Europol takes down hackers who allegedly stole over $100 million in crypto from celebs

The group used SIM-swaps to target sports stars, influencers, and musicians.

Eight men have been arrested in the UK for their role in a spate of hacks on US celebs, per Europol, after the criminals broke into the victims’ phones to steal over $100 million in cryptocurrencies. The suspects, aged 18 to 26, were part of a larger gang that was also busted in Malta and Belgium and mainly targeted high-profile Americans, including sports stars, influencers and musicians and their family members.

Starting last Spring, the network of around a dozen criminals began using SIM-swap attacks to access the victims’ phone numbers and apps by changing their passwords. They also hijacked social media accounts to post content and send messages masquerading as their targets.

SIM-swapping involves hackers taking control of a person’s phone number by deactivating their SIM and porting the number over to their own SIM card. This is typically done with the help of an insider at the targeted phone service or through social engineering ploys, such as phishing, according to law enforcement.

According to authorities, the criminal network was reprimanded after a sweeping multilateral investigation that involved agents from Europol, the UK’s National Crime Agency, the US Secret Service, Homeland Security Investigations, the FBI and the Santa Clara California District Attorney’s Office. Those arrested now face prosecution for offences under the Computer Misuse Act, alongside fraud and money laundering, and extradition to the US.

“As well as causing a lot of distress and disruption, we know [the network] stole large sums from their victims, from either their bank accounts or bitcoin wallets,” Paul Creffield, head of operations in the NCA’s National Cyber Crime Unit, said in a statement.

SIM-swapping and voice phishing are on the rise in Europe and the US. To prevent these types of attacks, Europol is advising people to keep their device’s software up to date, to limit data-sharing online and to use two-factor authentication for online services.