Last updated: October 26, 2026
A SIM swap attack is when a criminal convinces or bribes your mobile carrier to move your phone number to their SIM card, then uses SMS codes to reset your email and exchange passwords and empty your crypto accounts — often within minutes. The defense is to stop relying on your phone number: use app-based or hardware-key 2FA, remove the phone number from crypto and email accounts, add a carrier PIN, and keep savings in self-custody where no SMS can unlock them. No-KYC swaps such as BTC → XMR need no phone number at all.
- Minutes from SIM swap to drained account
- SMS 2FA is the weak point
- 0 phone numbers needed for no-KYC swaps
- Self-custody can't be reset by SMS
How a SIM swap attack works
- Research: the attacker finds your name, number and some personal details — often from data leaks or social media.
- Carrier takeover: they impersonate you or bribe an employee to port your number to a new SIM.
- Your phone loses signal — the first warning sign.
- Password resets: SMS codes let them reset email, then exchange accounts.
- Withdrawal: funds are sent out before you can react.
What's exposed vs protected
| Asset | Risk from SIM swap |
|---|---|
| Exchange account with SMS 2FA | High |
| Email with SMS recovery | High — and it unlocks everything else |
| Exchange account with app/hardware 2FA | Low |
| Self-custody wallet (seed offline) | None — SMS can't reset a seed |
| No-KYC swap with no account | None — nothing to log into |
How to protect yourself (step by step)
- Switch 2FA from SMS to an authenticator app or hardware key on email and every crypto account — see 2FA for crypto.
- Remove your phone number as a recovery option where possible.
- Set a carrier PIN or port-out lock with your mobile operator.
- Use a separate email for crypto, protected with strong 2FA.
- Keep savings in self-custody — hot vs cold wallets.
- Don't publish your number or holdings — privacy mistakes.
If your phone suddenly loses signal
- Call your carrier immediately from another phone and ask whether your SIM was changed.
- Secure your email first — change the password and 2FA from a trusted device.
- Lock exchange accounts and disable withdrawals if possible.
- Report to the police and your carrier — reporting guide.
Services that don't need a phone number remove this risk entirely — see swapping crypto without a phone number.
Frequently asked questions
What is a SIM swap attack?
A criminal takes over your phone number by having your carrier move it to their SIM, then uses SMS codes to break into your accounts.
Can a SIM swap steal crypto from my hardware wallet?
No. A hardware or self-custody wallet is protected by its seed phrase, which SMS can't reset. Exchange accounts with SMS 2FA are the main targets.
Is SMS 2FA better than nothing?
Slightly, but it's the weakest form. Authenticator apps or hardware keys are much safer for crypto and email.
How do I know if I've been SIM swapped?
Your phone suddenly shows no service or "SOS only" while others nearby have signal, and you may get password-reset emails you didn't request.
Do no-KYC exchanges ask for a phone number?
Most non-custodial instant exchanges don't ask for a phone number or an account at all.
Swap without a phone number: BTC → XMR, USDT → XMR or the most private exchanges. No account, no ID, no logs.