§ 01The brief
The client woke up with no phone signal. By the time he got a new SIM from his carrier, his exchange account had been logged into, the email changed, and $680,000 in Bitcoin and ETH withdrawn.
§ 02What I did
- 1.
Got the carrier's port-out records and the exchange's login history to show exactly when the takeover happened.
- 2.
Traced the withdrawals to a second exchange within six hops.
- 3.
Filed the CCS report and sent the second exchange a freeze request through law enforcement the same week.
§ 03The outcome
The second exchange froze $455,000 before it could be withdrawn. Those funds were returned to the client four months later.