Teenagers stole $ 24 million in cryptocurrency as a result of SIM card fraud

Bloomberg journalists told a sensational story about the theft of $ 24 million in cryptocurrency, which was made possible by a SIM card swapping scheme.

In 2018, hackers gained access to the crypto wallets of Michael Turpin, the American businessman and chairman of Transform Group, and stole $ 24 million worth of digital assets. One of the organizers of the scam was 15-year-old gamer Ellis Pinsky, who was recruited into an international hacker group through the game Call of Duty.

In January 2018, Michael Turpin received a notification from Google about logging into his account from an unknown device. The entrepreneur immediately suspected a hack: six months ago, he had already been attacked by fraudsters who tried to access his mailboxes and steal cryptocurrency by replacing his SIM card. Back then, the criminals were unable to get hold of the businessman’s digital assets, but managed to deceive several of his friends and swindle them out of their money. Mobile operators T-Mobile and AT&T promised Terpin to observe an increased level of security: if he wants to transfer a number from one SIM card to another, he will need to enter an additional code.

Theft victim Michael Turpin.

However, no security measures could protect Turpin from a second attack. Funds in three digital currencies disappeared — Steem ($ 60,000), Skycoin ($ 1 million), and Triggers ($ 22.7 million). Having gained control of three million Triggers tokens, the hackers sold them and collapsed the value of the digital asset.

SIM card fraud is a relatively simple hacking scheme that does not require high competence from attackers. All the fraudsters need is to know the victim’s number and bribe (or deceive) a telecommunications company employee who will have to transfer the victim’s number to a new SIM card. According to Bloomberg, one of the main reasons for the spread of this simple scheme is that providers are paying more attention to the convenience of their customers over security.

Six months after the fraudsters managed to withdraw Terpin’s assets, the businessman sued AT&T, demanding $ 224 million in compensation from the mobile operator for the company’s failure to protect his data. According to Turpin, in his case, the case was not limited to the alleged involvement of an employee in the SIM card swap. At the time of the theft, his wife Maxine called the provider’s technical support and asked to block her husband’s number, which took the company an hour and a half. Terpin suggested that if AT&T employees had responded more quickly, the fraudsters would not have had time to transfer the assets.

Hacker Ellis Pinsky.

The businessman was later contacted by hackers who explained the theft scheme. a 15-year-old gamer, Ellis Pinsky, who was recruited into the Community group, admitted his involvement in the crime and returned about $ 100,000 to the victim. Hacker Nicholas Trulli was ordered to pay Turpin $ 20 million — despite the fact that he received only $ 800,000 during the robbery.

Turpin’s lawsuit against AT&T was never satisfied: in March 2023, a judge denied the businessman the right to compensation. According to the verdict, the contract with the company did not describe a situation in which a bribed employee would replace the SIM card and then hack accounts and steal cryptocurrency. Interestingly, in an interview with Bloomberg, even Ellis Pinsky sided with his victim and said that companies like AT&T need to take better care of customer security.