Once a SIM swap attack succeeds, your phone number is no longer in your control—every SMS 2FA code sent to your number will be received by the attacker. This isn't your phone being hacked; it's your number being transferred to someone else's SIM card.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
You need to confirm two things immediately: whether your phone suddenly lost signal, and whether you have any unusual login notifications from your exchange account.
Step 1: Check if a SIM Swap Has Happened
This is how you tell if SMS 2FA has already failed.
What to do: Check your phone's signal. If it suddenly shows "No Service" or "SOS Only" and doesn't come back after a restart, your SIM has likely been swapped. Also log into your email and look for any password reset requests or exchange login alerts you didn't trigger.
Done when: You've confirmed the signal loss is due to SIM swap.
Once the attacker has your number, they can use SMS verification codes to reset your email password, then take over all linked accounts through your email. The whole process can be as quick as 15–30 minutes. If you get password reset emails or login alerts, the attacker is already moving.
Step 2: Contact Your Mobile Carrier Immediately to Freeze Your Account
This is the only way to get your number back under your control.
What to do: Using another device (a friend's phone or Wi‑Fi calling), call your carrier's customer service. Report that your SIM was illegally transferred and request an emergency account freeze and number recovery.
Done when: The carrier confirms your account is frozen and your number is being restored.
Risk reminder: Don't wait. Attackers start scanning your accounts within minutes of taking your number. An account can be breached within 30 minutes of a SIM swap. Call your carrier first, then change passwords—the order matters. Changing passwords without getting your number back is useless.
Step 3: Check and Clean Up Your Exchange Account
After your number is recovered, inspect what the attacker did inside your account.
What to do:
- Log into your exchange, go to the "Device Management" page, and end all login sessions from unknown devices.
- Check withdrawal history for any suspicious withdrawals or open orders.
- Review your API key list and delete any keys you did not create.
- If SMS 2FA is still active, turn it off immediately and switch to an authenticator app like Google Authenticator.
Done when: All active sessions are from your own devices, the API key list is cleared, and SMS 2FA is removed.
Common mistake: After a SIM swap, many people only change their exchange password but forget to clear API keys and active sessions. The attacker may have created a high‑permission API key in minutes as a backdoor. Changing the password doesn't stop the API access.
Step 4: Long‑Term Fix — Ditch SMS 2FA for Good
SMS codes are the weakest form of two‑factor authentication today. SIM swaps and SS7 network attacks can bypass them in minutes. Google has warned users to stop relying on SMS verification.
What to do: On every account that supports authenticator apps, replace SMS 2FA with Google Authenticator, Authy, or a hardware security key (like YubiKey).
Done when: Your exchange, email, and carrier accounts no longer use SMS verification codes for login or recovery.
According to security advice from top crypto exchanges, TOTP codes generated by authenticator apps are created locally and never sent over the cellular network, so even if your SIM is swapped, the attacker cannot get your 2FA codes.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
How to Verify You're Safe
After your number is restored, log into your exchange from another device and make sure you can complete login using your authenticator app. Check withdrawal records to confirm the attacker didn't steal any assets. Finally, contact your carrier and set a security PIN on your account. From now on, anyone asking to swap your SIM must provide that PIN.
