SIM-swap and an exchange: what to do if your number is hijacked and your account falls under someone else's control

This scheme doesn't necessarily require a "hack" in the usual sense. An attacker gains control of your phone number and uses it to restore access to your email or exchange account. The attack is built on exactly this ordinary action.

The main thing to know right away: The main thing is not to panic and not to try to "fix" the situation with random transfers. First, stop the repeat risk, save the original data, and only then figure out what happened.

How the scheme works

In a SIM-swap, the attacker hijacks your phone number and uses SMS to reset passwords or confirm logins. The risk is especially high if the same number is linked to your email, exchange, and other critical accounts.

In this situation, it's important to separate two things: the attack mechanism itself and what has already happened to your assets. The attacker gains control of your phone number and uses it to restore access to your email or exchange account. After the incident, a technical review begins not with guesses, but with a specific transaction and its continuation on the blockchain.

What to do if it has already happened

Contact your mobile operator and the exchange at the same time: restore control of your number, block suspicious sessions and withdrawals, change passwords from a clean device, and replace SMS-2FA with TOTP or a hardware key.

1. Stop repeating the action that led to the incident: don't sign new requests and don't send additional payments.
2. Save the tx hash, full addresses, network, asset, amount, and time of the transaction.
3. Record the correspondence, domain, profile, app, or signing screen — everything that explains the context of the transaction.
4. If there's a risk that your wallet is compromised, move the remaining assets to a new secure wallet without using the exposed seed phrase.
5. If the amount is significant, it makes sense to trace the further route of the funds and identify service points along the way.

What to save for the review

For this specific topic, it's especially useful to save: operator notifications, login/password reset emails, IP/session logs, and exchange withdrawal history.

For an initial review, prepare the data in a single message or file — this reduces the risk of losing an important detail:

• tx hash / txid
• full sender and recipient addresses
• network, asset, amount, and time
• screenshots and correspondence
• domain, profile, or app if they are related to the incident

What you should avoid doing

• Don't share your seed phrase or private keys with "helpers" or a "recovery service".
• Don't pay an unknown intermediary a "tax", "insurance", or "unlock fee".
• Don't delete correspondence or transaction history before everything is saved.

Important: a transaction and an address are verifiable on-chain facts. The owner's identity, motive, and legal status should not be automatically inferred from a single graph.

When it makes sense to bring in a specialist

If the amount is significant, the route has already branched, or exchanges, swap services, bridges, and other services have appeared along it, a manual review helps separate available actions from useless ones. To start, public data is usually enough — private keys are not needed.

Frequently asked questions

Why contact both the operator and the exchange?

Because the compromise starts on the number side, while the financial actions occur in the service account. Logs from both sides help reconstruct the timeline.

Can a confirmed transaction be reversed?

As a rule, no. Further actions depend on the route of the funds and whether services capable of restricting the movement of assets have appeared along it.

Can you immediately identify the fraudster by the address?

No. The blockchain shows addresses and transactions. Identity requires additional data: the service's KYC, public sources, case materials, or other confirmations.

In short

An attacker gains control of your phone number and uses it to restore access to your email or exchange account. If this has already happened, first stop the repeat risk and save the original data. Then you can analyze the route and the real points for further action.