Why SMS Two-Factor Authentication Fails Crypto Traders

What finally got me to strip SMS off every account I own was learning how little work the attacker actually does. Nobody breaks any encryption and nobody touches your phone. Someone calls your mobile carrier, or walks into a retail store, and convinces an employee that they are you and that your number needs to move to a new SIM. Sometimes they do not even need to be convincing, because carrier insiders have historically been paid to process swaps directly. Either way the port goes through, your handset drops to no signal, and every SMS code that was supposed to protect your accounts starts arriving on a phone in someone else's pocket.

Crypto holders sit near the top of the target list for this, and it makes sense from the attacker's side. A drained bank account can often be reversed. A drained brokerage account triggers a fraud process with a decent chance of recovery. A drained exchange account gets converted into whatever moves fastest across chains, and by the time you are on hold with your carrier the money has been split, bridged, and mixed. The irreversibility that makes crypto interesting also makes it the best possible loot.

How the drain actually happens

The sequence is worth walking through, because the defense depends on understanding the order of operations. Step one is recon. Your phone number and email get matched together, usually from old breach dumps, sometimes from things you posted publicly, occasionally from data leaked out of exchanges themselves. Any signal that you hold crypto, a Telegram handle in a trading group, an ENS name, a screenshot of a position, moves you up the list.

Step two is the swap itself, the social engineering call or the paid insider. Step three, and this is the part people miss, does not start at your exchange. It starts at your email. Most email providers will reset a password with an SMS code if a phone number is on file for recovery. Once the attacker owns your inbox, your exchange password is one forgot-password click away, the reset link lands in a mailbox they control, and the SMS challenge at login goes to their SIM. Password reset, second factor passed, and they are in. Withdrawals typically start within the hour, and from the post-mortems I have read, usually at a time chosen to be the middle of the night wherever you live.

Notice that at no point was anything hacked in the way people usually mean. Every system worked as designed. The design just assumed your phone number belongs to you, and a phone number is really an account with a customer service department, which means it belongs to whoever the carrier believes.

TOTP, hardware keys, and passkeys, honestly

The fix is to make your second factor something that does not route through a carrier. There are three real options and they are not equivalent.

TOTP apps, the six digit codes from Google Authenticator or Aegis or similar, generate codes locally from a seed that was shared once when you scanned the QR code. No network is involved, so a SIM swap gets the attacker nothing. This is the minimum bar and a big upgrade from SMS. Two caveats though. TOTP is still phishable in real time; a fake exchange login page can relay your code to the real site within its thirty second window, and phishing kits that do this are commodity tools. And if your authenticator app syncs its seeds through a cloud account, the security of your 2FA quietly becomes the security of that cloud account, so treat it accordingly.

Hardware security keys, the YubiKey style devices speaking FIDO2, close the phishing hole. The key signs a challenge that is cryptographically bound to the real domain, so a lookalike site gets a signature that is useless to it. There is nothing to type and nothing to relay, and the private key never leaves the device. The honest downsides are that exchange support is uneven, some platforms accept a key for login but still fall back to weaker factors for withdrawals or account changes, and a lost key with no backup is a genuine lockout. The standard advice is to buy two, enroll both everywhere, and keep one somewhere that is not your everyday bag. I follow it.

Passkeys are the same cryptography as hardware keys, stored in your phone or laptop instead of a separate device, usually synced through Apple, Google, or a password manager. Phishing resistance is equivalent and convenience is better, so for the long tail of accounts they are the practical choice. The trade is that the syncing account becomes your root of trust. If your passkeys live in your Google account, protect that account with a hardware key, or the whole structure rests on whatever guards Google's recovery flow.

My rough hierarchy is hardware keys on email and on any exchange holding size, passkeys or TOTP for everything else, and SMS for nothing that touches money. One trap deserves calling out because it quietly defeats the entire exercise. Adding TOTP while leaving SMS enabled as a fallback gives you roughly the security of SMS alone. The attacker ignores your strongest factor and clicks through to the weakest recovery path the platform allows. Enabling a strong factor matters much less than removing the weak one.

Migrating without locking yourself out

The lockout fear is legitimate, and it is why people put this off for years. The way through is ordering. Never remove an old factor until the new one has been proven with a real login. Here is the sequence I use.

1. Inventory every account that touches money or can reset one that does. Email first, then exchanges, then the password manager, then banks and brokers.
2. Call your carrier and add a port-out PIN or number lock before touching anything else. This closes the door while you work.
3. Fix your email before any exchange. It is the recovery path for everything else, so it inherits the risk of everything else. Use a hardware key there if the provider supports one.
4. On each account, add the new factor while the old one is still active. Delete nothing yet.
5. Open a private browser window and log in fresh using only the new factor. If that works end to end, and only then, remove SMS from both login and recovery.
6. Save the recovery codes each service generates, on paper or in an encrypted file that does not live on the phone holding your authenticator. Two copies, two places.
7. Hunt for lingering SMS. Check recovery options, not just the 2FA settings page, because plenty of services keep a phone number as a reset path long after you switch factors.
8. Enroll your backup key or second device now, while you are calm, rather than after a loss.
9. On exchanges, turn on withdrawal address allowlisting with a time delay, and set an anti-phishing code for emails. Both limit damage even if a login is somehow compromised.

The whole thing is maybe two evenings of tedium for a normal footprint. Do the email account and the carrier lock the first night, since those two moves remove most of the tail risk on their own, then work outward.

Part of why we built trade execution at Blockcircle to be non-custodial is exactly this class of failure. Keys staying under the user's control shrinks what a stolen login is worth. But API keys and exchange balances still sit behind whatever login security you chose, so the stack underneath has to hold either way.

One last thing I would flag. If your number has ever appeared next to your email in a breach, assume the pairing is for sale and permanent, because you cannot un-leak a phone number. What you can do is make the number worthless to whoever takes it. After the migration above, a successful SIM swap against you gets the attacker a phone that receives spam and nothing else, which is a satisfying thing to be able to say, and it costs about a weekend.