On Wednesday, two men from Massachusetts were sentenced to more than two years in prison each for stealing cryptocurrency in SIM swapping attacks and hijacking their victims' accounts on social media.
See also: Mastercard will help banks offer cryptocurrency trading
In their attacks, Eric Meiggs and Declan Harrington targeted individuals who likely held significant amounts of crypto assets in Coinbase or Block.io wallets (such as cryptocurrency executives) or possible victims who were managing high‑value «Original Gangster» (OG) Instagram and Tumblr accounts.
See also: Crypto hacks: October becomes the worst month
«Meiggs and Harrington conspired to breach and take control of these victims’ online accounts in order to obtain valuable items, such as cryptocurrencies», a DOJ press release said.
«They used an illegal practice known as «SIM-swapping» and other techniques to gain access, to take control and in some cases to steal cryptocurrencies from the accounts».
Harrington and Meiggs were charged in November 2019 for targeting at least ten victims in SIM swapping attacks and, in some cases, for death threats.
The defendants admitted that both were guilty of crypto theft and hijack victims' accounts on social media.
While each defendant faced a statutory maximum prison sentence of 20 years for wire fraud charges, Meiggs was sentenced to two years and one day in prison and Harrington to two years and seven days.
Death threats, hacking and cryptocurrency theft
According to court documents, it is believed that they stole cryptocurrencies worth $200,000 from an Arizona resident in a transaction, who “was publicly communicating with cryptocurrency experts online”, while $100,000 was taken from a victim in California who is closely linked to someone who “was running a blockchain-based business”.
Another $165,000 in cryptocurrency was stolen from a cryptocurrency project leader in Illinois, while a crypto asset worth $35,000 was taken from the Block.io cryptocurrency wallet of a victim in Nevada who owned a “network Bitcoin Automated Teller Machine”.
Also, Meiggs called a victim and threatened to kill his wife while trying to take control of the target's Instagram handle, according to the indictment.
The victim complied and changed the account profile name, allowing the scammer to take control.
According to the indictment, the tactics and methods allegedly used by the two defendants in their attacks include the following:
- Identifying potential victims who possibly had significant amounts of cryptocurrency and researching the potential victims using online tools.
- Participation in «SIM swapping» in order to take control of the victims' mobile phone numbers.
- Exploiting the victims' phone numbers that have been compromised to gain unauthorized access to their online accounts, including email accounts, social media accounts, and crypto accounts.
- Using their access to the victims' accounts to take over and steal the control of their accounts and their cryptocurrencies.
- Sale or otherwise transfer of the victims' log-in credentials, account handles, and cryptocurrencies.
- Using the victims' compromised accounts to solicit money and cryptocurrencies from the victims' friends and families .
- Using multiple online accounts to hide identity and avoid detection by law enforcement.
See also: Google chooses Coinbase for crypto payments for cloud services
The US Federal Trade Commission (FTC) is providing guidance on how to protect against SIM swapping attacks. The FBI has also issued a warning about the increased use of SIM swapping to steal cryptocurrency.
Information source: bleepingcomputer.com
