U.S. Court Convicts Hacker Behind $37M SIM Swap Attack

A United States court has convicted a hacker involved in a massive Subscriber Identity Model (SIM) swap attack. The hack that resulted in a $37 million cryptocurrency theft.

Blockchain investigator ZachXBT revealed that the Canadian Cameron Redman attempted to launder the stolen funds using hundreds of microtransactions routed through centralized crypto exchanges.

Hacker Arrested For Stealing $37M

In February 2020, Redman, then 17 years old, hijacked the phone number of crypto investor Josh Jones. This gave the teenage hacker access to two-factor authentication codes, allowing him to steal over 1,547 BTC and 60,000 BCH. Despite ZachXBT’s efforts, law enforcement recovered only $5.4 million, leaving over $31 million unaccounted for. Redman was formally charged in November 2021 in Canada, with investigative assistance from U.S. federal agencies.

The case highlights the growing threat of SIM swap attacks, a form of identity theft where attackers trick mobile providers into transferring a victim’s phone number to a SIM card they control. This allows them to intercept SMS verification codes and access secure accounts, including cryptocurrency wallets. According to the FBI, SIM swap scams resulted in significant losses, with $68 million reported in 2021, $48.8 million in 2023, and $82 million in 2024.

Being guilty of four counts of criminal offenses, Redman could face as many as nine years behind bars.

ZachXBT has called for stricter penalties for SIM swap and social engineering attacks, criticizing the legal frameworks in Canada and the European Union as too lenient. He argues that current laws allow many offenders, including minors, to avoid meaningful consequences and maintain anonymity.

Not The First

The conviction of Redman highlights the need for robust security measures to prevent SIM swap attacks.

Recall that in May 2025, Eric Council Jr. bagged a 14-month prison sentence for hacking the SEC’s X account. Council pleaded guilty to conspiracy to commit aggravated identity theft after using a SIM swap attack to gain unauthorized access to the SEC’s account. After the hack, he posted fake Bitcoin ETF news and influenced the market.

However, he was ordered to pay $50,000 and serve three years of supervised release, with restrictions on accessing the dark web and committing identity fraud.