(Bloomberg) -- Three people have been charged with orchestrating a SIM-swapping scam that siphoned more than $400 million from FTX as the cryptocurrency exchange spiraled into bankruptcy.

Hours after FTX filed for bankruptcy in November 2022, and its founder Sam Bankman-Fried resigned, hackers drained hundreds of millions of dollars worth of digital currency from the platform, before funneling it through a web of decentralized exchanges. 

Bankman-Fried, who is facing decades in prison after being convicted of fraud late last year, distanced himself from the hack, but speculated that it could have been an inside job. 

Turns out it wasn’t, prosecutors say.

The Department of Justice charged Robert Powell, of Illinois, Emily Hernandez, of Colorado, and Carter Rohn, of Indiana, last month with participating in a SIM-swapping ring that targeted FTX and other individuals over a two year period. SIM swappers have repeatedly identified victims in the crypto world and FTX’s lax security — pointed out by the company’s new CEO after he took over — appeared to make it a prime target. 

According to the indictment filed in federal court in Washington, Powell, Rohn and Hernandez collected personal data of about 50 victims and used the information to convince cell phone providers to port the victims’ phone numbers to a dummy phone in their possession. In doing so, the trio could intercept text messages - including multi-factor authentication codes, which allowed them to break into the victims’ financial accounts and crypto wallets.

The indictment does not name FTX, but two people familiar with the case confirmed it was in fact “victim company-1” in the court filings.

Around Nov. 11, 2022, Hernandez used a fake ID with an FTX employee’s details to convince AT&T to transfer the mobile phone account to another SIM card. The alleged ringleader of the group, Powell – who uses online monikers ‘R$’ and ElSwapo1 – then used various authentication codes to access FTX’s crypto wallets.

SIM swapping doesn’t require sophisticated hacking skills, but centers on psychological manipulation — or bribing — of telecom customer service reps.

It has become a popular way to hack into social media and email accounts, cryptocurrency exchanges and online banking. In 2022 the FBI received 2,056 SIM-swapping complaints, with losses totaling $71.6 million, up from 1,611 complaints and $68 million in losses the year before. True figures are likely higher, according to experts.

Hernandez, Powell and Rohn were charged with fraud and identity theft. Powell’s attorney, Gal Pissetzky, declined to comment while Hernandez and Rohn couldn’t be reached. 

©2024 Bloomberg L.P.