Cryptocurrency theft has triggered an international operation in Poland: the Central Bureau for Combating Cybercrime detained four people believed to be members of an organized group that laundered digital assets through SIM card swaps.
According to investigators, the perpetrators intercepted victims’ phone numbers, gained control over messages and email, and then bypassed two-factor authentication to access accounts on crypto exchanges. The FBI and the US Department of Homeland Security’s investigative service reported that stolen assets were laundered specifically through such SIM swap attacks.
The suspects are charged with participating in a criminal organization, hacking computer systems to steal funds, and money laundering. All four will remain in custody until trial. The maximum penalty in the case could be up to 25 years in prison.
How the SIM Swap Scheme Worked
Investigators believe the group first gained access to the IT systems of companies linked to telecom operators. Several methods were used for this:
- Technical hacking of IT systems of companies associated with telecom operators.
- Social engineering.
- Manipulation of employees.
- Special software that opened access to work email.
After this, the criminals launched SIM card swaps: transferring or intercepting victims’ numbers to receive one-time codes and notifications. When the group gained control over the phone and email, this allowed them to:
- Reset passwords.
- Access exchange accounts.
- Withdraw funds.
This scheme is dangerous because a phone number is still used as a key to restore access. For users who store Bitcoin, Ethereum, or other cryptocurrencies on exchanges, weak mobile number protection can become a direct path to losing funds.
The FBI previously estimated the damage from SIM swap attacks in the US in 2021 at more than $68 million. Money was stolen from both bank accounts and crypto wallets.
Investigators Probe Money Laundering Worth Tens of Millions of Zlotys
According to police, the stolen funds quickly passed through an extensive financial network. Prosecutors believe the suspects viewed this activity as a steady source of income.
Investigators say the money could have moved through several channels:
- Personal bank accounts — accounts in Poland and abroad; example: transfers between different jurisdictions.
- Payment services — another channel for moving funds; example: transactions through payment platforms.
- Multi-currency crypto wallets — wallets for storing and moving various digital assets; example: transfers between wallets.
The scale of the alleged money laundering is estimated by investigators at tens of millions of zlotys, that is, several million dollars.
Such cases are usually not limited to one country. Information technology crimes quickly cross national borders: infrastructure, victims, accounts, and wallets can be located in different jurisdictions. That is why the FBI and the US Department of Homeland Security’s investigative service joined the Polish investigation.
Why SIM Swaps Remain a Threat to the Crypto Market
SIM swap attacks rely on a combination of human error and weak account recovery procedures. Sometimes, criminals only need to convince an employee, obtain service data, or install malware to continue down the chain to victims’ accounts.
The risks here differ from classic fraud schemes, where investors are lured by a financial pyramid. With a SIM swap, the user may not communicate directly with the criminals and may only learn about the hack after the assets have been withdrawn.
Cryptocurrency theft does not always start with a SIM swap. Other schemes are also common:
- Phishing — fake emails, websites, or messages that trick users into giving up passwords, codes, or seed phrases. Do not click suspicious links and check the website address before logging in.
- Wallet hacking — gaining access to a user’s device, files, or keys. For large sums, it is better to use hardware wallets and store the seed phrase offline.
- Fake apps — counterfeit wallets and services that mimic real products. Download apps only from official websites and stores.
- Investment scams — promises of quick profits, after which the money goes to criminals. Check the platform and do not transfer funds under pressure or promises of guaranteed returns.
Regulators, including the Bank of Russia, regularly warn about the growth of digital fraud, and the development of artificial intelligence-based tools makes phishing and social engineering more convincing. Against this backdrop, reliable authentication is becoming not an optional extra, but a basic protection for crypto asset holders.
For crypto accounts, SMS codes should not be considered the main protection: it is more reliable to use multi-factor authentication that does not depend on the phone number.
The Central Bureau for Combating Cybercrime in Poland does not disclose the names of those detained or publish their photos, as the investigation is ongoing. The agency admitted that new arrests may follow in the case.
What to Do if Your Cryptocurrency Is Stolen or You Are Scammed With a Transfer
If you notice a withdrawal, account login from another device, or realize you have transferred cryptocurrency to scammers, it is best to act immediately:
- Change passwords for the exchange, email, and related services.
- Disable access for suspicious devices and active sessions.
- Report the theft to the exchange, wallet, or platform through which the transaction was made.
- Document the facts: transaction hashes, wallet addresses, account screenshots, emails, notifications, and correspondence.
- Contact law enforcement and provide them with the collected data.
- If it is a SIM swap, urgently contact your mobile operator and regain control over your number.
For court and investigation, digital traces are important: blockchain transactions, correspondence, account data, login notifications, documents from platforms, and, if necessary, expert opinions.
Is It Possible to Recover Stolen Cryptocurrency
Recovering stolen assets can be difficult, but the chances are higher if you quickly document the theft and immediately involve the exchange, wallet, payment service, and law enforcement. The outcome depends on how quickly you act, the degree of anonymity of the criminals, and the willingness of platforms to cooperate.
The process usually starts with tracking transactions and passing wallet addresses to platforms through which the funds may pass. If the assets end up on an exchange or payment service, you can request an account block or freeze the funds. Then, investigations and legal proceedings follow.
How to Protect Your Cryptocurrency From Theft
Basic protection relies on several simple rules:
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“about”: [
{
“@type”: “Thing”,
“name”: “cryptocurrency”
},
{
“@type”: “Thing”,
“name”: “information technology crimes”
},
{
“@type”: “Thing”,
“name”: “bitcoin”
},
{
“@type”: “Thing”,
“name”: “ethereum”
},
{
“@type”: “Organization”,
“name”: “Bank of Russia”
},
{
“@type”: “Thing”,
“name”: “artificial intelligence”
},
{
“@type”: “Thing”,
“name”: “authentication”
},
{
“@type”: “Thing”,
“name”: “malware”
}
]
}
- Use strong, unique passwords for exchanges, email, and wallets.
- Enable two-factor or multi-factor authentication, preferably not via SMS.
- Store large amounts in hardware wallets.
- Do not share your seed phrase, private keys, or one-time codes.
- Check links, website addresses, and apps before logging in or installing.
- Do not agree to transfers under pressure, promises of quick profits, or requests from strangers.
