$24 Million Crypto Heist: AT&T Back In Legal Hot Water Over SIM Swap Scandal

As a researcher with extensive experience in digital security and consumer rights, I find myself deeply invested in the ongoing legal battle between Michael Terpin and AT&T. Having closely followed similar cases of data breaches and SIM swap attacks, I cannot help but empathize with Mr. Terpin’s plight.


once more, AT&T finds itself making headlines due to fresh legal disputes stemming from a high-profile SIM swap incident. In this instance, a cryptocurrency worth approximately $24 million was swindled from an investor named Michael Terpin.

More recently, the Ninth Circuit Court of Appeals reversed a previous decision made by a lower court that had been in favor of a telecom company. This means the case will now proceed to trial.

This ruling also brings back on track Terpin’s lawsuit against the telecom company, and consequently, underlines important issues involving the different roles of telcos in protecting customer information.

A Lengthy Legal Fight

Everything started back in 2018 when Terpin became a victim of a highly advanced SIM swap scam. Crooks managed to persuade an AT&T employee to move Terpin’s phone number to a new, empty SIM card they possessed. This allowed them to take control of his phone and reset passwords, bypassing two-factor authentication. Consequently, they were able to steal a substantial amount of Terpin’s cryptocurrency assets. Despite taking numerous security measures, such as consulting with security experts, Terpin was unable to prevent the attack.

Michael Terpin, an investor in digital currencies, has filed a lawsuit against an individual who graduated from high school recently. The accusation is that this person stole approximately $24 million in cryptocurrency from Terpin by exploiting a SIM swap scheme, thereby circumventing the two-factor authentication safeguarding his crypto wallet. Additionally, Terpin is demanding a total of at least $45 million in the lawsuit.

— Wu Blockchain (@WuBlockchain) October 3, 2024

Initially, Terpin sued AT&T and Ellis Pinsky for $24 million in damages. But on April 20th, 2023, a judge decided in favor of AT&T, granting them a summary judgment that dismissed most of Terpin’s allegations. This surprising decision left both Terpin and many onlookers questioning AT&T’s responsibility to safeguard customer data, as it was generally believed this was their duty.

The Appeals Court Decision

By October 2024, the Ninth Circuit Court has overturned the previous decision, finding that AT&T indeed violated the Federal Communications Act. The court agrees that AT&T failed to safeguard Customer Proprietary Network Information (CPNI), which customers reasonably assume will be kept confidential and secure. This is crucial because it allows Terpin to pursue damages claims against AT&T, amounting to over $45 million, including interest and legal fees.

$24 Million Crypto Heist: AT&T Back In Legal Hot Water Over SIM Swap Scandal

Terpin reports that lead attorney Pierce O’Donnell expressed optimism about the verdict. He pointed out that this decision establishes a precedent for other litigants to file lawsuits against telecom companies when they fail to safeguard customers’ sensitive information. O’Donnell emphasized that this isn’t just about one person, but rather thousands of consumers who have been compromised due to AT&T’s inadequate security measures.

$24 Million Crypto Heist: AT&T Back In Legal Hot Water Over SIM Swap Scandal

Implications For Consumers

This case has far-reaching consequences, not just for Terpin and AT&T, but also within the growing realm of cryptocurrency. As more people start utilizing cryptocurrencies, the risk of SIM swapping increases significantly. Many individuals secure their accounts using text message two-factor authentication, but these methods are also susceptible to being compromised via SIM swaps. Security experts caution that relying on text messages for security is a poor practice.

Terpin emphasized that this would have given AT&T an opportunity to evade accountability, potentially establishing a harmful pattern in terms of data protection within the telecommunications sector. “This isn’t about personal gain for me,” he stated. “It’s about fostering an environment where companies prioritize their customers’ data security seriously.

Read More

2024-10-04 10:44