Your Number Is the Key: SIM-Swaps and Crypto Theft in 2026

On a January afternoon in 2024, the most trusted account in American securities regulation told the world a lie. The official X account of the US Securities and Exchange Commission announced that spot Bitcoin exchange-traded funds had been approved for listing on national exchanges. Bitcoin jumped more than $1,000 within minutes. The post was fake. The account had been hijacked, and the person behind it never guessed a password, never broke a line of code, and never touched a private key. He walked into a phone store with a forged ID and walked out in control of the number tied to the account.

That attack has a name, a SIM swap, and it is the clearest window into how a large share of crypto theft actually happens in 2026. The nine-figure headline losses still come from stolen admin keys and drained bridges, and with Bitcoin trading near $83,600 and the total crypto market worth close to $3 trillion (CoinGecko), the targets have rarely been fatter. But a growing slice of everyday losses never involves cracking anything. The attacker takes the one credential almost everyone treats as a master key without meaning to, the phone number, and then lets the victim’s own recovery systems hand over the money.

This is private-key compromise by proxy. The key is still the prize, but in 2026 crypto rarely sits behind the key alone. It sits behind a chain of resets: a text-message code, an email inbox, a cloud backup, an exchange login. Pull the first link and the rest usually follow. The private key is never stolen because it never has to be. The phone number is the shortcut, and it has quietly become the softest part of most people’s security.

What a SIM swap actually is

A SIM swap, sometimes called SIM hijacking, moves your phone number off the SIM card in your phone and onto one controlled by someone else. Your carrier treats the number as something that can be reassigned to a new SIM or ported to a new carrier. Normally that is a convenience: you break a phone, you get a new SIM, your number follows you. The attacker abuses the same process. Once the number lands on their device, every call and text meant for you arrives on their phone instead, including the one-time codes that so many services still send by SMS.

There are three common ways in. The first is social engineering: the attacker calls the carrier posing as the customer, armed with personal details bought from data brokers or scraped from old breaches, and talks a support agent into moving the number. The second is a forged identity used in person or online, the method that took down the SEC’s account. The third, and the hardest to defend against, is a bribed or complicit employee at a carrier or an outsourced call center who performs the swap from the inside for a fee. Port-out fraud is a close cousin: rather than swap the SIM, the attacker ports the number to a different carrier entirely, which can be slower to detect and reverse.

None of this requires technical skill aimed at your wallet. It requires a convincing story, a little of your personal data, and a weak link at the carrier. That is why SIM swapping scales: the attacker is not breaking cryptography, they are breaking a customer-service desk, and there are a great many of those.

When the SEC got SIM-swapped

The SEC case is worth telling in full, because the victim was the market’s own referee. On 9 January 2024, Eric Council Jr., of Athens, Alabama, created a fraudulent identity document and used it to persuade an AT&T store employee to issue a replacement SIM for the number linked to the SEC’s X account, according to the US Department of Justice. His co-conspirators used the hijacked number to reset access and post the fake approval. Bitcoin spiked more than $1,000 on the news, then gave back more than $2,000 once the SEC confirmed the post was bogus, a swing of roughly $3,000 driven by a single code landing on the wrong SIM. The real approvals came the next day, when the SEC genuinely cleared the first US spot Bitcoin ETFs, which only sharpened how disruptive the counterfeit had been.

Council was no mastermind. He advertised SIM-swap jobs on Telegram under the handle easymunny, charging between $1,200 and $1,500 per swap, and admitted to earning about $50,000 from such work between January and June 2024, which he was ordered to forfeit (Cointelegraph). He pleaded guilty and, in May 2025, was sentenced to 14 months in prison followed by three years of supervised release (CNBC). Darren Cox, then acting FBI assistant director, called it “the deliberate takeover of a federal agency’s official communications platform … a calculated criminal act meant to deceive the public and manipulate financial markets” (CoinDesk). X’s safety team later said the account had been compromised through control of its associated phone number rather than any breach of X itself, a reminder that two-factor protection is only as strong as the channel used to deliver it.

The uncomfortable lesson is not that the SEC was uniquely careless, though relying on a text message to protect a market-moving account was a mistake. It is that the single most scrutinized social media account in US finance was guarded, in the end, by a phone number that a $1,500 favor could steal. If that is the SEC’s exposure, it is worth asking what protects the account where you keep your coins.

How a phone number became a master key

Crypto security is usually told as a story about the private key: guard the seed phrase, never type it into a website, keep it off the internet. That advice is correct, and it is also incomplete, because for most users in 2026 the key no longer stands alone. It is wrapped in layers of recovery meant to save people from locking themselves out, and those same layers are what attackers aim at. The phone number sits at the root of almost all of them.

Consider the chain. A custodial exchange account is protected by a login, and if that login resets by SMS, the number controls the coins. An email inbox resets most other services, and if the inbox falls back to SMS recovery, the number controls the inbox. A self-custody wallet that backs its seed up to a cloud account is only as safe as that cloud login, which often resets by email or text. Even the newer wallets built to retire the seed phrase, the embedded and multi-party-computation designs that split a key across a phone and a server and unlock with a passkey or an ordinary login, usually keep a recovery route that leads back to an email address or a phone number. As the model of a wallet shifts from a device you hold to an account you log into, a change we traced in our look at how much of your wallet now acts without you, the number quietly inherits the role the seed phrase used to play.

This matters more every year because crypto keeps moving onto phones. Samsung has moved to put a dollar stablecoin in front of tens of millions of its handsets, and embedded wallets turn an ordinary app login into a crypto account, a trend we examined in our report on where the onboarding funnel still leaks. The more the phone becomes the wallet, the more the number that identifies the phone becomes the key. The table below shows which recovery factors a SIM swap actually defeats, and which ones shrug it off.

The pattern is blunt. Everything tied to the phone number falls; everything bound to a physical device or a cryptographic secret that never travels over the network survives. A SIM swap is powerful precisely because so much of the recovery stack still routes through SMS, a channel designed in an era when nobody imagined it guarding a seven-figure wallet.

The LastPass lesson: a password vault is a recovery path too

If the SEC case shows how a number can be the key, the LastPass heists show why storing a key anywhere reachable is the same mistake in a different coat. In 2022 the password manager LastPass disclosed that attackers had copied customer vaults, which are encrypted backups of everything users saved. Encryption bought time, not safety: the attackers took the stolen vaults offline and ground away at weak master passwords at their leisure. Once a master password fell, so did everything inside, including, for a striking number of victims, their crypto seed phrases saved as secure notes.

Taylor Monahan, lead product manager at MetaMask, was among the first to connect the thefts. Studying victim after victim, she found a common thread and a disturbing profile. “The victim profile remains the most striking thing. They truly all are reasonably secure,” she wrote; these were employees of reputable crypto companies, venture investors, and people who deploy contracts and run their own nodes, not careless beginners. Security researcher Nick Bax put the stakes plainly: “The seed phrase is literally the money. If you have my seed phrase, you can copy and paste that into your wallet, and then you can see all my accounts” (KrebsOnSecurity).

By late 2023 researchers tied more than $35 million in losses across over 150 victims to the breach, with fresh drains arriving in waves (CoinDesk). The toll kept climbing. In 2025 US federal agents confirmed in a forfeiture filing that the breach was linked to a string of heists exceeding $150 million, including one investigators connected to Ripple co-founder Chris Larsen, and seized roughly $23 million in related funds (BleepingComputer). No smart contract failed and no wallet was hacked. The victims had simply kept the one secret that is the money somewhere a cracked password could reach.

The through-line with SIM swapping is exact. In both cases the private key was never the point of attack; the recovery path around it was. A seed in a cloud vault, a key behind an SMS code, a backup in an email account: each is a door that bypasses the lock. It is the reason a protocol can earn a flawless audit and its users can still be drained, a gap we examined in our review of which audit firms to trust after a brutal year. The code was never the weak point.

Terpin, AT&T, and whether the carrier owes you a duty

Crypto SIM-swap litigation has a founding case, and it is still running. In 2018, investor and entrepreneur Michael Terpin lost about $24 million in crypto after attackers hijacked his number through his carrier. Terpin went after both the people who did it and the company whose process let them. In 2019 a Los Angeles court ordered Nicholas Truglia, one of the perpetrators, to pay Terpin $75.8 million in a civil judgment (CoinDesk).

Collecting from a convicted hacker is one thing; holding the carrier responsible is another. Terpin’s long-running suit against AT&T argues that the company failed to protect his account despite knowing he was a repeat target. Courts dismissed large parts of it, but in 2024 the Ninth Circuit revived a key claim, finding that a number reassigned to an attacker could amount to a carrier disclosing a customer’s proprietary network information under Section 222 of the Communications Act (Cointelegraph). The theory is simple and consequential: your carrier has a legal duty to safeguard your account, and handing your number to a stranger can breach it.

The case matters beyond one wealthy victim because it puts a price on the carrier’s customer-service desk. If a forged ID or a smooth phone call is enough to move a number, and moving that number drains a wallet, the question of who pays stops being academic. That liability pressure, as much as any rulebook, is what finally pushed carriers to harden the process.

The crews: swap-for-hire and the teenagers who run it

SIM swapping is not the work of lone geniuses. It is a cottage industry with a recognizable workforce, much of it strikingly young. Researchers describe a loose online subculture known as The Com, a sprawling network of mostly teenagers and young adults who graduate from online harassment and gaming-account theft to SIM swapping, crypto theft, and extortion, often chasing status among peers as much as money (CyberScoop). Allison Nixon, chief research officer at the investigations firm Unit 221B, has tracked these communities for years and documented how members social-engineer and, at times, bribe telecom-store employees to perform swaps on demand (MIT Technology Review).

The most capable of these crews move on to serious crime. Members of the group tracked as Scattered Spider combined SIM swaps with slick phone-based social engineering to breach major companies. One of them, Noah Urban of Palm Coast, Florida, who used handles including Sosa and King Bob, pleaded guilty and in August 2025 was sentenced to ten years in prison and ordered to pay about $13 million in restitution for SIM-swap schemes that drained crypto from dozens of victims (KrebsOnSecurity). The distance from a Telegram handle like easymunny to a federal sentence is short, but the supply of new entrants is deep, and notoriety keeps recruiting them.

The reason the work keeps paying is division of labor. One person forges the ID or bribes the clerk; another intercepts the codes; another launders the proceeds. The swapper does not need to understand blockchains at all. That specialization, the same logic that turned the broader key-theft economy professional, is what makes the telecom layer such a durable and renewable target.

The numbers behind SIM-swap losses

Measuring the damage is harder than it sounds, because a SIM swap is rarely the final step. The FBI’s Internet Crime Complaint Center, known as IC3, tracks SIM-swap complaints, and the reported figures describe a threat that spiked, then appeared to recede as carriers and victims caught on. The catch is that the swap is an access pass, not the payoff: once the attacker is in, the money is usually stolen as crypto fraud, investment fraud, or account takeover, and the loss gets recorded under those categories instead.

Source: FBI Internet Crime Complaint Center annual reports. The SIM-swap line understates the crypto damage by design. Set it against the scale of what it so often enables: Americans filed more than 181,000 cryptocurrency-fraud complaints with IC3 in 2025, reporting over $11 billion in losses, up more than a fifth from the year before (FBI IC3). The FBI has separately warned that criminals are escalating SIM-swap tactics to steal larger sums (BleepingComputer). The reported SIM-swap total may be falling; the share of crypto theft that begins with a hijacked number almost certainly is not.

The FCC steps in

Because the weak link is the carrier, the most direct fix came not from a financial watchdog but from the telecom regulator. In November 2023 the Federal Communications Commission adopted rules targeting SIM-swap and port-out fraud. They require wireless providers to authenticate customers securely before moving a number to a new SIM or carrier, to notify customers immediately whenever a SIM change or port-out is requested, and to offer customers a way to lock their account against such changes (Federal Register). Carriers were given a rollout window and leaned on it, but by 2024 the protections were landing (FCC).

It is worth being clear about the regulatory split, because crypto readers often expect the SEC to appear here. For a self-custody or exchange SIM-swap theft, the SEC is largely a bystander: the consumer-protection muscle sits with the FCC over carriers and with the FBI and Department of Justice over the criminals. The SEC’s role in the 2024 episode was as victim, and then as the authority policing the market manipulation the fake tweet caused. Spot crypto held in self-custody is not a security, and losing it to a hijacked number is a fraud and a telecom-security failure, not a securities violation. The lines of defense that matter here are the carrier, the platform, and you.

The locks you can switch on today

The practical upshot of those rules is that every major US carrier now offers a free account lock that blocks SIM changes and number transfers, and turning it on is the single highest-value step most people can take in an afternoon. The feature names differ:

• Verizon offers SIM Protection, which blocks unauthorized SIM swaps and eSIM transfers, and Number Lock, which blocks ports to another carrier; both are toggled in the My Verizon app (Verizon).
• AT&T offers Wireless Account Lock, which stops unauthorized SIM changes and number transfers, managed in the myAT&T app.
• T-Mobile overhauled its system in 2025 with a SIM Protection toggle set per line or account-wide, plus Port-Out Protection and an in-store photo-ID requirement to remove the lock.

These locks are not perfect. A bribed insider can sometimes override them, and a determined attacker may try a different carrier path. But they turn a quiet, instant swap into a process that trips alarms and demands extra proof, which is usually enough to send an opportunistic swapper looking for an easier target.

Cutting the phone number out of your crypto

The carrier lock defends the number. The deeper fix is to make the number worthless to an attacker by removing it from anything that guards money. A SIM swap only pays off when a hijacked number can reset something valuable; sever that link and the attack collapses.

• Kill SMS two-factor everywhere it touches money. Replace text-message codes with an authenticator app (TOTP) or, better, a passkey or hardware security key built on the FIDO2 standard. These never send anything to your number, so a SIM swap has nothing to intercept.
• Take the phone number off your email and exchange accounts. Your inbox resets most of your digital life; if it can be recovered by SMS, your number still controls it. Remove the phone as a recovery and login factor and use an authenticator or security key instead.
• Use a separate, secret email for crypto. An address you never post publicly and never reuse breaks the chain attackers follow from a leaked address to a password reset.
• Never store a seed phrase anywhere online. Not in a password manager, not in cloud notes, not in email. The LastPass victims did almost everything else right.
• Keep serious holdings in air-gapped self-custody. A hardware wallet seed you generated yourself and never backed up to the cloud is untouchable by a SIM swap, because nothing about it is reachable over a network.

There is a quiet irony here. The slogan not your keys, not your coins was meant to push people toward self-custody, and against the SIM-swap threat it is exactly right: the person who holds an offline seed and uses hardware-backed logins is effectively immune, while the person who leaves coins on an exchange behind an SMS code is the easy mark. Professionals already treat this as basic hygiene; the operators who run validator and restaking infrastructure, profiled in our look at the economics of running SSV operators, manage keys as an operational discipline precisely because a single recovery lapse can be catastrophic. The same discipline, scaled down, protects an individual.

The platform’s side of the defense

Individuals are not the only line of defense; the exchanges and wallet providers that hold or guard coins have hardened their own controls, and using those controls is part of the job. Most major platforms now let you allowlist withdrawal addresses, so funds can leave only to destinations you pre-approved, and many impose a holding period before a newly added address can receive anything. That delay is aimed squarely at the swap-and-drain playbook: even an attacker who seizes your number and logs in cannot instantly send coins to a fresh wallet of their own.

The bigger shift is in how platforms let you log in at all. Leading exchanges now support passkeys and hardware security keys, bind sessions to known devices, and flag logins from new locations with extra checks, and a growing number steer users away from SMS codes toward authenticator apps. None of this helps if you leave the weakest option switched on, which is the recurring theme of this whole story. A platform can offer a vault-grade lock, but if your account still resets to a phone number you never protected, the lock is decorative. Treat every security toggle a platform offers as mandatory, not optional, and start by deleting SMS from the list.

Custodial platforms carry one burden that self-custody does not: when they hold the coins, a SIM-swap takeover of a customer account becomes their fraud problem too, which is why the better ones now invest heavily in account-takeover detection. It is a useful reminder that the choice between custody and self-custody is really a choice about which set of recovery paths you are willing to defend.

Not every theft is a swap: the malware cousin

It is worth marking the edge of this threat so you defend the right thing. A SIM swap never touches your phone; it takes your number while the handset sits untouched in your pocket. A different and equally active class of attack does the opposite: it leaves your number alone and compromises the device itself. In 2025 researchers at ThreatFabric exposed Crocodilus, an Android trojan that abuses the phone’s accessibility features and, in a clever twist, shows victims a fake warning telling them to back up their wallet key within 12 hours, steering them to reveal the very seed phrase the malware then harvests (ThreatFabric). Within months it had spread across several countries.

The defenses differ because the vector differs. Carrier locks and killing SMS two-factor stop the swap; they do nothing against malware that already owns the device. For that you need app-store discipline, a clean device reserved for signing, and deep suspicion of any prompt that asks you to enter or back up a seed phrase. The two threats share a target, your keys and your coins, but they come through different doors, and a complete defense closes both.

The bottom line for 2026

The lesson running through every case here is the same one reshaping crypto security broadly: attackers have stopped going through the front door. They do not crack the key when they can take the number that resets it, the vault that stores it, or the inbox that unlocks both. The private key remains the crown jewel, but it is ringed by a perimeter of conveniences, and the perimeter is where the fighting happens now.

The defense is not exotic. Treat your phone number as a credential, not a utility, and cut it away from anything that touches money. Turn on your carrier’s account lock. Move off SMS codes. Keep seeds offline and holdings in hardware you control. None of it is glamorous, and all of it would have stopped the SEC’s hijacking, the LastPass drains, and most of the swap-for-hire thefts in between. In a market where a single text message can move Bitcoin by thousands of dollars, the cheapest security upgrade available is to make sure that message is no longer worth sending.

Frequently Asked Questions

What is a SIM swap and how does it steal crypto?

A SIM swap moves your phone number onto a SIM card controlled by an attacker, usually through social engineering, a forged ID, or a bribed carrier employee. Once they hold your number, they intercept the SMS codes and password resets that protect your email, exchange accounts, and cloud wallet backups, then use them to drain your crypto without ever touching your private key.

Can a SIM swap drain a hardware wallet?

Not on its own. A hardware wallet seed that you generated offline and never backed up to a cloud account or password manager is unreachable by a SIM swap, because nothing about the key travels over a network. SIM swaps succeed against exchange accounts, SMS-protected logins, and seed phrases stored online, not against properly air-gapped self-custody.

How do I protect my phone number from a SIM swap?

Turn on your carrier’s free account lock, such as Verizon SIM Protection and Number Lock, AT&T Wireless Account Lock, or T-Mobile SIM Protection, which blocks unauthorized SIM changes and number transfers. Then remove your phone number from the recovery settings of your email, exchange, and wallet accounts and replace SMS codes with an authenticator app or a hardware security key.

Was the SEC really hacked with a SIM swap?

Yes. In January 2024 the SEC’s official X account was taken over after Eric Council Jr. used a forged ID to SIM-swap the number tied to the account, and his co-conspirators posted a fake Bitcoin ETF approval that briefly moved Bitcoin by about $3,000. Council was sentenced to 14 months in prison in May 2025.

Is SMS two-factor authentication safe for crypto?

No. SMS two-factor is better than no second factor, but it routes through your phone number, which a SIM swap can hijack. For anything protecting crypto, use an authenticator app or a FIDO2 passkey or hardware security key instead, since those cannot be intercepted by taking over your number.

By Marcus Feld, senior security correspondent at HOGE Wire.