SIM swap attack intercepts exchange withdrawal SMS 2FA

05 September 2026

A SIM swap attack targets the weakest link in exchange account security: SMS-based two-factor authentication. The attack exploits how phone carriers handle number porting and how exchanges rely on SMS for critical withdrawal confirmations.

The attacker begins by gathering personal information about the target. This can come from data breaches, social media, phishing emails, or publicly available records. Name, address, date of birth, and sometimes even the last four digits of a Social Security number are common targets.

With this data, the attacker contacts the victim's mobile carrier. They pose as the account holder. They claim the SIM card was lost, damaged, or stolen. The goal is to convince the carrier to port the phone number to a new SIM card the attacker controls.

Carrier security measures vary widely. Some require only basic personal information. Others may ask for a PIN, but social engineering can bypass even that. Once the carrier processes the transfer, the victim's number goes dead. The attacker now receives all SMS messages intended for the victim.

With control of the phone number, the attacker visits the exchange where the victim holds funds. They trigger a password reset. The exchange sends the reset code via SMS to what it believes is the legitimate number. The attacker sees it and resets the password.

Next, the attacker initiates a withdrawal. The exchange sends a confirmation code via SMS. The attacker enters it. The withdrawal request is now authenticated from the exchange's perspective. Funds move to the attacker's wallet.

SMS 2FA is the weakest link because SMS is not encrypted. It can be intercepted at the carrier level. It depends entirely on the carrier's security practices. A motivated attacker with enough personal data can almost always defeat it.

A withdrawal whitelist can be the last line of defense even after a successful SIM swap. A whitelist restricts withdrawals to pre-approved addresses. Changing the whitelist typically requires a cooldown period - often 24 to 48 hours. During that time, the exchange notifies the account holder via email. If the victim still has email access, they see the request and can freeze the account. The whitelist delay buys time.

Even with a whitelist, the attacker still controls the phone number. They can monitor SMS for reset codes. But they cannot immediately drain funds because the whitelist prevents new addresses from receiving funds until the cooldown expires.

Concrete steps to protect your account

Switch from SMS 2FA to an authenticator app like Google Authenticator or Authy. Authenticator codes are generated locally on your device. They are not transmitted over phone networks. A hardware key like a YubiKey is even stronger. It requires physical possession of the device to authenticate.

Set a carrier port-freeze PIN with your mobile provider. This is a separate PIN required to authorize any SIM swap or number port request. Not all carriers offer this, but most major ones do. Call customer service and ask to add a "number transfer lock" or "SIM swap PIN."

Remove your phone number as an account recovery option on every exchange. Phone numbers should only be a contact method, not a recovery method. If the exchange offers multiple recovery factors, disable SMS recovery entirely. Even if the exchange forces you to keep a phone number on file for compliance, you can often uncheck the box marked "Use for account recovery."

Enable withdrawal address whitelisting on every exchange that offers it. Set a cooldown period of at least 48 hours. Keep the whitelist short - only addresses you control and use regularly.

Monitor your phone service. If your cell signal suddenly drops without explanation, call your carrier immediately. Most SIM swap attacks produce a momentary outage before the attacker's SIM activates. Fast action can sometimes reverse the swap before damage is done.

These steps do not guarantee safety. No system is immune. But they raise the attacker's cost and complexity. A SIM swap attack becomes much harder to execute when the target uses a hardware key, has a carrier PIN, and has whitelisted withdrawal addresses.

As of August 31, 2026, the Merry Christmas token (contract 0x39876D4b4573Ae66b206231D9761DEf058AFE894) on the Base chain is effectively dead. Liquidity is $204.41. The fully diluted valuation is $200. In the prior 24 hours, the token saw 2 transactions and $0.01 in volume. The first and only liquidity pool launched on Uniswap on December 24, 2025. The price was $0.0000001999. This token is not actively traded. It poses no current withdrawal risk because it has no exchange listing. The attack vector described here applies to any exchange account using SMS 2FA.

Back to withdrawals