A SIM swap attack (also called SIM hijacking or SIM splitting) is when an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can reset passwords and drain crypto accounts.
How SIM Swapping Works
- Research — Attacker gathers personal info (email, DOB, address) from data breaches or social media
- Social engineering — Attacker calls your mobile carrier, pretends to be you, claims they lost their SIM
- Transfer — Carrier activates a new SIM with your number
- Access — Attacker uses SMS-based 2FA to reset your exchange, email, and social media passwords
- Drain — Attacker transfers crypto to their own wallets
Why It’s Dangerous
| Factor | Why It Works |
|---|---|
| Carrier support is your weakest link | Customer service reps are trained to help — not to suspect fraud |
| SMS is insecure | SMS text messages can be intercepted or redirected |
| Personal data is abundant | Your DOB and address are likely in a data breach already |
| Recovery is difficult | Once the attacker changes your passwords, recovering accounts is complex |
High-Profile SIM Swap Attacks
- Michael Terpin — Lost $24M in crypto (won $75M lawsuit against AT&T)
- Various Twitter accounts — High-profile Twitter accounts taken over via SIM swaps
- Crypto influencers — Dozens of crypto Twitter personalities have been SIM swapped
How to Protect Yourself
1. Remove SMS 2FA
The single most important step. Stop using SMS for two-factor authentication.
| 2FA Method | Security Level |
|---|---|
| SMS | ❌ Not secure |
| Authenticator app (Google Authenticator, Authy) | ✅ Secure |
| Hardware key (YubiKey, Trezor) | ✅ Most secure |
| Email-based 2FA | ⚠️ Somewhat secure (if email is protected) |
Swap every account from SMS to authenticator app or hardware key.
2. Add a PIN or Password to Your Mobile Account
Most carriers allow you to add an account PIN or password. This creates an extra barrier for SIM swaps.
| Carrier | How to Add PIN |
|---|---|
| T-Mobile | Account takeover protection in settings |
| AT&T | Wireless passcode (4–8 digits) |
| Verizon | Account PIN in your profile |
| EE (UK) | Account password on your account |
| Vodafone (UK) | Security question or PIN |
3. Use a Google Voice Number (US)
If you must use SMS, get a Google Voice number and use that instead of your mobile number. Google Voice numbers are harder to SIM swap.
4. Monitor Your Mobile Signal
If you suddenly lose mobile service when you normally have coverage, your SIM may have been swapped. Act quickly:
- Call your carrier immediately
- Check your email for account change notifications
- Start recovery of crypto exchange accounts
5. Use a Hardware Wallet
Funds on a hardware wallet cannot be drained by a SIM swap. The attacker would still need physical access to your device and PIN.
What to Do If You’re SIM Swapped
| Step | Action |
|---|---|
| 1 | Call your carrier to regain your number |
| 2 | Change passwords for all linked accounts |
| 3 | Check exchange accounts for unauthorised activity |
| 4 | Contact exchanges to freeze withdrawals |
| 5 | File a police report |
| 6 | Report to your local cybercrime unit |
Bottom Line
SIM swapping is one of the most dangerous crypto threats because it targets a weak link — mobile carriers — not your crypto security directly. Remove SMS 2FA from every account today. Use authenticator apps or hardware keys. Add a carrier PIN. And never rely solely on your phone number for crypto account security.
Why SIM swaps succeed
SIM swapping does not break your crypto security head-on; it sidesteps it by attacking the weakest link — your mobile carrier. Customer service representatives are trained to help, not to suspect fraud, and with enough personal data from a data breach or your social media, an attacker can convincingly impersonate you in a phone call. Once the carrier transfers your number, the rest of the chain follows: SMS recovery codes for your email, exchange, and social media all arrive on a device the attacker controls, and from there every account that trusts those codes falls.
This is why the single most effective change is removing SMS from your 2FA everywhere, not just on exchanges. Swap every account that supports it — email first, because email is how most password resets work — to an authenticator app or a hardware security key. An authenticator code changes every thirty seconds and is tied to the app on your device, not your phone number. A hardware key such as a YubiKey is even stronger because the attacker would need the physical key in addition to your password. SMS should remain only as an absolute last resort for accounts that offer nothing better.
Building the habit of phone security
Protection also means reducing the number of times a phone number matters in the first place. Ask your carrier to add an account PIN or password that a thief cannot guess from public data, and treat any help-desk call as an opportunity to confirm those settings. Periodically check which of your accounts still rely on SMS as the only 2FA and upgrade them. Keep your most sensitive accounts — large balances, the email that controls everything else — on hardware keys rather than phone-based methods, so that even a successful SIM swap cannot unlock them.
Funds that never touch a phone-based account are the ultimate protection. Crypto held on a hardware wallet cannot be drained by a SIM swap, because the attacker would still need physical access to the device and your PIN. The phone number only matters for accounts that can be reset with an SMS code, and those are exactly the accounts you should move away from phone-based recovery. Combine that with monitoring: if your phone suddenly loses service when you normally have full coverage, treat it as a possible swap and act immediately rather than waiting.
When the number is gone
If you do discover a swap, speed decides how much you lose. Call your carrier to regain the number, change the passwords on every linked account, check your exchange balances for unauthorised activity, and ask exchanges to freeze withdrawals. Keep your recovery focused on the accounts you cannot afford to lose and move any remaining funds to a hardware wallet where your phone is not the key. A SIM swap is alarming, but it is survivable and entirely preventable — the routines that stop it are quick to set up and become permanent once your accounts no longer trust a phone number for their security.