Hackers hijack cell phone numbers to drain cryptocurrency wallets, pointing to security weaknesses at both carriers and wallet services
Hackers have discovered that one of the most central elements of online security — the mobile phone number — is also one of the easiest to steal.
Context & Ripple Effects
The attack chain here was demonstrated years earlier: Karsten Nohl's 60 Minutes SS7 eavesdropping demo showed that knowing only a phone number was enough to intercept calls and texts, and hackers then used the same protocol weakness to intercept two-factor banking codes. This article extends the pattern from bank accounts to cryptocurrency wallets, where a hijacked number plus an SMS code can mean irreversible theft.
The corpus also shows where this goes next: within a year, Motherboard documented OGUSERS, a forum trading handles stolen via SIM hijacking, meaning the technique moved from skilled SS7 exploitation to social-engineering carrier customer service at scale.
First-order effects
- Cryptocurrency holders who rely on SMS-based two-factor authentication are directly exposed: once a carrier ports their number to an attacker's SIM, password resets and login codes route to the thief, and wallet balances are drained with no reversal mechanism.
- Carriers' customer-service porting processes are revealed as the weakest link, since a bribe or a convincing phone call defeats controls designed for lost phones, not account takeover.
Second-order effects
- Wallet services and exchanges face pressure to stop treating a phone number as proof of identity, pushing them toward hardware tokens and app-based authentication rather than carrier-delivered codes.
- The irreversibility of crypto transfers makes these attacks more damaging than the bank-account versions seen in the SS7 coverage, giving carriers a liability and reputational problem they did not face when stolen codes emptied reversible accounts.
Third-order effects
- If phone numbers remain the universal recovery anchor, every documented weakness in carrier infrastructure — SS7 interception, the later mass theft of call records from over ten providers worldwide, and newly found 4G/5G flaws — becomes an authentication vulnerability for finance, not just a privacy one.
- The pattern points toward a structural split in which high-value accounts migrate off the phone network entirely, leaving SMS verification for low-stakes services and concentrating telecom security failures among users who cannot move.
The trend: Authentication is being forced off the phone number and the carrier signaling stack, as each new telecom exploit converts SMS-based two-factor codes from a security feature into an attack vector.