In 2023, the cryptocurrency exchange Crypto.com fell victim to a hacker attack, during which the perpetrators gained access to the personal data of a limited number of users. The exchange confirmed the breach, emphasizing that the incident did not result in the loss of customer funds and only affected a small number of individuals.
This is reported by Business • Media
Activities of the Scattered Spider Group and the Role of Noah Urban
Details about the attack on Crypto.com were revealed in a report about Noah Urban, a member of the hacker group Scattered Spider. Urban shared that he first became acquainted with fraud methods through SIM card swapping at the age of 15, earning $50 for each successful call that led to the theft of crypto assets. Later, in August 2022, he and his associates hacked Twilio Inc., gaining access to user information from 209 organizations. In December of the same year, a group known as 0ktapus breached Gemini Trust Co., stealing personal data from 5.7 million users.
“I just wanted financial freedom to hang out all day, spend time with friends, and listen to music.”
The Crypto.com Breach and Other Cyberattacks by the Group
After joining forces with Scattered Spider, Urban, along with a hacker named Jack, gained access to the account of an employee at Crypto.com from January to March 2023. To collect personal data, the attackers utilized the United Parcel Service Inc. system.
In a series of attacks, the hacker group also breached the database of the gaming studio Riot Games Inc. in January 2023, demanding a ransom of $10 million. The company refused to pay the cybercriminals. In March 2023, the Federal Bureau of Investigation conducted a search at Urban’s residence, seizing cryptocurrency, cash, luxury items, and technology, but this did not stop him from committing further crimes.
In January 2024, Urban was arrested on charges of hacking 13 companies. By August 2025, the court found him guilty of electronic communication fraud and cryptocurrency theft, sentencing him to 10 years in prison. He had assets worth $4.8 million confiscated and was ordered to pay $13.4 million in restitution to the victims. After the sentence, Urban expressed regret over the events but did not repent, stating that he was satisfied with how he lived his life.
Previously, details about another large-scale data breach of customers at the exchange Coinbase were revealed.