Californian Richard Yuan Li, 20, has been charged with conspiracy to commit wire fraud for his role in SIM-swap attacks targeting at least 20 individuals, as well as the attempted extortion of a New Orleans-based doctor and cryptocurrency investor known only as ‘Investor A.’

Li is believed to have collaborated with others from January 2018 until February 2019 to defraud numerous victims through SIM-swapping attacks, with some of the co-conspirators remaining unknown to the United States Attorney’s Office.

SIM-swaps involve rerouting a victim’s SIM to a phone in possession of the attackers, allowing them to gain access to personal information and sensitive accounts including emails, bank accounts, and cryptocurrency wallets.

20-year-old charged over SIM-swap attacks

The complaint asserts that Li first participated in a scheme to defraud Apple Inc. in January 2018. After convincing Apple customer support staff that they had not received an iPhone 8 purchased from the company, Lie and his co-conspirators were able to gain possession of a second device.

On November 10, Victim A’s phone number was swapped to a SIM card contained in the fraudulently obtained iPhone 8 — which Li operated from his dormitory in San Diego.

Attackers demand 100 Bitcoins

Li and his co-conspirators were able to gain control over Victim A’s email, before accessing several of the physician's accounts with various cryptocurrency exchanges.

After stealing “a significant portion of Victim A’s cryptocurrency,” the group rang the physician to demand a ransom of 100 Bitcoins (BTC) to prevent sensitive information from being leaked and purportedly restore control over his crypto accounts.

Between October 2018 and December 2018, Li participated in 28 SIM-swapping attacks that targeted at least 19 other victims.

If convicted, Li faces up to five years imprisonment and a fine of up to $250,000.

15-year-old steals $23.8 million via SIM-swap

During May, pioneering crypto investor and the victim of a $23.8 million SIM-swap attack in 2018, Michael Terpin, filed a civil suit for $71.4 in damages against 18-year-old Ellis Pinsky of Irvington, New York for masterminding the hack.

Pinsky had been just 15 years old at the time of the attack, and had planned to retire early after the heist.