The Outlier Lab

Case Study - FTX Theft via SIM Swap (2022)

On FTX's bankruptcy day in November 2022, a SIM swap of an employee's phone allegedly gave attackers the codes to move $400M+ from company wallets; three were indicted in DC.

What happened

  • The ring. Prosecutors allege a group that ran from about March 2021 to April 2023. It took stolen personal data, made fake IDs in victims' names, impersonated them at mobile carrier retail stores, and moved their phone numbers to devices the group controlled. It then used those numbers to get into the victims' financial, online and social accounts and drain them. More than 50 victims are referenced.
  • The FTX employee. On November 11, 2022, Powell allegedly ordered a SIM swap of an FTX employee's AT&T account. Hernandez allegedly presented a fake ID (with her own photo and the employee's details) at a mobile carrier store in Texas. With the number moved, co-conspirators received the authentication codes for FTX's online accounts and passed them on.
  • The money movement. Over November 11–12, more than $400M in virtual currency moved from FTX wallets to wallets the group controlled. Estimates vary by source and pricing date: Elliptic valued the stolen assets at about $477M, while FTX's administrators reported about $413M in losses from unauthorized third-party transfers, a gap Elliptic attributed partly to some assets being seized and returned. Other reporting cited broader outflows of more than $650M in the same window. Only the $400M+ is charged.
  • Why the timing mattered. The theft happened on the day of the bankruptcy filing, when monitoring, staffing and decision rights were in disarray. For incident response, that combination of maximum exposure and minimal oversight is the worst case.
Diagram: Ring, Carrier store, Employee phone number, Exchange accounts

Timeline

DateEvent
March 2021Alleged start of the SIM-swapping conspiracy
November 11, 2022FTX files for Chapter 11. Alleged SIM swap of an FTX employee. Outflows begin.
November 12, 2022Outflows continue. Total alleged at more than $400M.
April 2023Alleged end of the conspiracy period
January 18, 2024Indictment filed in the US District Court for the District of Columbia (United States v. Powell, 1:24-cr-00038-ACR)
Late January to early February 2024Powell arrested in Illinois. Indictment unsealed. Powell later released on bond to home confinement.
May 16, 2024Hernandez pleads guilty to wire fraud and aggravated identity theft and agrees to cooperate. Her plea agreement estimates a guideline range of 41–51 months. Powell and Rohn have pleaded not guilty.
October 8, 2024FTX's Chapter 11 plan confirmed. Customers are projected to receive at least 118% of their petition-date account values.

Mechanisms involved

  • SIM Swap and Port-Out Fraud: the enabling attack on the carrier.
  • MFA Bypass and OTP Interception: SMS codes were the factor that failed.
  • Account Takeover (ATO): control of company accounts that held customer assets.
  • Synthetic Identity Fraud: fake identity documents made from stolen personal data, used to impersonate victims to the carrier. This is impersonation rather than a fully synthetic identity, but the document-forgery capability is the same.
  • Insider Fraud: the employee is alleged to be a victim. The case shows how attacks on employees with privileged access are as dangerous as insiders themselves.

Control gaps

GapWhy it mattered
SMS-based codes protecting high-value treasury accessA carrier-level compromise defeated the second factor (Passkeys and Phishing-Resistant Authentication)
Single-person control over large wallet movementsOne person's account was enough to move hundreds of millions (Insider Access Controls)
No out-of-band hold on unusual treasury outflowsTransfers went through over two days with no effective stop (Withdrawal and Payout Controls, Velocity and Exposure Limits)
Carrier retail identity checksA fake ID was enough for a SIM change at a store (Phone Risk Signals, Document Verification and Liveness)
Monitoring during a corporate crisisExposure peaked while oversight was at its lowest (Fraud Incident Response)

Detection and response

Outflows were noticed publicly in real time. FTX US's general counsel posted that the company was investigating abnormalities in wallet movements. Attribution took more than a year and came from outside the exchange, through a broader federal SIM-swap investigation. Blockchain analysts traced part of the proceeds through a mixer and exchanges also used by Russia-linked criminal groups, which suggests a laundering intermediary, though that link is not established. Apart from the partial seizure and return Elliptic referenced, no recovery of the stolen funds has been publicly described.

Outcome

  • Criminal: three defendants indicted on two counts: conspiracy to commit wire fraud (18 U.S.C. § 1349) and conspiracy to commit aggravated identity theft and access device fraud (18 U.S.C. § 371). Hernandez pleaded guilty in May 2024 and is cooperating. Powell and Rohn pleaded not guilty. No final outcomes are public as of October 2026.
  • Financial: $400M+ in alleged losses to the FTX estate, which was already insolvent. Customers were ultimately projected to recover more than their petition-date balances under the October 2024 plan. That came from asset recoveries and crypto price gains, not from recovering the stolen funds.

Lessons for practitioners

  1. Don't treat a phone number as proof of identity. Any money movement protected by SMS codes or SMS-based recovery inherits the security of the carrier's retail counter. Move high-value approvals to phishing-resistant factors (Multi-Factor Authentication (MFA), Passkeys and Phishing-Resistant Authentication).
  2. Treat SIM change as a high-risk account event. Carrier SIM-change and port-out signals should feed your risk engine. A recent SIM change followed by a login and a large withdrawal is a textbook sequence to step up or hold (Account Change Events, Phone Risk Signals, Playbook - SIM Swap and Contact Change Abuse Members).
  3. Require dual control on treasury movements. No single credential, however privileged, should be able to move a material share of assets. Quorum approvals, time-locks and outflow caps limit the damage from any one compromise (Insider Access Controls, Velocity and Exposure Limits).
  4. Employees with privileged access are a target. Attackers went after the person who held the keys. Extend ATO protections, SIM-lock guidance and monitoring to staff whose accounts control customer funds (Playbook - Insider Fraud Members, Support Team Fraud Training).
  5. Plan for attacks during a crisis. Layoffs, bankruptcies, outages and leadership changes reduce oversight. Pre-define who can freeze outflows during a crisis (Fraud Incident Response).
  6. The consumer version is the same attack. SIM swaps that drain retail brokerage, neobank and crypto accounts follow the same pattern at smaller scale. Compare Case Study - DraftKings Credential Stuffing (2022) and see Brokerage and Investing and Neobanks and Consumer Fintech.

Sources