Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case

Polish authorities have arrested four members of an organized criminal group accused of conducting SIM swap attacks on cryptocurrency exchanges, stealing digital assets, and laundering the proceeds, with onchain sleuth ZachXBT claiming a popular threat actor identified in past analysis was among the detained.

The joint operation supported by the U.S. FBI and Homeland Security Investigations agents found that group members breached the IT infrastructure of entities that cooperate with telecommunications operators, using specialized software and social engineering to access employees' email accounts, according to a press release published Thursday by Poland's Central Bureau for Combating Cybercrime, known by its Polish acronym CBZC.

That access enabled SIM swap attacks, or the illegal cloning and hijacking of victims' phone numbers, which the group then used to seize control of user accounts on cryptocurrency exchanges and drain the digital assets held there, according to the CBZC statement.

Stolen funds were then laundered through a distributed financial network spanning personal bank accounts in Poland and abroad, international payment platforms, and multi-currency digital wallets.

The total value of funds laundered is estimated to exceed tens of millions of Polish zlotys, according to the CBZC.

All four suspects were remanded into pre-trial detention at the request of the prosecutor's office. The suspects face charges including participation in an organized criminal group, theft by hacking, and money laundering, carrying penalties of up to 25 years' imprisonment, according to court documents.

Threat actor 'Merry' among suspects

Onchain investigator ZachXBT alleged separately that one of those detained is Wojtek Kulisz, a Polish social engineering threat actor known online as "Merry." On this official Telegram channel, ZachXBT said designer clothing and jewelry items visible in the CBZC's footage of the raid match items Kulisz had publicly displayed on his Instagram account.

Polish authorities have not confirmed the identity of any of the four suspects, citing the ongoing international nature of the investigation.

ZachXBT, whose real identity remains unknown, has a track record of identifying suspects in crypto theft cases before formal law enforcement disclosures. His prior investigations have contributed to arrests and asset recoveries across multiple jurisdictions, as The Block has previously reported.

The CBZC said detailed information on the targets of the attacks and secured accounts will not be disclosed at this stage.