Skip to main content
Sign in

Poland SIM-Swap Crypto Theft Ring — June/July 2026

avoid.net/poland-sim-swap-crypto-theft-ring-june-july-2026→0/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

In June 2026, Poland's Central Bureau for Combating Cybercrime (CBZC), acting jointly with the FBI and U.S. Homeland Security Investigations (HSI), arrested four members of an organized cybercrime ring that conducted SIM-swap attacks against cryptocurrency exchange users. The group allegedly breached telecom partner systems and employee email accounts using specialized software and social engineering, hijacking victims' phone numbers to bypass two-factor authentication and drain cryptocurrency holdings. Blockchain investigator ZachXBT alleged that one of the arrested individuals is Wojtek Kulisz, known online as 'Merry,' a social engineering threat actor linked to prior SIM-swap activity; Polish authorities have not confirmed this identification.

Connected Entities

1 entities · 10 linked investigations
Protocols
⌂Poland SIM-Swap Crypto Theft Ring — June/July 2026
Relationships
    Also appears in
    edgeX Exchange·28Saga EVM Blockchain·32Mach-O Man Malware Campaign (Lazarus / Chollima)·0Trenton Richard Johnston·2Q2 2026 DeFi Record Hack Wave·0Gamma Strategies·28Bunni Protocol·28Interpol Operation First Light 2026 — $123M Romance Scam Crypto Network·5Axiom DEX Insider Trading (Broox Bauer)·14Thorchain DEX·28
    Have evidence about Poland SIM-Swap Crypto Theft Ring — June/July 2026?

    Timeline(3 events)

    2026-06-25

    Poland's CBZC, with active support from the FBI and HSI, arrested four individuals alleged to be members of an organized SIM-swapping cybercrime ring targeting cryptocurrency exchange users. Suspects placed in pre-trial detention.

    The Block, BleepingComputer, Help Net Security

    2026-06-25

    Blockchain investigator ZachXBT alleged via Telegram that one of the arrested individuals is Wojtek Kulisz, operating under the alias 'Merry,' based on matching designer clothing and jewelry between official police raid footage and the suspect's Instagram account. Polish authorities did not confirm this identification.

    The Block, Cryptopolitan, CoinAlertNews

    2026-06-26

    Multiple major cybersecurity and crypto news outlets published detailed reporting on the arrests, including BleepingComputer and Help Net Security, expanding public awareness of the operation.

    BleepingComputer, Help Net Security
    Provenance & Audit Trail
    9 Wayback Archives

    Decision Log

    • #1publish⛓ pending8/1/2026, 12:15:23 PM
      hash: FekYKVSu9tmFnBkTa5w8aYPsJUbZuUCxmVLL9gGwLquH

    9 of 10 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 8/1/2026, 12:15:16 PM

    last updated: 8/1/2026, 6:52:21 PM

    avoid.net — verified advice for a post-truth world