On Monday, Karim Baratov went to the gym, a local GoodLife Fitness near his home in Ancaster, Ont., a suburb of Hamilton, where the 22-year-old is said to have gone almost every day.
He seemed "normal" said a friend who went to high school and worked out at the same gym as Baratov, who was seemingly without a job and appeared to have a suspicious amount of wealth.
"Super friendly, a little odd, but came up to you every time and shook your hand," said James, who asked that his last name not be used.
The man expected to see Baratov at the gym on Tuesday, but he never showed up.
Friends soon learned he was arrested Tuesday morning at his home in Ancaster, Ont., by Toronto police. On Wednesday, he was indicted by the FBI, accused of being part of an international criminal conspiracy along with a pair of Russian intelligence officers and a fourth man in the massive 2014 breach of information from former tech giant Yahoo.
Jag Virk, a criminal lawyer who briefly represented Baratov after his arrest, told CBC News the Canadian citizen who has roots in Kazakhstan "maintains his innocence."
But when Baratov's friend from the gym saw the news about his arrest, he said, "It kind of just clicked right away. You're like, 'Well, that makes sense.'"
Baratov is being held in custody — it is not clear where, or by whom — and is set to appear via video link Friday in a Hamilton court. The U.S. is seeking to extradite Baratov on charges that include computer fraud and identity theft.
He is being represented by criminal lawyer Amedeo DiCarlo, who was retained by Baratov's family on Tuesday after his arrest.
Rumours that 'he was a hacker'
Late Wednesday evening, the friend said Baratov's arrest was the talk of the gym that day.
"Literally everybody I talked to was like "well, I guess it caught up with him" or 'That makes sense, I guess we knew where he got all the money for his cars,'" he said.
He described Baratov as a flashy but nerdy guy who used his money to buy both cars and friends — behaviour that dated back to their time at Ancaster High School.
"I had heard multiple times before this that he was a hacker," the friend said, recalling that Baratov would only ever say he ran an online website. "But to this extent, nobody would ever expect it."
Virk, the criminal lawyer, said he was was briefly retained by Baratov on Wednesday, and met with him that day. "He's obviously very scared, very stressed out. He's trying to be strong," Virk said.
By late afternoon on Thursday, Virk said that DiCarlo would be "the only lawyer on this case moving forward until further notice."
Earlier in the day, Virk told CBC News in an email that he believed "the charges against [Baratov] may be politically motivated by the U.S."
"He is a 22-year-old young man with no criminal record. Everyone should wait for the facts to come out before rushing to judgement," he said.
"Donald Trump is trying to make it appear like he's going after Russian hackers, but he's going after a 22-year-old kid from Ancaster," he later added via phone. "He's being used as a scapegoat."
For what, exactly, was not clear.