2023 Kroll — T-Mobile SIM swap on employee; FTX, BlockFi & Genesis bankruptcy claimant data stolen
Data compromised
Personal information of bankruptcy claimants across FTX, BlockFi, and Genesis estates administered by Kroll—names and contact details per victim notices; downstream phishing/SIM-swap campaigns against creditors followed, with investigator and community estimates of eight- to nine-figure and $300M+ aggregate crypto thefts cited in 2026 discourse (not a single attested Kroll figure)
Technical writeup
On August 19, 2023 Kroll confirmed a T-Mobile SIM-swapping attack transferred a Kroll employee's phone number to a threat actor without company authorization, enabling access to files containing personal information of bankruptcy claimants in the BlockFi, FTX, and Genesis restructuring matters Kroll administered. FTX and BlockFi disclosed the breach to customers August 2023; Genesis privately notified customers per CoinDesk reporting. KrebsOnSecurity and The Record documented immediate FTX-themed phishing emails urging wallet connections. Subsequent reporting (Help Net Security, March 2024) described BlockFi creditor phishing draining millions within days; blockchain investigator ZachXBT and security commentators in 2026 resurfaced the incident citing eight- to nine-figure downstream thefts and aggregate $300M+ creditor losses from phishing and social engineering without criminal prosecution of the SIM swapper—figures remain community/investigator estimates rather than a unified regulatory attestation. FBI investigated; Kroll stated no evidence other systems were impacted. A 2026 putative class action (Hall Attorneys v. Kroll) alleges post-incident email-only claims administration amplified phishing harms. BreachHistory indexes recordsAffected 0 pending disclosed claimant-row totals.
Root cause
T-Mobile SIM-swapping attack against a Kroll employee phone number on August 19, 2023; attacker accessed files with bankruptcy claimant personal information for FTX, BlockFi, and Genesis restructuring matters
References
- https://www.kroll.com/en/about-us/news/security-incident
- https://krebsonsecurity.com/2023/08/kroll-employee-sim-swapped-for-crypto-investor-data/
- https://therecord.media/sim-swap-attack-caused-crypto-breach
- https://www.coindesk.com/policy/2023/08/25/ftx-blockfi-warn-of-data-breach-after-kroll-sim-swap-attack/
- https://www.helpnetsecurity.com/2024/03/25/blockfi-ftx-phishing/