Audit log

Every state-changing event for Poland SIM-Swap Crypto Theft Ring — June/July 2026: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-01 12:15:23Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   FekYKVSu9tmF…9gGwLquHcopysha256 → base58

   verifying row…

   canonical bytes (15917 B) ▸

   {"actor":"system:backfill","investigation_id":"560492dd-7a63-4ab3-8a6a-0176a9cef7f2","kind":"publish","page_slug":"poland-sim-swap-crypto-theft-ring-june-july-2026","published_at":"2026-08-01T12:15:23.201Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Poland SIM-Swap Crypto Theft Ring — June/July 2026","sections":[{"content":"On June 25, 2026, Poland's Central Bureau for Combating Cybercrime (CBZC) announced the arrest of four individuals alleged to be members of an organized SIM-swapping cybercrime ring targeting cryptocurrency holders. The operation was conducted with active participation from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI), making it a joint transatlantic law enforcement action. The four suspects were placed in pre-trial detention and the investigation is supervised by the Regional Prosecutor's Office in Kraków. Polish authorities did not publicly disclose the names of the four arrested individuals, citing the ongoing international nature of the investigation.","heading":"Overview and Arrests","severity":"critical","sources":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"}]},{"content":"According to Polish authorities, the group employed specialized software and social engineering tactics to gain unauthorized access to the IT infrastructure of entities that work with telecommunications operators. By compromising employee email accounts at these telecom-adjacent companies, the group obtained credentials and access sufficient to execute SIM-swap attacks — the illegal cloning and takeover of victims' phone numbers. Once a victim's phone number was under their control, the attackers could intercept SMS-based and email-based two-factor authentication codes, enabling them to seize control of cryptocurrency exchange accounts and drain the digital assets held within them. Stolen funds were then allegedly laundered through personal bank accounts in Poland and abroad, international payment platforms, and multi-currency digital wallets.","heading":"Attack Methodology","severity":"critical","sources":[{"credibility":2,"name":"Poland arrests four in SIM-swapping ring linked to more than $5 million in crypto theft — TechEchelon","type":"news_article","url":"https://www.techechelon.com/post/poland-arrests-four-in-sim-swapping-ring-linked-to-more-than-5-million-in-crypto-theft"},{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"}]},{"content":"Polish prosecutors estimated the total value of funds laundered by the group exceeds several tens of millions of Polish zloty. Multiple reporting outlets noted a USD equivalent of approximately $5 million or more, though this figure is an approximation based on exchange rates and has not been confirmed in official court documents publicly available as of the time of reporting. The Cryptopolitan reported an estimate of approximately $15 million at prevailing exchange rates, though sourcing for the higher figure varies. Stolen cryptocurrency was routed through a distributed financial network including personal bank accounts in Poland and internationally, international payment platforms, and multi-currency digital wallets. No specific cryptocurrency exchanges or individual victims have been publicly named by authorities.","heading":"Financial Scale and Laundering","severity":"critical","sources":[{"credibility":2,"name":"Poland arrests four in SIM-swapping ring linked to more than $5 million in crypto theft — TechEchelon","type":"news_article","url":"https://www.techechelon.com/post/poland-arrests-four-in-sim-swapping-ring-linked-to-more-than-5-million-in-crypto-theft"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"}]},{"content":"Following the CBZC's public release of arrest footage and raid images, independent blockchain investigator ZachXBT alleged via his Telegram channel that one of the four arrested individuals is Wojtek Kulisz, a Polish social engineering threat actor operating under the online alias 'Merry.' ZachXBT's identification was based on a comparison of designer clothing and jewelry visible in the official police raid footage with items Kulisz had publicly displayed on his Instagram account (username 'wojtekk'). ZachXBT characterized 'Merry' as having played a central role in orchestrating SIM-swap attacks, not merely as a participant. Polish authorities have not confirmed or denied this identification; the claim remains unverified by law enforcement and should be treated as alleged. The alias 'Merry' has been previously referenced in ZachXBT's documented research on SIM-swap-linked cryptocurrency theft actors, though detailed prior incident reporting specifically naming 'Merry' is limited to community-level sources.","heading":"ZachXBT Identification of Alias 'Merry'","severity":"high","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":3,"name":"Poland Arrests Four in SIM Swap Crypto Heist, ZachXBT Links Suspect to 'Merry' — CoinAlertNews","type":"news_article","url":"https://coinalertnews.com/news/2026/06/25/poland-sim-swap-crypto-arrests"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":3,"name":"Poland Arrests 4 Suspects in SIM-Swap Crypto Theft Tied to 'Merry' — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/finance/poland-arrests-4-suspects-in-sim-swap-crypto-theft-tied-to-merry-269994"}]},{"content":"The four arrested individuals face charges under Polish law including: participation in an organized criminal group, unauthorized access to computer systems (hacking), and money laundering. If convicted on all charges, the suspects face potential sentences of up to 25 years in imprisonment. The case is under the supervisory authority of the Regional Prosecutor's Office in Kraków. As of the time of reporting, no trial dates had been publicly announced and the investigation was described as ongoing. The international dimension of the operation — involving active FBI and HSI participation — suggests potential for parallel proceedings or extradition considerations, though no such actions had been publicly announced.","heading":"Charges and Legal Proceedings","severity":"critical","sources":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":2,"name":"4 arrested in Poland for SIM-swapping and cryptocurrency theft — SC Media","type":"news_article","url":"https://www.scworld.com/brief/four-arrested-in-poland-for-sim-swapping-and-cryptocurrency-theft"},{"credibility":2,"name":"Poland arrests SIM-swap gang in crypto theft case — Bitdefender HotForSecurity","type":"news_article","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/poland-sim-swap-crypto-theft-arrests"}]},{"content":"The operation was a joint effort between three agencies. Poland's Central Bureau for Combating Cybercrime (CBZC) led the domestic enforcement action. The U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI) provided active operational support, reflecting the cross-border scope of the alleged crimes and likely indicating that victims or targeted exchanges with U.S. connections were involved. The Regional Prosecutor's Office in Kraków has supervisory authority over the prosecution. No Europol or other European agency involvement was reported.","heading":"Law Enforcement Agencies Involved","severity":"medium","sources":[{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"}]},{"content":"This investigation concerns a separate organized criminal group from any prior Wojtek Kulisz entry in the AVOID database. While ZachXBT has alleged that one of the four arrested individuals in this June 2026 operation is Wojtek Kulisz — the person he associates with the alias 'Merry' — this identification is unconfirmed by Polish authorities. The ring described here is characterized by its systematic compromise of telecom partner infrastructure and employee email accounts as a supply-chain vector for SIM swapping, which may differ operationally from separately documented Kulisz-attributed activity. Users should treat the ZachXBT identification as alleged and unverified pending official confirmation.","heading":"Distinction from Wojtek Kulisz Case in AVOID Database","severity":"medium","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"}]}],"sources_used":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Poland arrests four in SIM-swapping ring linked to more than $5 million in crypto theft — TechEchelon","type":"news_article","url":"https://www.techechelon.com/post/poland-arrests-four-in-sim-swapping-ring-linked-to-more-than-5-million-in-crypto-theft"},{"credibility":2,"name":"Poland arrests SIM-swap gang in crypto theft case — Bitdefender HotForSecurity","type":"news_article","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/poland-sim-swap-crypto-theft-arrests"},{"credibility":2,"name":"4 arrested in Poland for SIM-swapping and cryptocurrency theft — SC Media","type":"news_article","url":"https://www.scworld.com/brief/four-arrested-in-poland-for-sim-swapping-and-cryptocurrency-theft"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":3,"name":"Poland Arrests Four in SIM Swap Crypto Heist, ZachXBT Links Suspect to 'Merry' — CoinAlertNews","type":"news_article","url":"https://coinalertnews.com/news/2026/06/25/poland-sim-swap-crypto-arrests"},{"credibility":3,"name":"Poland Arrests 4 Suspects in SIM-Swap Crypto Theft Tied to 'Merry' — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/finance/poland-arrests-4-suspects-in-sim-swap-crypto-theft-tied-to-merry-269994"}],"summary":"In June 2026, Poland's Central Bureau for Combating Cybercrime (CBZC), acting jointly with the FBI and U.S. Homeland Security Investigations (HSI), arrested four members of an organized cybercrime ring that conducted SIM-swap attacks against cryptocurrency exchange users. The group allegedly breached telecom partner systems and employee email accounts using specialized software and social engineering, hijacking victims' phone numbers to bypass two-factor authentication and drain cryptocurrency holdings. Blockchain investigator ZachXBT alleged that one of the arrested individuals is Wojtek Kulisz, known online as 'Merry,' a social engineering threat actor linked to prior SIM-swap activity; Polish authorities have not confirmed this identification.","timeline":[{"date":"2026-06-25","event":"Poland's CBZC, with active support from the FBI and HSI, arrested four individuals alleged to be members of an organized SIM-swapping cybercrime ring targeting cryptocurrency exchange users. Suspects placed in pre-trial detention.","source":"The Block, BleepingComputer, Help Net Security","source_url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"date":"2026-06-25","event":"Blockchain investigator ZachXBT alleged via Telegram that one of the arrested individuals is Wojtek Kulisz, operating under the alias 'Merry,' based on matching designer clothing and jewelry between official police raid footage and the suspect's Instagram account. Polish authorities did not confirm this identification.","source":"The Block, Cryptopolitan, CoinAlertNews","source_url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"date":"2026-06-26","event":"Multiple major cybersecurity and crypto news outlets published detailed reporting on the arrests, including BleepingComputer and Help Net Security, expanding public awareness of the operation.","source":"BleepingComputer, Help Net Security","source_url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4411da3b-cb5c-4f1d-a5a8-048eca81f258copy