A Wallet Drained Within Minutes of a SIM Swap
A client's mobile carrier account was compromised, allowing an attacker to intercept a one time passcode and access a wallet holding a significant BTC balance. The full balance was transferred within minutes.
The Situation
A client's mobile carrier account was compromised, allowing an attacker to intercept a one time passcode and access a wallet holding a significant BTC balance. The full balance was transferred within minutes.
The Challenge
The client had no prior experience with blockchain records and had already lost access to the compromised accounts by the time our team was engaged, limiting the device side evidence available.
The Investigation
We reconstructed the transaction history from the point of compromise, modeled the pattern of onward transfers, and cross referenced the client's carrier records to establish a precise timeline.
Findings
The funds passed through two intermediate wallets and a bridge between two blockchain networks before arriving at a wallet cluster associated with a regulated exchange.
Outcome
A structured evidence package was submitted to the identified exchange's legal request process. The exchange froze the remaining balance at the deposit address and, following the completed legal process, released a portion of the funds back to the client.
Lessons
Acting quickly to preserve transaction identifiers and account records materially improved how much could be reconstructed. Recovery, where it occurs, depends on the exchange and the legal process working together with the investigation, not on any single step alone.
Origin Wallet
Wallet from which the unauthorized transfer originated.
Facing a similar situation?
Every case is scoped on its own facts. Tell us what happened.