What a SIM swap is and why it defeats SMS 2FA

A plain explanation of how phone number hijacking bypasses SMS-based two-factor authentication and what actually stops it.

A SIM swap is when an attacker convinces a mobile carrier to port your phone number onto their own SIM card. Once they control the number, they use it to trigger password resets on exchange accounts and email, since both often rely on a text message to confirm identity.

It is not a crypto protocol attack. Nothing about a blockchain or a smart contract fails here. The failure is in a mobile carrier's account recovery process, and it is devastating precisely because so many wallets and exchange accounts still lean on SMS as their second factor.

What it means for the person doing the work

If you are looking at an account takeover and SMS 2FA was in the chain, the carrier is a plausible entry point worth ruling in or out early. The compromise did not need to touch anything cryptographic: it needed a customer service rep, a support form, or an automated verification step to accept the wrong person as the account owner.

This also means the usual signals you look for in a wallet compromise, like leaked keys or phished seed phrases, may simply not be present. The victim's crypto security could have been fine. The number was the weak link, not the wallet.

What to actually do about it

• Move two-factor authentication off SMS entirely: use a hardware key or an authenticator app instead.
• Treat the mobile carrier's account recovery process as the weakest link in the whole security stack, not an afterthought.
• Audit any account, personal or client, that still has SMS listed as a 2FA or recovery option, and remove it.
• Apply the same logic to email recovery: an email account tied to a phone number is only as secure as that phone number.

A SIM swap succeeds without breaking any cryptography. It succeeds by getting a carrier to hand over a phone number to the wrong person.

WalletDNA's glossary keeps a plain-language definition of SIM swap and related terms for quick reference: https://walletdna.com/glossary