Polish Crypto Raid: FBI-Backed Arrests Hit Alleged SIM-Swap Gang Behind Millions in Theft

TLDR

• Polish cybercrime police arrested four alleged SIM-swap gang members.
• The operation was supported by the FBI and Homeland Security Investigations.
• Suspects allegedly targeted crypto exchange accounts through telecom access.
• Laundered funds reportedly exceeded tens of millions of Polish zlotys.
• ZachXBT linked alleged threat actor “Merry” to the arrests.

Polish authorities arrested four members of an alleged organized cybercrime group accused of using SIM-swap attacks to steal cryptocurrency from exchange users and launder the proceeds through bank accounts, payment platforms, and digital wallets.

The arrests were carried out by Poland’s Central Bureau for Combating Cybercrime, known as CBZC, with support from the U.S. Federal Bureau of Investigation and Homeland Security Investigations. Polish officials said the case is being supervised by the Regional Prosecutor’s Office in Krakow.

All four suspects were placed in pre-trial detention at the request of prosecutors. They face charges including participation in an organized criminal group, theft by hacking computer systems and money laundering, with potential penalties of up to 25 years in prison.

Authorities Say Telecom Access Enabled SIM Swaps

Investigators said the group gained access to IT infrastructure used by entities that work with telecommunications operators. The attackers allegedly used specialized software and social engineering to obtain employee email access, which then helped them target mobile phone numbers linked to victims.

SIM swapping involves hijacking or cloning a victim’s phone number, allowing attackers to receive calls, text messages and authentication codes intended for the account owner. Once in control of a number, attackers can attempt password resets and bypass weak forms of two-factor authentication.

Polish authorities said the group used this access to seize accounts on cryptocurrency exchanges and remove digital assets held by victims. The statement did not name the targeted platforms or disclose the number of affected users, citing the ongoing international nature of the investigation.

The method has remained a recurring threat across crypto and banking services because many platforms still allow phone-based account recovery. U.S. authorities previously reported that SIM-swap schemes caused tens of millions of dollars in losses from bank and virtual currency accounts.

Stolen Crypto Was Laundered Through Multiple Channels

After stealing the digital assets, the group allegedly moved funds through a distributed financial network designed to conceal the source of the proceeds. Polish officials, consequently, said the network included personal bank accounts in Poland and abroad, international payment platforms, and multi-currency digital wallets.

The total laundered amount is estimated to exceed tens of millions of Polish zlotys, according to CBZC. That figure places the case among the larger recent European enforcement actions involving crypto theft and laundering.

Prosecutors said the suspects treated the thefts as a source of regular income. Authorities have not released detailed information on seized accounts, victim identities or the full transaction trail, as the investigation remains active.

The involvement of the FBI and Homeland Security Investigations as a result suggests that the alleged scheme may have involved victims, infrastructure or financial flows beyond Poland. Cross-border cooperation has become common in crypto crime cases because stolen assets can move through exchanges, wallets and payment systems in several jurisdictions within minutes.

ZachXBT Links “Merry” to the Case

On-chain investigator ZachXBT separately alleged that one of the detained individuals may be Polish social engineering threat actor Wojtek Kulisz, known online as “Merry.” ZachXBT said designer clothing and jewelry shown in official raid footage appeared to match items displayed on Kulisz’s public Instagram account.

Polish authorities have not confirmed the identities of the four suspects. CBZC said more details about the targets of the attacks and secured accounts will not be disclosed at this stage because the case remains international and ongoing.

ZachXBT has previously identified suspects and transaction patterns in crypto theft investigations before formal law enforcement disclosures. His claim remains separate from the official Polish statement unless authorities later confirm the identities involved.

The Polish raid, as a result, adds to a broader enforcement push against SIM-swap crews targeting digital asset holders. Similar tactics have appeared in U.S. prosecutions involving crypto exchanges and personal wallets, including cases linked to large exchange thefts and social engineering campaigns.

The post Polish Crypto Raid: FBI-Backed Arrests Hit Alleged SIM-Swap Gang Behind Millions in Theft appeared first on CoinCentral.