Mechanics of a Crypto Heist: How SIM Swappers Can Steal Cryptocurrency

Recently, I shared with you how alarmingly simple it was to not only "hack" my own email account but then to use that compromised account to hack my other online accounts. Given how SIM-swap attacks on cryptocurrency exchanges escalated in 2019, I wanted to better understand these modern-day bank heists as we go into the new year. My hunch was that SIM swappers were using hijacked phone numbers like a set of keys to open locked doors into a world of online crypto accounts. Would I (or a hacker) have the same success hacking my crypto exchange accounts using just my phone number?

The first step in hacking my cryptocurrency accounts was gaining access to my personal email account with just a phone number. As I did in my first "hacking" experiment, I chose the "forgot password" option on my Yahoo account and was able to reset the password using only my publicly available username (my email address) and an SMS code sent to my mobile phone.

The fact that I only needed to type in the SMS code sent to my mobile phone indicates that single-factor authentication was in place here, not two-factor authentication (2FA). 2FA is the practice of authenticating to an account using (1) something you know, (2) something you have, or (3) something you are (biometrics). In the case of the SMS code, I simply had to type in "something I had" without a second factor proving my identity. This means a hacker who SIM-swapped my phone number would be able to reset my email account within a matter of minutes, even though I added my number to these accounts for added security. (You can read more about how SIM swapping works in my earlier experiment.)

After resetting my email password with an SMS code sent to my phone number (which could have been swapped to a hacker), the next step involved using that email access to identify and reset passwords on my cryptocurrency accounts. For a cybercriminal, the end goal is transferring bitcoin or other crypto assets to the attacker's crypto wallet.

I navigated to my first cryptocurrency account (let's call it Account #1), entered my publicly available email address as my username, and chose the "forgot password" option. Account #1 sent an email message to my now "hacked" Yahoo account. I was able to click the password reset link, enter an SMS code from my (SIM-swapped) mobile phone, and change the password on Account #1.

I tried the same technique with my second crypto exchange account (Account #2). This account did offer the option for application-based 2FA (such as Google Authenticator), but I had disabled that in favor of traditional password authentication. Given these settings, when I clicked "forgot password," I received a simple password reset link to my (hacked) Yahoo account that allowed me to set a new password and gain full access to Account #2.

At this point, I had gained access to an email account and two cryptocurrency accounts in about 10 minutes or less. These steps demonstrate how an attacker receiving text messages to a compromised mobile number could take over email accounts and easily gain access to crypto funds. Had I been an attacker, I could have quickly transferred crypto assets from my exchange accounts to a series of other crypto wallets and laundering sites that would funnel the money through various untraceable paths. This would leave the victim with little recourse to recoup the stolen assets.

Some cryptocurrency platforms have built-in mechanisms to prevent a SIM swapper from facilitating such a quick compromise of accounts. For example, one exchange where I opened an account (Account #3) allows single-factor authentication but implements a 24-hour lockout period before the password reset will take place. This effectively times out SIM swappers who have a short window in which to empty accounts before the stolen number is retrieved by its rightful owner.

This table highlights the variability in SMS authentication security options offered by crypto exchanges:

As I learned firsthand, several exchanges still allow for password resets via a link sent to an email account, which could easily be hacked by a SIM swapper in control of a phone number. Most exchanges offer stronger application-based 2FA for resetting passwords, but many still allow users to default to weaker single-factor authentication. For example, my Account #2 defaulted to application-based 2FA during registration, but users can log in before enabling this setting.

Similarly, while Account #1 offers more secure forms of 2FA such as application-based options, it also allows users to opt for SMS-based authentication settings that created the vulnerability in this experiment. Traditional bank accounts generally require more in-depth authentication to reset a password, such as Social Security number or security questions. Until cryptocurrency accounts implement similar password reset requirements, SIM swappers will continue to target these exchange accounts using the techniques outlined above.

It's clear that the true vulnerability at the heart of SIM-swap attacks on crypto accounts lies in crypto exchanges' and email providers' variable implementation of 2FA. Until all crypto exchanges force the implementation of more secure application-based 2FA, these vulnerabilities will continue to allow for SIM-swapping attacks against crypto accounts.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "5 Pieces of GDPR Advice for Teams Without Privacy Compliance Staff."