Fantasy Sports Hack: Stokes Stole Tens of Thousands in Brazen Credential Stuffing Attack

Kamerin Stokes, a 21-year-old from Memphis, Tennessee, has pleaded guilty to hacking a fantasy sports and betting website, stealing hundreds of thousands of dollars from victims in a brazen credential stuffing attack.

According to the charging documents, Stokes, also known as “TheMFNPlug,” was part of a scheme to hack user accounts at the fantasy sports and betting website, and sell access to those accounts online. Stokes’s co-conspirators successfully accessed approximately 60,000 accounts through the credential stuffing attack, and in some instances, were able to add a new payment method, deposit $5 into the account, and then withdraw all the existing funds.

The stolen funds were sold on various websites that traffic in stolen accounts, which are frequently referred to as “Shops.” Stokes controlled his own Shop and purchased the stolen accounts in bulk, obtaining accounts with a total listed value of over $125,000.

“With today’s guilty plea, this Office has successfully prosecuted a second member of a scheme to hack fantasy sports and betting accounts and sell access to them online,” said U.S. Attorney Damian Williams. “Kamerin Stokes and his co-defendants greedily lined their own pockets by profiting off of harmful hacks that drained victims of hundreds of thousands of dollars and erode the public’s trust in online platforms.”

STOKES is scheduled to be sentenced by Judge Naomi Reice Buchwald on August 15, 2024, at 11:00 a.m. and faces a maximum sentence of five years in prison for one count of conspiracy to commit computer intrusion.

The case is being prosecuted by the Office’s Complex Frauds and Cybercrime Unit, with Assistant U.S. Attorneys Kevin Mead and Micah Fergenson in charge of the prosecution. Mr. Williams praised the outstanding work of the Federal Bureau of Investigation in bringing the case to light.

The brazen credential stuffing attack has raised concerns about the security of online platforms and the ease with which hackers can profit from stolen information. The case serves as a reminder that hackers and cybercriminals who sell stolen information online should be warned that this Office is watching and will continue to protect internet-users from malicious actors.

The guilty plea is a significant development in the ongoing efforts to combat cybercrime and protect the public from online threats. As the investigation continues, it is clear that Stokes’s actions had far-reaching consequences for the victims of the fantasy sports and betting website.

The Federal Bureau of Investigation has commendably brought this case to light, and we look forward to seeing the outcome of the sentencing and the continued efforts to combat cybercrime in the Southern District of New York.”