SIM‑Swap Fraud Leads to $260K Crypto Theft, Perpetrator Sentenced in London
What Happened – A 25‑year‑old London resident was convicted for a SIM‑swapping scheme that let criminals hijack victims’ phone numbers, intercept one‑time SMS codes, and drain roughly £260 000 (≈ $300 000) from cryptocurrency wallets, including Coinbase accounts.
Why It Matters for Trust & Control Assurance
- The incident shows how reliance on SMS‑based one‑time passwords can defeat account protections, a gap that continuous identity‑access control programs are built to detect and remediate.
- Evidence from the telecom provider (BT) was crucial for investigators, underscoring the need for auditable logs of number‑change events and third‑party data‑sharing controls.
Who Is Affected – Cryptocurrency users, fintech platforms, and telecom operators that manage mobile‑number provisioning.
Recommended Actions
- Replace SMS‑based MFA with stronger factors (hardware tokens, authenticator apps) and enforce device‑binding where possible.
- Implement continuous monitoring of SIM‑change requests and retain immutable logs for forensic review.
Technical Notes – Attack vector: SIM‑swap fraud (phone‑number takeover) → interception of SMS OTPs → unauthorized crypto wallet transfers. No software vulnerability disclosed. Source: https://therecord.media/cryptocurrency-sim-swap-london