Control of $175,000 on KuCoin restored in 20 hours
The SIM was reassigned overnight. An unusual sign-in prompted the exchange to restrict the account. While withdrawals remained disabled, access for the legitimate owner was restored before the attacker found a workaround.
An anonymized case. A similar situation does not mean the same timeline or outcome.
What happened to the client
According to the clientDuring the night, the mobile operator sent an SMS stating that the SIM had been reassigned to another device. The client immediately opened KuCoin and found that the account had already been restricted. It held about $175,000.
The attacker controlled the phone channel. The client contacted us within about 30 minutes after the notification, while withdrawals on the exchange were still disabled.
What was documented
Documented factPlatform and amount
A KuCoin account; about $175,000 was at risk.
Automatic restriction after an unusual sign-in
The exchange restricted the account after a sign-in attempt from a new device and an unusual pattern. While the restriction remained in place, withdrawals were unavailable to both the attacker and the owner.
Compromised SMS channel
The attacker controlled the SIM: calls and SMS messages, including 2FA codes, were delivered to another device.
Ownership evidence
The package included sign-in and IP history, transaction history, identity and KYC materials, and confirmation from the mobile operator that the SIM had been blocked.
Steps toward resolution
Our analysis- 01
Urgent intake and fact preservation
We recorded the time of the attack, the amount, the account status, and the mobile operator without making speculative sign-in attempts.
- 02
In parallel: SIM block and exchange emergency channel
We helped the client block the SIM with the mobile operator while preparing a submission to KuCoin's emergency security channel instead of standard support.
- 03
Ownership evidence package
We submitted facts that an attacker holding the reassigned SIM could not readily reproduce: sign-in history, transactions, identity documents, and confirmation that the number had been blocked.
- 04
Prompt responses to security requests
Additional verification requests were addressed within minutes rather than hours while the automatic restriction was still protecting the account.
- 05
Restored control and changed the security setup
After access was restored, the password was reset, SMS-based 2FA was replaced with a hardware key, the funds were moved to a cold wallet, and other accounts linked to the same number were checked.
How the case ended
Control of the account was restored to the legitimate owner. No unauthorized withdrawal took place. The period from the initial request to restored access was about 20 hours.
Control restored; no unauthorized withdrawal took place.
Factors that influenced the outcome
Our analysis- The client contacted us within about 30 minutes, while the automatic restriction was still preventing withdrawals.
- The exchange's unusual-sign-in controls provided time by immediately disabling withdrawals.
- The emergency security channel was used instead of a standard support ticket.
- The evidence package relied on facts that an attacker controlling the SIM could not readily reproduce.
Important limitations
- This outcome does not promise the same result or timeline in another case.
- The exchange's decision, response time, and the completeness of the ownership evidence all matter.
- The client and personal data are not disclosed.