Senior code farmers are also recruited, BitGo engineer director stolen $100,000 bitcoin

SIM card hijackers who steal bitcoin and other cryptocurrencies are becoming more and more daring. They are no longer just pursuing vulnerable people, and now they are even looking for technically savvy goals.

One of the victims was Sean Coonce, engineer director of cryptocurrency company BitGo. The blockchain engineer publicly stated that the attacker had stolen bitcoin worth more than $100,000 from his Coinbase account, which was a very bold move. The attacker succeeded in doing this in as little as 24 hours, while carefully covering up all the evidence.

Coonce said that this incident last week was the "most expensive lesson" in his life.

Hijacking SIM cards to steal bitcoin: an increasingly common form of attack

Coonce said the attackers first transferred their SIM cards to the devices they controlled last Tuesday. He realized this until his phone was out of service. Soon after, he tried to log in to his Google account but failed.

At the same time, the attacker enabled the Retrieve Password feature in Coonce's Coinbase account. However, the password reset link can only be sent after 24 hours. After starting this process, the attacker deleted the email associated with Coinbase without leaving any evidence.

At first, Coonce suspected that the SIM card had a problem because his mobile phone fell to the ground. He changed a new one the next day, thinking that the problem had been solved. But that night, Coonce found that his cell phone signal disappeared. He also received a message reminding him to log in to his Google account.

Unfortunately, this issue did not attract Coonce's attention, and he decided to solve the problem the next morning. But at this point the attacker has completed the password reset process of Coinbase, 24 hours has passed. In addition to stealing all the coins in his Coinbase wallet, the attacker also used Coonce's funds to buy the cryptocurrency. The attacker then transfers the stolen bitcoin and other cryptocurrencies to another chain address.

The frequency of "SIM card swap scams" is getting higher and higher. Two weeks ago, the US Eastern District Prosecutor's Office accused nine people involved in SIM card hijacking, and the group profited more than $2.4 million from their activities. Even more disturbing is the fact that three employees of a wireless carrier are members of the gang, which proves that insiders sometimes meet the attacker.

Although some victims of SIM card hijacking do not take legal action against wireless carriers, not everyone is reluctant to accept it. For example, last year, bitcoin investor Michael Terpin sued US telecommunications giant AT&T. After Terpin's SIM card was hijacked, he lost millions of dollars worth of crypto assets. Terpin also filed a lawsuit against a 21-year-old SIM card hijacker. Earlier this month, the California Supreme Court awarded him $75.8 million in compensation for the case.

The biggest security hole: humanity

Although there are always criminals who exploit the weaknesses of cybersecurity, Coonce said that while mobile networks, online service providers and device manufacturers can enhance security, the biggest hole remains in human nature.

Coonce admits that he did not take cyber security seriously because he "has never been attacked." The blockchain engineer is still blamed for being lazy to some extent:

“Although I understand my risk situation, I am just too lazy to protect my assets seriously.”

Recently, in an interview, cryptocurrency hackers who claimed to be Daniel also said that if people do not better protect themselves, they can only blame themselves.

We will continue to update Blocking; if you have any questions or suggestions, please contact us!