How One SIM Card Brought Down a Crypto Empire

Picture this: someone sneaks into your mobile carrier, hijacks your phone number, intercepts your codes—and suddenly, your fortress is breached. That’s exactly how the infamous 2022 FTX hack went down—through a SIM-swap attack that exposed epic security failures and drained $400 million in crypto.

FTX’s Security Blind Spots
FTX relied on SMS-based two-factor authentication (2FA) and had thin controls over their cloud and transaction systems. These shortcomings created the perfect breeding ground for disaster:

Attackers pulled off a SIM swap to claim control of phone numbers tied to critical accounts.
With One-Time Paswords intercepted, they reset passwords, escalated privileges, and unlocked FTX’s online wallets and backend systems.
From there, fund transfers rolled out without triggering alarms.
By the time FTX’s systems should have caught on, it was too late.

 
The Fallout: Confidentiality, Reputation, and Bankruptcy
- Confidentiality
Attackers exposed secret keys and wallet credentials, making off with massive sums.

- Integrity
The system itself held together (no blatant data corruption), but trust crumbled.

- Business & Brand Damage
FTX collapsed under financial strain. Bankruptcy followed, as did a fiendish reputation—new management even called it “the most complete failure of corporate controls” he’d ever seen.

 
The Anatomy of Failure: What Went Wrong
- Weak Identity & Access Management (IAM). Relying on One-Time Passwords sent via SMS left FTX vulnerable to interception.

- Lax internal controls. Poor segmentation and change controls let attackers roam.

- Zero transaction oversight. No red flags raised for abnormal fund flows.
These missteps weren’t random—they formed a chain reaction attackers exploited end to end.

 
How This Could Have Been Avoided
FTX might still be standing with better controls in place. Here’s what they—and any financial or crypto platform—should enforce:

- Preventive Measures
Move beyond OTP: adopt hardware keys, passkeys, or biometric MFA.
Enforce the principle of least privilege: restrict what each user or system can do.
Lock down change paths: require approvals for configuration or access changes.
Make sure user deprovisioning is robust and automatic.

- Detective Measures
Monitor SIM-association changes or sudden authenticator reconfigurations.
Use anomaly detection on transactions and login patterns.
Regularly review access rights and enforce separation of duties.

- Corrective Measures
Assemble a rapid incident response plan tailored for stolen crypto or wallet access.
Rotate cryptographic keys regularly so a compromise has limited window.
Build clawback or escrow mechanisms to recover unauthorized transactions when possible.
Back up critical data and configs securely, so you can restore what’s lost.