Polish Police Bust SIM Swap Ring That Exploited Telecom Supply Chain for $15M
What You Need to Know
- Four arrests in Poland and US for SIM swap attacks targeting cryptocurrency exchanges, estimated $15 million laundered.
- Attackers compromised telecom company IT systems and employee emails to perform SIM swaps at scale upstream.
- SIM swap attacks have drained hundreds of millions from crypto holders over five years using SMS vulnerabilities.
- Cross-border crypto crime enforcement becoming routine, with FBI freezing $580 million in March and seizing $8 billion in May.
Polish and US law enforcement arrested four people on June 25 for running SIM swap attacks against cryptocurrency exchange accounts, with prosecutors estimating the laundered proceeds at roughly $15 million after converting from tens of millions of zlotys.
What makes this operation more than a routine cybercrime bust is the method. The group did not brute-force exchanges directly. Instead, they first compromised the IT systems of companies servicing telecom operators, used social engineering to access employee email accounts, and then performed SIM swaps from that position of trust inside the supply chain. That is a meaningful escalation in technique: rather than targeting individual victims, they embedded themselves upstream where a single foothold could enable attacks at scale. Blockchain investigator ZachXBT linked one suspect to a social engineer known online as “Merry,” whose public Instagram account reportedly displayed designer clothing and jewelry matching items photographed during the seizure. The laundered funds moved through personal bank accounts in Poland and abroad, international payment platforms, and digital wallets across multiple currencies.
SIM swap attacks have drained hundreds of millions from crypto holders over the past five years, and the technique keeps working because SMS-based two-factor authentication remains widespread despite its known weaknesses.
The CBZC, FBI, and Homeland Security Investigations running this jointly signals that cross-border crypto enforcement is becoming more procedurally routine, not exceptional. The FBI froze roughly $580 million tied to Southeast Asian fraud compounds in March, and Operation Blackout in late May seized over $8 billion in assets including more than 127,000 Bitcoin linked to a separate scam network. The pattern suggests US agencies are increasingly deploying resources through foreign partners rather than waiting for suspects to enter US jurisdiction, which compresses the operational window for groups running this kind of infrastructure. Exchanges that still rely on SMS verification for high-value account access are the implicit losers here: each prosecution that maps the attack chain in detail also maps the continuing vulnerability.
All four suspects remain in pretrial detention facing up to 25 years in prison on charges of participation in an organized criminal group, unauthorized computer access, and money laundering, while investigations continue.
0 Comments