A SIM swap that moved the price of bitcoin

Why this case matters

Most SIM swap prosecutions involve a stolen cryptocurrency wallet. This one involves a federal regulator’s social media account and a measurable movement in a global market — which makes it an unusually clear illustration of what a phone number is actually worth.

The Justice Department’s own description of the technique is worth quoting for its plainness: a SIM swap is where a criminal “fraudulently induces a cellular phone carrier to reassign a cellular phone number from a victim’s SIM card to a SIM card controlled by the criminal actor, in order to access a victim’s social media or virtual currency accounts.”

The method was analogue

There is no exploit here, no malware and no clever cryptography. Council used an identification card printer. He made a physical fake ID from personal details supplied by co-conspirators, presented it to a mobile carrier, and asked them to move a phone number.

That is the entire attack. The security of every account that used that number for password resets came down to a retail employee looking at a plastic card.

What the number controlled

Once the number moved, the co-conspirators could reset the password on the account it protected — in this case the SEC’s — and post as the chairman of a financial regulator. Bitcoin rose more than $1,000 per coin in the minutes that followed, and fell more than $2,000 after the correction.

The same mechanism applied to an individual reaches their email, their bank, and any cryptocurrency exchange account that uses text-message verification. The phone number is not one credential among many; it is the key that resets all the others.

What it tells you about the scheme

The practical defence follows directly from the method. Because the attack happens at the carrier rather than on your device, no amount of care with your own passwords prevents it — which is why the useful measures are a port-out PIN or number lock with your carrier, and moving two-factor authentication off SMS and onto an authenticator app or a hardware key wherever the option exists.