Three foreign nationals have been charged with using artificial intelligence to impersonate corporate executives and attorneys at major law firms in a scheme that allegedly stole at least $129 million from hospitals, banks, and other businesses. According to an indictment unsealed Thursday in the Southern District of New York, employees were tricked into wiring money for confidential deals that did not exist.
Prosecutors say the operation targeted thousands of companies worldwide. After the money associated with the fake deals reached bank accounts controlled by conspirators, they say, it was converted into crypto before being divided among the participants.
“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities,” Federal Bureau of Investigation (FBI) Assistant Director in Charge James C. Barnacle, Jr., said in a statement.
The defendants are Jacob Soall, 41, of Marbella, Spain, and the United Kingdom; Sharon Hazan, 54, of Israel; and Guy Sheetrit, 42, of Israel and the United Arab Emirates. Each faces seven counts: conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy, and two counts of money laundering. The wire fraud and money laundering offenses each carry maximum sentences of 20 years, while each aggravated identity theft count carries two years. Any potential sentence would be determined by a judge if the defendants are convicted.
Notably, Hazan was previously convicted of conspiracy to commit bank fraud in the same Southern District of New York in 2008, according to prosecutors. Soall and Hazan were arrested in Spain on June 17th and August 5th, respectively, while Sheetrit was arrested in the United Kingdom on September 7th. Extradition requests are pending, and three men are presumed innocent unless and until proven guilty.
How the Alleged Scam Worked
The indictment describes a conspiracy running from at least about July 2024 through at least about February of this year. Targets typically worked in accounting, and had enough authority to approve a large wire transfer. The approach often began with an email sent through an electronic signature service such as DocuSign, supposedly from the employee’s chief executive, asking for help with a secret financial transaction.
One example, sent to an employee of an unnamed major New York investment bank, read, “We need to loop you into a deal we’ve been working on. The companies involved require you to sign an NDA – see attached.” The nondisclosure agreement (NDA) was followed by instructions to contact a lawyer to arrange a compliance call.
On subsequent phone or video calls, conspirators allegedly used AI to mimic the executive’s voice and sometimes even their appearance. The fake executive would direct the employee to a fake attorney, often borrowing the identity of a real lawyer in the European office of one of the world’s 50 largest law firms. That attorney would describe a confidential transaction, often an acquisition, and tell the employee where to send the money.
According to the indictment, Soall primarily impersonated attorneys from the United Kingdom and kept a handwritten “Lawyer Call” script. It invoked confidentiality and insider-trading concerns to discourage employees from discussing the supposed deal with colleagues. Of course, the person issuing the instructions was not the actual lawyer, and the destination account belonged to conspirators, prosecutors allege.
Hazan and Sheetrit allegedly handled the money laundering associated with the fraudulent transactions, and prosecutors say Hazan boasted that he had been laundering money since 1994, had laundered more than $400 million in just the previous three years, and was “number one all over the world” among professional money launderers.
The alleged boasting echoes the case of John Daghita, the son of an executive at a contractor entrusted with storing seized crypto for the U.S. Marshals Service, who was arrested in March for allegedly stealing more than $46 million from those holdings. Blockchain investigator ZachXBT connected Daghita to the theft after a Telegram account linked to him showed control of a wallet tied to the stolen funds while arguing with another user over who had more crypto.
Hospitals, Banks, and a Pet Food Company
The charging documents do not identify the victim companies by name, but the alleged losses span several industries. Prosecutors say a Missouri hospital system lost about $4.83 million in November 2024, while a Rhode Island bank lost about $2.68 million that same month. A California hospital system allegedly lost roughly $2.97 million in December 2024.
The indictment also describes about $11.58 million taken from a United Kingdom financial technology company in March 2025, approximately $4.64 million from a Massachusetts mutual fund company in April 2025, and about $5.24 million from a Florida pet food company in June 2025.
The aforementioned major New York investment bank did not lose the roughly $2.85 million sought in the October 2024 attempt described in the indictment. Although an employee authorized the payment, the bank’s back office stopped the wire before it was sent, prosecutors say.
U.S. Attorney Jamie McDonald used President Trump’s preferred term “super intelligence” (SI) in the announcement, although the underlying indictment describes the use of “artificial intelligence.”
“SI technology offers tremendous potential. But the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” McDonald said.
Deepfakes and Impersonation Commonly Used in Crypto Hacks
Deepfake and impersonation tactics are familiar in the crypto industry, where fake recruiters and job interviews can be used to infect computers and steal crypto or gain access to company systems. In 2022, the Ronin network suffered a roughly $625 million hack that the FBI attributed to North Korea. A developer was reportedly targeted through LinkedIn and sent a malware-laced job offer after several interview rounds. I’ve received these sorts of fake job offers on many occasions myself.
Google-owned cybersecurity firm Mandiant has also documented a scam in which attackers used a compromised crypto executive’s Telegram account to arrange a meeting on a counterfeit Zoom interface. Supposed audio problems then became a pretext for getting the target to run troubleshooting commands that installed malware. The Security Alliance, a crypto security organization, has described similar campaigns using hijacked accounts to target their owners’ contacts through fake Zoom or Microsoft Teams interfaces. Braiins Chief Marketing Officer Kristian Csepcsar also described how this sort of approach was used to hack more than ten of his bitcoin friends (and almost him) in a January X post.
More than 10 of my bitcoin friends got hacked in the past month. All had 2FA enabled. It didn’t help. Here’s how they almost got me too 👇
HOW THEY FOOL YOU
1️⃣ Someone from your contacts messages you to schedule a call. This is already a stolen account. A friend who got scammed… pic.twitter.com/UmFi06Hi5p
— Kristian Csepcsar (@KristianCsep) January 27, 2026
In 2022, then-Binance Chief Communications Officer Patrick Hillmann also said scammers used a deepfake of him in video meetings with crypto project teams about potential token listings.
More recently, Binance said a bogus recruitment process was a key component of the attack that drained approximately $6.3 billion from the exchange last week. In its initial incident report published Tuesday, Binance described an engineer contacted in September through a legitimate job-hunting platform by someone posing as a project director. A fake human resources representative conducted a video interview and shared social media photos and videos to build trust. A second interviewer, claiming to be the chief executive of a fictitious company, then told the engineer to download an assignment containing malicious code onto his work computer.
According to Binance, the attackers subsequently used that compromised computer and an internal AI tool to reach other engineers’ systems before accessing wallet-signing operations. However, to be clear, the exchange described the attack as a multistage campaign, not a single phishing incident.
