Crypto glossary
SIM swap
A SIM swap is an attack in which a criminal convinces or bribes a mobile carrier to move a victim's phone number to a new SIM card that the attacker controls.
Once the number is transferred, every call and text message goes to the attacker. That includes the one-time codes many services send by SMS for login, password resets and withdrawal confirmations. The attacker usually gathers personal data first, from leaks or social media, and then impersonates the victim in a call or a store, or pays an insider at the carrier.
Crypto holders are attractive targets because a hijacked number can unlock exchange accounts, email inboxes and social media profiles at the same time. In January 2024 the SEC's account on X was taken over through a SIM swap and used to post a false announcement that bitcoin ETFs had been approved, briefly moving the market.
The best protection is to stop relying on SMS: use an authenticator app or a hardware security key, remove the phone number as a recovery method where possible and ask the carrier for a port-out PIN or extra account protection.
Example
An attacker calls a carrier pretending to be the victim, has the number moved to a new SIM, resets the victim's exchange password with an SMS code and withdraws 3 BTC within an hour.
