SIM swap attack drained my exchange account: recovery options

15 October 2026

If a SIM swap attack drained your exchange account, act immediately: contact the exchange's support team, report the incident to your mobile carrier, file a complaint with law enforcement and financial regulators, and gather every piece of evidence you can. Time is the critical factor, and the speed of your response can affect whether you recover any funds.

A SIM swap attack - sometimes called SIM splitting or SIM hijacking - happens when an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can intercept the SMS codes or phone calls used to authenticate account logins, reset passwords, or approve withdrawals. If your exchange account was protected only by SMS-based two-factor authentication, the attacker may have been able to reset your password, bypass 2FA, and drain your balance before you even noticed your phone had lost service.

Act first: secure what remains

Before you do anything else, protect whatever is left in your account and any other accounts that share the same phone number or email address.

1. Contact the exchange immediately. Use their emergency channels - many have dedicated phone lines or special procedures for compromised accounts. If you cannot reach them by phone, open a support ticket and also try their official social media accounts. Provide your account email, your full legal name, and a clear statement that you believe you were the victim of SIM swapping.
2. Call your mobile carrier. Tell them you did not authorize the SIM change and that your phone lost service unexpectedly. Ask them to place a fraud alert on your account, revoke the new SIM, and restore your number to a device you control. Also ask them to add a strong account PIN or passcode so the attacker cannot do this again.
3. Change passwords on your email and any other important accounts. If the attacker accessed your email, they may have reset passwords for other services. Start with the email account linked to your exchange, then move to banking, other financial apps, and any account that uses the same password.
4. Enable a non-SMS 2FA method on any account you can still access. If you have a hardware security key or an authenticator app on a device the attacker does not control, set that up now. If you cannot access your accounts at all, focus on the carrier and the exchange first.

What to Expect From the Exchange's Recovery Process

Exchanges handle SIM swap incidents differently depending on their security policies, the size of the loss, and whether you had withdrawal whitelisting or other protections enabled. Do not expect an instant refund. Many exchanges treat SIM swap losses as the account holder's responsibility, especially if SMS 2FA was the only protection in place, because SMS is widely documented as insecure. Others have insurance funds or customer protection programs that may cover some losses, but these are not guaranteed and often require extensive verification.

When you contact the exchange, be ready to provide:

• Your account email and username.
• A detailed timeline of when you noticed the attack and what you observed.
• The last transaction or withdrawal you did not authorize.
• A police report number, if you have one.
• A copy of your government-issued ID.
• Any communication from your carrier confirming the SIM swap occurred.

The exchange may freeze your account, reverse pending transactions if they have not been confirmed on the blockchain, or ask you to complete a formal dispute form. Some exchanges will require you to sign an affidavit stating you did not authorize the withdrawals. Do not lie or exaggerate; inconsistencies can harm your case.

File reports: law enforcement and regulators

A SIM swap attack is a crime in most jurisdictions. Even if the stolen amount is small, filing a report creates a paper trail that can help the exchange, your bank, or regulators take your case seriously.

• Local police: Go in person or file online. Bring your ID, any evidence of the attack, and a list of the unauthorized transactions. Ask for a copy of the report.
• Your country's financial regulator or cybercrime unit: In the United States, this includes the FBI's Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC). In the UK, report to Action Fraud. In Canada, the Canadian Anti-Fraud Centre. Many countries have similar agencies. These reports do not guarantee action, but they add weight to your exchange dispute.
• Your mobile carrier's fraud department: Beyond restoring your number, ask for a written confirmation that a SIM swap occurred on your line. This document can be critical evidence for the exchange.

What might happen next: realistic outcomes

The honest truth is that recovering funds lost to a SIM swap attack is difficult and often unsuccessful. Cryptocurrency transactions are irreversible. If the attacker moved the funds to an exchange with proper KYC, there is a chance - still small, but real - that law enforcement can trace and freeze them. If the funds went to a mixing service or a non-custodial wallet, they are likely gone.

Possible outcomes include:

• Full or partial reimbursement from the exchange if they determine their security controls failed or if they have a discretionary customer protection policy.
• Reversal of pending transactions if you caught the attack before the blockchain confirmed the withdrawal. This is rare but possible.
• No recovery, if the exchange determines you were negligent (for example, by using SMS 2FA when app-based or hardware 2FA was available) or if the funds cannot be traced.

The exchange may also place your account under review while they investigate. This can take weeks. During that time, do not create a second account or try to circumvent their process; that can look suspicious and delay everything.

Long-Term lessons: what to do differently

After you have exhausted your recovery options, take steps to ensure this never happens again. The key is to remove SMS from the authentication chain entirely.

• Use a hardware security key (like a YubiKey) or an authenticator app for exchange logins and withdrawals. Never rely on SMS alone.
• Set up withdrawal address whitelisting. This prevents withdrawals to any address you have not previously verified, which can slow down an attacker even if they compromise your login.
• Use a unique, strong password for your exchange and email. Store them in a password manager.
• Add a recovery method to your carrier account that is not SMS-based, such as a separate PIN or a security question.
• Monitor your phone for unexpected loss of service. If your phone suddenly stops working, that is a red flag.

A SIM swap attack is a frightening and financially damaging experience. The recovery process is slow, bureaucratic, and frequently unsuccessful. But the steps you take in the first hours - contacting the exchange, securing your carrier account, and filing reports - give you the best possible chance of a good outcome, and they lay the groundwork for preventing the same attack from happening again.

Back to account recovery