Noah Urban, 20, Sentenced to 10 Years in Federal Prison Over Defrauding at Least 59 Victims of $13 Million in Crypto Scam

Noah Michael Urban, the 20-year-old Palm Coast resident charged last year with 14 federal counts of cryptocurrency fraud and identity theft, was sentenced to 10 years in prison followed by three years on probation. He had faced up to 22 years in prison. 

“All of the crimes that we have charged in this indictment,” Assistant U.S. Attorney John Cannizaro told the court in a hearing last year, “are based specifically on the information that was found on Mr. Urban’s computer in Palm Coast.” 

Cannizaro said Urban had started defrauding people “probably around when he was about 16.” He was 19 when he was arrested. He finished high school and had a year in college. 

In the cases covered by the investigation, Urban had used the name, credentials, and email accounts of at least 59 victims to take money from their cryptocurrency accounts and transfer it to his account. The victims lost at least $13 million between August 2022 and March 2023. (Cannizaro at the hearing had bracketed the fraud between late 2020 and early 2023.) 

Urban and others conducted targeted attacks called “SIM swaps,” to obtain victims’ personal identification information.

“This conspiracy involved what was called SIM swapping, or two-factor authentication,” Cannizaro told the court. “Basically what that would mean is somebody has a specific email account, and that email account would be linked to a cryptocurrency, basically, bank account, where these particular victims would be investing in cryptocurrency.” The money would be in a so-called “wallet.” 

Urban would gain access to the victims’ email addresses, go on Coinbase, a platform to invest in cryptocurrency, log in, and when prompted, say he forgot his password. Coinbase would send him a one-time password. “He would then sign on to that specific website,” Cannizaro  said. “He would then be able to see all the funds that were available to him. And he would transfer the victim’s cryptocurrency into his own cryptocurrency wallet. And all of those victims that are listed in the indictment, Your Honor, all five of them, all of that information was found directly on Mr. Urban’s computer. So all of those victims basically were exploited. And all of their money, whether it was Ethereum or Bitcoin, was taken from their bank accounts into Mr. Urban’s bank accounts.”

Urban was also part of a group that targeted employees of companies nationwide with phishing text messages. Phishing is a form of fraud. The texter or emailer pauses as a representative of a reputable firm, swindling the recipient into revealing personal information that can then be used to access computers or bank accounts. It was one such scam that led to the loss of over $700,000 in Flagler County school district money earmarked for the expansion of Matanzas High School. 

Urban and his group would use the information to log in and steal non-public company data and information. The group also used stolen information obtained from victim company intrusions, leaked data sets, and other sources to gain unauthorized access to numerous individuals’ cryptocurrency accounts and wallets and steal millions of dollars of virtual currency.

Cryptocurrency totaling $4.8 million from the victims’ stolen accounts was found on Urban’s devices. The total loss to the victims, when including Urban’s role with the group, was over $13 million.

All the victims were contacted. They had no idea the transfers were taking place. 

Federal authorities located Urban at a $300-a-night beachhouse Airbnb in Volusia County on Jan. 10, 2024, and was ordered detained without bond. He had made a motion to be released to his parents, which the U.S. attorney opposed, revealing much about Urban and his relationship with his parents. 

“Even his own parents presented obstacles in their ability to serve” as his custodians, the government’s response stated. Urban’s father, who lives in DeLand, told authorities that Urban “was living in various Airbnb’s, did not have any employment whatsoever but was paying his father rent to live in a previous house, and was so intelligent that he could possibly use his father’s Wi-Fi even if not being told the password.” 

Urban’s mother said that her son would not follow her rules and was kicked out of her home. “He would not agree to follow my rules and he ended up going to stay with Dad,” she testified in court. (The parents are divorced.) “I did not trust him on computers. I did not trust him with regard to school.” She added: “We had been having a hard time most of his childhood with — he has multiple diagnoses, one of which is, like, oppositional defiant disorder. So behavior has been challenging.” He would be “secretive, playing games, being up at night, not wanting me to check in on him.”

Urban was sentenced by Senior Federal District Judge Harvey Schlesinger on Aug. 22. He was prosecuted by Assistant U.S. Attorney Lauren Restrepo of the Central District of California and Assistant U.S. Attorney John Cannizaro of the Middle District of Florida, the latter under the direction of then-U.S. Attorney for the Middle District Roger Handberg. (Handberg, who has since joined the GrayRobinson law firm in Orlando, is the featured speaker at Flagler Tiger Bay on Sept. 17.) 

Count one was for conspiracy to commit wire fraud, counts two through nine were for wire fraud, and counts 10 through 14 for aggravated identity theft. The first nine counts carried a maximum of 20 years. He was sentenced to eight years on those. There’s a minimum mandatory of two years of imprisonment on the aggravated identity theft counts, which by law have to be served consecutively to any other term of imprisonment. That added the two years for a total of 10. 

The court recommended that he be imprisoned at the Coleman federal prison in Central Florida, and that he participate in mental health treatment, “specifically gambling therapy,” according to the sentencing document.