Wojtek ‘Merry’ Kulisz linked to four detained in FBI and Polish crypto fraud raid

Poland’s Central Bureau for Combating Cybercrime (CBZC) has detained four people in a joint operation with FBI and Homeland Security Investigations (HSI) agents. 

Poland’s authorities have charged the four detained individuals with running SIM swap attacks in order to steal from cryptocurrency exchange accounts. They have also been charged with laundering the proceeds through a number of bank accounts and digital wallets.

What is a SIM swap attack?

On June 25, Poland’s Central Bureau for Combating Cybercrime (CBZC), with support from the FBI and Homeland Security Investigations (HSI), arrested four people accused of running SIM swap attacks to steal cryptocurrency and launder tens of millions of zlotys. 

A SIM swap attack happens when a criminal tricks a phone company into switching a victim’s phone number to a new SIM card that the criminal controls. Once the criminal has the victim’s phone number, they can receive all calls and text messages, including one-time security codes used to access online accounts.

The group arrested in Poland targeted cryptocurrency exchanges specifically. 

According to the CBZC, they first broke into the IT systems of companies that work with telecom operators, and with the help of social engineering and special software, they compromised employee email accounts. 

This access allowed them to perform SIM swap attacks, which means they cloned and hijacked victims’ phone numbers. 

With full access to SMS and email channels, the suspects hijacked accounts on cryptocurrency exchanges and systematically emptied them. The stolen funds were then laundered through personal bank accounts in both Poland and abroad, international payment platforms, and digital wallets of various currencies.

Blockchain investigator ZachXBT linked one of the suspects to Wojtek Kulisz, a social engineer known online as “Merry.” 

Investigations are still ongoing while the four individuals are in pretrial detention, facing up to 25 years in prison.

Polish authorities did not release names or photographs, but Zach reported that designer clothing and jewelry visible on Kulisz’s public Instagram account “wojtekk” matched items photographed by the authorities during the seizure.

Polish prosecutors estimate the total value of laundered funds exceeds “tens of millions of zlotys,” which at current exchange rates is roughly $15 million.

Authorities are fighting crypto crime globally

All four suspects face charges of participation in an organized criminal group, theft through unauthorized access to computer systems, and money laundering.

Similar to the Polish operation, other international law enforcement agencies have partnered up to fight crypto-enabled crime. For instance, in March, the FBI and Thai police froze approximately $580 million in cryptocurrency tied to Southeast Asian fraud compounds. 

And in late May, the FBI’s Operation Blackout seized over $8 billion in assets, including more than 127,000 Bitcoins linked to a transcontinental scam network.