Yes, a SIM swap crypto theft can often be investigated, and the fastest way to improve your odds is to secure your phone number and preserve transaction and carrier records right now. Investigators and forensic analysts can sometimes trace the stolen funds, and law enforcement can sometimes seize them, but outcomes vary and speed matters. Start with your carrier, your accounts, and your transaction IDs.
TL;DR:
- Call your carrier to lock or reverse the transfer and request account logs and recordings; replace SMS verification with an authenticator app or security key.
- File an IC3 complaint and notify local police, because a formal report supports subpoenas and forfeiture requests; preserve timestamps, tickets, screenshots, and original emails.
- Transaction hashes, wallet addresses, and timestamps let analysts follow funds, while carrier logs and full email headers can help establish how the takeover happened.
- Contact exchanges immediately to request an emergency hold, since attackers may move funds within minutes and cryptocurrency payments are typically irreversible.
- A forensic specialist can trace wallets and prepare technical reports for court, but only police and prosecutors can compel records or seize assets.
Table of Contents
- What should you do in the first 24 to 72 hours?
- Which evidence do investigators and prosecutors need?
- How does blockchain forensics trace stolen funds?
- What does a federal response look like in practice?
- When does a specialist investigator make sense?
- How can we help you right now?
- FAQ
- Sources
What should you do in the first 24 to 72 hours?
The first hours decide how much evidence survives. Work through these steps in order:
- Call your mobile carrier and report the SIM swap. Ask for an emergency lock on your number, a reversal of the reassignment, and copies of the account-change logs and any call recordings.
- Secure your email and exchange accounts. Change passwords from a clean device, then replace SMS two-factor authentication with an authenticator app or a hardware key. The FBI notes that moving to phishing-resistant methods such as authenticator apps or security keys is the stronger setup, and that legitimate providers never ask for seed phrases or private keys.
- Contact every exchange and wallet provider involved. Send transaction hashes and account details, ask for an emergency hold, and write down what each platform requires. Our guide on exchange freezes explains what to expect.
- File an IC3 complaint and notify local police. A formal report is what lets prosecutors issue subpoenas and pursue forfeiture. The FBI’s IC3 advisory tells victims to contact their carrier, change passwords, and report the incident.
- Document everything: timestamps, screenshots, emails, call reference numbers, and any suspicious messages that came before the swap.
Pro Tip: Write a running timeline as you go, with the time you noticed the loss, each call you made, and each ticket number you received. Investigators rebuild events from exactly this kind of record.
If you also suspect your wallet itself is compromised, read what to do when a seed phrase is stolen. Our reporting steps cover the same ground in more detail.
Which evidence do investigators and prosecutors need?
Law enforcement has stressed that victims should keep transaction IDs, communication logs, and proof of account compromise, because these artifacts drive forensic tracing and legal action. Collect these items:
- On-chain records: transaction hashes, wallet addresses, exchange deposit and withdrawal IDs, and trade timestamps.
- Off-chain records: exchange account IDs, support tickets, screenshots of account changes, and the original email files with full headers saved as .eml.
- Carrier records: account-change logs, SIM activation or port timestamps, and call recordings, requested in writing from your carrier.
- Safe copies: exported CSV files from each exchange, raw .eml files, device screenshots, and a duplicate set stored off the compromised phone.
Why does each category matter? Hashes and timestamps let analysts follow the money. Carrier logs show when and how your number moved. Email headers can help attribute a scam message to its source, which is why we explain how to trace scammer emails.
Pro Tip: Do not edit, rename, or crop original files. Keep untouched originals in one folder and work from copies, so the evidence stays credible if it is ever reviewed in court.
Handling matters for admissibility too. Our digital evidence preservation guide covers how to keep a clean chain of custody.
How does blockchain forensics trace stolen funds?
Public blockchains record every transfer, so analysts can map where stolen assets went even when the thief uses many wallets. The core techniques are:
- Transaction graphing and cluster analysis, which follow outputs from wallet to wallet and group addresses likely controlled by the same actor, often leading to a hosted exchange that holds identity records. See our overview of transaction graph analysis.
- Obfuscation handling. Mixers, bridges, cross-chain swaps, and peel chains split and disguise funds. They complicate tracing but rarely make it impossible, and every extra hop the thief makes before cashing out raises the difficulty.
- Exchange and platform requests. Once funds reach a regulated platform, investigators can seek records through subpoenas or cooperation, and your formal report strengthens that request.
- Court-ready reporting. Findings are documented with preserved evidence and metadata so prosecutors, attorneys, and courts can rely on them. Our pages on wallet activity analysis and blockchain forensics explain the method.
Time is the limiting factor. Court records in one SIM swap prosecution show that attackers often move funds within minutes, so transaction timestamps and exchange logs need to be captured quickly. Cryptocurrency payments are also typically not reversible, as the FTC’s scam guidance points out, which is why contacting exchanges immediately matters. For the difference between watching wallets and running a full case, see transaction monitoring versus investigation.
What does a federal response look like in practice?
Federal authorities pursue these thefts with criminal indictments, civil forfeiture, and asset seizures, often working with exchanges and international partners. Results exist, though they are concentrated in larger cases.
In 2021, the FBI’s IC3 received 1,611 SIM swapping complaints with adjusted losses of more than $68 million. Scale like this is why SIM swapping draws federal attention.
Recent actions show what is possible. The Justice Department announced a $225 million cryptocurrency forfeiture action in June 2025, and it has sought forfeiture of bitcoin stolen in SIM swapping scams. On the infrastructure side, ICE HSI’s Operation Signal Break dismantled SIM farms, seizing more than 500,000 SIM cards and over 1,900 SIM boxes.
If your case draws federal interest, expect a slow process and limited updates. A clear technical report that ties your transactions to the suspect wallets makes it easier for prosecutors to act. If you wonder whether police will take up a smaller loss, our page on what to report to trigger an investigation explains how to frame it.
When does a specialist investigator make sense?
Law enforcement and private forensics do different jobs, and they work best together. We handle blockchain tracing, OSINT attribution, evidence preservation, and court-ready technical reports. Police and prosecutors can compel records and seize assets, while a specialist moves quickly on tracing, documents the trail, and supports exchange requests and civil follow-up. Expect the timeline to vary, with deliverables in writing, and keep supplying documents and answering questions promptly. Our view is that a SIM swap victim with a meaningful loss should assume the clock is already running.
— cristian
How can we help you right now?
We trace stolen funds, preserve evidence, and produce technical reports built for legal proceedings. If you want us to review your case, start at our cryptocurrency scam investigation services. You can read how our tracing work is structured before you reach out.
Before you contact us, have these ready:
- Transaction hashes and the wallet addresses involved
- Screenshots of account changes, exchange alerts, and suspicious messages
- Your carrier’s ticket or reference numbers, plus any call recordings
- Your IC3 complaint number and any police report number
At intake we ask for the timeline of the loss, the platforms involved, and the documents above, so a complete package speeds up our first assessment. If you are weighing whether paid forensics is worth it, our guide to crypto recovery scam risk and our note that there is no universal recovery success rate will help you decide with clear eyes. When you are ready, contact us here and tell us what happened.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
FAQ
How can you tell if someone SIM swapped you?
The most common sign is your phone suddenly losing service or showing “SOS only” with no explanation. You may also receive carrier alerts about a SIM change, or notices that your accounts were reset; before you share sensitive information, consider using a class action app to verify security settlements. If any of this happens, call your carrier from another phone right away.
How worried should you be about SIM swapping?
Take it seriously if you hold significant crypto or use SMS for two-factor authentication. The FBI describes SIM swapping as exploiting weak mobile carrier authentication, so SMS codes are a risky safeguard. Setting a carrier PIN and using an authenticator app lowers your exposure.
Can someone access your phone through a SIM card?
A SIM swap does not give attackers your phone itself. It reroutes your number to a SIM they control, so calls and text codes reach them. That is enough to reset passwords on accounts that rely on SMS verification.
How do you report a SIM swap?
Report to your carrier first, then file a complaint with the FBI’s IC3 and notify local police. Include your timeline, transaction hashes, and carrier ticket numbers. Cases that arrive with organized documentation are easier for investigators to act on.
Sources
- Ic3
- Office of Public Affairs | Head of the Criminal Division, Matthew R. Galeotti, Delivers Remarks in Cryptocurrency Investment Fraud Forfeiture Announcement | United States Department of Justice
- ICE HSI dismantles ‘SIM farms’ in nationwide cyber fraud crackdown | ICE
