Short answer

"Cracked" overstates it. SMS 2FA isn't broken cryptographically — the 6-digit code itself remains secret to the user receiving it. The attack is on the SIM card: SIM-swap attacks convince the mobile carrier to transfer your phone number to a SIM the attacker controls, after which the SMS codes go to them. According to an FBI IC3 public service announcement from February 2022, IC3 received 1,611 SIM-swapping complaints in 2021, with adjusted losses of more than $68 million; many victims never file a report, so the real figure is higher.

How SIM-swap works

The attacker collects PII about you — name, address, last 4 of SSN, recent payment amounts — from a data breach or social engineering. They call the carrier (T-Mobile, AT&T, Verizon), claim a lost phone, request a SIM swap to a new card. With enough PII, the carrier accepts.

Within minutes, your phone loses signal. The attacker's SIM now receives all SMS and voice calls intended for your number. They go to your bank, exchange, email service — request password reset via SMS — receive the code on their SIM, take over the account.

Why this is a crypto problem specifically

Crypto exchanges that use SMS 2FA are vulnerable in a way banks aren't because:

  1. The withdrawal address can be a new, attacker-controlled wallet — funds gone immediately
  2. The transactions are irreversible — no chargeback, no fraud reversal
  3. More can be taken in a single attack — one exchange account may hold a person's entire crypto balance

Banks reverse fraudulent transactions; crypto exchanges return funds only at their discretion (rare).

The defenses, ranked

1. Drop SMS 2FA entirely. Replace with TOTP (Google Authenticator, Authy), Passkey, or hardware security key (YubiKey). This eliminates the entire attack vector. Every major US exchange supports at least TOTP.

2. Carrier-side port-out protection. T-Mobile NOPort, AT&T Number Lock, Verizon Number Lock — all available, all underused. They add a passcode or PIN required before any SIM swap. Far fewer swaps would succeed if these were universally enabled.

3. Separate phone for crypto. A secondary phone number, used only for crypto exchange accounts, with no public association to you. Google Voice works but Coinbase doesn't accept VoIP numbers; use a second cellular line from US Mobile, Visible, or similar.

What's actually happening on US carriers in 2026

Leaked personal data — name, address, the last digits of an SSN — is exactly what an attacker needs to talk a carrier rep into a swap, and carrier breaches keep putting that data into circulation. The carriers say they've improved port-out verification, but the swap process itself is still the weak point.

Bottom line: don't trust the carrier to protect your phone number. Use 2FA methods that don't rely on the phone number at all.

Further reading: SIM Swap, 2FA, The 2FA truth.