Audit log

Every state-changing event for Wojtek Kulisz ('Merry') — SIM Swap Crypto Theft Ring: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-07-02 12:08:02Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 430,303,672

   sig

   4oZhF6zo4qRL…4VAeEgPWcopyexplorer ↗

   hash

   3tkR3YFJwwQi…Hhv2FvWTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (17375 B) ▸

   {"actor":"system:backfill","investigation_id":"d53822ee-03b7-4da0-b084-f276cf7f263d","kind":"publish","page_slug":"wojtek-kulisz-merry-sim-swap-crypto-theft-ring","published_at":"2026-07-02T12:08:02.020Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wojtek Kulisz ('Merry') — SIM Swap Crypto Theft Ring","sections":[{"content":"Polish authorities arrested four individuals on June 25, 2026, but withheld all suspects' identities, citing the ongoing international nature of the investigation. Blockchain investigator ZachXBT publicly alleged that one of the four detainees is Wojtek Kulisz, a Polish national operating under the online alias 'Merry'. ZachXBT's attribution rested on visual evidence: designer clothing and jewelry items visible in CBZC raid footage matched items Kulisz had displayed on his public Instagram account under the handle 'wojtekk'. A Polish-language post by the Bitcoin-focused account BitHub on X (formerly Twitter) also named 'Wojtek K.' with the alias 'Merry' as one of those detained. As of the time of reporting, Polish authorities had not officially confirmed or denied Kulisz's identity in connection with the case. ZachXBT described Kulisz as a known social engineering threat actor active in crypto circles prior to his alleged arrest.","heading":"Identity and Attribution","severity":"critical","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":3,"name":"BitHub on X: naming 'Wojtek K.' alias 'Merry' among those detained","type":"social_media","url":"https://x.com/BithubPl/status/2070189409949937817"},{"credibility":2,"name":"Polish hacker Merry suspected of being raided by authorities — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/polish-hacker-merry-suspected-of-being-raided-by-authorities"}]},{"content":"The four arrested individuals, including the suspect alleged to be Kulisz, were charged by the Krakow Regional Prosecutor's Office with three offenses under Polish law: (1) participation in an organized criminal group, (2) theft through unauthorized access to computer systems, and (3) money laundering. A court ordered all four suspects into pretrial detention following their arrest. The maximum combined sentence exposure under Polish law for these charges is up to 25 years' imprisonment. No formal indictment or trial date had been publicly announced as of late June 2026. Polish authorities stated that identity disclosures were withheld to protect the ongoing international investigation.","heading":"Criminal Charges and Legal Status","severity":"critical","sources":[{"credibility":2,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Poland Arrests Four in SIM-Swapping Ring Linked to More Than $5 Million in Crypto Theft — TechEchelon","type":"news_article","url":"https://www.techechelon.com/post/poland-arrests-four-in-sim-swapping-ring-linked-to-more-than-5-million-in-crypto-theft"}]},{"content":"According to CBZC's official statement, the criminal group employed a multi-stage attack methodology. Members first breached the IT infrastructure of companies that cooperate with telecommunications operators, using specialized software and social engineering techniques to compromise employee email accounts and gain unauthorized access to internal telecom systems. With this access, they were able to clone and hijack victims' phone numbers, effectively taking over their cellular identity. Once in control of a victim's phone number, the group intercepted SMS-based two-factor authentication codes and email communications, enabling them to bypass security measures on cryptocurrency exchange accounts. The accounts were then systematically drained. Stolen funds were subsequently laundered through a distributed network that included multiple personal bank accounts in Poland and abroad, international payment platforms, and multi-currency digital wallets to obscure the origin of the proceeds.","heading":"Criminal Methods: SIM Swapping and Telecom Infrastructure Breach","severity":"critical","sources":[{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":2,"name":"4 arrested in Poland for SIM-swapping and cryptocurrency theft — SC Media","type":"news_article","url":"https://www.scworld.com/brief/four-arrested-in-poland-for-sim-swapping-and-cryptocurrency-theft"}]},{"content":"Polish prosecutors stated that the total value of funds laundered by the group is estimated to exceed 'tens of millions of Polish zlotys.' At exchange rates prevailing in June 2026, this figure corresponds to approximately $5 million to $15 million USD depending on the precise amount. Different reporting outlets quoted figures ranging from 'more than $5 million' to 'roughly $15 million', reflecting uncertainty in the official estimate expressed in zlotys. Funds were moved through a geographically dispersed network of financial infrastructure including personal bank accounts in multiple countries, international payment gateways, and multi-currency cryptocurrency wallets. No specific cryptocurrency exchanges targeted by the attacks were publicly named by authorities. No breakdown by individual victim was disclosed.","heading":"Financial Scale and Laundering","severity":"critical","sources":[{"credibility":2,"name":"Poland Arrests Four in SIM-Swapping Ring Linked to More Than $5 Million in Crypto Theft — TechEchelon","type":"news_article","url":"https://www.techechelon.com/post/poland-arrests-four-in-sim-swapping-ring-linked-to-more-than-5-million-in-crypto-theft"},{"credibility":2,"name":"A $15 million SIM swap scam hits crypto exchanges — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/a-15-million-sim-swap-scam-hits-crypto-exchanges-what-happened-during-the-joint-operation/"},{"credibility":2,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"}]},{"content":"The arrests on June 25, 2026 were conducted by Poland's Central Bureau for Combating Cybercrime (CBZC), which is the primary national cybercrime law enforcement unit. The operation had direct operational support from two U.S. federal agencies: the Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI). The involvement of U.S. agencies suggests that victims or elements of the criminal operation extended into the United States or were of direct U.S. investigative interest. The Krakow Regional Prosecutor's Office has jurisdiction over the case. Authorities characterized the investigation as ongoing and international in scope. No extradition proceedings have been publicly disclosed as of the time of reporting, as all four suspects were arrested in Poland.","heading":"Law Enforcement Operation","severity":"high","sources":[{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Polish cybercrime unit arrests four in FBI-backed SIM swap and crypto theft raid — MEXC News","type":"news_article","url":"https://www.mexc.com/news/1174401"},{"credibility":3,"name":"Dark Web Informer on X: CBZC arrests with FBI and HSI support","type":"social_media","url":"https://x.com/DarkWebInformer/status/2070160796575818073"}]},{"content":"On-chain investigator ZachXBT published the alleged identity of one of the four arrested suspects as Wojtek Kulisz, known by the alias 'Merry'. ZachXBT described Kulisz as a known social engineering threat actor in the crypto space. The identification methodology relied on visual matching of distinctive designer clothing and jewelry items seized during the police raid against publicly visible items on Kulisz's Instagram profile ('wojtekk'). ZachXBT has a documented track record of identifying crypto criminals prior to or alongside official law enforcement disclosures, though his identifications represent community-level intelligence rather than official findings and should be treated as alleged until confirmed by authorities. No prior law enforcement charges or public criminal proceedings involving Kulisz specifically have been surfaced in available reporting. The CBZC has not commented on any prior history of investigations involving the suspects.","heading":"ZachXBT Investigation and Prior Threat Actor History","severity":"high","sources":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"}]},{"content":"Victims of the SIM swap operation were users of cryptocurrency exchanges whose accounts were compromised after their phone numbers were hijacked. Polish authorities did not publicly name any affected exchanges or individual victims, citing the sensitivity of the ongoing investigation. The international scope of the FBI and HSI involvement indicates victims were likely located across multiple countries, including the United States. No breakdown of individual victim losses has been made publicly available. The specific cryptocurrencies stolen and the wallets involved have not been disclosed in available public sources.","heading":"Victims and Targeted Exchanges","severity":"high","sources":[{"credibility":2,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":2,"name":"SIM-Swap Arrests: Poland and FBI Bust Crypto Theft Ring — CoinInsider","type":"news_article","url":"https://www.coininsider.com/news/polish-police-nab-four-in-fbi-backed-crypto-sim-swap-crackdown/"}]}],"sources_used":[{"credibility":2,"name":"Four arrested in Poland over crypto SIM-swap attacks; ZachXBT links 'Merry' to case — The Block","type":"news_article","url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"credibility":2,"name":"Poland busts SIM-swapping gang tied to millions in crypto theft — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"},{"credibility":2,"name":"SIM-swapping gang busted in international police operation — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"credibility":2,"name":"Wojtek 'Merry' Kulisz linked to four detained in FBI and Polish crypto fraud raid — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wojtek-merry-detained-fbi-crypto-fraud-raid/"},{"credibility":2,"name":"Poland Arrests Four in SIM-Swapping Ring Linked to More Than $5 Million in Crypto Theft — TechEchelon","type":"news_article","url":"https://www.techechelon.com/post/poland-arrests-four-in-sim-swapping-ring-linked-to-more-than-5-million-in-crypto-theft"},{"credibility":2,"name":"4 arrested in Poland for SIM-swapping and cryptocurrency theft — SC Media","type":"news_article","url":"https://www.scworld.com/brief/four-arrested-in-poland-for-sim-swapping-and-cryptocurrency-theft"},{"credibility":2,"name":"Poland Detains Four Over SIM-Swap Attacks and Crypto Theft, With ZachXBT Linking a Known Threat Actor — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/poland-detains-four-over-sim-swap-attacks-and-crypto-theft-with-zachxbt-linking-a-known-threat-actor/"},{"credibility":2,"name":"SIM-Swap Arrests: Poland and FBI Bust Crypto Theft Ring — CoinInsider","type":"news_article","url":"https://www.coininsider.com/news/polish-police-nab-four-in-fbi-backed-crypto-sim-swap-crackdown/"},{"credibility":2,"name":"A $15 million SIM swap scam hits crypto exchanges — Coin Turk","type":"news_article","url":"https://en.coin-turk.com/a-15-million-sim-swap-scam-hits-crypto-exchanges-what-happened-during-the-joint-operation/"},{"credibility":2,"name":"Polish cybercrime unit arrests four in FBI-backed SIM swap and crypto theft raid — MEXC News","type":"news_article","url":"https://www.mexc.com/news/1174401"},{"credibility":3,"name":"BitHub on X: naming 'Wojtek K.' alias 'Merry' among those detained","type":"social_media","url":"https://x.com/BithubPl/status/2070189409949937817"},{"credibility":3,"name":"Dark Web Informer on X: CBZC arrests with FBI and HSI support","type":"social_media","url":"https://x.com/DarkWebInformer/status/2070160796575818073"},{"credibility":2,"name":"Polish hacker Merry suspected of being raided by authorities — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/polish-hacker-merry-suspected-of-being-raided-by-authorities"}],"summary":"Wojtek Kulisz, known online as 'Merry', is a Polish national alleged by blockchain investigator ZachXBT to be among four individuals arrested in Poland on June 25, 2026, as part of a joint CBZC-FBI-HSI operation targeting an organized SIM swap crypto theft ring. The group is accused of breaching telecommunications infrastructure, hijacking victims' phone numbers, and draining cryptocurrency exchange accounts, with prosecutors estimating laundered funds in excess of tens of millions of Polish zlotys (approximately $5–$15 million USD). Polish authorities placed all four suspects in pretrial detention facing charges of participation in an organized criminal group, unauthorized computer system access, and money laundering, each carrying a maximum sentence of 25 years.","timeline":[{"date":"2026-06-25","event":"Poland's Central Bureau for Combating Cybercrime (CBZC), with operational support from the FBI and HSI, arrested four members of an organized SIM swap crypto theft ring. All four were placed in pretrial detention by court order.","source":"Help Net Security / CBZC official statement","source_url":"https://www.helpnetsecurity.com/2026/06/26/poland-sim-swap-gang-arrests-cryptocurrency-theft/"},{"date":"2026-06-25","event":"Blockchain investigator ZachXBT publicly alleged that one of the four detainees is Wojtek Kulisz, alias 'Merry', matching designer items visible in raid footage to the suspect's public Instagram account 'wojtekk'.","source":"The Block","source_url":"https://www.theblock.co/post/406159/four-arrested-poland-sim-swap-attacks-crypto-exchanges-zachxbt-social-engineering-threat-merry"},{"date":"2026-06-25","event":"Polish-language account BitHub on X named 'Wojtek K.' with alias 'Merry' as one of those detained, corroborating ZachXBT's identification from a separate source.","source":"BitHub on X","source_url":"https://x.com/BithubPl/status/2070189409949937817"},{"date":"2026-06-26","event":"Multiple international security and crypto news outlets reported the arrests, with Polish prosecutors estimating laundered funds exceeding tens of millions of zlotys (approximately $5–$15 million USD). Investigation described as ongoing.","source":"BleepingComputer / TechEchelon / Cryptopolitan","source_url":"https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bde68586-80fb-4d6e-bf75-101b57156201copy