Poland dismantles sim-swap ring behind millions in crypto theft

A major joint operation between Polish law enforcement and U.S. agencies has resulted in the arrest of four members of an organized cybercrime syndicate. The group is accused of executing a large-scale cryptocurrency theft operation by exploiting vulnerabilities in telecommunications infrastructure.

The Attack Vector

As detailed by BleepingComputer, the perpetrators utilized a combination of specialized software and social engineering to breach the systems of telecommunications partners. By hijacking employee email accounts, they obtained sensitive data required to perform SIM-swapping attacks.

By illegally cloning the victims' phone numbers, the gang could intercept SMS-based verification codes and email communications. This allowed them to bypass two-factor authentication (2FA) and seize full control of accounts on various cryptocurrency exchanges, subsequently draining the digital assets.

Laundering Millions in Assets

The operation was led by the Polish Cybercrime Bureau (CBZC) with critical support from the FBI and Homeland Security Investigations (HSI). Investigators found that the stolen funds were laundered through a complex, distributed financial network involving multiple bank accounts across various jurisdictions and numerous digital wallets.

The CBZC estimates that the total amount laundered exceeds several tens of millions of Polish zloty, which equates to at least $5 million. According to officials, the suspects treated these cyberattacks as a consistent and regular source of income.

Identification and Legal Fallout

While the CBZC did not officially name the suspects, renowned blockchain investigator ZachXBT identified one of the arrested individuals as Wojtek Kulisz, known by the alias "Merry," using images released from the police raids.

The four suspects are currently in pre-trial detention. They face charges including participation in an organized criminal group, unauthorized access to IT systems for theft, and money laundering. Under Polish law, these offenses carry a maximum penalty of 25 years in prison.