Three Americans were charged this week with stealing more than $400 million in a November 2022 SIM-swapping attack.
The U.S. government did not name the victim organization, but there is every indication that the money was stolen from the now-defunct cryptocurrency exchange FTX, which had just filed for bankruptcy on that same day.
A graphic illustrating the flow of more than $400 million in cryptocurrencies stolen from FTX on Nov. 11-12, 2022.
The indictment says the $400 million was stolen over several hours between November 11 and 12, 2022.
Tom Robinson, co-founder of the blockchain intelligence firm Elliptic, said the attackers in the FTX heist began to drain FTX wallets on the evening of Nov. 11, 2022 local time, and continuing until the 12th of November.
Robinson said Elliptic is not aware of any other crypto heists of that magnitude occurring on that date.
Either way, it's certainly over $400 million, and we are not aware of any other thefts from crypto exchanges on this scale, on this date.
The SIM-swappers allegedly responsible for the $400 million crypto theft are all U.S. residents.
There are some indications they had help from organized cybercriminals based in Russia.
In October 2023, Elliptic released a report that found the money stolen from FTX had been laundered through exchanges with ties to criminal groups based in Russia.
Nick Bax, director of analytics at the cryptocurrency wallet recovery firm Unciphered, said the flow of stolen FTX funds looks more like what his team has seen from groups based in Eastern Europe and Russian than anything they've witnessed from US-based SIM-swappers.
CISA's alert on Scattered Spider says they are a cybercriminal group that targets large companies and their contracted information technology help desks.
Nick Bax, posting on Twitter/X in Nov 2022 about his research on the $400 million FTX heist.
Earlier this week, KrebsOnSecurity published a story noting that a Florida man recently charged with being part of a SIM-swapping conspiracy is thought to be a key member of Scattered Spider, a hacking group also known as 0ktapus.
That group has been blamed for a string of cyber intrusions at major U.S. technology companies during the summer of 2022.
Financial claims involving FTX's bankruptcy proceedings are being handled by the financial and risk consulting giant Kroll.
In August 2023, Kroll suffered its own breach after a Kroll employee was SIM-swapped.
According to Kroll, the thieves stole user information for multiple cryptocurrency platforms that rely on Kroll services to handle bankruptcy proceedings.
KrebsOnSecurity sought comment for this story from Kroll, the FBI, the prosecuting attorneys, and Sullivan & Cromwell, the law firm handling the FTX bankruptcy.
Attorneys for Mr. Powell said they do not know who Victim 1 is in the indictment, as the government hasn't shared that information yet.
This Cyber News was published on krebsonsecurity.com. Publication date: Thu, 01 Feb 2024 18:45:19 +0000