{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-blockchain-capital-co-founder-loses-6-3m-in-sim-swap-14m-attempt-blocked"},"incident":{"title":"Blockchain Capital co-founder loses $6.3M in SIM swap; $14M attempt blocked","date":"2023-05","date_precision":"month","victim_org":"Bart Stephens, co-founder of Blockchain Capital","sector":"Cryptocurrency","country":"United States","primary_vector":"SIM Swap","secondary_vectors":["Help Desk Impersonation"],"ai_involvement":"No AI reported","ai_notes":"No AI involvement was reported.","outcomes":["Cryptocurrency Theft","Identity Theft","Attempt Blocked"],"loss_usd":6300000,"loss_note":"$6.3 million in bitcoin, ether and other tokens per the civil complaint. A further attempted theft of about $14 million from a cold storage wallet was stopped. Roughly half the stolen funds were routed through mixers.","records_affected":null,"threat_actor":"Unidentified attacker sued as 'Jane Doe'","summary":"Blockchain Capital co-founder Bart Stephens lost $6.3 million in cryptocurrency to a SIM-swap attack in May 2023 and sued the unidentified attacker in the Northern District of California on August 16, 2023. A separate attempt to move about $14 million out of a cold storage wallet was blocked when a Blockchain Capital employee saw the withdrawal notification and intervened. The attacker taunted Stephens, claiming the ability to remotely hijack any phone number in the mainland US.","how_it_worked":"The attacker assembled Stephens's personal details from public sources and dark web data, then used them to pass the identity checks at his mobile carrier, change the account password, order a new handset and port his private cell number to a SIM in that device. Holding the number, the attacker triggered password resets across Stephens's digital wallets and satisfied the SMS second factor on each one, then systematically moved assets out. The one transfer that failed was the cold storage withdrawal, which generated a notification seen by a colleague at the firm who acted before it settled.","lessons":"Removing SMS as a recovery or second factor for any wallet, and routing large withdrawals through a mandatory second-person approval with a time delay, are the two controls that separated the $6.3 million loss from the $14 million save.","confidence":"Reported","sources":[{"title":"Blockchain Capital's Bart Stephens Lost $6.3 Million In SIM-Swap Crypto Hack","url":"https://www.forbes.com/sites/iainmartin/2023/08/21/blockchain-capitals-bart-stephens-lost-63-million-in-sim-swap-crypto-hack/","publisher":"Forbes"}],"entry_type":"incident","slug":"2023-blockchain-capital-co-founder-loses-6-3m-in-sim-swap-14m-attempt-blocked","year":2023,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-blockchain-capital-co-founder-loses-6-3m-in-sim-swap-14m-attempt-blocked"}}