SIM Swap Crypto Theft Case: Massachusetts Sentences

In this case a phone number was the key to an inbox, a social account and a crypto wallet. Whoever controlled the number controlled the rest.

By Siddharth ShankarUpdated October 11, 2026

For many people, a mobile number has quietly become their master key. It receives the code that resets the email password, which resets everything else. A 2022 Justice Department case from Massachusetts shows what happens when someone else controls that number.

What happened

The Justice Department announced on October 19, 2022 that two men, aged 24 and 22, from Brockton and Beverly, Massachusetts, were sentenced for a nationwide scheme to steal social media accounts and cryptocurrency. One received two years and one day, and the other two years and seven days. The investigation was led by the FBI in Boston with IRS Criminal Investigation.

At least 10 victims were identified across the United States. The release states that approximately $330,000 in cryptocurrency was stolen.

How a SIM swap works

The release explains the method in three steps. First, the men persuaded mobile carriers to move a victim's phone number to a SIM card in a phone the criminals controlled. Second, they posed as the victim to online account providers and asked for password-reset links or codes to be sent to that phone. Third, they used the resets to change login details and take over the accounts.

Nothing in that chain requires hacking the victim's phone. The weak point is the carrier's identity check and the provider's willingness to send a reset code by text. Once the number moves, the victim's phone simply loses service while the attacker receives every message.

What was exposed

The targets were chosen for what their accounts were worth. The release says they included executives of cryptocurrency companies and holders of valuable "OG" social media account names. In other words, the exposure was not stolen data in a database. It was control of a single identifier that many services treat as proof of identity.

If your phone number appears on public profiles or in people-search listings, it is easier for someone to attempt this attack on you. Our guide to what an exposed phone number means explains the risk.

How it ended

This case ended in convictions and prison terms, but the sentences were short compared with the $330,000 loss, and the release does not mention restitution. We do not claim to know whether the victims recovered anything. For account takeovers, the lasting harm often includes lost access, lost files and the time spent recovering accounts.

What you can do

Key facts at a glance

• Announced: October 19, 2022
• Sentences: two years and one day, and two years and seven days
• Victims: at least 10 identified, nationwide
• Loss: approximately $330,000 in cryptocurrency
• Targets: cryptocurrency company executives and holders of valuable social media account names
• Investigators: FBI Boston with IRS Criminal Investigation

Why text-message codes are the weak link

Many services send a code by text when you forget a password. That is convenient, but it means anyone who controls your number can attempt the reset. The criminals in this case relied on exactly that. Authenticator apps and security keys generate codes on your own device, so moving a phone number to a different SIM does not move them. Providers that allow it often let you choose the stronger method in security settings.

What the release does not say

The release does not say how the men learned enough about victims to pass the carrier's checks, and it does not report restitution. We have not guessed. For the same attack in the UK, see our report on a London SIM swap sentence.

The practical next step is similar for most people. Read up on what to do if your phone number was in a breach, what an exposed phone number means and how scammers find your phone number and email, then review your own accounts. You can also try our free phone number exposure check.