How a SIM-swap attack works and where the money goes

A SIM-swap attack takes, on average, minutes to execute. By the time most victims notice, the phone is dark, the authenticator codes have been redirected, and the exchange account is draining. The money does not disappear – it moves, on-chain, leaving a trail. The question is whether anyone acts fast enough to follow it.

A SIM-swap attack works by convincing a mobile carrier to transfer a victim's phone number to a SIM card the attacker controls. Once the number is live on their device, the attacker intercepts SMS-based two-factor authentication codes, resets exchange-account credentials, and initiates withdrawals. The stolen assets then pass through a predictable layering sequence – peer-to-peer transfers, mixers or bridging protocols, and ultimately a cash-out exchange. On-chain tracing can follow that sequence to the point where the attacker must interact with a regulated venue.

This analysis covers the full attack chain, the on-chain movement patterns that typically follow, the legal instruments available to freeze and recover stolen digital assets, and the honest limits of each. The cross-border dimension matters throughout: both the attack and the layering sequence routinely span several jurisdictions before the funds reach a cash-out point.

What is a SIM-swap attack and how does it work?

A SIM-swap attack is a form of identity fraud targeting the mobile number that acts as the recovery key for a victim's financial accounts. The attacker's goal is to own that number, not the phone.

The mechanics are straightforward. An attacker first gathers personal data – name, address, partial account numbers, sometimes the last four digits of a social-security-equivalent identifier. This information is obtained through phishing, data-broker purchases, or prior breaches. Armed with it, the attacker contacts the victim's mobile carrier, either by phone, in-store, or through a compromised carrier employee. They claim the phone was lost or stolen and request a SIM transfer to a new card they already hold. Carrier security checks vary widely in quality. When the transfer completes – often in under an hour – all calls and SMS messages route to the attacker's device, not the victim's.

At that point the victim's phone typically goes silent: no signal, no data, sometimes just "SOS only". Many victims interpret this as a network glitch. That window – before the victim reports the outage to their carrier – is the attacker's operational runway.

With the number redirected, the attacker triggers password-reset flows on every account tied to that number. Email first, then exchange accounts, then any custodial wallet tied to the same email. SMS-based two-factor authentication codes arrive on the attacker's device. The victim's own authentication app codes – the safer alternative – become irrelevant if the account also accepts an SMS backup path, which many platforms still do.

In our experience, the most damaging SIM-swap cases involve victims who had enabled an authenticator app but had not disabled the SMS fallback route. That single residual vector is all the attacker needs.

How are the stolen assets moved on-chain?

Once withdrawals begin, the attacker's priority is speed and distance from the source address – not invisibility. Public blockchains record every transfer permanently, so the attacker's strategy is to make attribution difficult, not to erase the trail.

The typical layering sequence runs in three phases.

The first phase is rapid dispersal. Funds leave the compromised exchange account to one or several attacker-controlled wallets, often within the same block or in consecutive blocks. Large balances may be split across multiple addresses immediately. This complicates tracing by creating a fan-out pattern, but each hop is recorded.

The second phase is obfuscation. Attackers use one or more of the following: cross-chain bridging protocols (moving assets from one blockchain to another to break the chain-analytics trail); decentralised exchange swaps (converting one token to another without a custodian); mixers or privacy-coin conversions (introducing anonymity layers). None of these is invisible to a trained analyst. Bridging transactions leave entry and exit records. Mixer outputs are statistically attributable using wallet-clustering and attribution methods. Privacy-coin conversions require an on-ramp and an off-ramp, both of which carry risk for the attacker.

The third phase is cash-out. At some point, the attacker must convert digital assets to fiat or to a form they can spend. That almost always requires interacting with a regulated venue – a centralised exchange, a virtual-asset service provider (VASP), or an over-the-counter desk. These are the choke points. They hold know-your-customer records, they respond to legal process, and – critically – they can freeze balances on receipt of appropriate legal orders.

Does this mean recovery is certain? No. Timing determines whether a freeze is possible. If the cash-out completes before a disclosure order reaches the exchange, the trail may still exist on-chain but the fiat is gone. That is why the hours immediately after a SIM-swap discovery are the most consequential period in any recovery effort.

For a broader view of how stolen crypto is traced after cash-out, see our analysis of tracing crypto cashed out through the Bahamas.

What makes SIM-swap theft harder to recover from than other crypto fraud?

SIM-swap theft occupies an uncomfortable middle ground in the recovery typology. It is not a smart-contract exploit – no protocol flaw is being unwound. It is not a romance scam where the victim consented to transfers and must argue vitiation. The theft is clear. But the speed and the mobile-carrier involvement create complications that other crypto fraud does not.

Three features distinguish SIM-swap recovery matters from simpler cases.

First, the attack origin is domestic in many cases. The attacker exploited a local carrier's identity-verification failure. This creates a potential civil claim against the carrier in the victim's home jurisdiction – a separate recovery path that runs in parallel to on-chain tracing. We regularly advise clients to preserve evidence of the carrier's security failure from the first day.

Second, the layering phase moves quickly across blockchains. A single hop through a bridging protocol moves the asset from one chain's universe of analytics tools to another's. Coverage is uneven. Some chains have deep on-chain tracing infrastructure; others do not. Cross-chain movements require coordination between different tracing methodologies, which adds time and cost.

Third, the attacker's identity is often partially known. SIM-swap attackers interact with carrier staff, sometimes in person. They may reuse addresses or cash-out accounts linked to prior incidents. This means law enforcement interest is sometimes higher than in pure on-chain fraud – a factor that affects the decision on whether to run a parallel criminal complaint alongside civil tracing.

A matter in the Asia-Pacific region, early 2024, involving losses in the mid-six figures, illustrated this pattern clearly. The victim's mobile carrier had processed the SIM transfer without satisfactory identity verification. On-chain tracing identified the cash-out exchange within 48 hours. A disclosure order against the VASP was coordinated with local counsel in the relevant jurisdiction. The attacker's account held residual balances at the time the order was served. Civil proceedings against the carrier were initiated separately. Neither track was certain; the carrier proceeding in particular depended on facts specific to that jurisdiction's negligence regime.

Which legal instruments apply, and in what order?

Legal instrument selection after a SIM-swap theft follows a sequence driven by time and by what is known at each stage.

In the first hours, the priority is interim relief and information. If on-chain tracing has identified a likely cash-out exchange, a disclosure order against the VASP is the most immediate target: it compels the exchange to produce account details tied to the receiving wallet. A freezing order over the specific digital assets – or the account holding them – can follow immediately if the disclosure confirms a balance. Both applications are typically made without notice, to avoid tipping off the attacker.

Where the exchange is in a different jurisdiction from the victim or their lawyers, a foreign disclosure order may need to be recognised locally, or a parallel application made in the exchange's home jurisdiction. This is the first of the cross-border friction points. Response time at foreign VASPs varies by jurisdiction. Some have established cooperation protocols; others require full local proceedings before they respond.

A proprietary injunction – establishing the victim's beneficial ownership of the stolen assets – supports the freezing order and is particularly important where the assets have passed through multiple hands or where a third party now holds them. A proprietary injunction against "persons unknown" is available in certain jurisdictions where the attacker's identity has not yet been confirmed.

Where assets have moved through a mixer or across chains and the full trail is not yet resolved, a Norwich Pharmal order may be sought against the exchange or VASP at the next identifiable choke point. This compels disclosure of information the third party holds that could identify the wrongdoer – even if the third party is innocent of the fraud itself.

In parallel, a Bankers Trust order may be appropriate where the assets touched a traditional banking layer – for example, when proceeds were converted to fiat and wired through a correspondent bank. This order compels the bank to disclose account information to assist tracing.

If the matter has an arbitral dimension – for example, the exchange has an arbitration clause in its terms – enforcement of arbitral awards under the New York Convention may become relevant at a later stage. This is not a first-response tool, but it matters for long-run enforcement strategy in jurisdictions where court recognition of foreign judgments is slow.

To explore the full range of tracing and freezing mechanisms available, visit our asset tracing service overview.

What is the right order of operations in practice? That depends on where the assets are sitting at the moment the victim first engages a recovery specialist. There is no universal sequence. The decision matrix is: where are the assets now, what forum can act fastest, and what information is needed before a freezing application is viable?

How does the cross-border dimension change the recovery calculus?

The attacker rarely uses an exchange in the same jurisdiction as the victim. That is not coincidence – it is design. Cross-border dispersal slows legal process and adds cost. Understanding the specific friction points is essential to planning a realistic recovery effort.

Forum selection is the first problem. A freezing order granted in England, for example, does not automatically operate in a jurisdiction where the exchange is located. It must either be recognised locally or a parallel application must be made. Some jurisdictions have fast-track recognition procedures; others do not. In our experience, the difference between a jurisdiction that acts in days and one that acts in months is often the difference between recoverable and unrecoverable.

The second problem is VASP cooperation. Not all exchanges respond uniformly to legal process. Some centralised exchanges have compliance teams that respond to properly served orders within hours. Others require domestic court orders in their own jurisdiction before they engage. An exchange incorporated offshore may have a compliance posture governed by that territory's regulatory environment, which may be less developed than the victim's home jurisdiction.

Third, stablecoin issuers occupy a distinct and increasingly important position. A stablecoin issuer can, on appropriate legal process, freeze specific token balances on-chain – a form of interim relief that bypasses the exchange entirely if the stolen funds include a major stablecoin. This is a fast and powerful tool, but it depends on the issuer's policies and on the jurisdiction in which legal process is served.

Fourth, privacy-coin conversions create a cross-chain dead end in some cases. If stolen funds enter a high-privacy chain with no bridge back to a transparent ledger, tracing may stall. This is not universal – in-flow and out-flow analysis can sometimes reconstruct the path – but it represents a genuine limit that any honest practitioner must acknowledge to a client.

A matter in western Europe, summer 2023, involving losses in the high six figures, illustrated the forum-selection problem directly. The victim's jurisdictions could grant freezing relief quickly. The exchange holding the assets was incorporated in a territory where domestic proceedings were required. By the time a parallel application was made in that territory, the attacker had initiated a partial withdrawal. The remaining balance was frozen; a significant portion had already cleared. Earlier engagement – by 12 to 24 hours – would likely have captured a larger share. That is not a guarantee; it is an observation about the mechanics of the process.

What is the honest limit of on-chain tracing in SIM-swap cases?

On-chain tracing is a powerful instrument. It is not infallible. Setting accurate expectations at the outset protects a victim from making decisions based on false confidence.

The clearest limit is speed of layering. If the attacker completes all three phases – dispersal, obfuscation, cash-out – before a recovery specialist is engaged, the trail still exists on-chain, but there may be nothing to freeze. Tracing then becomes an evidence-gathering exercise to support litigation or a criminal complaint rather than an emergency asset-preservation measure. Both have value, but neither returns money as quickly as a successful early freeze.

A second limit is chain coverage. Blockchain-analytics tools have deep coverage of major chains. Coverage of newer or lower-volume chains is thinner. Cross-chain movements to less-covered environments create gaps. These can sometimes be bridged by following the in-flow transaction on the destination chain, but not always.

A third limit is the mixer question. Mixers do not make tracing impossible – statistical attribution and wallet-clustering methods have improved materially. But they add time and uncertainty. In a fast-moving recovery, uncertainty costs. A recovery specialist who tells a client that a mixer "solves" the problem is overstating the attacker's success; one who says it "ends" tracing is overstating the obstacle. The honest position is that it raises the cost and the time of attribution.

A fourth and often underappreciated limit is attacker sophistication. Most SIM-swap attackers are not sophisticated crypto launderers. They make operational security errors: address reuse, predictable timing patterns, cash-out to accounts they have used before. This is an advantage for tracing. A small number are more sophisticated. The appropriate level of resource to commit to a recovery effort depends on an early read of which category the attacker falls into.

The myth that "once crypto leaves your wallet nothing can be done" is exactly that – a myth. Public blockchains are transparent. Movement leaves a trail. Whether that trail leads to a recoverable balance depends on timing, on the attacker's errors, and on the quality of the recovery response. No practitioner should promise recovery; but no practitioner should dismiss the possibility without first examining the chain.

That said, some matters are not viable to pursue. The cost of multi-jurisdictional proceedings may exceed the recoverable amount. The trail may be genuinely cold. An honest assessment of viability – early, before significant fees are committed – is the most important service a recovery specialist can provide. You can assess the viability of your matter at our crypto recovery insight hub.

The steps above describe the typical pattern. Your matter turns on specific facts: where the funds went, how fast, which chains were used, and which forums can act. A confidential case review tells you whether it is worth pursuing and what the realistic options are. Contact Axiom Trace at info@axiomtracel.com to request one.

How recovery scams exploit SIM-swap victims – and how to spot them

SIM-swap victims are a targeted population for recovery fraud. The timing is deliberate: fraudsters monitor incident reports, social-media disclosures, and even law-enforcement announcements to identify recent victims. A victim who has just lost a significant sum and has been told "nothing can be done" is exactly the profile that recovery scammers seek.

The recovery scam playbook is recognisable once you know it. The fraudster presents as a specialist – sometimes impersonating a law firm or a government agency. They claim proprietary tools or law-enforcement connections that can reverse the transaction. They charge an upfront fee, often framed as a "processing cost", a "tax clearance", or a "smart-contract deployment fee". Once paid, they either disappear or demand further fees. No assets are recovered. The victim has now lost twice.

The distinguishing features of a legitimate recovery specialist are different. A real practitioner will not promise recovery. They will not charge a fee before assessing whether recovery is viable. They will explain the instruments being used – a freezing order, a disclosure order against the VASP – in concrete terms. They will coordinate with local counsel where proceedings require it, rather than claiming to bypass local courts entirely. And they will acknowledge, plainly, when a matter is not worth pursuing.

In our experience, the single most reliable signal of a recovery scam is the guarantee. No legitimate practitioner guarantees recovery of crypto assets. Any firm that does is either misrepresenting its capabilities or running a second fraud against an already-defrauded victim.

Related topics in crypto asset recovery

• Crypto asset recovery: hub and overview of techniques – the full range of on-chain tracing and freezing tools explained.
• Asset tracing service – how Axiom Trace traces assets across borders and on-chain, from first instruction to enforcement.
• Tracing crypto cashed out through the Bahamas – a worked analysis of cross-border cash-out tracing in a specific offshore context.

Frequently asked questions

Q: Can stolen crypto really be traced and frozen?

A: Yes, in many cases – but outcome depends on timing and the attacker's conduct. Public blockchains record every transfer permanently, so on-chain tracing can follow stolen assets through swaps, bridges, and mixer hops to a cash-out point. At that point, a freezing order over the digital assets or a disclosure order against the virtual-asset service provider can interrupt the process. The earlier the engagement, the greater the chance of reaching a balance before it converts to fiat and disperses further.

Q: How quickly do I need to act after a crypto theft?

A: Hours matter, not days. A SIM-swap attacker's cash-out sequence can complete within 24 to 48 hours of the initial compromise. Once fiat leaves a regulated exchange, the on-chain trail still exists but the recoverable balance may not. Engaging a recovery specialist on the same day as the discovery – with evidence of the compromise, the affected addresses, and the exchange accounts involved – maximises the window for urgent interim relief, including a without-notice application for a freezing order.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate specialist does not guarantee recovery, does not charge upfront fees before an honest viability assessment, and names the instruments being used – a worldwide freezing order, a Norwich Pharmal order, a proprietary injunction – in plain terms. A recovery scam promises guaranteed results, asks for fees framed as processing or tax costs, and produces nothing. If anyone contacts you unsolicited after a theft, claiming they can reverse the transaction for a fee, that is a second fraud. Axiom Trace provides a confidential viability assessment before committing any resources to a matter.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We have traced stolen digital assets across multiple chains and coordinated urgent without-notice applications in several jurisdictions, in matters where hours determined the outcome. We assess viability honestly and will tell you plainly when a matter does not justify the cost of pursuit. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.