahLee, Mod Ash, Emilyispro
- Security clearance, two passports
- Infrastructure hosted in Singapore for jurisdictional arbitrage
- Currently in Japan for F1
- Has an AI named Azula that stalks his brother's Roblox status
"Half of what I get away with is things I wouldn't expect to work."
