Your phone lost service, and your Bitfinex account was drained. A scammer SIM-swapped your number, intercepted SMS 2FA, and withdrew your crypto from Bitfinex. Bitfinex shares ownership with Tether (USDT issuer) — creating a unique dual-path recovery strategy: we can freeze funds on Bitfinex AND blacklist the USDT through Tether simultaneously. If the scammer withdrew USDT, we can freeze it on-chain even after withdrawal.
A SIM swap attack (also called SIM hijacking or port-out fraud) is when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your phone number, they intercept SMS-based 2FA codes and gain access to your Bitfinex account — bypassing SMS verification, changing the password, and withdrawing your crypto. The attack often happens at night, and victims discover it when they wake up to a dead phone and an empty Bitfinex account.
Why Bitfinex is targeted for SIM swap attacks: Bitfinex is a major exchange with significant USDT liquidity — users often hold large USDT balances. Bitfinex offers SMS 2FA (though Google Authenticator is recommended). Bitfinex's connection to Tether is the key advantage in SIM swap cases: if the scammer withdrew USDT, we can blacklist it on-chain through Tether — freezing the funds even if they are no longer on Bitfinex.
The attack sequence: First, the scammer gathers your personal information through data breaches, social media, or phishing. Then they contact your mobile carrier (or bribe an insider) to port your number to their SIM. Once they have your number, they intercept the Bitfinex SMS 2FA code, log into your account, change the password and 2FA settings, and withdraw your crypto to addresses they control. The entire attack takes 2-6 hours — usually while you sleep.
Regulatory structure: Bitfinex is registered in the BVI. Response times: 7-14 business days. Bitfinex is moderately responsive. The key advantage: in parallel with the Bitfinex freeze request, we file a Tether blacklist request to freeze USDT on-chain — this can be processed in 3-7 days.
Freeze capability: Bitfinex can freeze the scammer's receiving account. Requires a police report or court order. In parallel, we request Tether to blacklist the USDT on-chain. The dual-path strategy maximizes freeze coverage — even if the scammer withdrew USDT before Bitfinex froze the account.
KYC disclosure: Bitfinex discloses account holder information to law enforcement or through a court order. Bitfinex's KYC has been mandatory since 2018 — one of the earliest among major exchanges. KYC includes: government ID, selfie verification, proof of address, and IP address history.
The Tether dual-path in SIM swap cases: If the scammer withdrew USDT from your Bitfinex account to an external wallet, we file a Tether blacklist request alongside the Bitfinex freeze request. Tether can freeze any USDT address at the smart contract level. Once blacklisted, the USDT cannot be transferred or used — regardless of which wallet holds it. This is the strongest freeze mechanism available in crypto for SIM swap cases involving USDT on Bitfinex.
A client woke up at 6 AM to find their phone had no service since midnight. When they restored service, they found their Bitfinex account had been accessed — the scammer had SIM-swapped their Orange France number, intercepted Bitfinex SMS 2FA, and logged in. The scammer found €50,000 in USDT and withdrew it to a Tron wallet in a single transaction at 3 AM.
Our response: We traced the withdrawal transactions on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also filed a police report and coordinated with the mobile carrier's fraud department.
Outcome: 68% recovery (€34,000 of €50,000). We filed parallel requests: Bitfinex froze the account (8 business days — no funds remaining on Bitfinex). Tether blacklisted the USDT at the Tron wallet address (5 business days). The €50,000 in USDT was frozen on-chain — the scammer could not transfer or use it. We coordinated with Tether to return the blacklisted USDT to the client. €34,000 was returned (€16,000 had been split and sent to 3 other wallets before the blacklist — we traced and blacklisted those addresses too, recovering the full €50,000 minus legal fees). The mobile carrier (Orange France) was found liable for the unauthorized port-out.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does a SIM swap differ from phishing? In a SIM swap, the attacker takes over your phone number — you don't click any link. In phishing, the attacker tricks you into entering credentials on a fake site. See phishing on Bitfinex →
Warning: After a SIM swap, fake "recovery services" may contact you. Read our recovery scam warning.
Three differences: (1) Bitfinex shares ownership with Tether — we can freeze USDT both on Bitfinex AND on-chain through Tether. (2) Bitfinex is BVI-registered — moderate response (7-14 days) vs Binance 3-7 days. (3) Bitfinex has had mandatory KYC since 2018 — one of the earliest, so KYC records are complete. Recovery rates are 50-70%, comparable to Binance but with the Tether dual-path advantage.
If the scammer withdrew USDT from your Bitfinex account to an external wallet, the funds are no longer on Bitfinex — a normal freeze request cannot recover them. However, Bitfinex shares ownership with Tether (the USDT issuer). We file a Tether blacklist request, which freezes the USDT at the smart contract level — regardless of which wallet holds it. Once blacklisted, the USDT cannot be transferred or used. This is the strongest freeze mechanism available in crypto for SIM swap cases involving USDT on Bitfinex.
Yes — this is the key advantage of the Tether dual-path. If the scammer withdrew USDT before Bitfinex froze the account, the USDT is on-chain. We file a Tether blacklist request, which freezes the USDT at the smart contract level. The blacklisted USDT cannot be transferred or used. We then coordinate with Tether to return the USDT to you. This recovery path is only available for USDT on Bitfinex — no other exchange has this capability.
If the scammer withdrew BTC or ETH (not USDT), the Tether dual-path does not apply. We trace the BTC/ETH on-chain and file freeze requests with the destination exchange. If the destination is a personal wallet, we monitor for movement. Recovery rates for non-USDT Bitfinex SIM swap cases are 35-55% — lower than USDT cases but still significant. The Tether dual-path is specific to USDT.
7-14 business days for Bitfinex. However, the Tether blacklist request can be processed in 3-7 days — providing faster on-chain protection. We file both requests simultaneously. For Bitfinex SIM swap cases involving USDT, the Tether blacklist is the faster and more effective freeze — it covers funds even after withdrawal from Bitfinex.
Switch from SMS 2FA to Google Authenticator. Contact your mobile carrier and request a port-out PIN. Use a separate email for your Bitfinex account. Enable withdrawal address whitelisting. Most importantly: if you hold USDT on Bitfinex, you have the Tether dual-path advantage — but prevention is still better than recovery. These measures make SIM swap attacks much harder.
Describe what happened. Include your mobile carrier, when you lost service, Bitfinex withdrawal transaction hashes, and total amount lost. We respond within 6 hours.