SIM Swaps and Phishing: A Beginner’s Guide to Protecting Your Crypto From Social Engineering

The summer of 2023 delivered a harsh lesson in crypto security when Uniswap founder Hayden Adams had his Twitter account hijacked through a SIM-swap attack on July 21. Just one day later, CoinList’s official account met the same fate. These incidents, which collectively endangered millions of dollars in user funds, highlight a critical gap in most crypto investors’ security knowledge. If the founder of one of DeFi’s most important protocols can fall victim to social engineering, anyone can. Here is what you need to know to protect yourself.

The Basics

A SIM-swap attack occurs when a criminal convinces your mobile phone carrier to transfer your phone number to a SIM card they control. Once they have your number, they can receive your SMS messages and phone calls — including the verification codes used for two-factor authentication. From there, they can reset passwords on your email, social media, and exchange accounts, gaining access to your digital life within minutes.

Phishing attacks work differently but often in tandem with SIM swaps. In a phishing attack, the criminal creates a fake website that looks identical to a legitimate crypto platform. They then distribute links to this fake site through compromised social media accounts, emails, or direct messages. When you connect your wallet or enter your credentials on the fake site, the attacker captures everything they need to drain your funds.

The combination is particularly dangerous. In the Hayden Adams case, the attacker used a SIM swap to take over his Twitter account, then used that trusted account to distribute phishing links to his followers. The same criminal group had reportedly stolen $3.6 million from 358 victims through 23 different phishing websites before even targeting Adams.

Why It Matters

These attacks matter because they exploit trust, not technology. The blockchain itself may be secure, but the systems we use to interact with it — social media, email, phone networks — are far from impenetrable. When a trusted figure like the Uniswap founder posts a link, most followers assume it is legitimate. The attack works because it bypasses our normal skepticism by leveraging authority and urgency.

The financial impact is substantial. With Bitcoin trading around $29,908 at the time of these attacks, even a small successful phishing campaign could extract significant value. The $3.6 million stolen by the group behind the Adams hack represents real losses for real people, many of whom may never recover their funds.

Getting Started Guide

Step 1: Replace SMS two-factor authentication. This is the single most important change you can make. Go through every account that matters — especially your email, exchange accounts, and social media — and switch from SMS-based 2FA to an authenticator app like Google Authenticator, Authy, or Microsoft Authenticator. For maximum security, invest in a hardware security key like a YubiKey, which provides phishing-resistant authentication through the FIDO2 standard.

Step 2: Secure your email first. Your email account is the master key to your digital identity. If an attacker gains access to your email, they can reset passwords for virtually every other account you own. Use the strongest available authentication on your email, and consider creating a separate email address exclusively for cryptocurrency-related accounts.

Step 3: Verify before you click. Never click a link in a social media post or direct message without independently verifying its legitimacy. If a project announces something important, navigate to the project’s official website directly by typing the URL yourself. Check the URL carefully — phishing sites often use subtle misspellings or extra characters that are easy to miss.

Step 4: Use a hardware wallet. For any significant crypto holdings, a hardware wallet like a Ledger or Trezor provides a critical layer of protection. These devices keep your private keys offline, making them immune to phishing attacks that trick you into revealing keys through a malicious website. Even if your computer is compromised, a hardware wallet ensures that transactions require physical confirmation on the device.

Step 5: Enable a PIN or carrier port-out protection. Contact your mobile carrier and ask about port-out protection, which adds an additional verification step before your number can be transferred to a new SIM card. Some carriers offer this as a free security feature that can be enabled with a simple phone call.

Common Pitfalls

The most common mistake is assuming that attacks only happen to other people. The victims of the phishing campaigns in mid-2023 were not careless beginners — they were active crypto users who trusted a link from what appeared to be a legitimate source. Always maintain a healthy skepticism, regardless of who is sharing the link.

Another frequent error is reusing passwords across services. If one service is breached, attackers will try the same credentials on every other platform. Use a password manager to generate unique, strong passwords for each account. This limits the damage from any single breach to just one service.

Finally, many users neglect to regularly audit their wallet permissions. Every time you connect your wallet to a dApp or approve a token transfer, you create a potential attack vector. Use tools like Revoke.cash to review and revoke unnecessary approvals periodically.

Next Steps

Start today by auditing your authentication methods across all crypto-related accounts. Replace SMS 2FA with authenticator apps or hardware keys. Set up a hardware wallet for long-term storage of significant holdings. Create a bookmark folder with the official URLs of every platform you use regularly, so you never need to click links from social media or emails. These simple steps take less than an hour to implement but can protect you from the most common and devastating attacks in the current threat landscape.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with qualified professionals before making security decisions regarding your digital assets.