SIM Swap: How a Phone Number Becomes a Wallet Breach

A SIM swap is an attack on your phone number, not on your phone. In crypto, a sim swap crypto incident rarely stays a nuisance: someone persuades the carrier to port the number onto a SIM card they control, and from that moment your calls and texts arrive on their device instead of yours.

A sim swap crypto loss is therefore a design failure in the account, not a break in the encryption. What makes the attack effective is that the attacker never touches your wallet software: they attack the recovery channel instead, with a support agent, identity details stolen elsewhere, and an account whose only second factor was a six-digit code.

• SMS two-factor authentication is defeated by porting the number, because the code follows the number rather than the device.
• Attackers reach the carrier through stolen identity data or an insider, not through technical exploits.
• App-based or hardware second factors, a carrier PIN or port freeze, and a dedicated email address are the defences that hold.
• Removing SMS as a recovery route matters more than adding another factor on top of it.

How the porting actually happens

Porting is a routine customer service operation, and that is exactly why it is abusable. A number can be moved to a new SIM when the account holder asks, and the request is validated with information rather than with presence: name, address, date of birth, account number, sometimes the last few digits of a payment card.

Most of that information is not secret in any meaningful sense. It sits in breached databases, in old statements, in delivery records and on social profiles. An attacker who can assemble enough of it can sound exactly like you to a support agent working through a script with a queue in front of them.

The insider version

Sometimes no identity theft is needed. A carrier employee with access to the porting system can move a number directly, and that is why carrier-side controls such as a port freeze or an account PIN exist. They raise the cost of the attack; they do not make it impossible, because the control is administered by the same organisation being asked to move the number.

What you notice, and when

Usually the first sign is that your phone loses service for no reason, or shows an emergency-calls-only state. By the time you notice, the messages are already going elsewhere, and any password reset that depends on them is already available to someone else.

Why SMS codes fail against a sim swap crypto attack

SMS codes fail because they are delivered to a number, and the number is the thing being taken. The factor was never really “something you have” in the cryptographic sense; it was “something the carrier routes to whoever currently holds the SIM”.

This is not a flaw in the code itself. A one-time code is fine as a concept. The problem is the delivery channel has a human customer service desk in the middle of it, and that desk can be persuaded.

What the attacker gains

Password resets for email, for exchanges, for social accounts, and for anything else that treats a text message as proof of identity. Email is usually the first target, because email is the recovery route for everything else. Once email falls, the rest tends to follow without any further technical work.

What the attacker does not gain

They do not gain your seed phrase, your hardware wallet PIN, or your device passcode. Self-custody with a properly backed-up hardware wallet is not reachable through a phone number, which is one of the few genuine advantages of holding keys yourself.

The number is not a secret. It is a routing instruction, and routing instructions can be changed by anyone who can convince the router.

Defences that actually work against a sim swap crypto theft

The defence is to stop treating the phone number as a credential. Every serious sim swap crypto control does the same thing: it moves the decision away from the number. Replace SMS wherever it is offered, then reduce the places where the number can recover anything at all.

An authenticator app is the first step and the easiest: it generates codes locally, so the code cannot be intercepted by porting. A hardware security key is stronger still, because it is bound to the site’s real address and resists phishing, but it only helps where the service supports it.

Carrier-side controls

Ask your carrier for a port freeze, an account PIN, or a transfer lock, where those exist. They are not guarantees, and they can complicate a legitimate move, but they convert a fifteen-minute phone call into something that requires more knowledge than a breached database usually provides. Write the PIN down somewhere that is not your phone.

The email address nobody knows

Use an email address for financial accounts that you never post publicly, never use to sign up for newsletters, and never give to a shop. If the attacker cannot name the address, the password reset form is a dead end even after the phone is ported.

1. Log in to every account that holds value and switch the second factor from SMS to an authenticator app.
2. Where hardware keys are supported, register two: one to carry and one stored separately.
3. Ask your carrier to enable a port freeze or account PIN, and record the PIN offline.
4. Create a dedicated email address for financial accounts and never reuse it for anything public.
5. Remove your phone number as a recovery option on that email, replacing it with a code or a key.
6. Check that password resets for your email do not fall back to SMS when the primary factor is unavailable.
7. Write down the backup codes for each account and store them away from the phone they protect.
8. Repeat the review once a year and after any change of carrier or number.

If your number is ported: the first hour

Act on the assumption that messages are being read by someone else from the moment service drops. The order matters more than the speed: email first, then financial accounts, then the carrier.

From a different device and a different network, change the password on your primary email and revoke active sessions. Then work through exchange and wallet-service accounts, revoking sessions and removing the phone number as a factor. Call the carrier from another line and ask them to freeze the number and reverse the port; expect to be asked for identity documents.

Do not wait for the carrier to resolve the port before changing passwords, because the port may be reversed hours later while the account resets happen in minutes. And do not reuse the same password anywhere during the panic, since the attacker now has a good idea of which addresses are worth attacking.