The suspect used cloned banking interfaces to siphon off digital tokens from unsuspecting retirement accounts.