Polish authorities said on June 25 that four suspects were detained in a joint operation tied to SIM-swap attacks on cryptocurrency exchange accounts. Prosecutors believe the suspects acted as an organized group and moved illicit funds worth more than tens of millions of Polish zlotys, roughly $15 million at current exchange rates. The investigation is still open.
Investigators say the group first penetrated telecom service providers
According to investigators, the suspects initially breached the IT systems of companies that provide services to telecommunications operators. They used social engineering methods and custom-built software to gain access to employee email accounts. That access allowed them to duplicate victims’ phone numbers and redirect those numbers to SIM cards under their control.
A SIM-swap attack works by moving a person’s phone number onto a different SIM card. Once that happens, one-time SMS codes are no longer delivered to the real account holder. Control of the number can open the door to email accounts and crypto exchange logins in a very short time.
Exchange balances were emptied after SMS and email access was captured
Case files cited in the report say that after taking over victims’ SMS and email channels, the suspects seized control of crypto exchange accounts and systematically drained the balances. The stolen assets were then routed through personal bank accounts in Poland and abroad, global payment platforms, and multiple digital wallets connected to different assets.
Blockchain investigator ZachXBT linked one suspect to Wojtek Kulisz, described as a social engineering specialist known online as “Merry.” Polish authorities have not released names or photographs. ZachXBT said clothing and jewelry shown on a public Instagram account appeared to match items seen in confiscation images from the raid.
Suspects held in pre-trial detention as prosecutors press multiple charges
The four suspects face charges that include participation in a criminal organization, theft through unauthorized access to information systems, and money laundering. All four have been placed in pre-trial detention. If convicted, they could face up to 25 years in prison.
Officials said the case is still developing as authorities work to map the full extent of the network. The report also placed the operation alongside other recent enforcement actions involving crypto crime. In March, the FBI and Thai police froze about $580 million in cryptocurrencies linked to scam networks in Southeast Asia. At the end of May, the FBI’s Blackout Operation resulted in seizures exceeding $8 billion, including more than 127,000 Bitcoin.