How a Florida man, 21, went from ‘citizen hero’ to ‘hacker’ who stole $13M in cryptocurrency

JACKSONVILLE, Fla. – As a child, Noah Urban often wrote of a career in law enforcement or criminal justice, inspired by the TV show “Psych,” with dreams of becoming a lawyer, to “make life a lot more fair.”

At 10, the Longwood Police Department, outside of Orlando, named him a “Citizen Hero” for taking swift action to prevent a traffic crash when his father had a medical episode and lost consciousness behind the wheel.

Within a matter of years, the boy who family members said loved participating in community service projects and helping at church, the boy who convinced his mother to go through a fast-food drive-thru to get a meal for a homeless man he saw while riding in the car, became immersed in a world of online gaming, spending eight hours or more each day, playing and chatting with others.

That gaming led to other online activities that had real-world implications: targeting companies, getting access to data, and using that data to steal cryptocurrency.

Now, at the age of 21, the boy who dreamed of working in law enforcement’s involvement with the criminal justice system comes in a much different way – he was sentenced to spend the next decade of his life in federal prison for cybercrimes and described as a “hacker.”

MORE | Palm Coast man linked to ‘Scattered Spider’ cybercrime gang sentenced to 10 years for cryptocurrency theft | Florida teen ‘King Bob,’ federally indicted in crypto scam, behind leaked Playboi Carti, Ariana Grande songs: reports

Federal prosecutors said he and others stole victims’ personal information, then used that information to steal their cryptocurrency. Urban now owes $13 million in restitution to victims from coast to coast.

Noah Urban’s early years

A court document filed by Urban’s federal public defender in August, prior to his sentencing, gives a picture of the young man’s childhood. He was born in South Carolina, but grew up in central Florida. When he was 2, his parents divorced, and he spent most of his childhood going back and forth between their homes, in different cities, amidst a divorce that was described as “contentious and adversarial, and that adversarial relationship persists today.”

Letters from Urban’s family members paint a picture of what he was like as a child: a boy who loved the outdoors – hiking, kayaking, and whitewater rafting. He loved the library, enjoyed reading, and was described as tender-hearted and generous – participating in community service projects, helping at church, and leading bingo for seniors at a retirement community.

Urban’s father describes a memory from when the teen was 13, in his letter to the federal judge. He recounts how his son learned that a local family was struggling around the holidays, then gathered groceries, picked out Christmas items, and did extra chores in order to buy new gifts. Urban’s father explains how the boy didn’t want recognition, rather, he just “wanted to make sure that family felt seen and cared for.”

A hero’s honor

As a child, Urban had dreams of becoming a lawyer, as told in the sentencing memorandum written by his defense attorney. But that shifted to a dream of becoming a police officer, after an incident when he was 10 years old.

In November 2014, Urban was riding in his father’s car, when the elder Urban had a medical episode and began coughing to the point where he lost consciousness. The car, which had been driving through a parking lot, started accelerating, hitting a truck from behind and pushing it toward a busy road. From the passenger seat, Urban applied the car’s parking brake, slowing it down and preventing the truck from being pushed further into the roadway.

For that act, the Longwood Police Department honored him with a “Citizen Hero Award,” a recognition that carried with it a mayoral proclamation and a ceremonial presentation.

In a letter recommending Urban for the honor, a police sergeant wrote, “Having been a police officer for 27 years and a trainer for the majority of those years I know it takes discipline and training to get to the level at which Noah performed. Not only is his ability already at this level. He has already proven his ability during the crash. Outstanding!”

‘This was kind of like a game to them’

In 2020, as the COVID-19 pandemic changed the world, Urban was 15 years old. Court documents explain that he withdrew from a central Florida high school and was home-schooled, eventually receiving his diploma from Florida Virtual School in 2022.

Around that time, Urban met a group of other teenage boys, playing popular online games like Minecraft and Call of Duty, and talking with these same boys about the games and life in general through Discord. His sentencing memorandum explains he played “hours upon hours” of video games, eventually doing this every day, for several years. Once he began to primarily live with his father, he had “virtually unlimited” access to the internet and online gaming, playing video games for eight hours or more a day.

It was through these groups of online gamers, talking through Discord, that Urban was introduced to “SIM swapping,” according to his attorneys. That’s a tactic that involves stealing a victim’s personal information and arranging for their cell phone number to be swapped to phones in one’s control. Prosecutors said Urban and his co-conspirators would then use those swapped phones to get control of a victim’s cryptocurrency account by resetting passwords and confirming via text message passwords.

Urban’s defense attorneys write that the group would target companies by pretending to be their employees, and calling into their customer service or IT departments. They would pretend to need assistance, and unsuspecting workers gave them full access to company data, which the boys used to develop lists of people to target, thinking they had extensive crypto holdings.

“This was kind of like a game to them,” is how Urban’s attorney described the actions of Urban and his online associates, during Urban’s teenage years. When the FBI began issuing subpoenas to investigate him, he was still 17 years old, according to the sentencing memo.

Was it ‘real money’?

According to Urban’s sentencing memo, he and his co-conspirators, all teenage boys at the time, targeted people who had “significant” cryptocurrency holdings, assuming they were not stealing “real money” that people were using for food and shelter.

Cryptocurrency, a digital currency stored in a digital wallet, can sometimes be used for payments or it can be held as an investment. But, crypto accounts are not backed by a government, meaning if something happens to the account or funds, the government has no obligation to get your money back.

Urban used almost all the cryptocurrency he acquired to play online gambling games on a site based overseas. His attorneys write that although he wasn’t even old enough to gamble legally, he was easily able to play through the use of a VPN, as there was no age verification on the site.

At the sentencing hearing, Urban’s attorney argued that video game culture, and online video game currency, which plays a role in some of the games Urban and his friends were playing, reinforce the idea that online money is not “real money.”

But, the cryptocurrency at the heart of the scam did have real-world uses. Urban would exchange some of his crypto for cash, using peer-to-peer services, and crypto ATMs, which exchange crypto for cash through third-party providers. Urban used the cash to pay rent and utilities, as he moved out on his own at the age of 18.

The impact on victims

During Urban’s sentencing hearing in August, the judge read from victim impact statements submitted by some of the 60 identified victims of the scheme. Their stories told of hardships, both financial and emotional.

One victim wrote, “For weeks I woke up every night in cold sweats. I can’t overstate the emotional impact that this intrusion into my personal life has had on my peace of mind.”

Another victim, who was 72 at the time of the theft, explained that he lost a major portion of his retirement account. He wound up taking a job as a courier, which he did for two years, until he was physically unable to continue due to his injuries. That victim is now owed restitution of nearly $58,000.

A 68-year-old retired firefighter wrote of trying to do whatever he could to prevent further intrusions into his life.

“I became very paranoid, and still am to some extent,” he wrote. “I even questioned my next-door neighbor’s teenage son to see if he might have been the one involved. His parents took it very personally.” The retired firefighter wrote that questioning his neighbors led to the loss of their longtime friendship.

A Massachusetts man owed more than $10,000 in restitution wrote that he had wanted to set aside money for his kids’ college education.

“The financial harm is real,” he wrote in his victim impact statement. “It eroded my sense of security, not just in digital systems but in my daily life.”

Another victim told the judge how losing the cryptocurrency was affecting their dreams of a family. They had set aside money for in vitro fertilization, but the loss dealt a blow to that fund, leaving questions about how to pay the costs not covered by insurance, which they wrote can reach into the six figures.

One Minnesota man had flown to Jacksonville with the intent of addressing the court at Urban’s sentencing. After speaking with the prosecutor prior to the hearing, he opted not to testify in person, letting his written statements stand. He had lost more than $400,000, at a time when his children were starting high school.

A young man’s future

The boy who once dreamed of a career in law enforcement, who family members described as tender-hearted and generous, is now an inmate at FCI Tallahassee, a low-security federal prison in Florida’s capital city.

At his sentencing, Noah Urban addressed the court, before his punishment was handed down.

“I’d like to apologize to the victims of my crime, to the court, and to my family. I know what I did was wrong. I stole from people, and there’s no excuse. There’s nothing I can say. There’s no justification that will make it right,” Urban told the judge. He went on to explain he was focused and committed to bettering himself.

Following that, the federal prosecutor made his final remarks, saying he believed Urban when he said he wanted to make things right. He also pointed out that in the course of the crypto thefts, Urban and his co-conspirators beat the two-factor authentication – a security safeguard that has become commonplace for everything from financial accounts to social media. Typically, it involves sending a text message, push alert, or email to another device, to verify one’s identity.

“I don’t think Mr. Urban is an evil person. He’s a – I think he has the potential,” the prosecutor said. “But this was greed and this online culture, whatever you want to call it, and this desire to – to hack and steal.”