The 764 Network

Overview

Somewhere on a Discord server right now, a thirteen-year-old with depression is being told by a stranger that someone finally understands them. That stranger is patient. They are warm. They know exactly what to say because they have done this dozens of times before. Within weeks, that child will be producing images of self-harm on camera. Within months, they may be carving a stranger’s screen name into their own flesh with a razor blade. If they try to stop, the stranger will threaten to send every image to their parents, their school, everyone they know.

This is the 764 network. Not a conspiracy theory in the speculative sense — a confirmed, documented, and actively prosecuted transnational criminal enterprise that the FBI has elevated to “tier one” investigative priority, the same classification reserved for terrorist organizations and hostile nation-state intelligence services. The U.S. Department of Justice has roughly 250 open investigations across all 55 FBI field offices. Canada has designated the network as a terrorist entity. The U.S. State Department has designated the closely allied Terrorgram Collective as a Specially Designated Global Terrorist organization.

And most parents have never heard of it.

The 764 network represents something genuinely new in the taxonomy of organized cruelty — a decentralized digital cult that blends the coercive control techniques of NXIVM or Heaven’s Gate with the operational security of a terror cell, the recruitment mechanics of online grooming rings, and the ideological window dressing of neo-Nazism and accelerationist violence. It operates across platforms that millions of children use every day — Discord, Telegram, Roblox, Minecraft — and it has learned to exploit not just the children themselves but the algorithmic architecture of social media designed for engagement at any cost.

The 764 network is classified as confirmed. Its existence, methods, and criminal activity have been documented through federal indictments, guilty pleas, international law enforcement cooperation, and the testimony of survivors. What remains under investigation is the full scope of the network — how many cells are active, how many victims exist, and whether the organizational structure can be meaningfully dismantled given its deliberately decentralized design.

Origins: From CVLT to 764

The 764 network did not emerge from nothing. It evolved from a precursor group called CVLT, an online community that coalesced around 2019-2020 on Discord and other platforms, trafficking in edgelord aesthetics, gore content, and increasingly serious discussions of real-world violence. CVLT itself existed within a broader ecosystem of “com” communities — shorthand for “community” — that had been festering on Discord, Telegram, and various forums since the late 2010s. These com groups varied in severity from trolling and harassment to genuine criminal enterprise, but they shared a common culture: irony-poisoned nihilism, competitive cruelty, and the belief that inflicting suffering on others — particularly vulnerable people — was a form of status.

In 2021, a figure using the alias “Felix” — later identified by federal investigators as Bradley Chance Cadenhead — reorganized elements of the CVLT community into a more structured operation that would become known as the 764 network. The name itself is believed to derive from an area code or numerical identifier used within internal communications, though its exact origin remains somewhat obscured by the group’s deliberate mythology-building. Cadenhead brought organizational discipline to what had been a loosely connected scene. Under his direction, the group developed standardized grooming methodologies, established hierarchies of command and control, and began systematically targeting minors.

What Cadenhead understood — and what makes the 764 network different from earlier online predator rings — was that the operation could be structured like a franchise. There was no single server, no central headquarters, no physical location that could be raided. Instead, cells operated semi-autonomously across multiple platforms, sharing techniques and victim material while maintaining enough separation that taking down one node would not compromise the others. It was, in organizational terms, a terrorist cell structure applied to child exploitation.

The ideological veneer that Cadenhead layered over the operation was deliberately eclectic: elements of neo-Nazism, Satanism, accelerationism, misogyny, and nihilistic philosophy borrowed from figures like the Terrorgram Collective’s propaganda. But federal investigators and researchers who have studied the network emphasize that ideology is largely instrumental — a recruitment tool and bonding mechanism rather than a sincere belief system. The core motivation is simpler and darker: the exercise of absolute power over the most vulnerable possible targets. The ideology provides justification and group cohesion. The sadism is the point.

The Methodology of Coercion

The 764 network’s grooming methodology is systematic, refined through iteration, and devastatingly effective against its target demographic. Understanding it is essential for anyone trying to protect children — and genuinely disturbing to read about.

Target Selection

The network specifically targets minors between the ages of roughly nine and seventeen who display signs of psychological vulnerability. Members scan Discord servers, Roblox lobbies, Minecraft communities, and social media platforms for adolescents who express depression, anxiety, eating disorders, gender dysphoria, suicidal ideation, social isolation, or family conflict. These are not random attacks. They are calculated selections of victims least likely to have robust support systems and most susceptible to emotional manipulation.

The targeting is also gendered in specific ways. The network recruits both male and female victims but applies different coercion frameworks. Female victims are more frequently targeted for CSAM production. Male victims — particularly those who express feelings of alienation or anger — are more frequently pushed toward real-world violence, including mass casualty attacks. Both pathways involve the same underlying mechanism: the systematic destruction of autonomy through escalating coercion.

The Grooming Funnel

Initial contact typically occurs on a mainstream platform — a Roblox game, a public Discord server, a Minecraft lobby. The approach is warm, empathetic, and deliberately calibrated to fill whatever emotional need the target has expressed. A lonely child receives friendship. A depressed teenager receives validation. Someone struggling with identity receives acceptance and community.

This phase can last days or weeks. The operative builds trust, normalizes increasingly dark content, and gradually migrates the conversation to more private channels — a DM thread, a smaller Discord server, eventually encrypted platforms like Telegram or Signal. Each migration isolates the victim further from potential intervention by parents, teachers, or platform moderation.

Once sufficient trust and isolation are established, the operative introduces the coercion cycle. The first request is typically for a mildly compromising image — nothing immediately alarming, perhaps just a face photograph that could be paired with the conversations they have already had. Once any material exists, the dynamic shifts irreversibly. The operative reveals the trap: comply with escalating demands, or the material will be distributed to the victim’s family, school, and social network.

Escalation

The demands follow a documented escalation pattern. Early requests involve producing explicit images. These are followed by demands for self-harm content — cutting, burning, other injuries documented on camera. Victims have been coerced into carving the screen names or symbols of their handlers into their own flesh. Some have been pushed to abuse pets or other animals, again on camera. The most extreme demands involve suicide — sometimes framed as “proving loyalty,” sometimes as the logical endpoint of an existence the handler has convinced the victim is worthless.

At every stage, the material produced becomes additional leverage. A victim who has produced one compromising image is told that if they do not produce more extreme content, the first image will be released. A victim who has carved a name into their arm is told that the video will be sent to their parents unless they do something worse. The coercion ratchet only turns in one direction.

The network also uses victims as recruiters. Children who have been fully compromised are instructed to help identify and groom new targets — creating a self-replicating system that does not depend on any single adult operator. This is one of the most insidious aspects of the 764 model: it turns victims into perpetrators, deepening their psychological entrapment while expanding the network’s reach.

Platform Exploitation

The 764 network’s ability to operate at scale is inseparable from the design of the platforms it exploits. This is not a case of criminals finding loopholes in otherwise well-protected systems. It is a case of criminal enterprise exploiting fundamental architectural choices that platform companies have made — and in many cases continue to make — in pursuit of user growth and engagement.

Discord

Discord is the network’s primary operational platform. The service’s design — persistent servers with multiple channels, direct messaging, voice chat, screen sharing, and relatively pseudonymous accounts — is optimized for exactly the kind of community-building that the 764 network requires. Discord’s moderation, while improved in recent years, has historically been reactive rather than proactive, relying heavily on user reports rather than systematic detection of grooming patterns.

The network exploits Discord’s server structure by operating across many small, private servers rather than maintaining large, easily detectable communities. When a server is reported and taken down, the community simply reconstitutes elsewhere. Members maintain lists of backup servers, invite links, and alternative contact information. The whack-a-mole dynamic is built into the platform’s architecture.

Roblox and Minecraft

Gaming platforms serve primarily as hunting grounds. Roblox, which has approximately 80 million daily active users — the majority of them under 18 — provides an almost limitless supply of potential targets in an environment where initiating conversation with strangers is not only normal but expected. Minecraft servers function similarly. In both cases, the initial contact occurs in a context where the child has no reason to be suspicious: they are simply playing a game and talking to other players.

The platforms’ age-verification systems are largely self-reported and trivially circumvented. A 764 operative creating a Roblox account to approach children faces effectively no meaningful barrier to entry.

Telegram and Encrypted Platforms

Once grooming progresses past the initial contact phase, conversations are migrated to Telegram and other encrypted platforms where moderation is minimal or nonexistent. Telegram’s large-group functionality, channel system, and historically permissive approach to content moderation have made it a favored platform for the broader extremist ecosystem, including the Terrorgram Collective and related accelerationist groups.

The migration from mainstream platforms to encrypted channels serves a dual purpose: it isolates victims from potential intervention while moving the criminal activity to infrastructure where law enforcement faces significant technical and legal barriers to surveillance.

Connections to Real-World Violence

The 764 network is not merely an online exploitation ring. It has documented connections to real-world mass violence — connections that have fundamentally altered how federal law enforcement classifies and prioritizes the threat.

Solomon Henderson and the Antioch School Shooting

On September 28, 2023, Solomon Henderson, a fourteen-year-old student, entered The Covenant School in Antioch, Tennessee, and opened fire, killing one student and wounding two others before being fatally shot by police. Investigators subsequently discovered that Henderson had extensive ties to 764-affiliated accounts and the broader Terrorgram community. His online activity revealed immersion in the same ecosystem of accelerationist violence, nihilistic ideology, and competitive cruelty that defines the 764 network.

Henderson’s case crystallized a fear that had been building among law enforcement and researchers for years: that the online radicalization pipeline running through networks like 764 was not merely producing victims of exploitation but was actively cultivating perpetrators of mass violence. The grooming methodology — identifying vulnerable, isolated, angry young people and providing them with an ideological framework, a community, and escalating pressure to commit real-world acts — maps disturbingly well onto the pathway to targeted violence.

The Nashville school shooting by Audrey Hale in March 2023, while not directly tied to 764, occurred in the same city and same general timeframe, and subsequent investigations revealed that both Hale and Henderson had engaged with overlapping online fringe communities, further underscoring the interconnected nature of the digital extremist ecosystem.

The Terrorgram Collective

The Terrorgram Collective — a related but distinct entity — operates primarily on Telegram and functions as a propaganda and operational support network for accelerationist violence. The Collective produces and distributes manifestos, target lists, tactical guides, and hagiographies of past mass shooters, all designed to inspire and enable future attacks. Its publications, including documents like “The Hard Reset” and “Terrorgram Guide,” have been linked to multiple acts of real-world violence.

In January 2025, the U.S. State Department designated the Terrorgram Collective as a Specially Designated Global Terrorist (SDGT) organization — the first time the designation had been applied to a primarily online, decentralized extremist entity. The designation was significant not only for its practical implications (asset freezes, travel bans, material support prosecutions) but for what it signaled about the government’s evolving understanding of the threat: online networks without physical headquarters, formal membership rolls, or traditional organizational structures could nonetheless constitute terrorist organizations.

The relationship between 764 and Terrorgram is symbiotic rather than hierarchical. They share membership, ideology, platforms, and — most critically — victims. Young people groomed through 764’s coercion pipeline can be funneled toward Terrorgram’s violence-promotion apparatus. The two networks represent different functional specializations within the same broader ecosystem of digitally native extremism.

Law Enforcement Response

The federal response to the 764 network has been significant, if belated. By 2025, the threat had been elevated to a level of institutional priority rarely seen for non-state-actor investigations.

FBI Tier One Designation

In early 2025, the FBI elevated the 764 network to “tier one” investigative priority — the Bureau’s highest classification for threat assessment. This placed the network alongside nation-state intelligence services, major terrorist organizations, and the most significant transnational criminal enterprises. The designation was not symbolic. It triggered resource allocation across all 55 FBI field offices, with approximately 250 active investigations running simultaneously. The tier-one classification reflected a dawning recognition that the network’s combination of child exploitation, terrorism nexus, and decentralized structure represented a threat category that existing frameworks were poorly equipped to address.

Key Arrests and Prosecutions

Erik Lee Madison was arrested in November 2025 in Halethorpe, Maryland, on federal charges related to the sexual exploitation of minors. Madison’s arrest was part of a broader sweep targeting 764 network operatives and represented one of the highest-profile domestic enforcement actions against the network. Court documents in Madison’s case provided a detailed window into the network’s operational methods, including the grooming pipeline, the coercion escalation framework, and the use of encrypted communications to coordinate activity across multiple cells.

Jairo Jamie Tinajero pleaded guilty in February 2025 to racketeering, possession of child sexual abuse material, and conspiracy to commit murder — a charge sheet that reflected the full spectrum of the 764 network’s criminal activity. Tinajero’s case was notable for the conspiracy to murder charge, which underscored that the network’s operations extended well beyond exploitation and into direct incitement and facilitation of lethal violence. The racketeering charge was also significant: it demonstrated that prosecutors were treating the 764 network as an organized criminal enterprise rather than a collection of individual offenders.

Bradley Chance Cadenhead, the network’s alleged founder operating under the alias “Felix,” has been the subject of sustained federal investigation. Details of ongoing proceedings against Cadenhead remain partially sealed, but his identification as the network’s organizational architect has been central to the government’s broader theory of the case — that the 764 network, despite its decentralized structure, was deliberately designed and managed as a criminal enterprise.

Challenges

Law enforcement faces structural challenges that no amount of resource allocation can fully overcome. The network’s decentralized architecture means that arresting individual operatives does not disable the organization. Its cross-jurisdictional nature — with members and victims spanning multiple countries and dozens of U.S. states — creates coordination challenges even within the federal system. The use of encrypted communications platforms means that traditional surveillance tools are often ineffective. And the speed at which the network can reconstitute after enforcement actions — spinning up new servers, creating new accounts, activating dormant cells — means that disruption is temporary unless it reaches organizational critical mass.

The FBI’s own history with online investigations adds a layer of complexity. The Bureau must balance aggressive pursuit of genuine predators against the civil liberties concerns that arise whenever law enforcement operates in digital spaces, particularly when investigations involve minors. The tension between speed and due process is acute: every day an investigation takes to develop probable cause is a day that active exploitation continues.

International Reach

The 764 network is not an American problem with international spillover. It is a transnational operation that was born global, exploiting the borderlessness of digital communication to operate across jurisdictions in ways that strain existing international legal frameworks.

Canada

Canada’s decision to designate the 764 network as a terrorist entity — one of the first countries to do so — reflected both the network’s documented activity targeting Canadian minors and a broader recognition that domestic legal frameworks needed to evolve to address digitally native threats. The terrorist designation provides Canadian law enforcement with expanded investigative tools and enables more aggressive prosecution of anyone found to be providing material support to the network.

European Operations

European law enforcement agencies — particularly in the United Kingdom, Germany, and the Netherlands — have identified 764-affiliated activity within their jurisdictions. Europol has coordinated cross-border investigations targeting network operatives and has flagged the 764 model as a template that other criminal enterprises may seek to replicate. The European dimension adds the complexity of GDPR and varying national legal frameworks for online surveillance, creating additional friction in investigations that are already technically challenging.

The Five Eyes Dimension

The intelligence-sharing architecture of the Five Eyes alliance — the United States, United Kingdom, Canada, Australia, and New Zealand — has reportedly been leveraged in 764 investigations, allowing signals intelligence and law enforcement data to flow between partner nations more efficiently than standard mutual legal assistance treaties would permit. This has raised concerns among civil liberties organizations about the scope of surveillance being directed at online communications, particularly given the network’s use of platforms with massive user bases — platforms where monitoring for 764 activity inevitably means monitoring large volumes of innocent communications.

The Platform Accountability Question

The international dimension has also intensified pressure on platform companies. Discord, Roblox, Telegram, and other services operate globally but are primarily headquartered in the United States, creating a regulatory patchwork where different jurisdictions apply different standards for content moderation, age verification, and cooperation with law enforcement. Multiple governments have introduced or strengthened legislation — including the UK’s Online Safety Act and proposed EU Digital Services Act amendments — that would impose more aggressive obligations on platforms to detect and prevent grooming activity. The platform companies have generally resisted the most expansive proposals, arguing that they would require client-side scanning or backdoor access to encryption that would compromise the security of all users.

The debate mirrors the broader surveillance state tension that has defined digital policy since Edward Snowden’s revelations: how much privacy must everyone sacrifice to catch the worst actors? In the case of the 764 network, that question is not theoretical. Children are being harmed in real time on platforms that billions of people use every day, and the tools that could detect that harm more effectively are the same tools that could enable mass surveillance of the innocent.

Why This Matters Beyond the Cases

The 764 network is significant not only for the specific crimes it has committed but for what it represents in the evolution of organized extremism and exploitation. It is a proof of concept — a demonstration that the internet’s connective power can be weaponized to build coercive organizations that operate at scale, across borders, without physical infrastructure, and with a degree of resilience that traditional law enforcement approaches struggle to counter.

Every element of the 764 model is individually precedented. Online grooming existed before 764. Sextortion existed before 764. Accelerationist terrorism existed before 764. Decentralized cell structures existed before 764. What the network achieved was the synthesis — combining all of these elements into a single operational framework that is simultaneously a child exploitation ring, a cult, a terrorist recruitment pipeline, and a self-replicating social network.

The QAnon movement demonstrated that digital radicalization could operate at massive scale without centralized leadership. NXIVM demonstrated that coercive control could be maintained through compromising material used as leverage. The Satanic Panic of the 1980s demonstrated that moral panic about threats to children could itself become a form of exploitation. The 764 network sits at the intersection of all these precedents — and adds the dimension of targeting actual children, in real time, at industrial scale.

For parents, educators, and anyone responsible for children’s safety, the 764 network represents an urgent and specific threat. But it also represents a broader challenge: the platforms where children spend their time were not designed with their safety as a primary consideration, and the regulatory frameworks that govern those platforms were not designed for threats that look like 764. Closing that gap — between the speed at which these networks evolve and the speed at which institutions respond — is arguably the defining child safety challenge of the 2020s.

Timeline

• 2019-2020 — CVLT community forms on Discord, establishing the culture and tactics that will become the 764 network
• 2021 — Bradley Chance Cadenhead (“Felix”) restructures CVLT elements into the 764 network, introducing systematic grooming methodologies and cell-based organizational structure
• 2022 — Network expands across Discord, Telegram, and gaming platforms; early law enforcement awareness begins
• 2023 — Solomon Henderson, linked to 764/Terrorgram communities, carries out the Antioch, Tennessee school shooting in September
• 2024 — FBI investigations escalate as the scope of the network becomes clear; international law enforcement coordination begins through Europol and Five Eyes channels
• January 2025 — U.S. State Department designates the Terrorgram Collective as a Specially Designated Global Terrorist organization
• February 2025 — Jairo Jamie Tinajero pleads guilty to racketeering, CSAM possession, and conspiracy to murder in connection with 764 network activity
• 2025 — FBI elevates 764 to “tier one” investigative priority; approximately 250 investigations open across all 55 field offices; Canada designates 764 as a terrorist entity
• November 2025 — Erik Lee Madison arrested in Halethorpe, Maryland, on federal charges of sexual exploitation of minors
• 2026 — Investigations and prosecutions ongoing; network continues to operate in decentralized form despite enforcement pressure

Sources & Further Reading

• U.S. Department of Justice, “Justice Department Announces Charges Against 764 Network Members” (2025)
• U.S. State Department, “Designation of Terrorgram Collective as Specially Designated Global Terrorist” (January 2025)
• FBI, Statements on Tier One Threat Designation and 764 Network Investigations (2025)
• Public Safety Canada, “Currently Listed Entities — 764 Network” (2025)
• NBC News, “Inside the 764 network: How an online group targets children for sextortion and violence” (2025)
• Wired, “The Terrorgram Collective and the Evolution of Online Extremism” (2024)
• The Washington Post, “FBI investigating 764 network across all field offices as child exploitation threat grows” (2025)
• NCMEC (National Center for Missing & Exploited Children), Reports on online sextortion trends (2024-2025)
• Court documents: United States v. Tinajero, United States v. Madison (federal district court filings)
• Europol, Internet Organised Crime Threat Assessment (IOCTA), sections on online child exploitation and extremism (2024)

Related Theories

The 764 network exists within a broader constellation of digital-age conspiracy and extremism. The QAnon movement — ironically, a movement nominally concerned with protecting children from elite predators — demonstrated how online radicalization pipelines function at scale and how ideological communities can form without centralized leadership. Pizzagate, the debunked conspiracy theory about child trafficking rings operated by Democratic Party officials, showed how moral panic about children could be weaponized for political purposes — and how that weaponization could inspire real-world violence when Edgar Maddison Welch walked into Comet Ping Pong with an AR-15.

The social media addiction design framework — confirmed by former platform executives — explains why the digital environments where 764 operates are so effective as hunting grounds: they were engineered to maximize engagement and time-on-platform, creating the conditions for the kind of sustained, intimate contact that grooming requires. The Five Eyes surveillance alliance and the broader surveillance state apparatus represent both potential tools for combating networks like 764 and cautionary examples of the civil liberties costs of expansive digital monitoring. And the FBI’s documented history of entrapment operations raises uncomfortable questions about the line between investigating networks like 764 and the broader implications of aggressive online law enforcement.

The 764 network is not a conspiracy theory. It is a confirmed criminal conspiracy — one that forces a reckoning with the question of what happens when the internet’s greatest features (global connectivity, pseudonymity, ease of community formation) are turned toward its darkest possible purposes.