SIM Swap Attacks on Crypto Wallets and How to Prevent Them
A phone number is not a password. Yet many cryptocurrency exchanges and wallets still treat it as one. The attack chain is simple, well-documented, and devastating when it works.
A SIM swap attack starts with a call to your mobile carrier. The attacker convinces a customer service agent to port your number to a new SIM card in their possession. Once they control your number, they control any account that uses SMS for two-factor authentication. From there the attacker resets your email password. With your email compromised, they can request exchange password resets or access cloud backups that may contain seed phrases.
This is not a theoretical vulnerability. It is the recovery path used in some of the largest individual crypto thefts on record.
The most dangerous exchanges and wallets
Not every platform exposes the same risk. Some services make SIM swaps nearly impossible to exploit because they do not rely on phone numbers for critical flows. Others make it trivially easy.
The most dangerous services are those that allow SMS as a 2FA method and provide account recovery via email linked to the same phone number. Coinbase, Binance, Kraken, Gemini, and Bybit all permit SMS 2FA by default. Each offers account recovery through email - which the attacker already resets after the SIM swap.
The highest-risk wallets are custodial exchange wallets and any cloud-connected hot wallet that stores seed data. MetaMask mobile users who back up to iCloud are at particular risk. Phantom, Trust Wallet, and Coinbase Wallet all allow varying degrees of cloud backup that can expose a seed phrase if the attacker gains email access.
Hardware wallets like Ledger and Trezor are immune to SIM swap attacks as long as the seed phrase was never stored digitally. The attack vector is offline. The user is the weak point.
Prevention in priority order
You cannot prevent a SIM swap from happening. Phone companies hire poorly trained staff. Social engineers are patient. What you can do is break the chain at every link.
First and non-negotiable: remove SMS as a 2FA method on every cryptocurrency account. Not "consider removing." Remove it. SMS 2FA is better than nothing only if you do not hold crypto. For anyone with a wallet balance, it is a liability. Replace it with a hardware-based authenticator like a YubiKey or a TOTP app. TOTP is weaker than a hardware key but far stronger than SMS. Do not store the TOTP secrets on the same phone that receives SMS messages.
Second: secure your email account with a hardware security key. Your email is the master key to almost everything. If an attacker resets your email password through SMS, they own your inbox. A YubiKey registered as a U2F or FIDO2 credential cannot be bypassed by a phone number attack. Google, Microsoft, and ProtonMail all support hardware keys. Use one. Do not store recovery codes in cloud services that can be accessed from a compromised email.
Third: disable iCloud Backup of seed data if you use MetaMask on iOS. MetaMask offers an iCloud backup feature for its vault. This is convenient. It is also catastrophic. If an attacker controls your Apple ID through a SIM swap, they can restore that backup to a new device and extract your seed phrase. Go to iPhone Settings > iCloud > Manage Storage > Backups and ensure no crypto wallet app is backed up. Better yet, do not install wallet apps on the same phone that has SMS.
Fourth: set a carrier-level port-out PIN. Every major mobile carrier in the US, UK, Canada, and Australia offers a security PIN or passcode that must be provided before a number can be ported. This is not foolproof - social engineers can talk past it - but it adds a barrier. T-Mobile, Verizon, AT&T, and EE all provide this setting. Enable it immediately. Write down the PIN somewhere offline. Do not store it in a cloud document.
What to do if you are already attacked
Time is the only asset you have. As soon as your phone loses service, assume a SIM swap. Do not wait for confirmation. Call your carrier from another phone and report fraud. Simultaneously move any funds on centralized exchanges to a cold wallet or a new exchange account with a different phone number. Do not trust your email during this window - it may already be compromised.
If your seed phrase was in iCloud or Google Drive, consider those funds lost. The attacker only needed seconds. You may have minutes.
The single most effective defense costs nothing: never link a phone number to anything that holds value. A phone is a communication device, not a security token. Treat it that way.
Not financial advice. 4547onsol.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.