Poland Busts SIM-Swapping Gang Tied to Millions in Crypto Theft

Polish law enforcement has arrested four members of an organized cybercrime group accused of executing large-scale SIM-swapping attacks, according to a report from BleepingComputer published on June 25, 2025. The group allegedly breached telecommunications partners and hijacked email accounts to gain control of victims' phone numbers, ultimately stealing millions in cryptocurrency.

What Happened

The arrested individuals are accused of working as an organized unit to compromise systems belonging to telecom industry partners. By gaining access to these internal systems, they could reassign victims' phone numbers to SIM cards under the attackers' control. Once they controlled the phone number, they used it to bypass SMS-based two-factor authentication on email accounts and cryptocurrency platforms.

The attack chain is straightforward but devastating. Hijack the phone number, reset the email password, drain the crypto wallet. Polish authorities did not publicly disclose the full technical details of how the telecom partners were breached, but the scale of the operation suggests the group had sustained, privileged access to carrier or reseller infrastructure over a period of time.

Why This Matters to Small Teams

SIM swapping is not just a problem for high-profile crypto holders. Any account that uses an SMS code as its second authentication factor is vulnerable if an attacker can first obtain enough personal information to convince a carrier to reassign a number, or if they have direct access to carrier systems as this group allegedly did.

Small teams and solo developers often protect critical infrastructure with personal phone numbers. Your domain registrar, your cloud hosting account, your DNS provider, your payment processor, your code repository - if any of these rely on SMS-based 2FA tied to a personal number, a successful SIM swap could give an attacker full access to your business. The blast radius extends far beyond a crypto wallet.

This case also highlights a supply chain weak point that individual developers cannot fully control: the security posture of telecommunications partners. Even if your own practices are solid, attackers may find a path through a third-party reseller or internal carrier system. This makes reducing reliance on SMS-based authentication even more important, because you cannot assume the phone network itself is trustworthy.

How to Stay Protected

1. Replace SMS-based 2FA with app-based or hardware-based alternatives. Use an authenticator app (such as Authy or Google Authenticator) or a hardware security key (such as a YubiKey) for every account that supports it. These methods are not vulnerable to SIM swapping.

2. Audit which accounts are protected only by SMS codes. Make a list of every critical service your business depends on - registrar, DNS, hosting, email, payment processor, code repository - and check the 2FA method. Replace SMS wherever a stronger option exists.

3. Set a carrier PIN or port freeze on your phone number. Most carriers allow you to add a PIN or account passcode that must be provided before any SIM changes or number transfers are authorized. Contact your carrier and enable this now.

4. Use a dedicated email address for high-value accounts. Keep your domain registrar, DNS, and financial accounts linked to an email address that is not publicly associated with your name or company. This reduces the information available to attackers conducting reconnaissance before a SIM swap attempt.

5. Monitor for unauthorized account activity. Set up login alerts on every critical platform. Some registrars and cloud providers also support email or webhook notifications for DNS changes - enable these so you catch a breach within minutes, not days.

6. Review third-party access regularly. If your team uses shared accounts or delegated access through resellers, audit who has permission to make changes on your behalf. Revoke access that is no longer needed.

How UNPWNED Helps

UNPWNED focuses on web-facing security controls that small teams commonly misconfigure or miss. While a SIM-swapping arrest sits outside the scope of what a web scanner can directly detect, our checks cover weak authentication configurations, exposed admin interfaces, and missing security headers that could make your site easier to compromise once an attacker gains any foothold. Running regular scans helps you keep your web properties hardened so that even if account credentials are compromised through another channel, your attack surface is as small as possible. You can scan your site at unpwned.io.

---

This post was drafted with AI assistance based on authoritative security sources, then published under editorial review.