Convicted Cybercriminal Resentenced to 12 Years for $23 Million Crypto Theft

Nicholas Truglia, a convicted cybercriminal, has been resentenced to 12 years in prison by a New York federal judge. This decision comes after Truglia failed to pay $20 million in restitution to his victim, Michael Terpin, for a 2018 SIM-swapping attack that resulted in the theft of over $23 million in cryptocurrency. The revised sentence exceeds federal guidelines by more than double, which recommend between 51 and 63 months.

Truglia was initially sentenced to 18 months in prison in December 2022, with 12 months of time already served. He was released shortly after sentencing under the condition that he repay more than $20 million in restitution, a commitment he failed to honor. He was detained again in May 2023 in Miami for suspected violations of supervised release, after continuing to move funds and purchase luxury goods. Despite a contempt order, Truglia was released in November 2024 after the presiding judge determined he stood a better chance of repaying restitution outside prison. Again, he did not make any payments.

Prosecutors revealed that Truglia allowed co-conspirators to use his crypto accounts to receive Terpin’s stolen funds, converting them to Bitcoin and taking a cut. He personally retained roughly $673,000. Court records show that Truglia was ordered to repay $12.1 million by December 31, 2022, and an additional $8.3 million by January 30 of the following year. His failure to do so led to his resentencing.

Another member of the group, Ellis Pinsky, who was just 15 at the time of the hack, reached a $22 million settlement with Terpin. Terpin has been fighting legal battles ever since the attack, which exploited a vulnerability in the phone number porting systems of mobile service providers. He sued Truglia and Pinsky five years ago as well as telecoms giant AT&T in 2018, alleging it failed to safeguard his data. His civil suit against AT&T was initially thrown out but later revived.

SIM swapping is a cyberattack technique in which hackers trick or bribe telecom employees into transferring a victim’s phone number to a new SIM card. Once the number is hijacked, attackers intercept SMS-based two-factor authentication codes, gaining access to email, crypto wallets, and other sensitive accounts.

This case highlights the severity of SIM-swapping attacks and the legal consequences for those involved. The resentencing of Truglia to 12 years in prison sends a strong message about the legal system's stance on cryptocurrency theft. The courtroom video of Truglia boasting about hiding stolen crypto proved pivotal in the decision, showcasing his disregard for the legal process and his victims.