SIM swap

SIM swap and stolen crypto: what to do in the first hours

Your phone suddenly shows “No service” or “SOS only”, and an hour later your exchange account is empty. That is the classic pattern of a SIM swap: someone convinced or bribed your mobile operator to move your number to their SIM card, then used text-message codes to get into your email and your crypto accounts. The blockchain side cannot be undone, but a lot can still be done — with the operator, the exchanges, the police, and the trail of the funds. Here is the order that usually matters most.

Updated 17 October 2026 · about 8 minutes to read

How to recognise a SIM swap

A SIM swap rarely looks dramatic at first. The usual signs:

• Your phone loses mobile service in a place where it normally works, while Wi-Fi still works. Calls and texts stop arriving.
• A message from the operator that your SIM card was replaced, an eSIM was activated, or your number was ported to another operator — often sent just before the service drops.
• Password reset emails or “new login” alerts from your email provider, exchanges, or messengers that you did not request.
• Friends say they received odd messages from your number or your messenger account.

If your service is gone and you see any of the other signs, treat it as an attack in progress, not as a network fault. Minutes matter here: the attacker is usually working through your accounts one by one.

What to do right now

1. Contact the operator from another phone or visit a store in person. Say clearly that your number was taken by fraud, ask them to block the new SIM or eSIM and restore the number to you, and get a reference number for the complaint.
2. Secure your main email first. From a clean device, change the password, sign out all other sessions, remove any phone number or recovery address the attacker added, and check forwarding rules and filters — attackers often add a rule that hides exchange emails.
3. Contact every exchange you use. Use the official support channel in the app or on the website and ask them to freeze or lock the account, block withdrawals and API keys, and preserve login and withdrawal logs. Many exchanges have an emergency “disable account” function; use it.
4. Change passwords and 2FA on exchanges, wallets with cloud backup, messengers and banking. Replace SMS codes with an authenticator app or a hardware key where possible.
5. Write down the timeline while it is fresh: when the service dropped, which alerts arrived and when, what you saw in each account. Take screenshots of every alert and every transaction.

What to ask the mobile operator for

The operator holds the key evidence. Ask for it in writing, by a formal complaint, not only by phone. Useful items:

• The date and time of the SIM replacement, eSIM activation or number port, and the channel it was done through: a store, a call centre, the online account, a dealer.
• What identification was checked, and whether a passport, power of attorney or other document was presented in your name.
• The store or employee code that processed the change, if the operator records it, and whether any CCTV or call recording exists.
• Which security checks you had set — PIN, password, port-out lock — and whether they were bypassed.
• A request to preserve all records of the incident, because they may later be requested by the police or a court.

Operators often will not hand over everything to a customer, especially employee details, and say they will only release it to the police. That is normal; what matters is that you asked in writing and that they know to keep the records. Keep the reference numbers of every call and visit.

Is the operator responsible?

Sometimes. A claim against the operator is realistic when the facts show that the operator itself failed: for example, it issued a new SIM without proper identification, ignored a PIN or port-out lock you had set, or an employee was involved. It is much weaker when the attacker used your real documents or answered your security questions correctly.

What decides it:

• The operator’s own rules and your contract. Most operators have written procedures for SIM replacement. If they were not followed, that is the core of the claim.
• Local law. Consumer protection and telecom rules differ by country, and so do the limits operators put in their terms. Some regulators have introduced stricter identity checks for SIM changes; check what applies where your contract is.
• The link between the swap and the loss. You will need to show that the stolen crypto was taken through access gained with your number: timing of the swap, SMS codes used, login logs from the exchange.

Be realistic: operators usually contest these claims, and the compensation they offer voluntarily is often small. A formal complaint, then the telecom regulator or ombudsman, then court, is the usual order. The exchange’s logs are as important here as the operator’s records — request both.

Police and tracing the funds

File a police report as soon as you have the basic timeline. A SIM swap is a crime in itself, and the report is what lets investigators request the operator’s records and the exchanges’ data. Include your number, the operator, the time of the swap, every account affected, every transaction hash and the receiving addresses. Our guide on reporting crypto theft to the police explains how to structure it.

In parallel, follow the money. If the crypto was withdrawn from your exchange to an outside address, the transaction is public. Thieves often move funds quickly through several addresses and then try to cash out through another exchange. If the funds reach a regulated platform, that platform can sometimes freeze them on a request supported by a police reference — but only while they are still there. See the first 48 hours after a theft for how freeze requests work, and take the short test can your funds be traced and frozen.

Also ask your own exchange about its responsibility. If it allowed withdrawals right after a password and 2FA change, to a new address, without the usual holding period, that is worth raising in a formal complaint.

How to protect yourself next time

• Do not use SMS as your second factor for email, exchanges or wallets. Use an authenticator app or, better, a hardware security key.
• Remove your phone number from account recovery where the service allows it, especially on your main email.
• Set a PIN or password with your operator for any change to the SIM or the number, and ask about a port-out lock if your operator offers one.
• Use a separate email for exchanges that is not known publicly and not linked to your social media.
• Turn on withdrawal address whitelists on exchanges, so new addresses need a waiting period before use.
• Keep long-term savings in a wallet you control, with the seed phrase stored offline. A SIM swap cannot reach a seed phrase that is not in any online account.

If you lost significant funds, the swap is recent, or you think the operator or the exchange did not follow its own rules, it is worth having the case looked at early. Describe what happened and we will tell you honestly, free of charge, which routes still make sense — the operator, the exchange, a freeze request — and which do not.