Law enforcement officials in California have arrested another hacker accused of stealing cryptocurrency by hijacking phone numbers.

19-year old Xzavyer Narvaez has been charged with seven counts of computer crimes, identity fraud, and grand theft, according to a report on Motherboard.

According to the report, Narvaez had spent some of the Bitcoin made on luxury cards. The police found a 2018 McLaren purchased by Narvaez in part with Bitcoin and partly by trading-in a 2012 Audi R8 through his DMV records. Investigators also obtained his records from Bitcoin payment provider BitPay and cryptocurrency exchange Bittrex, where they discovered a flow of 156 Bitcoin (worth $1 million), according to a court document. This new arrest comes on the heels of that of Joel Ortiz who is accused of hijacking phone numbers to steal Bitcoin from victims in a first-of-its-kind crime earlier this year.

Investigators got on Narvaez’s trail when they found a cellphone used by Ortiz had, at some point, logged into Narvaez’s Gmail account. AT&T also provided the authorities with the unique identifying numbers of the cell phones used to take down the victim’s phone numbers, the coordinates of the phone towers they connected to and Narvaez’s call records. The information revealed Narvaez’s phone was connected to the same cell tower at the same time, as one of the phones used to SIM swap victims.

Hijacking phones, also known as SIM swapping or “port out scam” is a process of leading a telecoms provider into transferring a target’s phone number to a SIM card held by the hacker. Once they receive the new phone number, an attacker can use it to reset the victim’s passwords and break into their accounts, including e-mails and accounts on cryptocurrency exchanges.

The tactics employed by criminals perpetrating this fraud varies. Some attackers social engineer customer service agents of telecoms providers into believing they are the target. Others use, “plugs,” insiders within the telecom company who get paid for carrying out the illegal swap.

Last week, American investor Michael Terpin filed a $224 million lawsuit against AT&T claiming that he had lost $24 million worth of cryptocurrencies as a result of two separate hacks that occurred over a period of seven months. Terpin is currently seeking a $200 million punitive damages and $24 million in compensation from AT&T.