SIM-Swap Attacks on Crypto Accounts: How They Work and How to Stop Them

A SIM swap is when an attacker convinces your mobile carrier to move your phone number onto a SIM they control. Once the number is theirs, they receive your SMS codes and password-reset messages, take over your email and exchange accounts, and drain any custodial balances. It targets accounts protected by SMS 2FA. A self-custodied wallet with a seed phrase is not directly affected unless the seed was stored inside one of the accounts that got compromised.

That is the short answer. The rest of this page is the attack chain step by step, which accounts are exposed, and the defenses that hold up.

---

How a SIM swap actually works

The attack does not touch your phone. It touches your carrier. The chain looks like this:

1. Gather personal info. The attacker collects your name, phone number, date of birth, address, and often a partial answer to a security question. Data breaches, social media, and phishing supply most of this.
2. Social-engineer or bribe the carrier. They call support posing as you ("I lost my phone"), or they pay an insider at a store. Enough leaked detail passes the identity check.
3. Port the number. The carrier moves your number to the attacker's SIM. Your phone silently loses signal — that is often the first sign, and by then it is late.
4. Intercept the SMS OTP. Every SMS one-time code and reset link now arrives on their device.
5. Reset passwords and drain accounts. They reset your email, then use email plus SMS codes to break into exchanges and move funds out.

The whole sequence can run in under an hour. The weak point is not your password — it is the phone number acting as a recovery channel.

---

What is exposed and what is not

Exposure depends entirely on whether an account trusts your phone number.

The pattern: anything that relies on your phone number as proof of identity is exposed. Anything protected by a secret that never travels over SMS is not.

---

Defenses that actually hold

• Remove SMS 2FA. Replace it with an authenticator app (TOTP) or, better, a hardware security key using FIDO2/WebAuthn. Do this on every exchange and on your email first, because email is the pivot point.
• Set a carrier port-out PIN or SIM lock. Most carriers offer a "number lock" or "port freeze" that blocks transfers until you disable it in person or with a separate PIN. This closes the door the attacker walks through.
• Do not store seed phrases in email or cloud. A photo of your recovery words in cloud backup turns an email takeover into a wallet drain. Keep the seed offline. See self-custody basics.
• Use unique emails for exchanges. A dedicated address that is not tied to your public identity or your phone number gives attackers nothing to target. Combine it with an app or key for 2FA.
• Reduce your public footprint. The less of your birth date, address, and phone number is exposed, the harder the identity check is to fake.

---

Honest limits

No single control is a silver bullet, so it helps to know where each one stops.

Hardware security keys (FIDO2) are the strongest option because the login requires a physical device that cannot be phished or copied over SMS. Authenticator apps are a large improvement over SMS — the code never leaves your device — but a convincing fake login page can still trick you into typing a live code, so app 2FA can be phished where a hardware key cannot.

Self-custody changes the shape of the problem entirely. If your funds live in a wallet you control and the seed was never stored in a compromised account, a SIM swap has no exchange to break into and no balance to move. It sidesteps the account-takeover path completely. The trade-off is that you carry the full weight of key management yourself. If you hold on exchanges, see how identity checks tie your accounts together in crypto KYC explained, and review wallet options in the crypto wallets guide.

---

FAQ

What is a SIM-swap attack? It is when an attacker persuades your mobile carrier — through social engineering or a bribed insider — to move your phone number to a SIM they hold. They then receive your calls and texts, including any SMS 2FA codes and password-reset links, and use them to take over your accounts.

Is SMS 2FA safe for crypto? No, not for anything holding value. SMS 2FA is better than no second factor, but the phone number is a recovery channel an attacker can hijack without ever touching your device. Use an authenticator app at minimum and a hardware security key where possible.

Can a SIM swap steal my hardware-wallet funds? Not directly. A hardware wallet signs transactions with a key that never leaves the device, and there is no account to reset. The only way a SIM swap reaches those funds is if you stored the seed phrase in an email or cloud account the attacker took over. Keep the seed offline and it stays out of reach.

How do I protect against SIM swaps? Remove SMS 2FA in favor of an authenticator app or FIDO2 hardware key, set a port-out PIN or SIM lock with your carrier, keep seed phrases offline, and use a unique email for exchange accounts. Securing your email first matters most, because it is the key that unlocks everything else.

---

Once your accounts no longer depend on your phone number, the next weak link is how you approve transactions and where your keys live. Start with the crypto wallets guide and self-custody basics.