The 2018 theft of more than $24 million in cryptocurrency from tech entrepreneur Michael Turpin was one of the largest SIM-swapping crimes in history. The perpetrator was not a seasoned cybercriminal, but a 15-year-old boy from the New York suburbs who had taught himself to hack just a few years earlier. Ellis Pinsky grew up in a cramped Manhattan apartment, raised by a single mother who worked long hours to support him and his two brothers. When the family moved to Irvington, New York, his mother bought him a new Xbox.
It was through late-night gaming sessions on Call of Duty that Pinsky first encountered the darker side of the internet, when another player correctly guessed where he lived. Fascinated rather than frightened, Pinsky learned how to use a program called Wireshark to track IP addresses and pinpoint a user’s location. What began as a game to unsettle strangers quickly became an obsession. He spent months studying hacking forums and network vulnerabilities, and by age 14, he had discovered OG Users, an underground marketplace where hackers traded stolen accounts and shared illegal techniques.
Of all the methods Pinsky studied, SIM swapping stood out. The attack involves convincing a telecom employee to transfer a victim’s phone number to a card controlled by the hacker, granting access to every account tied to that number. To make the scheme more reliable, Pinsky and an older hacker known only as Harry bribed a low-level AT&T employee for access. Their target was Michael Turpin, a prominent cryptocurrency investor and tech figure who was attending a conference in Las Vegas on January 7, 2018.
At 7:00 p. m. that evening, Pinsky had Turpin’s phone number transferred to a burner SIM. Harry then used the compromised number to reset Turpin’s email password.
A script combed every message in the inbox, searching for keywords tied to cryptocurrency. For a time, the search came up empty and Harry was ready to abandon the plan. Pinsky refused to give up. The script eventually returned an email containing the 12-word seed phrase to one of Turpin’s crypto wallets, which held more than $24 million in digital currency.
The two spent hours breaking up the stolen funds into smaller accounts and converting them to Bitcoin to avoid detection. The heist made Pinsky a millionaire overnight, but the aftermath quickly unraveled. To move the money, Pinsky relied on a network of contacts, including Nick Truglia, a reckless Manhattan trader who agreed to sell part of the stolen cryptocurrency but disappeared with $1. 5 million.
Harry wanted revenge, even suggesting they hire someone to deal with Truglia. Pinsky talked him down, but trust within the group was broken. As Pinsky grew paranoid and began moving funds into hidden accounts, Truglia made a fatal mistake: he flaunted his new wealth on social media with photos of expensive watches, luxury cars, and nights out at exclusive clubs. The display drew the attention of investigators, who found chat logs, blockchain records, and other evidence connecting him to the Turpin heist.
His carelessness brought the entire operation into the spotlight. Turpin had realized his phone was compromised within hours of the hack. He first assumed it was a technical glitch, but soon discovered his accounts had been drained. He contacted lawyers, launched an investigation, and went public with his story, pressuring law enforcement to act and raising awareness about SIM-swapping vulnerabilities in the telecom industry.
Investigators traced Pinsky’s online alias, piie, to his real identity. They contacted his mother and laid out the evidence. Pinsky confessed to his family, returned what remained of the stolen funds, and hoped his cooperation would keep him out of prison. Pinsky avoided prison, largely because of his age at the time of the crime and his cooperation with authorities.
But Turpin filed a $22 million lawsuit against him, seeking damages for the stolen funds and the financial and emotional toll of the heist. The court ruled in Turpin’s favor, leaving Pinsky with a judgment he will likely never be able to repay. Truglia was not as fortunate. He was arrested on 21 felony charges, including wire fraud and identity theft, and sentenced to 18 months in prison.
By 2024, he was back in court, accused of hiding assets and failing to repay his debts. Prosecutors claimed he still had access to millions in stolen cryptocurrency, and a judge threatened to keep him in jail indefinitely for contempt of court. The consequences for Pinsky extended beyond money. His family faced threats and harassment, and armed intruders once broke into their home under the belief that he still had millions hidden.
The family barricaded themselves upstairs until police arrived. Now a student at New York University, Pinsky dreams of starting a legitimate tech company, but the $22 million judgment, media scrutiny, and lingering legal threats remain heavy burdens. Turpin has recovered only portions of the stolen funds. He has become a vocal advocate against SIM-swapping crimes, pushing for stronger security measures and greater accountability from companies like AT&T.
His fight for justice continues, and the missing millions remain unaccounted for.