U.S. charged two men over alleged $550,000 crypto SIM-swap scheme

The U.S. Department of Justice announced on November 14, 2019, that Eric Meiggs and Declan Harrington had been arrested and charged in federal court in Boston over an alleged campaign to take control of telephone numbers, online accounts and cryptocurrency.

The 11-count indictment charged the two Massachusetts men with one count of conspiracy, eight counts of wire fraud, one count involving computer fraud and abuse, and one count of aggravated identity theft. Prosecutors said members of the alleged conspiracy stole or attempted to steal more than $550,000 in cryptocurrency from at least 10 identified victims across the United States.

Those statements were allegations, not findings of guilt. Both defendants were entitled to a presumption of innocence, and the November 14 record did not establish a conviction, final loss amount or complete accounting of every participant.

A telephone number became an access key

The indictment described SIM swapping as the central entry point. An attacker would induce a wireless carrier to move a victim’s telephone number from the victim’s subscriber identity module to a SIM controlled by the attacker. Calls and text messages intended for the victim would then arrive on the attacker’s device.

Control of the number could be used to request password-reset links or intercept authentication codes. Prosecutors alleged that the conspirators moved from telephone accounts into email, social-media and cryptocurrency accounts, searched email for wallet recovery information and private keys, and sometimes transferred account credentials or cryptocurrency to other people.

The alleged conspiracy charged in Count One ran from November 5, 2017, through November 13, 2019. That period distinguishes the conduct from the November 14 arrests and charging announcement: the event tied to this archive date was the federal case becoming public, not the occurrence of every alleged intrusion.

What prosecutors alleged about the losses

The indictment provided examples rather than a complete public ledger of the claimed aggregate. It alleged that one targeted Coinbase account held approximately $200,000 in cryptocurrency, although Meiggs reportedly told alleged co-conspirators that he had not obtained those funds. In other episodes, members of the alleged conspiracy induced a contact of a compromised victim to send approximately $100,000 in cryptocurrency, stole $10,000 from another victim, used a private key obtained from email to steal more than $165,000, and removed approximately $35,000 from a Block.io wallet.

Those figures were prosecutors’ U.S.-dollar valuations attached to alleged incidents on different dates. The indictment did not identify every digital asset, disclose a common pricing source or publish blockchain addresses sufficient to reproduce the valuations. The Justice Department’s figure of more than $550,000 also combined completed and attempted theft, so it should not be read as a verified realized-loss total.

Why the case mattered to crypto security

Prosecutors said the alleged targets included cryptocurrency-company executives and other people believed to control substantial digital assets. That targeting model exposed a security boundary extending beyond an exchange or blockchain: a telephone carrier, an email provider and an SMS-based authentication process could all sit between an attacker and a wallet or hosted account.

The indictment therefore did not describe a failure of Bitcoin, Ethereum or another underlying consensus protocol. It described alleged account takeover and social engineering around services used to reach credentials and signing material. For institutions and individuals operating in cryptocurrency markets in 2019, that distinction mattered because strong blockchain cryptography could not compensate for a recoverable account protected by a compromised telephone number.

The charging structure was also notable. Federal prosecutors relied on conspiracy, wire-fraud, computer-fraud and identity-theft statutes rather than a cryptocurrency-specific offense. Digital assets were the alleged target and proceeds, while the legal theory used established laws governing unauthorized access, deceptive communications and identity misuse.

What remained unresolved on November 14

The public record on November 14 did not identify the victims, specify which wireless carriers processed the alleged swaps or establish how each carrier was persuaded to transfer a number. It also did not prove that every attempted intrusion succeeded. The indictment and arrest announcement established a documented federal enforcement action and a detailed allegation of operational risk; adjudication and a final loss determination remained separate questions.