Most stolen crypto is not taken from wallets. It is withdrawn from accounts, by somebody who logged in normally, using codes that arrived on the victim's own phone.

The dramatic version of crypto theft involves a hacked wallet. The common version is duller and far more effective: somebody signs into an account that belongs to you, using your password and a code sent to your phone number, and withdraws.

Nothing was broken. Every step was the normal login process working exactly as designed, for the wrong person.

The order in which accounts fall

Almost every takeover follows the same chain, and it does not start at the exchange.

1. The phone numberPorted to a new SIM by somebody who called the carrier with your name, date of birth and address. None of those are secret.
2. The email accountReset using an SMS code that now arrives on their phone. Email is the master key to everything else.
3. The exchangeReset from the email. Some platforms delay withdrawals after a password change; the good ones do, and it saves people.
4. Everything with the same passwordBecause reused passwords from old breaches are already in a searchable list, and they try them all.

Read that backwards and the defence becomes obvious: protecting the exchange account while the email that can reset it is protected by a text message is fixing the wrong lock.

Slide the picture sideways →

Why SMS is the weak point

A phone number is not something you own; it is something a carrier assigns and can reassign. Reassigning it requires convincing a shop assistant or a call-centre agent, and the information needed to do that is routinely available — data breaches, social media, a delivery label in a bin.

Once the number moves, the codes move with it. Your phone loses signal, and if that happens overnight you find out in the morning.

The second factors, ranked by what they resist

SMS codes stop a stolen password and nothing else. They fail against a SIM swap, which is precisely the attack aimed at people with money on an exchange.

Authenticator apps generate codes on the device itself, so there is no number to hijack. They still fail if you type the code into a convincing fake page, because the attacker relays it within the thirty seconds it lives.

Hardware keys and passkeys are bound to the site's real address. On a fake page they simply do not respond — not because the user was careful, but because the key cannot be persuaded that the wrong domain is the right one. This is the only factor that fails safely.

Anything is better than nothing, and the gap between SMS and an authenticator app is smaller than the gap between an authenticator app and a key.

What the attacker does once inside

Rarely an immediate withdrawal. First: change the email, add their own second factor, remove yours, and where possible generate an API key — because an API key survives you regaining the password. Then withdraw, often in several transactions sized under whatever threshold triggers a manual review.

This is why the recovery conversation with support turns on timing. An account regained in an hour is usually intact; one regained the next day frequently is not.

What actually reduces the risk

Take the phone number off the recovery path. On the email account first, then everywhere else. Where a platform insists on holding a number, add a carrier-level port-out PIN or lock — most carriers offer one and almost nobody asks.

Give the email account the strongest factor you have. It is the root of the tree. A hardware key on the email is worth more than one on any single exchange.

Use a different address for money accounts. Not a secret one — just one that has never been posted, sold, breached or used to sign up for anything.

Turn on withdrawal address whitelists where they exist, with the delay. It converts a theft into an alarm.

Check active sessions and API keys occasionally. A key you did not create is the clearest possible signal, and it is visible in the account settings of every serious platform.

If it is happening now

Speed beats completeness: carrier first, email second, exchange third, and the platform's support channel from a device you are certain about. The ordered version is on the page for exactly this, and if your funds are gone covers what comes after.