Three individuals have been accused by the Department of Justice (DOJ) of executing a SIM-swapping scam that led to the theft of over $400 million from the cryptocurrency exchange. This event unfolded shortly after FTX declared bankruptcy and its founder, Sam Bankman-Fried, who has since been convicted of fraud and faces a lengthy prison sentence, stepped down.

Bankman-Fried had previously suggested the possibility of an internal breach, but recent charges brought forth by prosecutors indicate otherwise. Illinois' Robert Powell, Colorado's Emily Hernandez, and Indiana's Carter Rohn were charged last month for their involvement in a SIM-swapping operation that targeted not only FTX but also numerous individuals over two years. The security weaknesses of FTX, which were highlighted by the exchange's new CEO, reportedly made it an attractive target for such schemes.

The federal indictment, which does not explicitly name FTX but identifies it as "victim company-1," alleges that Powell, Rohn, and Hernandez gathered personal information on approximately 50 victims. They used this data to persuade telecom providers to transfer the victims' phone numbers to devices under their control. This enabled them to intercept text messages, including those containing multi-factor authentication codes, granting them access to financial accounts and cryptocurrency wallets belonging to the victims.

On or about November 11, 2022, it's alleged that Hernandez used a counterfeit ID with details of an FTX employee to prompt AT&T to reassign a mobile phone account to a new SIM card. Powell, identified as the scheme's mastermind and known by the aliases 'R$' and ElSwapo1, is then accused of using the obtained authentication codes to infiltrate FTX's cryptocurrency wallets.

SIM-swapping, a tactic that relies more on social engineering than technical hacking prowess, has become a common method for compromising various types of online accounts, including those on social media, cryptocurrency exchanges, and banks. According to the FBI, the number of SIM-swapping complaints and the associated financial losses have risen in recent years, suggesting a growing trend in this type of cybercrime.

Charged with fraud and identity theft, the legal representation for Powell declined to comment, while Hernandez and Rohn have not been available for statements.

Bloomberg