Skip to main content
AVOID.NET
Sign in
← Wojtek Kulisz ('Merry') — SIM Swap Crypto Theft Ringreviewed 2026-09-05 · 26 claims checked

Fact-check findings

What an automated fact-checker found when it re-read Wojtek Kulisz ('Merry') — SIM Swap Crypto Theft Ring against the sources the page cites. Only the most recent review is shown.

Read this first

These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.

“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.

Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.

disputed 1unverifiable 1link rot 4confirmed 205 corrections pending · 0 applied

disputed

1 claim

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

  1. #3[disputed][awaiting moderator]in the summary
    “Polish authorities placed all four suspects in pretrial detention facing charges of participation in an organized criminal group, unauthorized computer system access, and money laundering, each carrying a maximum sentence of 25 years.”
    reviewerAll four suspects were placed in pretrial detention facing charges of organized-crime participation, unauthorized computer access, and money laundering, each carrying a maximum sentence of 25 years.Every source describes 25 years as the combined/overall maximum sentence exposure for the three charges together, not a separate 25-year maximum for each individual charge. The page's own section 2 ('Criminal Charges and Legal Status') correctly frames it as a combined exposure, so the summary's 'each carrying' phrasing is an internal inconsistency and a mischaracterization of the cited reporting.
    Proposed correction (not yet applied)
    Polish authorities placed all four suspects in pretrial detention facing charges of participation in an organized criminal group, unauthorized computer system access, and money laundering, carrying a maximum combined sentence of 25 years.
    citedwww.bleepingcomputer.com/news/security/p…in-crypto-theft/www.helpnetsecurity.com/2026/06/26/polan…ocurrency-theft/

unverifiable

1 claim

No source the reviewer could reach confirms or contradicts the claim.

  1. #21[unverifiable][awaiting moderator]in section: ZachXBT Investigation and Prior Threat Actor History
    “No prior law enforcement charges or public criminal proceedings involving Kulisz specifically have been surfaced in available reporting.”
    reviewerNo prior law enforcement charges or public criminal proceedings involving Kulisz specifically have been surfaced in available reporting.An absence-of-evidence claim; no prior record was found in extensive searching, but this cannot be conclusively proven as opposed to merely unreported, so it is marked unverifiable rather than confirmed.

confirmed

20 claims

The cited evidence supports the claim as written.

  1. #1[confirmed][no action needed]in the summary
    “Wojtek Kulisz, known online as 'Merry', is a Polish national alleged by blockchain investigator ZachXBT to be among four individuals arrested in Poland on June 25, 2026, as part of a joint CBZC-FBI-HSI operation targeting an organized SIM swap crypto theft ring.”
    reviewerWojtek Kulisz, alias 'Merry', a Polish national, was alleged by ZachXBT to be among four individuals arrested in Poland on June 25, 2026 in a joint CBZC-FBI-HSI operation targeting a SIM swap crypto theft ring.Directly corroborated by both cited outlets and by independent search results (The Block, KuCoin, Cryptopolitan all name Kulisz and the June 25 date).
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merrywww.cryptopolitan.com/wojtek-merry-detai…ypto-fraud-raid/
  2. #2[confirmed][no action needed]in the summary
    “The group is accused of breaching telecommunications infrastructure, hijacking victims' phone numbers, and draining cryptocurrency exchange accounts, with prosecutors estimating laundered funds in excess of tens of millions of Polish zlotys (approximately $5–$15 million USD).”
    reviewerProsecutors estimated laundered funds in excess of tens of millions of Polish zlotys, approximately $5-15 million USD.The $5-15M range accurately reflects genuine variance in how outlets converted the official PLN figure; the page's hedge is appropriate rather than a cherry-pick.
    citedwww.techechelon.com/post/poland-arrests-…-in-crypto-theften.coin-turk.com/a-15-million-sim-swap-s…joint-operation/
  3. #4[confirmed][no action needed]in section: Identity and Attribution
    “Polish authorities arrested four individuals on June 25, 2026, but withheld all suspects' identities, citing the ongoing international nature of the investigation.”
    reviewerPolish authorities arrested four individuals on June 25, 2026 but withheld all suspects' identities, citing the ongoing international nature of the investigation.Confirmed by multiple outlets consistently.
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merry
  4. #5[confirmed][no action needed]in section: Identity and Attribution
    “ZachXBT's attribution rested on visual evidence: designer clothing and jewelry items visible in CBZC raid footage matched items Kulisz had displayed on his public Instagram account under the handle 'wojtekk'.”
    reviewerZachXBT's attribution rested on visual evidence: designer clothing and jewelry items visible in CBZC raid footage matched items Kulisz had displayed on his public Instagram account under the handle 'wojtekk'.Directly supported, near word-for-word, by the cited source.
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merrywww.kucoin.com/news/flash/polish-hacker-…d-by-authorities
  5. #6[confirmed][no action needed]in section: Identity and Attribution
    “A Polish-language post by the Bitcoin-focused account BitHub on X (formerly Twitter) also named 'Wojtek K.' with the alias 'Merry' as one of those detained.”
    reviewerA Polish-language post by the account BitHub on X named 'Wojtek K.' with the alias 'Merry' as one of those detained.Could not fetch the tweet directly due to X blocking automated access, but its text was corroborated via an independent search index snippet, matching the page's characterization.
    citedx.com/BithubPl/status/2070189409949937817
  6. #7[confirmed][no action needed]in section: Identity and Attribution
    “As of the time of reporting, Polish authorities had not officially confirmed or denied Kulisz's identity in connection with the case.”
    reviewerPolish authorities had not officially confirmed or denied Kulisz's identity in connection with the case.Consistent across every outlet consulted.
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merry
  7. #8[confirmed][no action needed]in section: Identity and Attribution
    “ZachXBT described Kulisz as a known social engineering threat actor active in crypto circles prior to his alleged arrest.”
    reviewerZachXBT described Kulisz as a known social engineering threat actor active in crypto circles prior to his alleged arrest.Corroborated further by an independently found X post from a third account describing Kulisz as 'the Polish social engineering threat actor'.
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merry
  8. #9[confirmed][no action needed]in section: Criminal Charges and Legal Status
    “The four arrested individuals, including the suspect alleged to be Kulisz, were charged by the Krakow Regional Prosecutor's Office with three offenses under Polish law: (1) participation in an organized criminal group, (2) theft through unauthorized access to computer systems, and (3) money laundering.”
    reviewerThe four arrested individuals were charged by the Krakow Regional Prosecutor's Office with three offenses: organized-crime participation, theft via unauthorized computer access, and money laundering.Matches fetched source content closely.
    citedwww.helpnetsecurity.com/2026/06/26/polan…ocurrency-theft/
  9. #10[confirmed][no action needed]in section: Criminal Charges and Legal Status
    “The maximum combined sentence exposure under Polish law for these charges is up to 25 years' imprisonment.”
    reviewerThe maximum combined sentence exposure under Polish law for these charges is up to 25 years' imprisonment.This section correctly frames the 25-year figure as a combined exposure, in contrast to the summary's 'each carrying' phrasing (see separate disputed finding).
    citedwww.bleepingcomputer.com/news/security/p…in-crypto-theft/www.helpnetsecurity.com/2026/06/26/polan…ocurrency-theft/
  10. #11[confirmed][no action needed]in section: Criminal Methods: SIM Swapping and Telecom Infrastructure Breach
    “According to CBZC's official statement, the criminal group employed a multi-stage attack methodology.”
    reviewerThe group employed a multi-stage attack: breaching telecom-adjacent IT infrastructure, compromising employee email via social engineering, cloning/hijacking phone numbers, intercepting SMS 2FA and email, draining exchange accounts, then laundering through bank accounts, payment platforms and multi-currency wallets.The full section content closely tracks the cited Help Net Security reporting on attack methodology and laundering channels.
    citedwww.helpnetsecurity.com/2026/06/26/polan…ocurrency-theft/
  11. #12[confirmed][no action needed]in section: Financial Scale and Laundering
    “No specific cryptocurrency exchanges targeted by the attacks were publicly named by authorities. No breakdown by individual victim was disclosed.”
    reviewerNo specific cryptocurrency exchanges targeted by the attacks were publicly named by authorities, and no breakdown by individual victim was disclosed.Confirmed absence of exchange names/victim breakdown across all outlets consulted.
    citedwww.bleepingcomputer.com/news/security/p…in-crypto-theft/
  12. #13[confirmed][no action needed]in section: Law Enforcement Operation
    “The arrests on June 25, 2026 were conducted by Poland's Central Bureau for Combating Cybercrime (CBZC), which is the primary national cybercrime law enforcement unit.”
    reviewerThe arrests on June 25, 2026 were conducted by Poland's CBZC with direct operational support from the FBI and HSI; the Krakow Regional Prosecutor's Office has jurisdiction; no extradition proceedings have been publicly disclosed.Extradition is not applicable since all four suspects were arrested and are being held in Poland; the absence of extradition news is consistent, not a gap.
    citedwww.helpnetsecurity.com/2026/06/26/polan…ocurrency-theft/
  13. #14[confirmed][no action needed]in section: Law Enforcement Operation
    “The involvement of U.S. agencies suggests that victims or elements of the criminal operation extended into the United States or were of direct U.S. investigative interest.”
    reviewerThe operation had international scope, including elements in the United States.The page frames this as an inference ('suggests'); independent corroboration found makes it a stronger, directly-supported claim rather than mere inference, so no correction is needed.
    citedx.com/BithubPl/status/2070189409949937817
  14. #19[confirmed][no action needed]in section: ZachXBT Investigation and Prior Threat Actor History
    “On-chain investigator ZachXBT published the alleged identity of one of the four arrested suspects as Wojtek Kulisz, known by the alias 'Merry'.”
    reviewerZachXBT published the alleged identity of one of the four arrested suspects as Wojtek Kulisz, alias 'Merry', via visual matching of designer clothing/jewelry to his Instagram account 'wojtekk'.One of the three co-cited sources (crypto-economy.com) does not itself state the real name, but the claim is adequately supported by the other two co-cited sources which do.
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merrywww.cryptopolitan.com/wojtek-merry-detai…ypto-fraud-raid/
  15. #20[confirmed][no action needed]in section: ZachXBT Investigation and Prior Threat Actor History
    “ZachXBT has a documented track record of identifying crypto criminals prior to or alongside official law enforcement disclosures, though his identifications represent community-level intelligence rather than official findings and should be treated as alleged until confirmed by authorities.”
    reviewerZachXBT has a documented track record of identifying crypto criminals prior to or alongside official law enforcement disclosures, and his identifications represent community-level intelligence rather than official findings.General characterization of ZachXBT's track record is well-established public record and appropriately hedged as unofficial intelligence.
  16. #22[confirmed][no action needed]in section: Victims and Targeted Exchanges
    “Victims of the SIM swap operation were users of cryptocurrency exchanges whose accounts were compromised after their phone numbers were hijacked.”
    reviewerVictims of the SIM swap operation were cryptocurrency exchange users whose accounts were compromised after their phone numbers were hijacked; no exchanges or victims were named; the international scope indicates victims were likely located across multiple countries including the US.Consistent with all reporting; no exchange or victim has been publicly named by any outlet found.
    citedwww.bleepingcomputer.com/news/security/p…in-crypto-theft/www.coininsider.com/news/polish-police-n…-swap-crackdown/
  17. #23[confirmed][no action needed]in the timeline
    “Poland's Central Bureau for Combating Cybercrime (CBZC), with operational support from the FBI and HSI, arrested four members of an organized SIM swap crypto theft ring. All four were placed in pretrial detention by court order.”
    reviewerOn June 25, 2026, CBZC with FBI/HSI support arrested four members of the ring and all four were placed in pretrial detention by court order.Matches the cited source's own reporting.
    citedwww.helpnetsecurity.com/2026/06/26/polan…ocurrency-theft/
  18. #24[confirmed][no action needed]in the timeline
    “Blockchain investigator ZachXBT publicly alleged that one of the four detainees is Wojtek Kulisz, alias 'Merry', matching designer items visible in raid footage to the suspect's public Instagram account 'wojtekk'.”
    reviewerOn June 25, 2026, ZachXBT alleged one of the four detainees is Wojtek Kulisz, matching designer items in raid footage to his Instagram account 'wojtekk'.Confirmed.
    citedwww.theblock.co/post/406159/four-arreste…ing-threat-merry
  19. #25[confirmed][no action needed]in the timeline
    “Polish-language account BitHub on X named 'Wojtek K.' with alias 'Merry' as one of those detained, corroborating ZachXBT's identification from a separate source.”
    reviewerBitHub on X named 'Wojtek K.' with alias 'Merry' as one of those detained, corroborating ZachXBT's identification from a separate source.Same caveat as the earlier finding on this source: verified via search snippet, not direct fetch.
    citedx.com/BithubPl/status/2070189409949937817
  20. #26[confirmed][no action needed]in the timeline
    “Multiple international security and crypto news outlets reported the arrests, with Polish prosecutors estimating laundered funds exceeding tens of millions of zlotys (approximately $5–$15 million USD). Investigation described as ongoing.”
    reviewerMultiple international outlets reported the arrests on June 26, 2026, with prosecutors estimating laundered funds exceeding tens of millions of zlotys (~$5-15M USD), investigation ongoing.Grouped date is reasonable given multiple outlets published within the June 25-26 window; TechEchelon's own timestamp is ambiguous but consistent with this range.
    citedwww.bleepingcomputer.com/news/security/p…in-crypto-theft/www.techechelon.com/post/poland-arrests-…-in-crypto-theftwww.cryptopolitan.com/wojtek-merry-detai…ypto-fraud-raid/
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.