Ricky Handschumacher Recounts Escalation From Gamertag Theft to SIM-Swap Crypto Heists
· 1:20:16 · Watch on YouTube ↗
Summary
In Darknet Diaries, Ricky Handschumacher describes using support impersonation and SIM-swapping to steal usernames and cryptocurrency. The episode reports his four-year prison sentence and $7.6 million restitution order.
Key points
- Handschumacher says he began with gaming-related denial-of-service attacks before stealing and selling Xbox gamertags and Instagram usernames.
- He describes exploiting support-case reference numbers and weak email recovery checks to obtain account information and reset victims’ passwords.
- SIM-swapping let his crew intercept recovery texts, take over email accounts and search inboxes and cloud photos for exchange accounts, private keys and seed phrases.
- Handschumacher says he sometimes paid mobile-store insiders to bypass account protections and transfer victims’ numbers.
- In a separate account, Mark Kreitzman reports losing 2.2 Bitcoin after a SIM-swap despite requiring in-person identity checks. The episode does not establish that Handschumacher targeted him.
- The episode reports that Handschumacher pleaded guilty to federal charges, received four years in prison and was ordered to pay $7.6 million in restitution.
- Following his early release in 2024, Handschumacher has spoken at anti-fraud and security events and says he is working with Joseph Harris to build a penetration-testing company.
Article Details
- Topics
- [07:15] Gaming denial-of-service attacks and entry into cheating communities
- [11:48] Stolen gamertag markets and abuse of customer-support verification
- [21:40] Instagram username theft and resale
- [29:08] SIM-swapping, personal-data gathering and interception of account recovery texts
- [38:01] Cryptocurrency theft through compromised inboxes and cloud accounts
- [42:33] Mark Kreitzman’s separate SIM-swap experience and carrier insider risks
- [01:03:23] Investigation, arrests and Handschumacher’s sentencing
- [01:17:03] Post-release security outreach and plans for legitimate penetration testing
MITRE ATT&CK
T1078 · Valid AccountsThe crew accessed victims’ email, social-media and cryptocurrency exchange accounts after abusing password recovery.T1111 · Multi-Factor Authentication InterceptionThe crew used SIM-swapping to receive victims’ SMS recovery codes and gain access to email accounts.T1498 · Network Denial of ServiceHandschumacher describes using denial-of-service attacks to disconnect gaming opponents and win matches.T1552.001 · Credentials In FilesThe crew searched compromised cloud photos and stored material for screenshots of passwords, private keys and wallet seed phrases.T1589 · Gather Victim Identity InformationHandschumacher describes collecting victims’ phone numbers, addresses and Social Security information through support calls and people-search data to facilitate SIM-swaps.T1657 · Financial TheftHandschumacher describes stealing cryptocurrency from compromised exchange accounts and private wallets and splitting proceeds with his crew.
People
Threat Actors
Joel OrtizThe episode reports that he pleaded guilty after SIM-swapping victims and stealing millions of dollars in cryptocurrency, receiving a ten-year prison sentence.Joseph HarrisDescribed as a former SIM-swapper who exchanged username-theft strategies with Handschumacher. The episode says the two are now attempting to establish a penetration-testing company.Ricky HandschumacherInterview subject who admits stealing usernames and cryptocurrency through social engineering and SIM-swapping. The episode reports his guilty plea, four-year federal prison sentence and $7.6 million restitution order. He identifies Wolverine as his alias.
Vendors
AOL[15:06] RICKY: Okay, so, back in the day AOL and Yahoo were your most popular domains. What's theirAT&T[35:30] the correct dox and buy their social for $3, call up AT&T, Verizon, or T-Mobile or Sprint,Efani[51:37] called Efani. It’s a mobile carrier that resells AT&T and Verizon service with one big difference;Microsoft[13:41] easier way to get it is to trick Microsoft that you're the actual owner of the account and youSprint[35:30] the correct dox and buy their social for $3, call up AT&T, Verizon, or T-Mobile or Sprint,T-Mobile[35:30] the correct dox and buy their social for $3, call up AT&T, Verizon, or T-Mobile or Sprint,Verizon[35:30] the correct dox and buy their social for $3, call up AT&T, Verizon, or T-Mobile or Sprint,Yahoo[15:06] RICKY: Okay, so, back in the day AOL and Yahoo were your most popular domains. What's their
Products
Coinbase[40:29] that person has an account there. If they found an e-mail like Welcome to Coinbase, then they'dGmail[39:23] RICKY: If we're in your Gmail, we're searching the inbox. If we're in your iCloud,Google Photos[41:22] screenshots of these things and store them on their iCloud or Google Photos account. You know,iCloud[39:23] RICKY: If we're in your Gmail, we're searching the inbox. If we're in your iCloud,Instagram[21:46] wasn't just gamer tags anymore. [Music] His attention turned to Instagram handles.Xbox Live[12:22] first-serve kinda thing. So, Wolf must have made that gamer tag a long time ago when Xbox Live wasZune[13:53] RICKY: There was a company called Zune, which is like Microsoft’s music app. Come to find out
Tools
Industries
Cryptocurrency[56:54] will let you exchange cryptocurrency for cash. So, that wasn't going to work. His Bitcoin wallet wasGaming[06:05] I was never like, home, but I did have a passion for actual gaming.Social media[36:17] social media usernames. This is when his efforts really kicked into gear. He was taking over dozens