Audit log

Every state-changing event for Wojtek Kulisz aka Merry (SIM-Swap Gang): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-06-26 12:12:58Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 429,018,998

   sig

   4JFUABfkb8TG…ih7N7qkGcopyexplorer ↗

   hash

   7BPDhqrmxDTh…vhCwZaKBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (15816 B) ▸

   {"actor":"system:backfill","investigation_id":"af4d060c-46bf-4ace-a1b7-8ae8370b39fd","kind":"publish","page_slug":"wojtek-kulisz-aka-merry-sim-swap-gang","published_at":"2026-06-26T12:12:58.068Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wojtek Kulisz aka Merry (SIM-Swap Gang)","sections":[{"content":"On June 25, 2026, Poland's Central Bureau for Combating Cybercrime (CBZC) announced the arrest of four suspected members of an organized criminal group engaged in SIM-swap attacks, cryptocurrency theft, and money laundering. The operation was conducted jointly with agents from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI), indicating the presence of U.S. victims or infrastructure in the scheme. The Krakow Regional Prosecutor's Office is overseeing the criminal proceedings. All four suspects were ordered into pretrial detention following arraignment. If convicted, each faces up to 25 years' imprisonment under Polish law. Polish authorities have not publicly confirmed the identities of any of the four suspects, citing the ongoing and international nature of the investigation.","heading":"Arrest and Law Enforcement Action","severity":"critical","sources":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"}]},{"content":"Blockchain investigator ZachXBT publicly alleged that one of the four detained individuals is Wojtek Kulisz, a Polish social engineering threat actor known in cybercrime circles under the alias 'Merry'. ZachXBT's identification was based on a comparison of designer clothing and jewelry items visible in CBZC's official raid footage with items Kulisz had previously displayed on his public Instagram account under the handle 'wojtekk'. Polish authorities have not officially confirmed this identification. ZachXBT described Kulisz as a 'known social engineering threat actor' linked to the theft of tens of millions of dollars from cryptocurrency exchange accounts. The identification remains an allegation sourced from an independent on-chain investigator rather than a verified law enforcement attribution.","heading":"Identification of Wojtek Kulisz as 'Merry'","severity":"critical","sources":[{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":3,"name":"Poland Arrests 4 Suspects in SIM-Swap Crypto Theft Tied to 'Merry' - The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/finance/poland-arrests-4-suspects-in-sim-swap-crypto-theft-tied-to-merry-269994"}]},{"content":"According to CBZC and reporting by multiple outlets, the criminal group employed a multi-stage attack methodology. First, members allegedly used specialized software and social engineering techniques to breach the IT infrastructure of companies that cooperate with telecommunications operators. This access was then used to compromise employee email accounts at those firms. With those credentials, the group was alleged to have performed SIM swap attacks — the illegal cloning and hijacking of victims' phone numbers — redirecting their SMS and email communications to attacker-controlled devices. Once a victim's phone number was under their control, the group could bypass two-factor authentication protections on cryptocurrency exchange accounts and drain the digital assets held within. The specific exchanges targeted have not been disclosed by Polish authorities, who cited the need to protect the ongoing investigation.","heading":"Alleged Attack Methods and Modus Operandi","severity":"critical","sources":[{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"}]},{"content":"Polish prosecutors allege the total value of funds laundered by the group exceeds tens of millions of Polish zlotys, which at current exchange rates is estimated to be approximately $15 million USD. Reporting from multiple crypto news outlets attributes the broader scope of alleged thefts to tens of millions of dollars across multiple victims. The group allegedly laundered proceeds through a distributed financial network spanning personal bank accounts held in both Poland and abroad, international payment platforms, and multi-currency digital wallets. The use of multiple financial jurisdictions and instrument types is consistent with techniques designed to obscure the origin of stolen funds. No specific wallets, wallet addresses, or payment platforms have been publicly identified by authorities.","heading":"Alleged Financial Scale and Money Laundering","severity":"high","sources":[{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":3,"name":"Authorities Break Major $15 Million Crypto Heist - BitcoinHaber","type":"news_article","url":"https://en.bitcoinhaber.net/authorities-break-major-15-million-crypto-heist"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"}]},{"content":"The Krakow Regional Prosecutor's Office filed charges against all four suspects in three categories: (1) participation in an organized criminal group, (2) theft through unauthorized access to computer systems, and (3) money laundering. All four were ordered into pretrial detention following their arraignment on or around June 25, 2026. The investigation is described as ongoing and international in scope. If convicted on all charges under Polish law, each defendant faces a maximum sentence of 25 years' imprisonment. No trial date has been publicly set as of the date of this report.","heading":"Charges and Legal Status","severity":"critical","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":3,"name":"Polish Authorities Arrest Four in Major Crypto Theft Case with FBI and HSI - KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/polish-authorities-arrest-four-in-major-crypto-theft-case-with-fbi-and-hsi"}]},{"content":"Independent blockchain investigator ZachXBT played a notable role in publicly connecting one of the arrested individuals to the alias 'Merry' and the real identity of Wojtek Kulisz. ZachXBT's methodology in this case involved visual forensics: matching designer goods visible in official Polish law enforcement raid footage against luxury items displayed on the Instagram account 'wojtekk', attributed to Kulisz. ZachXBT described 'Merry' as a known social engineering threat actor with a prior history of targeting cryptocurrency users and exchanges. The specific prior incidents attributed to 'Merry' before the June 2026 arrests have not been independently verified or formally charged in publicly available documents at the time of this writing. ZachXBT's track record in prior high-profile on-chain investigations lends medium-to-high credibility to the attribution, though it falls short of official law enforcement confirmation.","heading":"Role of ZachXBT and On-Chain Investigation","severity":"medium","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"}]},{"content":"The operation involved active participation from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI) alongside Polish CBZC. The involvement of U.S. agencies suggests that victims or financial infrastructure affected by the group were located in or connected to the United States. The Krakow Regional Prosecutor's Office coordinated the legal proceedings on the Polish side. This cross-border law enforcement structure is consistent with similar crypto-focused cybercrime takedowns, such as Europol's October 2025 SIMCARTEL initiative, which dismantled comparable SIM-swap fraud networks across Europe.","heading":"International Law Enforcement Cooperation","severity":"high","sources":[{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":3,"name":"Polish cybercrime unit arrests four in FBI-backed SIM swap and crypto theft raid - MEXC News","type":"news_article","url":"https://www.mexc.com/news/1174401"}]}],"sources_used":[{"credibility":1,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft - BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":1,"name":"SIM-swapping gang busted in international police operation - Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case - The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor - Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":3,"name":"Polish Authorities Arrest Four in Major Crypto Theft Case with FBI and HSI - KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/polish-authorities-arrest-four-in-major-crypto-theft-case-with-fbi-and-hsi"},{"credibility":3,"name":"Polish cybercrime unit arrests four in FBI-backed SIM swap and crypto theft raid - MEXC News","type":"news_article","url":"https://www.mexc.com/news/1174401"},{"credibility":3,"name":"Poland Arrests 4 Suspects in SIM-Swap Crypto Theft Tied to 'Merry' - The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/finance/poland-arrests-4-suspects-in-sim-swap-crypto-theft-tied-to-merry-269994"},{"credibility":3,"name":"Authorities Break Major $15 Million Crypto Heist - BitcoinHaber","type":"news_article","url":"https://en.bitcoinhaber.net/authorities-break-major-15-million-crypto-heist"},{"credibility":2,"name":"Polish Cybercrime Police Arrest Four In Major Crypto Theft Investigation - CoinPedia","type":"news_article","url":"https://coinpedia.org/news/polish-cybercrime-police-arrest-four-in-major-crypto-theft-investigation"}],"summary":"Wojtek Kulisz, known online as 'Merry', is a Polish national alleged to be a social engineering threat actor linked by blockchain investigator ZachXBT to a four-person SIM-swap criminal ring arrested by Polish and U.S. authorities on June 25, 2026. The group is accused of breaching telecom infrastructure, hijacking victims' phone numbers, draining cryptocurrency exchange accounts, and laundering proceeds estimated to exceed tens of millions of Polish zlotys (approximately $15 million USD). Polish authorities have not officially confirmed Kulisz's identity among the detained, but he has been placed in pretrial detention alongside three co-suspects pending trial.","timeline":[{"date":"2026-06-25","event":"Polish Central Bureau for Combating Cybercrime (CBZC), with FBI and HSI support, arrests four suspected members of a SIM-swap crypto theft ring. All four are placed in pretrial detention. Charges include organized crime participation, computer system intrusion, and money laundering.","source":"BleepingComputer / Help Net Security","source_url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"date":"2026-06-25","event":"Blockchain investigator ZachXBT publicly links one of the four arrested suspects to Wojtek Kulisz (alias 'Merry'), citing matching designer clothing and jewelry between CBZC raid footage and Kulisz's public Instagram account 'wojtekk'.","source":"The Block / Cryptopolitan","source_url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"date":"2026-06-26","event":"Multiple crypto and cybersecurity media outlets report on the arrests and ZachXBT's identification of 'Merry'. Estimated stolen and laundered amount reported at approximately $15 million USD (tens of millions of Polish zlotys).","source":"Help Net Security / Crypto Economy / Cryptopolitan","source_url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cfb92d74-3278-4a37-9213-85cd36af74c9copy
2. #2reviewby reviewerreviewer

   2026-08-26 18:05:35Z
   Score: 2 → 2 (no score change)
   The core, checkable facts of the arrest -- date, agencies (CBZC/FBI/HSI), Krakow Regional Prosecutor's Office oversight, three charge categories, pretrial detention, and 25-year maximum sentence -- are well supported by credible reporting and consistent with the underlying CBZC statement. The page correctly and repeatedly flags that Polish authorities have never officially confirmed Wojtek Kulisz's identity as one of the four detainees, and no official Polish source (CBZC, prosecutor, or court) names him. However, the page has three notable defects: a summary sentence that undercuts its own hedge by asserting as fact that Kulisz specifically 'has been placed in pretrial detention'; an unsupported characterization of 'Merry' as having 'a prior history of targeting cryptocurrency users and exchanges' that goes beyond what any source (including the page's own hedge two sentences later) establishes; and a mischaracterized analogy to Europol's SIMCARTEL operation, which addressed a different fraud technique. A parallel AVOID.NET page on the same case uses more cautious language on both the financial figure and the prior-history question, creating a consistency gap between two live pages about the same unconvicted, named individual.
   anchoranchored

   chain

   ●mainnet-betaslot 443,521,848

   sig

   4cutztQeL2Vf…6pK3aoSecopyexplorer ↗

   hash

   ELx4Ge5q1AfQ…bWiry8btcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1617 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-26T18:05:35.143Z","decision":"review","investigation_id":"af4d060c-46bf-4ace-a1b7-8ae8370b39fd","new_score":2,"page_slug":"wojtek-kulisz-aka-merry-sim-swap-gang","prev_score":2,"reason":"The core, checkable facts of the arrest -- date, agencies (CBZC/FBI/HSI), Krakow Regional Prosecutor's Office oversight, three charge categories, pretrial detention, and 25-year maximum sentence -- are well supported by credible reporting and consistent with the underlying CBZC statement. The page correctly and repeatedly flags that Polish authorities have never officially confirmed Wojtek Kulisz's identity as one of the four detainees, and no official Polish source (CBZC, prosecutor, or court) names him. However, the page has three notable defects: a summary sentence that undercuts its own hedge by asserting as fact that Kulisz specifically 'has been placed in pretrial detention'; an unsupported characterization of 'Merry' as having 'a prior history of targeting cryptocurrency users and exchanges' that goes beyond what any source (including the page's own hedge two sentences later) establishes; and a mischaracterized analogy to Europol's SIMCARTEL operation, which addressed a different fraud technique. A parallel AVOID.NET page on the same case uses more cautious language on both the financial figure and the prior-history question, creating a consistency gap between two live pages about the same unconvicted, named individual.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 34f606dd-832f-4da3-af53-6ab65bd54066copy
3. #3review reviseby judgejudge

   2026-08-26 18:05:35Z
   Score: 2 → 0 (-15)
   The reviewer confirmed the core, checkable facts of the June 25, 2026 arrests, charges, and law-enforcement agencies involved, and correctly found that the charging stage (charges filed plus pretrial detention, no indictment or conviction) is reported accurately. But the disputed rate of 14.3% understates how serious the remaining problems are for a page naming a living, unconvicted person. The page's summary hedges Wojtek Kulisz's identification as 'not officially confirmed' and then, in the same sentence, states he 'has been placed in pretrial detention,' asserting as fact that the named individual is among the four detainees when no source supports that specific link (claim_findings[3]); separately, no official Polish source names him at all, and the identification rests solely on an outside investigator's comparison of Instagram photos to raid footage (claim_findings[6]). The page also asserts an uncited 'prior history' of targeting crypto users that exceeds any source and exceeds a sibling AVOID.NET page's more cautious wording (claim_findings[14]), cherry-picks the high end of a $5-15 million loss range as a single figure (claim_findings[2]), draws a factually incorrect analogy to an unrelated Europol operation (claim_findings[18]), and cites one link that is confirmed dead (claim_findings[20]). A second, inconsistent AVOID.NET page about the same unconvicted individual compounds the risk (coverage_gaps[0]). Together these push the penalty to the top of the applicable band even though the raw disputed-claim count alone would sit in the middle of it.
   anchoranchored

   chain

   ●mainnet-betaslot 443,521,872

   sig

   24dCvwniPdAN…5zGQwAQBcopyexplorer ↗

   hash

   417uHGq33o3k…tAf4EBr5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1958 B) ▸

   {"actor":"judge","decided_at":"2026-08-26T18:05:35.143Z","decision":"review_revise","investigation_id":"af4d060c-46bf-4ace-a1b7-8ae8370b39fd","new_score":0,"page_slug":"wojtek-kulisz-aka-merry-sim-swap-gang","prev_score":2,"reason":"The reviewer confirmed the core, checkable facts of the June 25, 2026 arrests, charges, and law-enforcement agencies involved, and correctly found that the charging stage (charges filed plus pretrial detention, no indictment or conviction) is reported accurately. But the disputed rate of 14.3% understates how serious the remaining problems are for a page naming a living, unconvicted person. The page's summary hedges Wojtek Kulisz's identification as 'not officially confirmed' and then, in the same sentence, states he 'has been placed in pretrial detention,' asserting as fact that the named individual is among the four detainees when no source supports that specific link (claim_findings[3]); separately, no official Polish source names him at all, and the identification rests solely on an outside investigator's comparison of Instagram photos to raid footage (claim_findings[6]). The page also asserts an uncited 'prior history' of targeting crypto users that exceeds any source and exceeds a sibling AVOID.NET page's more cautious wording (claim_findings[14]), cherry-picks the high end of a $5-15 million loss range as a single figure (claim_findings[2]), draws a factually incorrect analogy to an unrelated Europol operation (claim_findings[18]), and cites one link that is confirmed dead (claim_findings[20]). A second, inconsistent AVOID.NET page about the same unconvicted individual compounds the risk (coverage_gaps[0]). Together these push the penalty to the top of the applicable band even though the raw disputed-claim count alone would sit in the middle of it.","score_delta":-15,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d9388194-5676-4efb-8f7f-d550448b5f32copy