Spiderweb of Deceit: Palm Coast Man Nets 10 Years for Crypto Heist

JACKSONVILLE, FL – A young man from Palm Coast, Florida, aged 20, has received a decade-long prison sentence after admitting his involvement in a significant cybercrime operation. Noah Urban was sentenced Wednesday morning after pleading guilty to federal charges, including conspiracy to commit wire fraud and wire fraud itself.

Despite arguments from both the prosecution, who sought an eight-year term, and the defense, who requested five, the presiding federal judge ordered Urban to serve 120 months within the federal prison system, followed by three years of supervised release. Furthermore, he is obligated to pay $13 million as restitution to his numerous victims.

Urban’s guilty plea in April encompassed charges stemming from two distinct federal cases. One case, based in Florida, was revealed in January 2024. The other, originating in Southern California, came to light in November of the previous year. Specifically, in the Florida case, he confessed to conspiring to commit wire fraud, along with individual counts of wire fraud and aggravated identity theft. The California case saw him plead guilty to a single charge of conspiracy to commit wire fraud.

The Florida indictment alleged that Urban illicitly obtained at least $800,000 worth of cryptocurrency from five identified individuals between August 2022 and March 2023. Prosecutors detailed how Urban and his accomplices acquired victims’ personal information and then manipulated their cell phone service to transfer their numbers to devices under the conspirators’ control. This allowed them to seize control of cryptocurrency accounts by resetting passwords and confirming those resets through text messages. This manipulative tactic is commonly referred to as “SIM swapping.”

As part of his admission of guilt, Urban committed to repaying all those affected by his actions. The plea agreement documented specific amounts owed to each victim in both the Florida and California cases, exceeding $13 million across a total of 59 individuals. Notably, some of the listed restitution amounts were for people who were not direct victims of the specific offenses that Urban admitted to committing. However, he willingly agreed to these amounts as part of the plea agreement. Restitution is generally confined to actions to which a defendant pleads guilty, but Urban intentionally forfeited this standard limitation in his agreement.

Urban, identified in court documents by aliases like “King Bob” (alluding to the “Minions” movie) and “Gustavo Fring” (a reference from “Breaking Bad”), is suspected to be a member of the infamous cybercriminal collective known as “Scattered Spider.”

Federal cybersecurity authorities report that this group focuses its attacks on large corporations and their contracted IT support providers. They warn that members of Scattered Spider often:

• 
  Impersonate company IT personnel or helpdesk staff via phone calls or text messages to steal employee login information.

• 
  Pretend to be company IT, instructing employees to install remote access software, thereby granting unauthorized access.

• 
  Masquerade as IT staff to persuade individuals to share one-time passwords used for multi-factor authentication, a prevalent security measure.

• 
  Exploit access to victim networks in numerous ways, including extortion through ransomware and data theft.

According to sources cited by Krebs on Security and 60 Minutes, Urban is regarded as a central figure within this criminal enterprise.

In November of 2024, prosecutors in Los Angeles revealed that Urban was among five individuals facing charges for orchestrating a scam targeting companies through fraudulent text messages. The scheme involved acquiring employee login credentials to steal confidential data and information. Authorities added that the group leveraged these phishing messages to gain access to virtual currency accounts, siphoning off millions of dollars in cryptocurrency.

The U.S. Attorney’s Office indicated that the defendants in the California case executed phishing attacks from at least September 2021 to April 2023. These messages often warned employees about impending account deactivation and provided links to deceptively authentic-looking phishing websites.

The stolen data, according to prosecutors, included sensitive work materials, intellectual property, and personally identifiable information, such as login credentials, names, email addresses, and phone numbers. This data was then combined with other sources to compromise cryptocurrency accounts and embezzle substantial amounts of virtual currency.

Urban’s plea agreement also specifies items he has agreed to surrender, encompassing cash, cryptocurrency holdings, and tangible goods. He will forfeit assets in Dai, Ethereum, Monero, Bitcoin, and Ripple cryptocurrencies, all held across various digital wallets. While cryptocurrency values are prone to fluctuations, the Dai is currently estimated at approximately $1.3 million, and the largest portion of his Ethereum holdings also stands at around $1.3 million. In addition, Urban will give up $27,702 in cash seized from a Palm Coast residence, along with miscellaneous jewelry and six watches.

The plea agreement reveals that during a May 2023 interview with investigators, Urban admitted to personally amassing “several million dollars” through cryptocurrency theft between January 2021 and March 2023. He also implicated himself in thefts amounting to several million more overall. Urban claimed that most of his ill-gotten gains were squandered on online gambling sites, though he retained a “few million” on his desktop computer. When his computer was seized in March 2023, it contained around $2.89 million in cryptocurrency assets, which, as the plea agreement noted, were later revalued at approximately $3.67 million in October 2024 due to market volatility.