Hacker Jailed for Stealing Millions of Dollars in Cryptocurrencies by SIM Hijacking

A sixth member associated with an international hacking group
known as The Community has been sentenced in
connection with a multimillion-dollar SIM swapping conspiracy, the
U.S. Department of Justice (DoJ) said.

Garrett Endicott, 22, from the U.S. state of Missouri, who
pleaded guilty to charges of wire fraud and aggravated identity
theft following an indictment in 2019, was sentenced^[1]
to 10 months in prison and ordered to pay an amount totaling
$121,549.37 in restitution.

SIM swapping^[2], also called SIM
hijacking, refers to an identity theft scheme wherein malicious
parties persuade phone carriers into porting their victims’ cell
services to SIM cards under their control, often facilitated by
bribing an employee of a mobile phone provider or by contacting the
service provider’s customer support by posing as the victim and
requesting that the phone number be swapped to a SIM card operated
by the group.

The goal is to leverage the phone numbers as a gateway to hijack
different online services used by the targets such as email, cloud
storage, and cryptocurrency exchange accounts by resetting their
passwords and one-time verification codes that are sent via SMS
messages as part of the two-factor authentication (2FA) process,
enabling the cybercrime crew to circumvent security measures.

“Members of The Community engaged in Sim Hijacking to steal
cryptocurrency from victims across the country, including
California, Missouri, Michigan, Utah, Texas, New York, and
Illinois,” the DoJ said, resulting in the theft of cryptocurrency
valued, at the time of the theft, ranging anywhere between $2,000
to more than $5 million, from different affected parties.

Endicott is also the sixth and the last of the group members
from the case to be sentenced between two to four years in prison,
including four other people in the U.S. and one in Ireland — Ricky
Handschumacher (28), Colton Jurisic (22), Reyad Gafar Abbas (22),
Conor Freeman (22), and Ryan Stevenson (29).

“The actions of these defendants resulted in the loss of
millions of dollars to the victims, some of whom lost their entire
retirement savings,” said Acting U.S. Attorney Saima Mohsin for the
Eastern District of Michigan. “This case should serve as a reminder
to all of us to protect our personal and financial information from
those who seek to steal it.”