Justice Department Seeks Forfeiture of Over $5 Million in Bitcoin Stolen in SIM Swapping Scams

WASHINGTON - The Justice Department has filed a civil forfeiture complaint against over $5 million in bitcoin (BTC). The funds are alleged to be ill-gotten gains from multiple SIM swap attacks targeting victims across the United States, announced U.S. Attorney Jeanine Ferris Pirro.

As alleged in the complaint, these funds are traceable to the theft and unauthorized transfer of cryptocurrency from cryptocurrency wallets owned by five victims. The thefts took place between Oct. 29, 2022, and March 21, 2023.

Joining in the announcement were Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department's Criminal Division and FBI Special Agent in Charge Brett D. Skiles of the Miami Field Office.

The perpetrators of these thefts utilized a SIM swapping technique that allowed the perpetrators to authenticate their unauthorized access to the victims' cryptocurrency accounts and transfer the victim funds to perpetrator-controlled accounts.

A SIM swap attack is a type of account takeover whereby a perpetrator generally targets weaknesses in multi-factor authentication in order to gain access to a victim's phone number by swapping the victim's phone number to a SIM card associated with a phone in the perpetrator's control. With this access, the perpetrators intercept codes destined for the victim's phone and utilize those codes to "authenticate" that they are the victim. This allows the perpetrators to masquerade as the victim and conduct unauthorized activity transfers from the victim accounts.

After each of the five thefts occurred, the perpetrators moved the stolen funds through multiple cryptocurrency wallets and ultimately consolidated them into one wallet that funded an account at Stake.com, an online casino. Many of these transactions were circular in that they eventually returned funds to their original source, and consistent with money laundering utilized to "clean" proceeds of criminal activity.

For example, from on or about March 20, 2023, to on or about March 22, 2023, shortly after a portion of victim funds were consolidated into a single wallet, that wallet and the Stake.com account engaged in at least 32 circular transactions, including repeated deposits and withdrawals of BTC. Circular transactions obfuscate the origin of funds by inflating the volume of inflows and outflows in an account, making the larger balance (or source of funds) appear to engage in legitimate business.

For more information regarding SIM swapping and how to prevent it, please visit https://www.ic3.gov/PSA/2024/PSA240411.

This case is being prosecuted by Trial Attorneys Jessica Peck and Gaelin Bernstein of the Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys for the District of Columbia Kevin Rosenberg, Alexandra Hughes, and Asset Forfeiture Coordinator Rick Blaylock, Jr.

CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals and obtained court orders for the return of over $350 million in victim funds.