He didn't bail. He was removed, in writing.

"I bailed after a few days" collapses against six weeks of email from inside the group, with other members concurring in real time — months before the first public QAnon-origin think pieces, and a year before he reinvented himself as the creator who walked away. Every line below is verbatim, with its thread ID.

“Online expose day”: the same day, from his side

The first two emails in the ledger above are dated May 7, 2018, and one asks the group to report “Defango's new video.” This is that video: a 50-minute livestream on his channel, posted that day. His description calls it “the start of the expose on the cicada 3301 thing” and says he is “exposing the guy that is been behind many of the weird things happening in my life.”

Quotes are from a subtitle file the author supplied, with timestamps; YouTube's own auto-captions garbled several of these lines. The first two minutes are unrelated footage. At 16:13 he addresses “Lestat,” the author's handle, by name: “you didn't have to come out on Twitter and call me a liar.”

• Money (3:33, 21:39). “I was supposed to have a lot more money in my pocket.” “Why has Thomas been not paying me the money that I'm owed for the things that we're doing?” The emails above give the opposite grievance from the other side.
• Rights (20:33–20:54). He says he was promised a TV show or movie with his channel as the focus, then told he was out while they would use “everything that you did last year. Your life rights included.” He says he refused.
• Authenticity (3:48, 13:15). He will find out “if it genuinely actually was really Cicada 3301 or if it was an actual guy.” On trademarking, he says you need “all of the documentation associated for all the puzzles, starting from 2015,” and the group had “no documentation. No nothing.”
• Q (17:03). “The whole QAnon situation blew me away … when these guys started trying to tell me that they were behind the QAnon thing.” He says the man in question “knew the password,” that they shared it in October and nobody cracked it until November, and that he got an email saying “the Q thing's going really well.”
• His own DEF CON account (18:07). He asks whether this man was manipulating him “because he listened to all the stuff that I had talked about at Defcon and used it,” or “maybe all the stuff that I had said at Defcon was because I was basically just taking the same [expletive] that this guy had been doing for months, maybe even years, on 4chan. And just said it one more time.”
• The Q expose (20:08). “Thomas Schroederberger gets me to go on Douglas' channel, do this little Q expose,” and the next video, he says, tells that audience to discount him.
• Scope (33:45, 34:50). “I want no more puzzles. No more Cicada 3301.” “I'm not going against the QAnon people here because I'm only really exposing Thomas.”

Why it matters. Six weeks of email show the group treating him as removed, and here he is on camera that same day treating himself as removed, over pay and credit. And on May 7, 2018 he does not say he created Q. He says people around Thomas told him they were behind it, and he floats that his own DEF CON account was Thomas's 4chan material repeated. That is the opposite of the creator story in chapter 11, and it sits three years before “I was the one that used the q thing” (below). It also fits his public replies of Feb 12 and Apr 30, 2018, which credit Cicada with the start.

The email he means (17:47). Documented Thread 1636f0331cd14c0f, “Fwd: Dear Professor,” reached my inbox on May 17, 2018, a forward of a forward. Its oldest layer is dated Nov 28, 2017. At 4:38 pm the account “Th Stg” (tstger13) writes to Monty McGovern, whose address is at the University of Washington mathematics department: I knew you would improvise. Their heads are spinning. At 4:43 pm McGovern answers, calling him “Tom”: Q has a life of its own now. Its delightful. Shall we let it grow organically? What else can I do? “Th Stg” forwards it to a third person the same evening with “he he he.....”

Defango had it in January. Documented On Jan 3, 2018 he posted “CBTS General #276: Pray To Channel Good Energy Into Posts AKA DEFANGO Edition” to Steemit (category qanon, posted through the steemauto tool; permalink cbts-general-276-pray-to-channel-good-energy-into-posts-aka-defango-edition-1514976917). In his own lead-in he says a “3301 contact” gave him Q's “name and email” about two weeks earlier, that the person “was having a good time and it got almost a mind of it's own,” and that he “was suppose to stop, but kept it up.” He then shows the end of the email above, links his tweet 948400293724614656, and writes: He means us. This implies that the Proff made the Qdrops. So four months before the livestream he was telling the Q audience in public that a mathematics professor was behind the drops. On May 7 the video puts that claim in Thomas's side's mouth.

That post makes the email's text independent of my copy: it was public on Jan 3, 2018, not first seen in a forward that reached my inbox on May 17. It is still a chain without original headers or message IDs, I have not opened the tweet, and the post quotes only the last line. The post also puts the professor “at Cambridge Mass,” which is wrong (the address is Washington). The email does not say who posted as Q, and the word “tripcode” is not in it. Defango's paraphrase on the tape (“the Q thing's going really well”) is not the email's wording; I recognize it as the one he means.

Witness reading · Arturo Tafoya · UnverifiedOn the tape he says only “the password,” shared with him in October and not cracked “until November.” That is the Q tripcode, “Matlock,” the only one Q ever had. As I recall, Defango has long claimed he himself leaked it; I have not attached a source for that. The email above is dated the same November. Q's own drops, as Defango reposted them, fit: Jan 4, 2018, “Previous pw was let go”; Jan 10, “Matlock meant to become PUBLIC.” They do not say who held the password. In his later account (chapter 11) the release belongs to Microchip, not Thomas. McGovern is a University of Washington mathematician. Research in 2022 looked for a link to Ray McGovern (the Unity4J / Binney circle) and found nothing solid, so none is asserted here.

What the video documents is that he said these things on May 7, 2018. The allegations in it (stolen money, bought subscribers, who steered whom, who claimed Q) are his claims and stay Claimed; this file has nothing independent on them. Who “he” is at 17:03 is clear only from context (Thomas). Third parties and family he mentions in passing are left out.

The clip. 1 min 49 s, cut from the full stream; it starts at 16:46 of the original. In the clip: “the whole QAnon situation blew me away” (0:17), “he knew the [expletive] password” (0:42), the McGovern email (1:02) and the DEF CON line (1:32). Captions are from the author's subtitle file. His claims, not findings.

Online expose day. @defangog (Defango Gaming), streamed live May 7, 2018 · 50:52 · the player starts at 17:02, just before “the whole QAnon situation blew me away” (other points: 18:07, 20:08, 33:45, 34:50) · Watch on YouTube ↗

Promoting Q, in his own feed

Defango told Business Insider he had “never promoted the QAnon movement whatsoever” and had “only ever made videos trying to debunk it.” His Steemit blog (557 posts, Nov 2017 to Dec 2021, pulled from the Steem blockchain, which keeps the timestamps) reads differently for the first months of 2018. About 56 posts are filed under the qanon category, 49 of them before May 2018.

• Dec 2017 – Feb 2018. More than a dozen numbered “CBTS / Q Research / Storm General” threads, reposted through steemauto: Q's drops, the Q map, and on Jan 20 (#121) “Current Tripcode: !UW.yye1fxo … Q's Current Tripcode appears close to being cracked.”
• Jan 10, 2018. “The Storm is Here | Qanon Understanding.” His own opening: “Here we are exploring the history of Qanon and now things have shaped up since that faithful [sic] day at Defcon … I hope their will be no more troubles in the motion of draining the swamp.” Then the community text: “We are the Storm, and we are the Calm Center inside it.”
• May 8, 2018. “Online expose day 1 for 2 qanon and Cicada 3301”: QAnon is in the title, the body is about Thomas.

The record is mixed, and the entry should say so. The same feed carries “Q the Fake 8ch.net move” (Nov 27), “Qanon Community Divided … DISINFO Overload?” (Nov 29), “Qanon Exposed” (Jan 2) and “Qanon Goodbye” (Feb 20). The numbered threads are copied community posts, so what this shows is that he posted and amplified them, not that he wrote Q's text. Debunking and promoting sit side by side in one feed, and “only ever” debunking does not survive that.

Source: the Steem blockchain via api.steemit.com (condenser_api.get_discussions_by_blog, tag defango). Category counts are the chain's own category field; the dozen-plus and 49-of-56 figures are mine. Quotes are as written, typos included.

ShadowBox Strategies: paid work, on a filing

In the same months he now describes as trolling, Chavez is on the Delaware filing for ShadowBox Strategies with Thomas Schoenberger, Beth Bogaerts and Trevor Fitzgibbon. The first client is Ed Butowsky. Eighteen days after Butowsky signs, Schoenberger and Chavez each receive $5,000 from client fees, and Bogaerts sends $5,000 to Fitzgibbon in the same window (chapter 14). The Daily Beast later documented the September 2017 Dallas meeting that preceded it.

A retainer, named funders, documented payments and attendees are not a LARP. They are a vendor relationship with a client who needed a reputation repaired after the Seth Rich story collapsed.

Disclosure · Arturo TafoyaThey asked me to design the ShadowBox logo, and I did. I said so publicly in 2022 (CICAP Query No. 48), and I'm saying it here so nobody else gets to frame it.

The Dallas meeting, weeks before the filing

The Daily Beast reported that a group met outside Dallas in September 2017 to talk, among other things, about answering online critics of Ed Butowsky after the Seth Rich story fell apart. According to Butowsky, those present included Thomas Schoenberger, Chavez, Matt Couch and an associate, Joe Burkett (Lara Logan's husband), Malia Zimmerman and Trevor Fitzgibbon. Three attendees told the paper the group discussed wiretapping Rich's grieving parents. In a sworn deposition Schoenberger described it as wanting "ears in every room."

The ShadowBox Strategies filing (Oct 3, 2017) names three of these people (Schoenberger, Chavez and Fitzgibbon), so the meeting sits shortly before the company. What the report establishes is who was said to be there and what three of them said was discussed. It does not say anyone carried the plan out, and neither does this file.

Daily Beast, "Right-Wing Activists Discussed Wiretapping Seth Rich's Family, Three People in the Room Say" (Feb 2020; also on Yahoo News). Attendee list is Butowsky's account.

Steele on his show four times, "the greatest information operation of all time"

In late 2017 Chavez hosted Robert David Steele on his channel four times. In those episodes Steele calls QAnon "the greatest information operation of all time." Three years later Chavez told Business Insider he had "never promoted the QAnon movement whatsoever" and had "only ever made videos trying to debunk it and get it shut down."

The episodes are public videos. This entry moves to Documented when the four video links and dates are attached, per the file's own rule. Until then the Steele quote and the count are mine.

"I wrote half of the questions" — and the Q side's answer

In a clip of his own words played on Lift the Veil, Chavez says: "I wrote half of the questions that this dude asked on the message board, but I didn't type them in and put them out myself," calls Q "a group of people that work together to see what we could do with individuals online," and says the idea came after DEF CON, talking to "some people, feds, not feds."

On Col. Roy Potter's show, Paul Furber (BaruchTheScribe) answers him point by point. Caller identified by the author This is the same Furber whom chapter 9 files as the forensically established lead author of the Q posts. Chavez, he says, claimed on a January 1 livestream to be "part of a team that wrote" Q, but "He doesn't have anything to do with Q. I think he's just jumping on the bandwagon." On the document Chavez posted as proof: it was "created in July, but it was edited later," because it asks about George Soros moving his money into a non-profit, "that didn't happen until October." "That document is a lot of rubbish."

Both are Documented as things said on camera. Neither is adopted. Furber's dating argument is his. Put them beside the posts below: by February 12, 2018 Chavez is telling Roy Potter by name that it was "Started by 3301 … Then subverted." One more version, for one more audience. Clips via the sloppy socrates channel, re-uploaded Feb 14 and 16, 2018.

The claim. Chavez, played on Lift the Veil, 89 s.

The answer. Paul Furber (BaruchTheScribe) on Col. Roy Potter's show, 2 min.

Two 2018 posts: "Cicada 3301 started it"

Months before his removal in May 2018, Chavez says in public, twice, that the thing began with Cicada and that Q was something else. On February 12, 2018: "All road lead back to one place and its a narrow road. Started by 3301 and ended. Then subverted by U." On April 30, 2018: "The reality was that cicada 3301 started it … Its not the same q and anyone with some logic can see the change in linguistics."

Set these beside the later stories in this chapter. In 2018 he credits Cicada with the beginning and treats Q as a different voice. The direct messages below have him saying he was "the one that used the q thing."

"Lestat I was the one that used the q thing"

A direct-message exchange between @defangolives and me, in which I ask him to keep Cicada and Schoenberger out of his Q story. Chavez: "Lestat I was the one that used the q thing," then "If anyone goes down it's me and that was the plan all along," and, told Schoenberger had been missing for five days, "Hes probably in jail." The thread shares the Daily Dot's "These LARPers Say They Created QAnon" piece; the year is not shown on the captures.

The Evolution of an Alibi. Defango’s DEF CON 2017 origin story, the unrecorded “Sky Talk 303” briefing, checked against what the conference footage actually shows · Watch on YouTube ↗

My Discord DMs with Defango, 2017–2021

Two records of the same direct-message channel. Discord's data export of my account holds every message I sent Chavez, my side only. A capture of the live channel, made in October 2026, holds both sides for July 2017 to December 2018 and June 2019 onward; it shows nothing between July 2019 and June 2021. His words below come from that capture.

2017, working for OHM. In August 2017 he gives me a login to the WP Engine back end of OHM's site, and over the autumn I build pages and CSS for him. In November 2017, two weeks after the first Q post, I show him a teaser I made for Thomas, and he asks: "you and T doing something with ANON?" I answer "i dont think its anon … it could be miss leaded to think its ANON," and he asks "what then cicada?"

July 25, 2018, Unity4J. I warn him: "unity4j is a scam bro its rotten to the core its handled by the same people behind Qanon." He answers: "nope. It run by suzi3d," and of Pistis Sophia, "PS just showed up like the rest." I lay out what I saw on the stream and the site, and tell him the money "is not going to Assange."

Dec 24, 2018: "Dude I started q." In a call-and-chat fight over what I was putting out about Thomas Schoenberger, Chavez writes to me, in private: "Your like fucking up 2 years of worknhere," "Dude I started q," "I did it to get those gaia guys and Thomas to steal it," "Q did have the cicada connection in the beinging. It was my brood. I made the brood," and that when he "got them to stop posting," Schoenberger, Pistis Sophia "and all of them jumped in." On Unity4J: "Suzi dawson started it. Then Thomas group tried to get in." That part matches the public record: Suzie Dawson organized #Unity4J. Forty minutes later: "you gotta just stop for like a week. Let's plan out these drops a bit better."

His words, said privately to me, with no audience to perform for. That does not make them true: it is one more version, next to the "half of the questions" on camera and "the one that used the q thing" in the DMs above. What "drops" meant there, his Q story or my videos, the chat does not say. My replies, in the capture below: "i know im not talking about q," then "i agree" after the Cicada and "brood" lines, as I moved the talk back to Pistis Sophia; and, that evening, "I never denied you comming up with Q or whatever." I was not disputing him in the middle of a fight about something else; it is not a confirmation, and "or whatever" says how much weight I gave it. The same night I tell him Thomas "has been stripped of any type of power over cicada" and that any money should go to people Cicada had hurt, "like … defango that lost his job because of thomas." Days earlier I had sent him the vector file of a "qMAS" Christmas design I made; he put it on his Streamlabs.

2019, paid work, and how it ended. From April to May 2019 I am chasing him for weekly payments, "last week you send no $," and for the rest of a deal I remember as "2k," for "the videos I made for [A.]." In June it breaks down, and here both sides are on the record. Chavez: "So you back to your old ways after taking 2k from me and not putting up any work," "We still expect the video files since we paid you," and then: "Im talking to [A.]. The Directives where clear. You needed to not talk about the puzzle, [A.] or me." He tells me to "register your coinbase and get paid by [A.]." A. was the man behind a crypto project called Resistance coin, and he would only pay in Ethereum. Identified by the author My last word, July 19: "send via email what you need and ill do it ive already said this to you [Z.] and [A.]." I put this here because it is mine to disclose: it was a paid arrangement, and by his own account the pay came with a condition of silence about "the puzzle." What "the puzzle" meant is his word, not explained in the channel.

2021. In June I send him two clips, lala-defango-q and defango-claims-lala-is-q, and book him for The Farm podcast on July 2. That night he sends me the episode I had already done there, Inside Cicada 3301 & QAnon w/ Lestat Recluse: "you guys didnt seem to like me much." The last messages, on February 9, 2022, are "Discord Nitro Generator" spam I never wrote: the day my account was taken over.

Held back: private people in these messages, and one April 2019 message about "scheming" against the Q symbol, whose context is not in the export.

ArcadianArt: "Thomas … Please man stop this"

ArcadianArt is an artist who came into Thomas Schoenberger's Cicada circle the way I did, through the Sophia Musik channel. My Discord DMs with him run from February 2018 to February 2019; a capture of the live channel holds both sides. In March 2018 he is still asking whether Thomas "left the group," and calls it "troubling to think that cicada as a group hold a bond that can be so easily broken." Then he goes quiet until December: "From the beginning it's been a lonely experience for me … What was hard was sitting silent and pretending for so long."

On January 7, 2019 he sends me two screenshots of messages he says he wrote to Thomas, marked "10 months ago" and "1 year ago," which puts them around early 2018. The first: "Thomas, we need to talk. I know you have your ways but don't you think this Q mess has gone on enough. Good people have faith in everything that is surrounding the Q drops. If this is a larp you are going to break these peoples will in believing any source of truth. It can damage even Wikileaks … Please man stop this." To me: "before I even met you I was already aware. From the very first day."

Over the next weeks: "Q is a psyop Thomas ignored my plea to stop such a campaign," "I am not sure why T pushed for Q but it seems we both have the same suspicions," "We must find a way to combat the q op," and of Defango: "Defango and Thomas still working together," and he "floated his lips that he stared it all with cicada members at defcon but now it's a different spin."

What this is: a person inside the same circle, writing at the time, who believed Thomas could stop Q and asked him to. It is his belief, not proof that Thomas ran Q. The dates of his messages to Thomas are worked back from "10 months ago"; Thomas's answer, if any, is not in what he showed me. Left out: his accusations against other people, and a claim about his own computer being broken into.

Valor (intelvalor): "I told everyone a month before"

Valor, on Discord intelvalor, was another member of Thomas Schoenberger's Cicada group. Our DMs open on May 12, 2018, the month Schoenberger stayed at my family's house in Ensenada; by my account Valor was in contact through what happened there. Author's account A capture of the live channel holds both sides for May 2018; my own Discord export holds my side through September 2020.

On May 28, 2018, days after Defango's public break, he writes: "I told Everyone a month before he did what he did that we should have a page prepared for when he does and not respond," and about a line of his own, "I wrote that a month before defango went rogue." He adds that Defango "does not even know that I'm a member … I am a private individual," and that "Cicada is so much more than Money … It is purpose."

He also appears, as a tile named "Valor," in the video call where Defango's "I wrote half of the questions" clip was recorded (above). Identified by the author

In December 2018 I write to him: "im sorry fo what thomas did for you as well … good thing thomas has no more power," and that I "pushed thomas when he threaten me with a pgp 'youre fired' letter."

September 5, 2020. Three days after my first email with Jim Stewartson (chapter 24), I ask Valor to go on record: "you once told me that you were willing to go on record to stop Q from spreading," "we have a real opportunity to expose Thomas operation," "I'm working with a msm reporter," and "I'm not trying to prove you were Q … I know he uses other people, you told me this already … we just need to prove that Thomas was the original Q." His replies from that night are not yet in the capture, so this records what I asked and what I said he had told me, not his answer.

"My guys": CJ, Lala and the brood

Two direct messages between Thomas Schoenberger and Defango, shown on camera, name the accounts around them. In the first, Thomas, writing as "Stealth", tells Defango: "I had CJ, Maga, Dual, Flynn etc come out and defend you. I am restrained legally. Biss wont allow me … but I have my guys doing it." "Biss" is the lawyer named elsewhere in this chapter. The names are accounts he lists; who sits behind each is not in the message.

The second, a Twitter DM with the account Lala Shadilay (@ShadilayLala), appears on a livestream whose chat mentions the Paradise Papers, which dates it to around November 2017, weeks into Q. The sender writes "Brood 1 2 3 are now active," "Q brood has been active and is now posting information. The others are coming soon," and "Dont you see defango in the posts"; Lala answers "we're ready and have already prepared for more," then "10/4." Defango put it on screen during his own stream as one of his DMs, so the blue side is his account; I identify Lala as Thomas. Identified by the author "Brood" is the word Defango used to me in private a year later: "It was my brood. I made the brood" (above). Lala is also the account behind the "KevinFlynn" Drive folder filed under "How Cicada was turned into Q" (Unverified), and Defango later claimed on stream that Lala was Q.

The same Lala ran as Cozy Shadilay (@ShadowOp1), "Crim.Justice & Intel Major … This might be PsyOps satire," with a pinned post naming "Admiral Rogers and General Michael Flynn … WE ARE FELLOW WHITE HATS," and a profile link to wrongthink.net/ShadilayTrooper. In September 2020 I told Jim Stewartson that "Cozy Shadilay = Cozy lala" and that on wrongthink "all of them collide." The bio link is the account's own.

CJ is @CJohns555, an account that ran under the display names ReleaseTheTexts, ReleaseTheMemo and MacedonianTrollFarm. It posted "Anthony Weiner's contact list. 1St of 12 drops of the Weiner Files. More to come" (the list itself is blurred here), traded replies with @__0HOUR1_, and was flagged by the Botcheck.me classifier for "propaganda bot like patterns." Thomas, in a post filed in chapter 9: "I never posted on 4chan. That was CJ and Pepe etc."

Thomas's three versions. In a compilation of his own appearances, Thomas tells the @IWillRedPillYou story three ways. On HBO's Q: Into the Storm (ep. 5), Courtney Tubbs, a writer for the Watkins-owned Goldwater whose bio lists 8chan, "was in a chat room and asking me, what do you mean by this puzzle?" In another: "September 22, 2017 … a chat room with maybe 30 other people … that includes Rabbit … an account called I Will Red Pill You that we now know was Jim Watkins' account." In a third: "late August and early September 2017, she was in a chat room with a fellow named Charlie … more of an observer and taking notes … I also believe that Tracy Beanz was in the room." Charlie is CJ. Identified by the author The person, the account and the date move; in each version Thomas places himself in a room with the Watkins side weeks before Q.

Three versions. Thomas on VICE, HBO and other shows; edited by the author, 6 min.

Read together: Thomas says CJ is among "my guys"; Thomas says CJ, not he, posted on 4chan; and a DM I identify as Defango and Thomas talks about a "Q brood" now "posting information." Each piece is tagged at its own level. None of them alone proves who wrote any Q post.

Thomas to Defango: "Q has run its course"

One month into Q, Thomas, as "Stealth," writes to Defango on November 29, 2017 at 1:08 PM: "There has not been one update on Q since the 25th when I told you there will be no more. The only real update is Bernie Cornfeld … There will be more Hollywood bombs, but under a new name. Q has run its course and we cannot risk being compromised." He goes on to push Cornfeld as the real story.

Read it for what it says, not for what it proves. Thomas writes as someone who knows in advance when Q will stop, who says "we," and who talks about a "new name." Six months later he told me, in the email filed above, that "we had planned to intro Q Sept 26th." Whether Q's posting actually followed his schedule is a separate question; this DM does not answer it. What it shows is the voice: he speaks to Defango with the authority of an insider.

What the YouTubers say about Thomas

A compilation I edited of people who dealt with Thomas Schoenberger describing it in their own words. Everything here is their account, on camera; this site does not adopt it.

• Nathan Stolpman (Lift the Veil): Defango "was recruited to work on cicada, to promote cicada … to find smart people who then are also recruited," and "they tried to recruit me … the same guy is attached to these puzzles." Later, on his "Schoenberger Effect" show, he describes a breakdown he puts down to "fake Twitter accounts, articles about me … bot armies."
• Jesse Spots: the community is "only now starting to weed out Thomas Schoenberger's influence."
• Treach Renfro: Thomas sent "emails … directing me to scrub screens, scrub comments out of chats and block people … that didn't suit his narrative. I refused," and "I'm at this brink where I either join teams with him, give him my PayPal, let him put me on his payroll, or he's gonna keep attacking me." He also says Thomas sent his family threats.
• Cory (The Phoenix Enigma): "four people that are terrified … who do not want their names uttered."
• VICE: asked about Thomas, two interviewees, one of them Robert David Steele, refuse: "I'm not gonna talk about that individual."
• Zach McQuaid, to Cory: Thomas "was just sending it to me in his own text and email and then I was putting it into video format … and putting it out as my own work," and "he had people pay me, several people … Michael A. Levine" among them. That lines up with the Levine payments in chapter 9.

The second name. Zach names a second payer, "Jonathan Wolf … Alex Jones' cameraman." His words There is published reporting on a Jonathan Wolfe. Right Wing Watch (Jared Holt, Aug 17, 2020) reported that Wolfe, a jib-camera operator who ran accounts as "JibCamera" and "ghostcrab," said in a recorded Discord chat "Yeah, I work at Alex Jones," shared behind-the-scenes photos that appear to come from an Infowars set, and "repeatedly defended Schoenberger." Infowars did not confirm his employment. Thomas told RWW "Jib" was "a random who sometimes defends me and at other times does not," but in a 2019 email Thomas had included Wolfe's address and referred to "Jib" as part of a "team"; confronted with that, he again denied knowing him. Right Wing Watch ↗ Reported The reporting supports a tie between Wolfe and Thomas; it does not report any payment to Zach.

Some speakers go further, about Isaac Kappy's death. Those statements are left in the video as they were said; this page does not repeat them, and nothing here supports them.

In their words. Lift the Veil, Jesse Spots, Treach Renfro, The Phoenix Enigma, VICE; edited by the author, 13 min.

Two admissions in two sentences — and a disclosure

On a roundtable hosted by Stephen Snyder (Recluse) on The Farm, with Dave Troy and me as the other guests, Chavez spent two hours on the Microchip / DEF CON / Discord version of the story. When he sourced Microchip to "the anime right on Discord … this other place called Outer Heaven," my reply was one line: "It just counteracts; it counters with what we have in evidence." Later, offered as a defense of himself:

First: "we didn't do anything" becomes "the only person who did anything was me" inside one paragraph — he was the hand on the Butowsky work. Second: he subcontracted what he could not do. That is the pattern with every operation he has claimed authorship of: no skill, so the skill is hired, so the work happens, so it is claimed later.

The Stewartson call: what he said when he thought he was among friends

The recording runs several hours. Jim Stewartson had been working with him and had not yet pushed back. When Stewartson finally asks whether telling a sixty-person room to run "a giant psyop on the American people" was a good idea:

The man who told Business Insider he "never promoted QAnon" says on tape that he still thinks the operation was a pretty great idea, in Q's own vocabulary. And he places Schoenberger and the Fried Organ account in a working collaboration four months before the first drop — consistent with this desk's position since 2017, and inconsistent with every version of "I bailed."

On Fried Organ itself this file stays where chapter 16 put it: the identity is unresolved and carries no weight here. What does not depend on resolving it is Chavez's own June 10, 2021 mass-mailed evidence dump (thread 179f6745a0efa269), in which he writes that "Fried Organ is a member of the Cicada Org and was being used to make videos and other content in 2017 prior to the emergence of Q." Whoever it was, his own evidence puts it inside the group before Q — which is the opposite of an outside Microchip handoff.

The handoff every version depends on: three lines from his own mailing

Each version of Chavez's story needs a handoff. In 2017–19 he made it; in 2020–22 "Microchip" took it over and he left; in 2023–25 an outsider such as Justin McConney ran it. All three need Microchip to be someone outside the Cicada group. The mass mailing of June 10, 2021 (thread 179f6745a0efa269), which he sent to journalists and academics to prove his account, says three things:

Read together, his own lines put the Fried Organ handle inside the Cicada organization before the first Q post, and tie the voice he heard to "Richard." That is the opposite of an outside handoff. The "Microchip" name does not appear in my archive from the Cicada lists in 2017 and only turns up later, after Q was public.

This desk's working read is Richard Miller, one of the three attributions listed at chapter 16, and it stays there: a handle can be claimed by anyone, and "sounds exactly like" is his impression, not an identification. The point that does not depend on settling it is that the document he mailed out does not support an outside Microchip.

"Sent in to play Casanova and poison the well"

In April 2024, while Laura Dilley and I were still in active research correspondence — the relationship that had produced the peer-reviewed paper acknowledging my work — Chavez messaged her on his own initiative. Before the conversation moved to Signal voice, he wrote that I had been "sent in to play Casanova and poison the well." I had warned her not to engage him; she acknowledged the warning and moved to Signal anyway.

This file does not litigate Schoenberger v. Dilley here, and I am not a party to it. The point is narrow and dated: in the months before that suit was prepared, a fact pattern casting me as a bad-faith plant — rather than the documentarian the academic record already showed — was being seeded privately, by the man whose accounts this chapter tracks.

Joe Flynn names Defango as Q — and Defango names the Flynns' lawyers

On September 21, 2023, Joseph J. Flynn posts that Q "ain't Mike Flynn … he knows it's Defango and that crew." Chavez's own later replies go further in a different direction: Joe Flynn "did ask me but I ended up not doing it," and the Flynns' lawyers "took on Thomas schoenberger as a client." Asked for proof, he points to the Binnall Law Group cease-and-desist sent to Dilley on Schoenberger's behalf before the MSU suit, and says it is why he withdrew his deposition.

Both are claims by interested parties, filed at that tier. What they add is the direction of travel: the lawyer link this desk maps in chapter 14 is one that Chavez himself asserts.

The Cornwell Biss livestream, and why attacks keep backfiring

Tanya Cornwell Biss co-hosted a livestream with Chavez attacking me by name. The stream is documented; its place in the Cornwell Biss → Steven Biss → Binnall Law Group → Schoenberger v. Dilley path is this desk's mapping, set out in chapter 14 — the public predicate at the front end, the filing at the back.

What happened next is the useful part. Viewers told there was a Mexican researcher with documents the hosts wanted discredited went looking for the documents, and found the public archive. Some came back changed. The attacks generate visibility; the visibility surfaces the evidence; each round produces a small cohort who actually check it.

Griftcast

Since about 2021 he has operated as Griftcast — podcast, YouTube and the X account @Griftcast, formerly @Defango — mostly gaming and internet-drama streams, with 2023 guest spots in the anti-woke commentary circuit (the Chrissie Mayr Podcast, Simpcast). The relevant fact is the repositioning: from anonymous-adjacent origin claims to a named personality, with the QAnon material kept on the shelf for when a reporter calls. Whether the name is candid branding or a very good joke, this desk has never been sure.

"You were the friggin strategist": Defango on AIM

Douglas Gabriel opens the show: "This is Thomas Payne… also known as Douglas Gabriel and I am here with Defango." He says he "got contacted by Q," that he has "made a huge mistake," and then tells his audience that Z had just confirmed on the phone that Defango is "connected to him, to the group, to the people who created the original Q… You were the friggin strategist. That's what he just told me."

AIM itself later wrote that "Douglas only talked to deFango one time — Douglas and he did an audio a while back" (May 6, 2018, below). Author’s account For me this was the break. AIM's audience was large, and this was a known outlet putting Defango's "we made Q" story on air, with Z's word behind it.

The opening. AIM audio, 83 s. The still is AIM's own thumbnail for the episode.

Then AIM calls Q a psyop, and says it never knew Cicada

Within weeks AIM turned on Q in public: "Patriots Shut Down Q Psyops" (March 28, 2018), "Q is Dead" (March 29) and "Were you conned by the Q psyop?" (March 30). A reader's comment on the last one describes an AIM video, by "Thomas and Betsy," that opens with Cicada 3301's 2017 puzzle and runs Q posts beside it.

On May 6, 2018, AIM answered in the comments under its own name ("Our Spirit"): "we do not follow Q because it is a psyop and a waste of our time. But it was fun to post the Cicada video as we absolutely adore Sophia Musik channel." It says it "didn't know about Cicada" until someone showed it a Q-board post with AIM's name on it, and that its Glass Bead Game was "established on our websites long before we knew what a Cicada 3301 or deFango were." The next day a commenter signed "Thomas Schoenberger" wrote: "I don't follow Q, but I do follow AIM and enjoy their insightful articles!"

One week later: a "bridge" for people playing the Q puzzle

On May 13, 2018, Schoenberger introduced me by email: "Douglas, Arturo is Cicada's video genius. He is also a fan of your show!" Two days later he told me to show my first draft "only to bryan, not doug."

The brief Tyla Gabriel sent for the first video (written May 9 for another of Schoenberger's video makers, forwarded to me June 1) says what it was for:

• "a 'bridge' for folks that had been playing the Q puzzle or for those who want to play something as mysterious and thought-provoking as Cicada 3301"
• "we wanted to use the same videographer as Thomas' so that it had a similar 'feel' to Sophia Musik or anything you have done for Cicada," with music "Thomas has given us permission to use – Adagio."
• "We, too, can have our secret societies that they don't know about… Bring ten people into the game."
• The last frame must read "Come, play the Glass Bead Game with us," signed Tyla and Douglas Gabriel.

I made that video. My drafts went to her on June 1, 2018, and she asked for the closing invitation and the words "solve the enigma." Author’s account I made it while Schoenberger was staying at my house, pressing me to finish it. All he gave me was the MP3 of the music. I never saw him compose it. Tyla's reply the same day: "WE LOVE YOUR WORK." On June 1 she added: "The game is about discovery and we have spent 6 years leaving breadcrumbs all over the internet," and "Thomas might have a deadline for introducing the new Cicada game which is cool when we tie our Glass Bead Game to your puzzle." She wrote that she had paid Schoenberger $400 for the video, with $200 more on completion. In July, for a second video, I passed on his suggestion of $600 split evenly between us, and she copied him "so we are clear." In September she called the work "glass beads" for "Sophia's Temple of Wisdom in cyber space."

The video. "Come, Play the Glass Bead Game with us," 4 min 20 s, my work. Published June 15, 2018 on Tyla Gabriel's Gospel of Sophia channel; its description links aim4truth.org and patriots4truth.org. On October 28, 2026 the page showed 9,015 views and 131 likes, and YouTube's music panel credits the track, "Adagio," to Thomas Schoenberger (album Heaven).

Under the video, the channel answers a viewer's "What is this music?" itself: "A haunting piece by Thomas Schoenberger. See his channel at Sophia Musik." An account named @3301ORCHESTRA writes "Magical. Thank you," and the channel replies "Yes, you are part of our family." In the same thread a viewer thanks the account as "Sophia Musik" and asks whether the track sounds like "your music of Liber Secundus"; it answers as the composer: "I think the two melodies are different… Feel free to compare." That account is his own channel: on October 28, 2026, @3301ORCHESTRA is titled "Thomas Schoenberger," with a "3301" banner, about 123,000 subscribers and a link to his own site. YouTube ties a comment to the channel that posted it, so the "family" reply went to him. Viewers' handles are blurred.

Set beside the May 6 comment, it reads differently. Publicly, AIM did not follow Q and had not known Cicada. In private, a week later, it paid Schoenberger to have Cicada's video maker build a bridge from the Q puzzle into its own game. Paying for a video is not wrongdoing. What the emails fix is the purpose they stated, in their words. They are also the source of the "six years seeding clues" line in Dilley's 2023 book proposal: Tyla wrote it first, in 2018, about her own game.