Skip to main content
Category: Hacks → Account Takeover (CEX, Email, SIM Swap)HacksAccount TakeoverSIM SwapReading time: 12 minutes
Risk level: Critical
Target audience: Exchange users, mobile users

​
Meet Kunle

Kunle is a successful trader with ₦3.2 million on a major crypto exchange (Binance). He uses SMS-based 2FA to secure his account. One afternoon, his phone suddenly shows “No Service” and all calls/texts fail. He assumes it’s a temporary carrier issue and waits. Two hours later, he still has no signal. He calls his mobile provider from a friend’s phone to investigate.

​
What Happened

​
Step 1: The SIM Swap

What Kunle doesn’t know is that an attacker called his mobile carrier’s support line, claiming to be Kunle. The attacker provided:
  • Kunle’s phone number
  • His name
  • Some personal information (possibly from a data breach or social media)
  • A fabricated story (“I lost my SIM card,” “I’m switching to a new phone”)
Mobile carriers’ security procedures vary, but many rely on:
  • Verifying the phone number you’re calling from (the attacker called from a spoofed number)
  • Asking security questions (the attacker had answers from public information)
  • Asking for the last 4 digits of a credit card (possibly from a breach)
The carrier representative, under social pressure and with insufficient verification, authorized the SIM swap. The carrier moved Kunle’s phone number to a SIM card in the attacker’s possession.

​
Step 2: The Account Takeover

Now, the attacker controls Kunle’s phone number. All SMS messages intended for Kunle now go to the attacker. The attacker goes to Binance’s password reset page and enters Kunle’s email address. Binance sends a password reset SMS code to the phone number on file (which is now the attacker’s SIM). The attacker receives the code, resets the password, and logs into Kunle’s Binance account.

​
Step 3: The Withdrawal

With access to Kunle’s account, the attacker:
  1. Disables 2FA (the SMS codes are still going to the attacker’s SIM).
  2. Initiates a withdrawal of all holdings (₦3.2M in BTC, ETH, stablecoins).
  3. Moves the funds to another exchange to cash out.
By the time Kunle regains phone service (once the attacker finishes draining), the funds are gone.

​
Where the Scammer Won

  1. Mobile carrier social engineering: The attacker convinced the carrier to perform an unauthorized SIM swap.
  2. SMS 2FA vulnerability: SMS-based 2FA is vulnerable to SIM swaps. Binance’s reliance on SMS made the account easy to compromise once the phone number was hijacked.
  3. Poor carrier verification: Carriers don’t always verify identities rigorously.
  4. Information leakage: The attacker had enough personal information to pass verification (from public data or breaches).

​
What Kunle Could Have Done (Prevention)

​
Before a SIM Swap Happens

Use app-based 2FA (TOTP) instead of SMS. Authenticator apps (Google Authenticator, Authy) are not vulnerable to SIM swaps because they don’t rely on SMS. On Binance: Settings → Security → Two-Factor Authentication → switch from SMS to Google Authenticator.
Add a PIN or password to your mobile account. Call your carrier and ask to set a PIN for account changes. Any future changes to the account require the PIN.
Monitor your phone signal. If you suddenly lose service for no reason, assume a SIM swap and act immediately.
Use a hardware security key (optional but best). Some exchanges support hardware keys (U2F/FIDO2), which cannot be compromised via SIM swap.
Keep high-value funds off exchanges. Move the majority of holdings to a hardware wallet (Ledger, Trezor) that cannot be compromised via exchange account takeover.

​
If You Suspect a SIM Swap

Try calling your mobile provider immediately to ask what happened.
Change your email password from a different device (if you still have access to your email).
Disable recovery methods on critical accounts (email, exchange) to prevent further changes.
Enable additional security on your email (security keys, backup codes).

​
Red Flags (What Kunle Missed)

  • Sudden loss of phone service without explanation. If your phone suddenly goes out of service, assume a SIM swap until proven otherwise.
  • Security question verification for SIM swaps: Carriers shouldn’t rely solely on public information (full name, last 4 of SSN) to authorize a SIM swap.

​
How SIM Swaps Work

What happens: Attacker collects personal info (name, phone number, address) from social media, data breaches, or public records.
What happens: Attacker calls the carrier’s support line, claiming to be the victim.
What happens: Attacker convinces support to issue a new SIM card on the victim’s line.
What happens: Victim’s phone number is now on the attacker’s SIM. SMS 2FA codes go to the attacker.
What happens: Attacker resets passwords on email, exchange, and other accounts using the intercepted SMS codes.
What happens: Attacker transfers funds out of accounts.

​
Notable Incidents

SIM Swap Statistics

SIM swaps have been used in multiple high-profile cryptocurrency thefts. Average SIM swap attack results in $5,000–$100,000+ in losses for crypto victims. Estimates suggest $300M+ annually lost to SIM swaps globally.

​
Action Steps

​
Prevention (Before Attack)

Rule: Enable app-based 2FA (TOTP) on all critical accounts (email, exchange, wallet).
Rule: Add a PIN or password to your mobile carrier account. Call and ask for this service.
Rule: Use a hardware security key on critical accounts (if supported).
Rule: Keep bulk funds in cold storage (hardware wallet), not on exchanges.
Rule: Monitor your phone service. If it drops unexpectedly, investigate immediately.

​
If You Suspect a SIM Swap Is Happening

1

Call Mobile Carrier Immediately

Call your mobile carrier immediately from a different phone to report it.
2

Ask for Account Confirmation

Ask them to confirm your account hasn’t been modified.
3

Change All Critical Passwords

Change all critical passwords (email, exchange) from a different device.
4

Disable Withdrawals

Disable withdrawals on exchange and contact support.

​
If Funds Were Already Stolen

1

Report to Exchange

Report to your exchange and law enforcement.
2

Report to ChainAbuse

Report to ChainAbuse with wallet addresses of the thief.
3

Expect Difficult Recovery

Expect the case to be difficult; SIM swaps often involve stolen funds being moved through mixers.

Email Account Takeover

How email compromise leads to account takeover

Hacks Category

Explore all types of account takeover attacks

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. SIM swap overview and cryptocurrency impact
  2. SIM swap statistics and losses
  3. App-based 2FA (TOTP) vs. SMS 2FA security comparison
  4. Hardware security keys (U2F/FIDO2) for cryptocurrency exchange protection