Orca Crypto
Buy OCX Book a session
Start Here
Start Here overviewGet started in orderCoinbaseCoinbase AdvancedBase AppBinance.USUpholdJupiterTradingViewBrave BrowserWallets by chainBook a session
Learn
Learn overviewLearning pathWhat is blockchainWhat is BitcoinWhat is EthereumPublic and private keysWallets explainedYour first purchaseYour first swapGas feesReading a block explorerStablecoinsBridgesTokenomicsMarket cap vs priceCrypto glossary
Chains
Chains overviewAll networksLayer 1 networksLayer 2 networksLayer 3 networksBitcoinEthereumSolanaSuiBaseArbitrumRobinhood ChainBlock explorersName servicesBridgesProof of work vs stake
Exchanges
Exchanges overviewDEX vs CEXCentralized exchangesDecentralized exchangesTop ten DEXsDEX viewersUniswapPancakeSwapSushiSwapKyberSwapJupiterAll swap guidesSwap on EthereumSwap on BaseSwap on Solana
Markets
Markets overviewMacro driversFOMC and interest ratesInflation and CPIElections and policyWar and geopoliticsETF flowsBitcoin halvingLiquidity cyclesStablecoin supplyCharts 101CandlesticksChart patternsIndicatorsRisk management
Safety
Safety overviewSafety hubAttacks and scamsSelf custodySeed phrase securityHardware walletsCommon scamsSpotting a rug pullPhishing and drainersToken approvalsSecurity checklistWallets by chainHot vs cold walletsRecovery planning
More
GlossaryBook a sessionContactMining and stakingName servicesBlock explorersChart patternsFollow on XJoin on Telegram
Buy OCX Book a session
Account takeover

SIM swap attacks

Somebody moves your phone number to their SIM, then resets everything that trusts your number.

Loading live prices
Attacks
All attacksPhishing emails and messagesSextortion phishingRansomwareWallet dustingPig butchering and romance scamsFake support and impersonationGiveaway and doubling scamsSIM swap attacksMalicious airdrops and claim sitesClipboard hijackingCounterfeit wallets and extensionsPhysical safety and operational securityDeepfakes and AI impersonationSafety hubSecurity checklistSelf custodySeed phrase securityHardware walletsToken approvalsRecovery planning
Updated 2026-08-305 min read
The short answer

Somebody moves your phone number to their SIM, then resets everything that trusts your number. An attacker convinces your mobile carrier to port your number to a SIM they control, sometimes by social engineering a support agent and sometimes by paying an employee. Once they have the number they receive your SMS codes, which is enough to reset passwords and drain accounts on any exchange that trusts SMS two factor.

What it is

An attacker convinces your mobile carrier to port your number to a SIM they control, sometimes by social engineering a support agent and sometimes by paying an employee. Once they have the number they receive your SMS codes, which is enough to reset passwords and drain accounts on any exchange that trusts SMS two factor.

How it plays out

  1. They gather your details first

    From breaches, from your social media, and from what you have posted about owning crypto.

  2. They contact the carrier as you

    And request a SIM replacement or a port to a new provider.

  3. Your phone loses service

    That is the moment it happens, and it is the only warning you get.

  4. They reset accounts

    Email first if it uses SMS recovery, then every exchange behind it.

What gives it away

  • Your phone loses signal suddenly and stays dead while others nearby work.
  • Password reset emails you did not request.
  • Being unable to log in to an account that worked yesterday.

How to not be caught by it

  • Move every account off SMS two factor and onto an authenticator app or a hardware key.
  • Add a port out PIN or a port freeze with your carrier. Every major carrier offers one.
  • Use an email address for exchanges that is not published anywhere and does not use SMS recovery.
  • Stop posting about holding crypto under a name and location that can be tied to you.
  • Keep meaningful holdings in self custody, so an exchange takeover is not a total loss.
The hard part is not technical
None of these require technical skill to avoid. They require doing the boring check at the exact moment you feel most rushed, which is the whole difficulty.

If it already happened

  • Call the carrier from another phone and report the SIM swap immediately.
  • Lock exchange accounts and withdrawals from a device that is still logged in.
  • Change the email password first, then every account that used SMS recovery.
  • Report it. SIM swaps are prosecuted and carriers have been held liable.
Recovery scams
Anybody who contacts you offering to recover lost crypto for a fee is running the second scam on the same victim. There is no recovery service that can reverse a blockchain transaction, because nobody can. Report it through official channels and ignore everyone else.

Common questions

How common is sim swap attacks?

Common enough that it has a name and a playbook. The specific numbers move constantly, so rather than quote a figure that will be wrong next quarter: assume you will meet this one, and set your wallet up so meeting it is survivable.

Can the money be recovered?

Once a blockchain transaction confirms, no. What reporting can occasionally do is get funds frozen at the exchange where a thief tries to cash out, which is why reporting quickly is worth doing even when it feels pointless.

Does a hardware wallet stop this?

It stops anything that needs your keys, because the keys never leave the device. It does not stop you approving a malicious transaction on the device itself, so read what the screen says before you press confirm.

Where to go next

All attacksThe full list, side by side.Security checklistDo the fixes in order.Self custodyHolding your own keys properly.

Check your setup before you need to

An hour on a screen share, going through your wallets, your approvals, your backups and your recovery plan. You click everything and we never ask for keys.

Book a sessionSee all attacks