In brief
- A New York judge resentenced Nicholas Truglia to 12 years in prison after he failed to pay $20 million in restitution for a 2018 SIM-swap theft.
- The revised sentence more than doubles federal guidelines and follows Truglia’s early release from an initial 18-month term in 2022.
- Truglia evaded restitution while moving funds and buying luxury goods; a courtroom video of him boasting about hiding stolen crypto proved pivotal.
A New York federal judge has resentenced convicted cybercriminal Nicholas Truglia to 12 years in prison, following an 18-month sentence years earlier, after he failed to pay $20 million in restitution to his victim.
The ruling, handed down on Thursday, came after Truglia missed deadlines to repay crypto investor and promoter Michael Terpin for a 2018 SIM-swapping attack that resulted in the theft of more than $23 million in crypto.
The revised sentence exceeds federal guidelines by more than double, which recommends between 51 and 63 months.
Truglia was sentenced to 18 months in prison in December 2022, with 12 months of time already served. He was released shortly after sentencing under the condition that he repay more than $20 million in restitution, a commitment he failed to honor.
He was detained again in May 2023 in Miami for suspected violations of supervised release, after continuing to move funds and purchase luxury goods.
Despite a contempt order, Truglia was released in November 2024 after the presiding judge determined he stood a better chance of repaying restitution outside prison. Again, he did not make any payments.
Prosecutors said Truglia allowed co-conspirators to use his crypto accounts to receive Terpin’s stolen funds, converting them to Bitcoin and taking a cut. He personally retained roughly $673,000.
His initial sentencing hearing revealed, however, that he had more than $53 million in assets.
Court records show that Truglia was ordered to repay $12.1 million by December 31, 2022, and an additional $8.3 million by January 30 of the following year. His failure to do so led to his resentencing on Thursday.
Another member of the group, Ellis Pinsky, who was just 15 at the time of the hack, reached a $22 million settlement with Terpin.
“This is a turning point in how the legal system views the theft of cryptocurrency,” Terpin told Decrypt.
“The ‘Perry Mason’ moment in the hearing was the playing of a video from Vice on Showtime where Truglia stated in a masked voice that he would be able to keep his stolen crypto even if he had to be in jail for ten years because it can’t be seized like a bank account. He’s about to find out what more than ten years feels like,” he added.
“Perry Mason” refers to a fictional defense attorney from a long-running American legal drama, first appearing in a series of novels, then in a popular TV show that began in the 1950s. The show was known for its dramatic courtroom scenes, especially last-minute revelations or confessions on the stand that turned the trial in Mason’s favor.
Terpin has been fighting legal battles ever since the attack, which exploited a vulnerability in the phone number porting systems of mobile service providers.
He sued Truglia and another then-teenaged hacker, Ellis Pinsky, five years ago, as well as telecoms giant AT&T in 2018, alleging it failed to safeguard his data. His civil suit against AT&T was initially thrown out but later revived.
SIM swapping is a cyberattack technique in which hackers trick or bribe telecom employees into transferring a victim’s phone number to a new SIM card.
Once the number is hijacked, attackers intercept SMS-based two-factor authentication codes, gaining access to email, crypto wallets, and other sensitive accounts.
According to the FBI’s Internet Crime Complaint Center, SIM swapping scams led to over $25 million in reported losses last year, down from nearly $48 million in 2023 and $73 million in 2022.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.