It happened probably 6-7 months ago and worse yet, services I had downstream actually were sensitive to the geolocation of the caller. Fortunately I caught it quickly enough when someone I was working with tried to SSH into the host and couldn't.

Surely the account was being paid via cryptocurrency however it was already verified through the linking of an actual traditional credit card like they required.