Scattered Spider Hacker Gets 10 Years, $13M Restitution for SIM Swapping Crypto Theft

Noah Michael Urban, a 20-year-old member of the cybercrime gang Scattered Spider, has been sentenced in the U.S. to 10 years in federal prison for his role in cryptocurrency thefts and corporate hacks. Urban, who used multiple aliases including “Sosa” and “King Bob,” pleaded guilty in April 2025 to wire fraud and aggravated identity theft.

Authorities said he and accomplices carried out SIM swapping attacks between 2022 and 2023, stealing at least $800,000 from victims. In total, Urban was ordered to pay $13 million in restitution and will serve three years of supervised release after prison.

Scattered Spider, linked to wider English-speaking cybercriminal networks, is known for social engineering, SIM swaps, and ransomware attacks. The group recently allied with ShinyHunters and LAPSUS$, consolidating resources amid law enforcement crackdowns. Experts warn the merger could make them more dangerous and versatile.

Cybersecurity analysts note that Scattered Spider’s tactics—such as vishing, smishing, and MFA fatigue attacks—highlight how human deception often bypasses technical defenses.

sosa gets 10 pom gets 3 make it make sense

it's because bob wasn't autistic

To the government, they were 2 very different cases.

With Pom, the government wanted to take down BreachForums (but couldn't), and charged Pom with selling "access devices" (credit cards, bank account info and such). The victims might get phishing emails. Running a forum isn't illegal, so they went after him for the middleman service, and it was likely a tough sell. The message was "Want to run a hacking forum? Be careful."

With Sosa, they wanted to take down Scattered Spider (but couldn't), and charged Sosa with hacking. That's much easier for the government to handle. And the victims had millions of dollars of crypto taken from them. The judge takes sees the victim impact statements and 10 years might not seem out of line. The message was "Want to hack? We'll get you."

I was surprised that even after the added twist of pedo charges, Pom originally didn't get sentenced to any prison time. The appeals court must have been surprised too, as they went with 3 years.