Coinbase SIM swap

A SIM swap attack is a quiet and clinical theft that begins with a simple human weakness and ends with irreversible loss, and understanding it demands both precision and caution. In this fraud, an attacker convinces a mobile carrier to reassign a victim’s phone number to a SIM card the attacker controls. Once the number is ported, the attacker can intercept SMS messages and voice calls and thus receive one-time codes used for two-factor authentication. The result is that any custodial account tied to that phone number becomes vulnerable to takeover. Many people discover this only after digital assets have been moved away. Storing coins on a custodial platform creates a single point of failure because access is governed by web-style credentials and secondary checks that rely on the phone network. A mistake in custody is not merely an error in convenience; it transforms trust into exposure. Preventive measures are straightforward and still rarely used. First, avoid SMS-based two-factor authentication for sensitive accounts. Use app-based authenticators or cryptographic passkeys when available. Second, move assets you truly need to protect into non-custodial storage where private keys are held outside any third party. Hardware wallets and offline key storage remove the phone channel from the attack surface. Third, harden your mobile account with carrier-level protections such as port freezes or unique PINs, and minimize public exposure of identifying data that could help social engineering. Fourth, employ transaction defenses like multisignature setups and time-delayed withdrawals to create friction for attackers. Fifth, maintain vigilant account hygiene by using unique passwords, monitoring for unrecognized SIM activity, and keeping recovery phrases physically segregated and encrypted. If a SIM swap is suspected, act fast: contact the carrier, lock accounts, and alert service providers to prevent further transfers. Remember that technology that promises convenience often converts into a lever for coercion if custody is ceded. Treat your phone number as an authentication token that can betray you, and design your security to assume that any single channel can fail. In this field, resilience is built by reducing single points of control and by moving secrets into forms that cannot be commandeered by a misplaced SIM.