A Twin Cities man opened an email, realized his mistake and watched as more than $2 million was drained from his Bitcoin account in a phishing scam, according to a state investigation.

An investigator working with the state Bureau of Criminal Apprehension (BCA) Financial Crimes Task Force laid out the Anoka County man’s reverse windfall in a search warrant affidavit filed this week. It seeks to gather information from the prime suspect‘s social media account.

The filing said the task force investigator in recent weeks has been communicating with the suspected cryptocurrency thief, who possibly has ties to Nigeria.

As of Friday, there have been no arrests nor charges in connection with the case, said Brooklyn Park Police Inspector Matt Rabe. The suburban department’s Cyber Unit supervisor, Sgt. Jake Tuzinski, is heading up this investigation.

Once the investigation is complete, the case will be sent to the U.S. Attorney’s OIffice for consideration of charges, Rabe said. The Minnesota Star Tribune generally does not identify suspects before they are charged.

Tuzinski said Friday that everyone needs to “take a pause while reading these emails. Verify who the email is coming from. Check not just the name of the header such as ‘From: Coinbase,’ but also drop it down and look at the full email domain it is coming from.”

 According to the search warrant affidavit: