T-Mobile has been ordered to pay $33 million in compensation following a SIM swap attack that resulted in the theft of $38 million worth of cryptocurrency from a customer’s account. The ruling, which emerged from a private arbitration process, marks one of the largest settlements related to mobile carrier security breaches.
The incident occurred in February 2020 when hackers targeted Joseph “Josh” Jones, a tech entrepreneur. The attackers gained unauthorized control of Jones’ T-Mobile account and transferred his phone number to a SIM card under their control, enabling them to bypass multi-factor authentication on his cryptocurrency wallets. The breach resulted in the theft of over 1,500 Bitcoin and approximately 60,000 Bitcoin Cash, valued at $38 million at the time.
The case revealed significant security vulnerabilities at T-Mobile, the the company has more recently made efforts to enhance authentication security through measures like YubiKey deployment. Jones had implemented enhanced security measures on his account, including an eight-digit PIN, yet attackers still managed to compromise his account.
According to the legal team at Greenberg Glusker representing Jones, the breach was enabled by “numerous security failures” at T-Mobile. The firm argued that the carrier had long been aware of SIM swapping vulnerabilities but failed to implement adequate protective measures.
The arbitration award, finalized in late 2023, remained confidential until recently when details emerged through a petition to confirm the award. T-Mobile had attempted to seal information about its security lapses, but the proceedings brought these details into public view.
“SIM swapping has been an unchecked security flaw for years,” stated Paul Blechner, an attorney at Greenberg Glusker. “Carriers like T-Mobile have known about it and failed to take basic precautions. This award makes it clear: they must do better.”
The ruling comes at a time when cryptocurrency platforms are increasingly implementing enhanced security measures, including biometric verification and advanced identity authentication systems, to prevent unauthorized access to digital assets.
This case sets a significant precedent for carrier accountability in securing customer accounts and highlights the growing importance of robust identity verification systems in protecting digital assets.
Sources: Ainvest, Phone Arena, Android Authority, Original Source
—
April 1, 2025 – by Ali Nassar-Smith
