A British hacker, Joseph O’Connor, aka the PlugwalkJoe, has been sentenced to five years in a United States prison for stealing $794,000 worth of crypto through a SIM swap attack.
The SIM swap attack case
O’Connor was initially arrested in Spain in July 2021 for his involvement in a SIM swap attack on a crypto exchange executive in 2019. He was later extradited to the United States on April 26, 2023. In May, he pleaded guilty to several charges, including conspiracy to commit computer intrusions, wire fraud, and money laundering.
The identity of the hacked crypto executive has not been disclosed. Between March and May 2019, O’Connor and his co-conspirators successfully executed SIM swap attacks on three company executives. By gaining unauthorized access to multiple accounts and computer systems, they could steal and divert cryptocurrency worth approximately $794,000 at the time, now valued at over $1.6 million.
After the theft, O’Connor and his co-conspirators laundered the stolen cryptocurrency through various transfers and transactions, exchanging some of it for bitcoin using cryptocurrency exchange services. A portion of the stolen cryptocurrency was deposited into a crypto exchange account controlled by O’Connor.
The prison sentence was announced in a statement on June 23 by the United States Attorney’s Office for the Southern District of New York, which also mentioned that O’Connor would be subject to three years of supervised release. He has been ordered to pay $794,012.64 in forfeiture.
O’Connor’s additional crimes and charges
In addition to the SIM swap attack, O’Connor pleaded guilty to multiple other crimes related to the major Twitter hack in July 2020. O’Connor and his crew hacked around 130 prominent Twitter accounts and accounts on TikTok and Snapchat, using social engineering techniques and SIM-swapping attacks. They used these prominent, compromised accounts to defraud other Twitter users or sell access to them.
O’Connor’s charges include blackmailing. He blackmailed a victim on Snapchat by threatening to release private messages publicly unless they promoted O’Connor’s online persona. He stalked and threatened another victim and orchestrated swatting attacks by falsely reporting emergencies to authorities or sending messages to the families of his victims, threatening to take their life.
Although O’Connor’s crimes happened years ago, SIM swap attacks still remain an issue in the crypto sector. These attacks involve taking control of a victim’s phone number by linking it to another SIM card controlled by the attacker, allowing them to reroute calls and messages and gaining access to accounts that use SMS-based two-factor authentication (2FA).
