DOJ Moves to Seize $5 Million in BTC
DOJ Moves to Seize $5 Million in Bitcoin Tied to SIM-Swap Attacks — What It Means and What You Should Do!
On September 9, 2025, the U.S. Department of Justice announced a civil forfeiture action seeking more than $5 million in Bitcoin believed to be the proceeds of phone-number hijack attacks, also known as SIM-swaps. In these crimes, attackers take control of a victim’s mobile phone number, defeat weak two-factor protections, and drain exchange or wallet accounts. The complaint describes funds moving through a series of crypto wallets and into an account at an online gambling platform, along with short, rapid deposit/withdraw cycles designed to create noise on the blockchain. None of those tricks erased the trail.
For everyday crypto users, compliance teams, and victim advocates, this case is a timely reminder of three truths:
- Phone-based codes are fragile. If a criminal can reroute your calls and texts, SMS two-factor authentication (2FA) becomes a paper wall.
- Blockchain “noise” is not invisibility. Circular flows and fast exchange hops leave links that investigators can follow.
- Civil forfeiture is a powerful preservation tool. When prosecutors move quickly, they can freeze suspected proceeds before they scatter for good — improving the odds victims eventually see restitution.
Below is a plain-English guide to how SIM-swap thefts work, what’s new in the government’s approach, and exactly how to harden your accounts today.
How SIM-Swap Attacks Work (and Why Crypto Holders Are Prime Targets)
A SIM-swap is social engineering against your mobile carrier. The attacker convinces carrier support to “port” your number to a SIM card they control, or they get call-forwarding and voicemail settings changed behind your back. Once your number is theirs, password resets and SMS 2FA codes fall into their hands. From there, criminals reset logins, register new devices, and push value out in fast bursts.
Common entry points include:
- Impersonation at the carrier: The attacker poses as you, supplying stolen personal details (date of birth, last four of SSN, past addresses, etc.).
- Phishing carrier accounts: If your carrier login or email gets phished, the adversary may change forwarding rules or port-out settings without any phone call.
- Account recovery daisy chains: A compromised email unlocks your exchange; the exchange unlocks another app; one reset triggers the next.
Once inside your financial apps, the attacker:
- Resets passwords and swaps in a new authenticator or device where policies allow.
- Initiates withdrawals to fresh addresses under their control.
- Creates on-chain noise — short hops, tiny back-and-forth “wash” transfers, and deposits to high-throughput services like casinos — attempting to blur origin.
- Converts or cashes out through exchanges, mixers, OTC desks, or gambling payout rails.
The key takeaway: control of a phone number often equals control of SMS-secured accounts. That is why the best defense starts with removing SMS as a second factor anywhere significant value is at risk.
What’s Notable About This Seizure Effort
1) Speed and Specificity
Civil forfeiture lets the government move fast to preserve assets suspected to be crime proceeds. The filing describes specific wallets and transaction patterns. That granularity helps exchanges, compliance teams, and intelligence vendors label flows quickly — and it gives victims a concrete window for evidence collection.
2) Use of “Noisy” Destinations as Anchors
Even when funds are funneled into services with high transaction volume, those services create new points of leverage: KYC files, IP addresses, device fingerprints, and payout routes. In other words, the very exit ramps criminals use become breadcrumb factories.
3) Pattern Recognition at Scale
The complaint highlights circular transfers over a tight time frame. These are classic obfuscation loops: small amounts ricochet between controlled wallets to inflate the graph. They don’t erase provenance; they multiply linkages investigators can traverse.
Harden Your Accounts Today (No New Gadgets Required)
You can raise your defenses in an afternoon. Start with the highest-value accounts (crypto exchanges, self-custody wallets with spending rights, banks, brokerages).
- Retire SMS-based 2FA
Switch to an authenticator app (TOTP) or, better, to a hardware security key wherever supported. Prioritize email, exchanges, and any wallet management portal. If a site offers only SMS, consider whether it’s appropriate for meaningful value. - Lock Down Your Carrier
Call your carrier and set a port-out PIN that is required before any SIM change. Ask the rep to add a note requiring in-store verification for SIM swaps. Log in to your carrier portal today and look for unexpected call-forwarding, voicemail, or line-sharing rules; remove anything you did not set. Enable account alerts for any profile changes. - Segment Your Digital Life
Put value on a “quiet” device: no social apps, no random browsing, no side-loading. Use a separate email address (not posted anywhere public) exclusively for financial accounts and recovery codes. - Reduce the “Reset” Attack Surface
Use unique passphrases per site. Turn off email-based 2FA for sensitive accounts and rely on TOTP or hardware keys instead. Add recovery codes and store them offline. - Kill Phishing With Rituals
Never click a login link you did not request. Build a habit: type the site domain directly, or use a password manager’s saved entry. Treat any urgent request for verification codes as hostile unless you initiated the action. - Tighten Withdrawal Rules
Where possible, enable allow-lists for withdrawal addresses with a mandatory cool-off period on any change. This slows thieves and buys you time to react.
Your First-Hour Response Plan if Your Number Is Hijacked
Time is everything. If you suspect a SIM-swap or see odd carrier behavior (no service, calls go straight to voicemail, unfamiliar forwarding rules), take these steps immediately:
- Reclaim the Number
Call your carrier from another line. Tell them your number has been ported or forwarding has been added without authorization. Ask them to:- Restore your SIM.
- Disable call-forwarding/voicemail changes.
- Add or change the port-out PIN and note the account.
- Provide a log of profile changes from the last 7–14 days.
- Lock Your Email First
Reset your primary email password and 2FA, revoke all sessions, and review app passwords or active devices. Email is the key to everything else. - Secure Financial Accounts
- Rotate passwords and 2FA secrets on exchanges and wallets.
- Revoke any new devices.
- Enable withdrawal allow-lists and pause withdrawals if the platform supports it.
- Preserve Evidence
Take screenshots of: carrier portal settings, suspicious login notifications, strange IP addresses, password-reset emails, two-factor prompts you did not initiate, and on-chain transaction IDs. Save chat logs, phone numbers that called you, and any messages demanding codes or money. - Notify Platforms and Open Support Tickets
Contact exchanges, wallet providers, and banks right away. Provide transaction hashes, addresses, timestamps, and any account identifiers so they can tag flows and coordinate with law enforcement. - File a Report
File an online report with your local police and the appropriate cybercrime reporting portal in your jurisdiction. Include your carrier ticket number, account IDs, timestamps, addresses, and dollar values. Ask the responding agency to note that your phone number was compromised via SIM-swap or unauthorized forwarding. - Get Professional Help
If value moved on-chain, engage investigators immediately. The sooner addresses are identified and tagged, the better the chance exchanges or service providers can intercept or freeze funds.
Guidance for Banks, Fintechs, and Exchanges
If you run risk or compliance, the latest forfeiture push is a blueprint for tightening controls without throttling legitimate users.
Signals to Watch
- Password or 2FA reset + new device registration + high-value outflow in a short window.
- Logins from net-new IP/UA pairs coupled with phone-number change events, call-forwarding, or voicemail resets.
- Bursts of small, rapid withdrawals to previously unseen addresses.
- New deposits to high-throughput services (casinos, gambling wallets, certain OTC rails), followed by immediate withdrawals or short back-and-forth cycles.
Controls to Implement
- Enforce cool-off periods after 2FA resets or device additions before withdrawals are permitted.
- Require out-of-band verification for disabling allow-lists or changing 2FA methods.
- Maintain a rolling “first-seen” label for destination addresses and add friction for high-risk patterns (e.g., first-seen address + device change + recent 2FA reset).
- Share tagged address sets and time windows with peer institutions where lawful and appropriate.
What to Include in Internal Case Notes
- On-chain address clusters, transaction graphs, and any labels for service destinations.
- Timestamps for carrier-related events reported by the customer (loss of service, call-forwarding onset).
- Device fingerprints, IP blocks, geolocation deltas, and browser hashes tied to the unauthorized sessions.
- Any chat, email, or SMS content used by the adversary to social-engineer the victim.
For Parents and Schools: A Quick Word on Youth Risk
SIM-swap-enabled sextortion and “pay or we leak” threats often target teens and young adults. If a minor is involved, prioritize safety first: stop contact with the extortionist, preserve evidence without sharing further, and engage local authorities and appropriate child-protection hotlines. Do not send more funds; do not negotiate. Early reporting to platforms increases the odds of swift intervention.
For Victims: What Realistic Recovery Looks Like
Not every case leads to a seizure, but this is not a hopeless landscape. Realistic outcomes include:
- Interdiction at Exchanges or Services: If addresses are quickly shared and funds hit a compliant platform, freezes can occur.
- Civil Preservation: Even where criminal charges take time, civil actions can preserve value.
- Restitution Post-Conviction or Settlement: Tagged funds can be distributed to victims later, often months down the line.
Your job as a victim (or advocate) is to move fast and document everything: addresses, hashes, timestamps, screenshots, ticket numbers, the works. The better your evidence package, the easier it is for platforms and authorities to act.
Final Thoughts and a Simple Checklist
This case underscores a modern reality: identity is the new perimeter, and your phone number is often the weakest gate in that wall. Criminals exploit urgency, familiarity, and flawed defaults. You don’t need to become a security engineer to be safer; you just need to change a few defaults and build two or three good habits.
One-Page Checklist
- Replace SMS 2FA with an authenticator app or hardware key on all high-value accounts.
- Set a port-out PIN with your carrier; request in-store verification for SIM swaps.
- Use a “quiet” device and a private email for financial accounts only.
- Turn on withdrawal allow-lists and cool-off periods.
- Never click login links you didn’t request; type the domain or use a password manager.
- If your number is hijacked: reclaim it, lock email, secure financial accounts, preserve evidence, notify platforms, file reports, and engage help.
