12-Year Prison Term Handed Down in $22M SIM Swap Cryptocurrency Heist Involving Nicholas Truglia

A federal court has imposed a substantial prison sentence on Nicholas Truglia following his conviction in one of the cryptocurrency community’s most notable security breaches. U.S. District Judge Alvin Hellerstein determined the 12-year term appropriate given Truglia’s inability to fulfill a $20.4 million restitution obligation owed to affected parties.

The SIM Swap Attack Mechanism

The criminal enterprise centered on a sophisticated social engineering attack targeting Michael Terpin, the CEO of Transform Group. Rather than traditional hacking methods, Truglia and his co-conspirators manipulated telecom personnel to reassign Terpin’s mobile phone number to a SIM card under their control. This takeover granted them unrestricted access to the victim’s cryptocurrency accounts and digital assets.

Converting Stolen Assets

Once the perpetrators gained control of Terpin’s communications channel, they systematically emptied his crypto holdings. The stolen digital currency—totaling $22 million—was then processed through Bitcoin conversions, a common laundering technique used to obscure the illicit funds’ origin and trail.

Legal Accountability and Restitution

Truglia’s guilty plea acknowledged his participation in the criminal scheme. However, the absence of meaningful restitution payments led Judge Hellerstein to increase the sentencing duration. The $20.4 million compensation figure represents the court’s assessment of damages to victims, underscoring the financial devastation such attacks inflict on targeted individuals.

Broader Security Implications

This case demonstrates a critical vulnerability in the cryptocurrency ecosystem: the reliance on centralized telecommunications infrastructure to secure digital asset access. Many investors rely on phone-based authentication for account recovery, making them susceptible to SIM swap attacks when coordinating with telecom companies inadequately trained in security protocols.