The Rise and Fall of “King Bob”: The Scattered Spider Hacker Who Stole in Crypto

A notorious figure in the world of cybercrime has come into the spotlight. Noah Michael Urban, a 20-year-old from Palm Coast, Florida, has pleaded guilty to wire fraud, identity theft, and conspiracy charges in two separate federal cases—one in Florida and another in California. His case sheds light on one of the most aggressive and high-profile cybercrime groups operating today: Scattered Spider, also known as UNC3944 or 0ktapus.

The Case in Brief

Noah Urban—better known in the hacking underworld as “King Bob” or “Sosa”—has admitted his role in orchestrating a wide-reaching online fraud operation that netted at least $800,000 in stolen cryptocurrency. His plea agreement reveals a deeper entanglement with Scattered Spider, a group linked to cyberattacks on major companies like Twilio, Mailchimp, DoorDash, and LastPass.

Urban’s methods included SIM swapping, phishing, and social engineering scams, which allowed him and his accomplices to steal personal data and hijack online accounts, primarily targeting cryptocurrency wallets.

What Happened: A 30-Line Breakdown

Who: Noah Michael Urban, age 20, a resident of Palm Coast, Florida.
Aliases: Online identities included “King Bob,” “Sosa,” “Gustavo Fring,” and “Elijah.”
Charges: Conspiracy to commit wire fraud, identity theft, and wire fraud.
Federal Cases: One in Florida, one in California.
Affiliation: Member of the Scattered Spider hacking group.
Group’s Modus Operandi: Social engineering, phishing, SIM swapping.
Targeted Victims: At least five individuals, primarily crypto holders.
Total Estimated Theft: Over $800,000 in crypto between August 2022 and March 2023.
Restitution Ordered: Urban agreed to pay $13 million in total restitution.
Organizations Attacked by Group: Twilio, Mailchimp, DoorDash, LastPass, and more.
Online Community: Group active on “The Com,” a cybercriminal underground forum.
Social Engineering: Used fake emails, calls, and SMS to breach corporate systems.

– Arrest Date: January 2024.

Court Plea: Initially pleaded not guilty; later accepted a plea deal.

– Criminal Activity Spread Across: Multiple U.S. states.

Music Industry Impact: Leaked unreleased songs from Ariana Grande, Playboi Carti, Lil Uzi Vert.
Emotional Fallout: Artists expressed emotional and financial distress over leaks.
SIM Swapping Details: Hijacked phone numbers to reset crypto wallet passwords.
Aggravated Identity Theft: Will be sentenced separately with at least two additional years.
Co-Conspirators: Not yet fully identified in court filings.
Toolkits Used: Sophisticated phishing kits and spoofed domains.
Data Handling: Helped export and monetize stolen data.
Prosecutors’ Narrative: Urban was a central figure in the group’s phishing operations.
News Source: Covered by News4Jax and Security Affairs.
Impact on Victims: Immediate financial loss and ongoing legal battles.
Urban’s Hacker Persona: Known to flaunt attacks on underground forums.
Legal Outcome: Faces a long prison term, with added years for identity theft.
Symbolic Case: Demonstrates real-world consequences of digital crimes.
Cross-State Prosecution: Indicates increasing coordination among U.S. cybercrime units.
Urban’s Online Trail: Left a significant digital footprint under multiple pseudonyms.
Cultural Impact: Cybercrime intersects with pop culture, influencing the music industry.
Cryptocurrency as a Target: Once again shown to be vulnerable to social engineering.
Sentencing Yet to Come: Exact prison term to be announced, but restitution is confirmed.

What Undercode Say:

Urban’s story isn’t just about a rogue teenager—it’s a deeper glimpse into the ecosystem of next-generation cybercrime. The Scattered Spider group exemplifies how modern hacking groups blur the lines between social engineering and technical intrusion. Their attacks are low-tech but high-impact, often bypassing even enterprise-level security by targeting human error.

SIM swapping, one of the group’s preferred methods, highlights the vulnerabilities in mobile carriers’ verification systems. By impersonating a victim and convincing a phone company to transfer service to a new SIM card, attackers gain instant access to authentication tokens, passwords, and accounts. It’s shockingly simple, yet devastatingly effective.

What’s especially disturbing is

His association with The Com, a forum where hackers flex their exploits, tells us how gamified and competitive cybercrime has become. This isn’t just theft—it’s performance art in the black hat world.

And the $13 million restitution? It’s unlikely Urban will ever pay it in full, but the symbolic figure is meant to drive home the true cost of cybercrime—not just financial, but emotional and cultural. Ariana Grande’s public statement on the leaks makes this crystal clear: digital crimes have personal consequences.

From a security standpoint, this case is a call to action. Enterprises, artists, and everyday users need stronger controls over identity verification, SIM security, and password recovery workflows. Social engineering is thriving because we continue to rely on outdated models of trust.

For cybersecurity researchers and ethical hackers, this case reinforces the need to study the psychology and social behavior of attackers, not just their tools. Urban’s downfall wasn’t the result of a technical slip—it was a breakdown in operational security and overconfidence in digital anonymity.

Fact Checker Results:

Confirmed Identity: Noah Urban, aka “King Bob,” is a verified member of Scattered Spider per court documents.
Financial Impact: The $800,000 crypto theft and $13M restitution figure were confirmed in official plea filings.
Music Leaks: Multiple sources corroborate Urban’s link to the leaks involving Ariana Grande and others.

you’d like a visual timeline or infographic version of the events.