Verify a decision

{"actor":"system:backfill","investigation_id":"af4d060c-46bf-4ace-a1b7-8ae8370b39fd","kind":"publish","page_slug":"wojtek-kulisz-aka-merry-sim-swap-gang","published_at":"2026-06-26T12:12:58.068Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wojtek Kulisz aka Merry (SIM-Swap Gang)","sections":[{"content":"On June 25, 2026, Poland's Central Bureau for Combating Cybercrime (CBZC) announced the arrest of four suspected members of an organized criminal group engaged in SIM-swap attacks, cryptocurrency theft, and money laundering. The operation was conducted jointly with agents from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI), indicating the presence of U.S. victims or infrastructure in the scheme. The Krakow Regional Prosecutor's Office is overseeing the criminal proceedings. All four suspects were ordered into pretrial detention following arraignment. If convicted, each faces up to 25 years' imprisonment under Polish law. Polish authorities have not publicly confirmed the identities of any of the four suspects, citing the ongoing and international nature of the investigation.","heading":"Arrest and Law Enforcement Action","severity":"critical","sources":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"}]},{"content":"Blockchain investigator ZachXBT publicly alleged that one of the four detained individuals is Wojtek Kulisz, a Polish social engineering threat actor known in cybercrime circles under the alias 'Merry'. ZachXBT's identification was based on a comparison of designer clothing and jewelry items visible in CBZC's official raid footage with items Kulisz had previously displayed on his public Instagram account under the handle 'wojtekk'. Polish authorities have not officially confirmed this identification. ZachXBT described Kulisz as a 'known social engineering threat actor' linked to the theft of tens of millions of dollars from cryptocurrency exchange accounts. The identification remains an allegation sourced from an independent on-chain investigator rather than a verified law enforcement attribution.","heading":"Identification of Wojtek Kulisz as 'Merry'","severity":"critical","sources":[{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":3,"name":"Poland Arrests 4 Suspects in SIM-Swap Crypto Theft Tied to 'Merry' - The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/finance/poland-arrests-4-suspects-in-sim-swap-crypto-theft-tied-to-merry-269994"}]},{"content":"According to CBZC and reporting by multiple outlets, the criminal group employed a multi-stage attack methodology. First, members allegedly used specialized software and social engineering techniques to breach the IT infrastructure of companies that cooperate with telecommunications operators. This access was then used to compromise employee email accounts at those firms. With those credentials, the group was alleged to have performed SIM swap attacks — the illegal cloning and hijacking of victims' phone numbers — redirecting their SMS and email communications to attacker-controlled devices. Once a victim's phone number was under their control, the group could bypass two-factor authentication protections on cryptocurrency exchange accounts and drain the digital assets held within. The specific exchanges targeted have not been disclosed by Polish authorities, who cited the need to protect the ongoing investigation.","heading":"Alleged Attack Methods and Modus Operandi","severity":"critical","sources":[{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"}]},{"content":"Polish prosecutors allege the total value of funds laundered by the group exceeds tens of millions of Polish zlotys, which at current exchange rates is estimated to be approximately $15 million USD. Reporting from multiple crypto news outlets attributes the broader scope of alleged thefts to tens of millions of dollars across multiple victims. The group allegedly laundered proceeds through a distributed financial network spanning personal bank accounts held in both Poland and abroad, international payment platforms, and multi-currency digital wallets. The use of multiple financial jurisdictions and instrument types is consistent with techniques designed to obscure the origin of stolen funds. No specific wallets, wallet addresses, or payment platforms have been publicly identified by authorities.","heading":"Alleged Financial Scale and Money Laundering","severity":"high","sources":[{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":3,"name":"Authorities Break Major $15 Million Crypto Heist - BitcoinHaber","type":"news_article","url":"https://en.bitcoinhaber.net/authorities-break-major-15-million-crypto-heist"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"}]},{"content":"The Krakow Regional Prosecutor's Office filed charges against all four suspects in three categories: (1) participation in an organized criminal group, (2) theft through unauthorized access to computer systems, and (3) money laundering. All four were ordered into pretrial detention following their arraignment on or around June 25, 2026. The investigation is described as ongoing and international in scope. If convicted on all charges under Polish law, each defendant faces a maximum sentence of 25 years' imprisonment. No trial date has been publicly set as of the date of this report.","heading":"Charges and Legal Status","severity":"critical","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":3,"name":"Polish Authorities Arrest Four in Major Crypto Theft Case with FBI and HSI - KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/polish-authorities-arrest-four-in-major-crypto-theft-case-with-fbi-and-hsi"}]},{"content":"Independent blockchain investigator ZachXBT played a notable role in publicly connecting one of the arrested individuals to the alias 'Merry' and the real identity of Wojtek Kulisz. ZachXBT's methodology in this case involved visual forensics: matching designer goods visible in official Polish law enforcement raid footage against luxury items displayed on the Instagram account 'wojtekk', attributed to Kulisz. ZachXBT described 'Merry' as a known social engineering threat actor with a prior history of targeting cryptocurrency users and exchanges. The specific prior incidents attributed to 'Merry' before the June 2026 arrests have not been independently verified or formally charged in publicly available documents at the time of this writing. ZachXBT's track record in prior high-profile on-chain investigations lends medium-to-high credibility to the attribution, though it falls short of official law enforcement confirmation.","heading":"Role of ZachXBT and On-Chain Investigation","severity":"medium","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"}]},{"content":"The operation involved active participation from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI) alongside Polish CBZC. The involvement of U.S. agencies suggests that victims or financial infrastructure affected by the group were located in or connected to the United States. The Krakow Regional Prosecutor's Office coordinated the legal proceedings on the Polish side. This cross-border law enforcement structure is consistent with similar crypto-focused cybercrime takedowns, such as Europol's October 2025 SIMCARTEL initiative, which dismantled comparable SIM-swap fraud networks across Europe.","heading":"International Law Enforcement Cooperation","severity":"high","sources":[{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":3,"name":"Polish cybercrime unit arrests four in FBI-backed SIM swap and crypto theft raid - MEXC News","type":"news_article","url":"https://www.mexc.com/news/1174401"}]}],"sources_used":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":3,"name":"Polish Authorities Arrest Four in Major Crypto Theft Case with FBI and HSI - KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/polish-authorities-arrest-four-in-major-crypto-theft-case-with-fbi-and-hsi"},{"credibility":3,"name":"Polish cybercrime unit arrests four in FBI-backed SIM swap and crypto theft raid - MEXC News","type":"news_article","url":"https://www.mexc.com/news/1174401"},{"credibility":3,"name":"Poland Arrests 4 Suspects in SIM-Swap Crypto Theft Tied to 'Merry' - The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/finance/poland-arrests-4-suspects-in-sim-swap-crypto-theft-tied-to-merry-269994"},{"credibility":3,"name":"Authorities Break Major $15 Million Crypto Heist - BitcoinHaber","type":"news_article","url":"https://en.bitcoinhaber.net/authorities-break-major-15-million-crypto-heist"},{"credibility":2,"name":"Polish Cybercrime Police Arrest Four In Major Crypto Theft Investigation - CoinPedia","type":"news_article","url":"https://coinpedia.org/news/polish-cybercrime-police-arrest-four-in-major-crypto-theft-investigation"}],"summary":"Wojtek Kulisz, known online as 'Merry', is a Polish national alleged to be a social engineering threat actor linked by blockchain investigator ZachXBT to a four-person SIM-swap criminal ring arrested by Polish and U.S. authorities on June 25, 2026. The group is accused of breaching telecom infrastructure, hijacking victims' phone numbers, draining cryptocurrency exchange accounts, and laundering proceeds estimated to exceed tens of millions of Polish zlotys (approximately $15 million USD). Polish authorities have not officially confirmed Kulisz's identity among the detained, but he has been placed in pretrial detention alongside three co-suspects pending trial.","timeline":[{"date":"2026-06-25","event":"Polish Central Bureau for Combating Cybercrime (CBZC), with FBI and HSI support, arrests four suspected members of a SIM-swap crypto theft ring. All four are placed in pretrial detention. Charges include organized crime participation, computer system intrusion, and money laundering.","source":"BleepingComputer / Help Net Security","source_url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"date":"2026-06-25","event":"Blockchain investigator ZachXBT publicly links one of the four arrested suspects to Wojtek Kulisz (alias 'Merry'), citing matching designer clothing and jewelry between CBZC raid footage and Kulisz's public Instagram account 'wojtekk'.","source":"The Block / Cryptopolitan","source_url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"date":"2026-06-26","event":"Multiple crypto and cybersecurity media outlets report on the arrests and ZachXBT's identification of 'Merry'. Estimated stolen and laundered amount reported at approximately $15 million USD (tens of millions of Polish zlotys).","source":"Help Net Security / Crypto Economy / Cryptopolitan","source_url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"}]},"v":1}