U.S. federal prosecutors have charged three individuals, Robert Powell, Carter Rowan, and Emily Hernandez, for orchestrating a series of SIM-swapping attacks and have linked them to a $400 million hack of FTX in 2022. The charging document, filed in U.S. District Court in Washington, D.C., alleges that the trio conducted a SIM-swapping attack that stole the identities of 50 victims and convinced a telecommunications provider to transfer the victims' numbers to mobile phones controlled by the attackers. The court filing also details an attack on "Victim Company-1," believed to be FTX, where Hernandez allegedly impersonated an employee, allowing Powell to access the AT&T account and move over $400 million in virtual currency out of crypto wallets.
Blockchain security firm Elliptic noted in a blog post on February 1 that FTX appears to be "Victim Company-1" as mentioned in the indictment. The hack of FTX occurred just hours after the indictment was filed. The attackers conducted multiple unauthorized transactions, leading to losses of approximately $400 million, and FTX subsequently filed for bankruptcy on November 11, 2022. According to Bloomberg, sources familiar with the matter confirmed that the company mentioned in the indictment was indeed FTX.
After the FTX hack, some of the stolen funds were sent to the cryptocurrency exchange Kraken. Nick Percoco, Kraken's Chief Security Officer, revealed the user's identity at the time. Following the hack, the attackers attempted to launder the stolen cryptocurrency by moving funds through different bridges and blockchains. SIM swapping is a technique that allows attackers to intercept multi-factor authentication codes commonly used for logins. The attack on FTX occurred in December 2023, when several prominent figures and projects in the cryptocurrency space were successfully targeted.
FTX's CEO and head of restructuring, John J. Ray III, acknowledged that the exchange had poor security and lacked proper systems when he took over after the bankruptcy, making it susceptible to such attacks. Powell, Rowan, and Hernandez are facing charges of conspiracy to commit wire fraud and identity theft in connection with the SIM-swapping attacks.
