A Midnight Carrier Port-Out That Emptied an Exchange Account by Morning

01How the takeover happened

The claimant did everything most people are told to do. Her exchange account used a password manager and SMS two-factor authentication. The weak link was the SMS itself. An attacker, using personal details likely bought from a prior data breach, contacted her mobile carrier and convinced them to port her number to a new SIM.

Once the number moved, every SMS code went to the attacker. They triggered a password reset on her email, then on her exchange, intercepting each one-time code. Within ninety minutes they had full control of an account holding roughly £88,500 in BTC and ETH.

02Where the funds went

The attacker initiated two withdrawals — one in BTC, one in ETH — to fresh external wallets, then immediately began moving the BTC toward a swap service to convert it into a privacy coin. Speed was their whole strategy: get the assets off the exchange and through a converter before anyone noticed.

The claimant noticed her phone had no signal at around 6 a.m., realised what had happened by 7, and contacted us the same morning. That timing is the single most important fact in this case. The ETH withdrawal had confirmed but had not yet moved further; the BTC was mid-conversion.

I always thought a SIM swap was something that happened to crypto influencers, not to a pharmacist who just wanted a retirement pot. The clock was the only thing on my side.

03How we recovered most of it

1. 01
   Locked the account first. We walked her through the exchange’s emergency account-freeze and got her carrier to reverse the port and restore the number under a port-freeze PIN.
2. 02
   Flagged the destination wallets. We identified both withdrawal addresses and the swap service the BTC was heading into, and submitted them to the exchange’s security team with timestamps while the funds were still in transit.
3. 03
   Caught the ETH before it laddered. The ETH had landed in a single external wallet and had not been split. The exchange, acting on our flagged report and her police crime reference, coordinated with the receiving platform to freeze it.
4. 04
   Chased the converting BTC. Part of the BTC had already cleared the swap into a privacy coin and was lost. The remainder, still queued, was held at the swap service after an abuse report.
5. 05
   Reconstructed for the bank and insurer. We packaged the full timeline for her crime report and an identity-theft insurance claim covering the unrecovered portion.

04Threat indicators

• A phone that suddenly loses all signal for no reason — the first sign of a port-out.
• SMS used as the only second factor on a high-value account.
• Password-reset and login emails you did not request, arriving in a burst.
• A carrier account with no port-freeze PIN or port-out protection enabled.
• Withdrawals to brand-new external addresses immediately followed by a swap to a privacy coin.