Federal Appeals Court Revives AT&T $24M Crypto Hack Lawsuit

A panel from the Ninth Circuit Court of Appeals has reinstated a key claim in the lawsuit brought by cryptocurrency investor Michael Terpin against AT&T. Terpin claims that AT&T permitted hackers to take over his phone, which resulted in the loss of $24 million in cryptocurrency.

This decision reinstates a part of the lawsuit which was earlier thrown out by the court and allows Terpin to proceed with his claims under the Federal Communications Act (FCA).

Court Revives AT&T $24M Crypto Hack Lawsuit

According to a Bloomberg report, the claims against AT&T have been narrowed. However, the appellate panel overturned the dismissal of the most fraud and negligence claims and only restored Michael Terpin’s Section 222 of the FCA claim, which regulates telecommunications carriers to protect customer proprietary network information.

The court stated that Terpin had presented a triable issue of fact that but for AT&T’s failure to protect Terpin’s account during the SIM swap, he would not have been exposed to hackers who subsequently stole his cryptocurrency.

The panel in its decision observed that through the fraudulent SIM swap, the hackers were able to acquire Terpin’s phone number, which provided them with access to his personal information. This access allowed hacker to change passwords and steal $24 million of cryptocurrency from Terpin’s wallets.

Details of the 2018 SIM Swap Attack

The alleged hack happened in January 2018, and according to the lawsuit filed by Terpin, a group of hackers led by Ellis Pinsky, who was 15-years old at the time, paid an AT&T staff to transfer Terpin’s phone number to a SIM card owned by the hackers. Even though new measures were taken in the year 2017, after the previous breach, which included a 6-digit passcode, the hackers found their way around the protection.

Having gained access to Michael Terpin’s phone number, the hackers changed his account passwords via his phone and sent himself $24 million in cryptocurrencies. Pinsky, however, returned his portion of the stolen money, but another hacker, Nicholas Truglia, was told by a Los Angeles court to pay Terpin $75.8 million in damages.

Concurrently, AT&T in July faced a situation where it was breached by hackers who reportedly stole customers’ information such as call records and text messages. As per the reports, AT&T then agreed to pay $400,000 in Bitcoin to the hackers to get the data deleted. While AT&T has not officially admitted or denied this payment, information from blockchain sources like Chainalysis indicates transfer of funds in relation with the mentioned ransoms.

What Next After Reinstatement?

Reinstating Terpin’s claim under the FCA allows his lawsuit to move forward to trial where he is sueing for $24 million in damages, plus prejudgment interest, and attorney’s fees. Terpin’s lawyer Pierce O’Donnell said that the appeal court ruling was good for consumers and opened up the possibility of other courts following suit to enable consumers to sue telecoms firms for SIM swap fraud.

While AT&T has apologized to the cryptocurrency investor for the theft of his assets, the telecommunications giant noted that the majority of the accusations leveled against it were thrown out of court. The company still has confidence to defend the remaining allegations related to FCA.

As the number of cryptocurrency-related hacking incidents continues to increase, it has caught the eye of blockchain experts like ZachXBT who recently exposed another big scam in the UK. In his investigation, ZachXBT discovered that more than 250 users were defrauded using fake Bybit demo accounts and lost $650,000.