Police in Canada have arrested a local teenager for stealing US$36 million in cryptocurrency from a single victim through a SIM-swapping attack.
On Tuesday, the Hamilton Police Service in Ontario reported it had arrested the unnamed “youth” following a joint investigation with the FBI and the US Secret Service.
“This is currently the biggest cryptocurrency theft reported from one person,” Hamilton police said. (Earlier this year, police in Europe arrested 10 suspects for collectively stealing $100 million in cryptocurrency through SIM-swapping attacks.)
The Canadian teen allegedly targeted a victim in the US. Details about the SIM swap attack were not revealed, but they often involve tricking a cellular provider into handing over access to the victim’s cell phone number. To pull this off, the attacker will first try to learn personal details about the victim’s background—such as ID numbers, address, and birthdate—and then try to impersonate them.
If the cellular provider falls for the trick, it’ll then duplicate a new SIM card registered to the victim’s phone number, which can be plugged into a smartphone. The attack can be particularly devastating because mobile phone numbers are often used to receive one-time passcodes to log in or reset the password for an online account.
In this case, the Canadian teen used the SIM-swap attack to do just that by intercepting the two-factor authentication codes used to log into the victim’s cryptocurrency accounts.
Hamilton Police said they began investigating the crime with US authorities in March 2020. Investigators then noticed some of the cryptocurrency stolen in the attack was used to buy “an online username that was considered to be rare in the gaming community,” which led them to identify the alleged culprit. As part of the arrest, Canadian police also seized US$5.5 million in cryptocurrency assets.
The news underscores that it's best to avoid using two-factor authentication systems that rely on SMS to send you the one-time passcode. Instead, install an authenticator app.