Florida Man Sentenced to 10 Years for Multi-Million Dollar Cryptocurrency Theft
Noah Michael Urban, a 20-year-old man from Palm Coast, Florida, was sentenced on August 21, 2025, to 10 years (120 months) in federal prison for orchestrating a multi-state cryptocurrency theft campaign tied to the notorious cybercrime group Scattered Spider.
In addition to his prison sentence, Urban was ordered to pay $13 million in restitution to victims and will serve three years of supervised release after completing his sentence. The restitution amount aims to cover losses from two separate federal cases in Florida and California, reflecting the profound financial damage caused by his activities.
Urban’s criminal actions involved complex cybercrime schemes, including SIM swapping and phishing campaigns, spanning from 2021 to 2023. In Florida, between August 2022 and March 2023, he used SIM swapping attacks to steal approximately $800,000 in cryptocurrency from at least five individuals. SIM swapping allows criminals to transfer a victim’s mobile phone number to a device they control, intercepting SMS-based two-factor authentication messages and enabling password resets on cryptocurrency accounts.
Separately, in California, Urban was involved in a wide-reaching phishing campaign targeting corporate employees with deceptive SMS messages, also known as “smishing.” These messages directed victims to fraudulent login pages that captured credentials, granting unauthorized access to corporate networks and personal cryptocurrency wallets. This scheme, which operated from September 2021 to April 2023, resulted in more than $11 million in cryptocurrency theft.
In court, Urban pleaded guilty to multiple felony charges, including conspiracy, wire fraud, and aggravated identity theft. Although federal prosecutors had recommended an eight-year sentence and the defense requested five years, the judge opted for a harsher sentence, underscoring the severity of the crimes and the extensive financial harm inflicted on victims.
Operating under aliases such as “King Bob,” “Sosa,” and “Gustavo Fring,” Urban was a key figure in Scattered Spider—a cybercriminal organization responsible for breaching over 130 major companies. The group specialized in SMS and voice phishing attacks that tricked victims into revealing login credentials and one-time passcodes, facilitating unauthorized access to valuable crypto wallets and networks.
This case marks the first sentencing of a Scattered Spider member and sets a precedent in the federal crackdown on sophisticated, large-scale cryptocurrency thefts. The $13 million restitution represents a significant effort to compensate those victimized in these technologically advanced scams.
The sentencing highlights ongoing challenges in cybersecurity, particularly around protecting cryptocurrency assets from emerging threats such as SIM swapping and social engineering. Law enforcement agencies continue to emphasize the importance of vigilance and enhanced security measures to combat these evolving criminal tactics.