DOJ Charges Five Men in Cryptocurrency Phishing Scheme

The alleged conspirators, aged 20 to 25, face charges including conspiracy to commit wire fraud, conspiracy, and aggravated identity theft. According to the DOJ, the group used phishing text messages to obtain employee credentials, which were then exploited as entry points to access and steal funds from cryptocurrency accounts.

Link to Scattered Spider

The five defendants are reportedly linked to Scattered Spider, a hacking group behind high-profile cyberattacks on Caesars Entertainment and MGM Resorts International. The group is known for extortion, data theft, and ransomware attacks, often employing advanced social engineering tactics, according to an FBI advisory.

Potential Sentences

If convicted:

• Conspiracy to Commit Wire Fraud: Maximum sentence of 20 years.
• Conspiracy: Up to 5 years.
• Aggravated Identity Theft: A mandatory 2-year consecutive sentence.

DOJ and FBI Warnings

United States Attorney Martin Estrada emphasized the sophistication of modern phishing and hacking schemes, calling for increased vigilance.

“Phishing and hacking have become increasingly sophisticated and can result in enormous losses,” said Estrada.

Akil Davis, Assistant Director of the FBI’s Los Angeles Field Office, noted that the suspects used stolen credentials “as a gateway to steal millions in their cryptocurrency accounts.”

Rise in Crypto Phishing Attacks

The indictment comes amid a surge in phishing incidents targeting cryptocurrency holders and platforms:

1. $1.4 Million Loss: A Pepe token holder recently lost this amount after unknowingly signing an off-chain Permit2 signature during a phishing attack.
2. Colorado Bitcoin Scam: Fraudsters tricked Colorado residents into transferring thousands of dollars in Bitcoin.
3. Global Trends: Kaspersky reported a 40% increase in phishing attacks in 2022, marking a shift from traditional financial fraud to crypto-targeted schemes.

Protecting Against Phishing

As phishing attacks become more sophisticated, authorities and cybersecurity experts urge individuals and businesses to exercise caution:

• Verify Communications: Suspicious emails or texts should be treated with skepticism.
• Secure Credentials: Use two-factor authentication and avoid sharing sensitive information through unverified channels.
• Regular Training: Companies should educate employees about recognizing phishing attempts.

Estrada summarized the importance of vigilance, stating, “If something about the text or email you received or website you’re viewing seems off, it probably is.”