Polish Cybercrime Police Arrest Four In Major Crypto Theft Investigation

Most crypto thieves use decentralization methods for crypto theft’s and love to talk about decentralization until law enforcement from multiple countries starts coordinating faster than their laundering routes.

On June 25, Poland’s Central Cybercrime Bureau (CBZC) announced the arrest of four individuals allegedly involved in an organized criminal operation specializing in cyberattacks, digital assets thefts (crypto thefts), and large scale money laundering.

The operation was conducted with active support from the FBI and Homeland Security Investigations (HSI), while prosecutors Kraków continue to oversee the case.

According to investigators, the group deliberately targeted IT systems and infrastructure linked to telecommunications partners and employee email accounts.

SIM Swap Attacks Returns To Headlines Again

The attackers allegedly relied on specialized software and social engineering techniques to gain unauthorized access to sensitive systems. That access was then used to conduct SIM swap attacks, following them to clone victims phone numbers and seize control of SMS and email communications.

Once those communication channels were compromised, crypto exchange accounts became easy targets.

Authorities claim the group then moved stolen crypto assets or digital assets through numerous domestic and international bank accounts, payment platforms, and multi-currency digital wallets in an attempt to legitimize the funds.

The amount allegedly laundered through these channels is estimated to exceed tens of millions of polish zlotys.

International Agencies Joins Expanding Investigation Efforts

The suspects face allegations including participation in an organized criminal group, hacking related theft, and money laundering offenses carrying penalties of up to 25 years in prison.

Polish courts have approved pre-trial detention for all four individuals.

Separately, on chain investigator ZachXBT alleged that one of those detained may be a polish social engineering threat actor known online as “Merry”. The claim was based on items visible during footage of the raid that allegedly matched luxury items previously displayed on social media.

Authorities have not confirmed the identity of any detainees and say details regarding victims, crypto exchange accounts, and seized assets will remain undisclosed while the international investigation continues.