SIM swapping is an attack where a criminal convinces a mobile carrier to move a victim's phone number onto a SIM card they control, instantly gaining access to every SMS code used for login and password recovery. For an exchanger's client, that means a phone-linked account can end up in someone else's hands within minutes. Here's why this hits crypto exchangers harder than most businesses — and what actually closes the gap.
What's actually happening under the hood
A phone number isn't really yours — it's an identifier you rent from a carrier, and that's exactly where the weakness lives. Attackers gather personal details from leaked databases or social media, then contact carrier support posing as the victim, claiming a lost phone. If the carrier's verification is thin, the number ports to a new SIM and the real owner simply drops off the network — often the first sign something is wrong.
Why exchangers sit squarely in the blast radius
An exchanger account typically touches a phone number at two critical points — login and withdrawal confirmation — which is exactly what an attacker needs. Plenty of platforms, especially smaller ones, still rely on SMS as the only second factor because it's cheap to wire up. That's not a flaw unique to one exchanger; it's a structural shortcut a large part of the industry leans on.
What this looks like in the real world
Picture a regular client who's traded USDT for cash every week for years, using the same number the whole time. One morning the phone loses signal. By evening, a withdrawal request to a brand-new wallet address has already gone through — support saw a valid SMS code and approved it. That's not an edge case; it's the standard shape of the attack, described over and over by support teams who've lived through it.
What actually stops SIM swapping
- Drop SMS as the only factor — a TOTP app (Google Authenticator, Authy) or a hardware key works entirely independently of the SIM card.
- Whitelist withdrawal addresses with a cooling-off period before a newly added address becomes active.
- Notify by email and push on any phone number or email change on the account — never rely on SMS alone to confirm SMS changes.
- Cap withdrawal size for recently changed contact details or newly added addresses.
- Add a manual support check for any contact-info change request tied to a large pending withdrawal.
Mistakes exchangers still make
- Treating SMS as the only 2FA "because it's simpler for the client."
- Letting a withdrawal address change and a payout happen in the same session.
- Not logging or alerting on phone number changes tied to an account.
- Giving "trusted" long-time clients a generous limit with no extra verification.
Conclusion
SIM swapping isn't an exotic edge case — it's a routine attack that exploits the weakest link in the chain, the phone network, not your platform. Closing it isn't technically hard; what's hard is the discipline of dropping SMS as a single factor and adding friction to sensitive changes. If you're running or launching your own crypto exchanger and want infrastructure built with withdrawal security in mind from day one, take a look at iEXExchanger.
