What happens to your crypto if you lose your phone?

Phones get lost and stolen every day. In London alone, there were 81,439 phone thefts and robberies in 2024, more than 200 a day, and 71,867 in 2025, according to the Mayor of London’s office.

Your bitcoin and your dollars aren’t on the phone, though. They sit on public networks, and the phone holds, or can reach, the key that moves them. So a lost phone raises two questions: can you get that key back, and could whoever has the phone use it? The answers depend on where the key lived, and on what you set up before the phone was gone.

What to do in the first hour

• Lock the phone from somewhere else. For an iPhone, open Find My on another device or at icloud.com/find and turn on Lost Mode, which locks it with its passcode. For an Android phone, go to Google’s Find Hub, at android.com/find, and mark it as lost, which locks it too.
• Secure the accounts that can reset the others. From another device, change the password of your email and of your Apple or Google account, and remove the lost phone from them. A thief with the phone and its passcode can change them first.
• Call your mobile carrier. Have the SIM card blocked and get a new one with your number, so the codes sent to it reach you and no one else.
• Erase the phone once you’ve given up on it. Erasing can’t be undone, and it removes the wallet app and everything in it from that phone. A key backed up somewhere else isn’t affected. On an iPhone, don’t remove the phone from Find My afterwards: that also turns off Activation Lock, which stops anyone else from setting it up as theirs.
• If the recovery words were on the phone, in a photo, a note or a screenshot, assume someone has them. Restore the wallet on another device and move the money to a new wallet, with new words, as soon as you can.

How you get back in depends on where the key was

On an exchange

The company holds the keys; your phone only held a way to log in. (The guide on custodial and self-custody explains the difference.) Install the app on a new phone and sign in.

The usual trap is the second step of the login. Until April 2023, Google Authenticator kept its codes on a single device, and Google itself spelled out the result: lose the device, and you lose the ability to sign in to every service set up with it. Since then it can back them up to your Google account. If your codes lived only on the lost phone, you need the backup codes you saved when you turned the second step on. Without them, it’s up to the company. Kraken, for example, lets you skip the step with a backup code or a master key, but only one you set up before the phone was gone; otherwise you write to its support team, and an agent gets back to you by email to remove it.

In a wallet with a seed phrase

The key was on the phone, and the words you wrote down, the seed phrase, can rebuild it. Install a compatible wallet on the new phone and enter them: the balance appears again, because it never left the network. If you never wrote the words down and the phone is gone, so is the money, and no company can bring it back.

In a wallet backed up to your Apple or Google account

Some wallets keep their key with the phone’s account, often as a passkey. Apple’s iCloud Keychain and Google Password Manager sync passkeys across the devices signed in to your account, end-to-end encrypted, so that neither Apple nor Google can read them. Sign in to the same account on the new phone and the wallet can find its key again.

The password alone won’t bring the key back. If every Apple device you had is gone, Apple asks for your Apple Account, a code sent by text to your phone number and the passcode of a device you used before, and it allows ten tries: after the tenth wrong one, its copy of your keychain is destroyed. On Android, you’ll be asked for your Password Manager PIN or the screen lock of a phone you used before. So get your number back first, and keep your old passcode in mind.

That moves the risk to the account. Losing the phone is fine; losing the account is not. Set up the account’s own recovery before you need it, because some of it takes time to start working:

• Apple Account. A recovery contact is someone you trust who can get you a code to reset your password, without any access to your account. A recovery key is a 28-character code that replaces Apple’s usual recovery: if you lose it, Apple says it can’t give it back, and you may be locked out for good.
• Google Account. A recovery phone number and email, and since October 2025, recovery contacts who can confirm it’s you. A new recovery phone number can take up to seven days to work, and a recovery contact can’t be used until seven days after accepting.

In a multisig wallet

The lost phone held one key out of several. The others can still move the money, so the usual step is to move it to a new wallet, with a new key in place of the lost one. In collaborative custody, where a company holds one of the keys, the company’s key and your backup do it. Do it soon: until then, one more lost key could be one too many.

On a hardware wallet

The key was never on the phone, which only served as a screen for the device. Install the app on another phone and connect the device. If the device was lost with the phone, you’re back to its words.

Could a thief use it?

A locked phone with a strong passcode is hard to get into, and wallet apps usually ask for Face ID, a fingerprint or their own PIN before moving anything. The risks are mostly outside the lock: a phone taken unlocked, or with a passcode someone watched you type; a phone number moved to someone else’s SIM card; and recovery words kept on the phone.

The phone and its passcode

With the phone and its passcode, a thief can do what you can, including change the password of the account everything else trusts.

In September 2022, prosecutors in Minneapolis charged 12 men who mostly targeted people leaving bars. Sometimes they were friendly and asked to borrow the phone; sometimes they were violent. Either way, according to prosecutors, they made sure the owner unlocked it. Investigators said they then moved cash and crypto to themselves through payment and crypto apps, and the losses of more than 40 victims topped 300,000 dollars. All 12 pleaded guilty, and the man described as their leader was sentenced to eight years.

In February 2023, the Wall Street Journal reported on thieves who watched owners type their passcode before taking the phone, and locked them out of their Apple account within minutes. In April 2023, CNN reported a further step: a new recovery key set on the owner’s account, which left the owner no way back in.

In January 2024, with iOS 17.3, Apple added Stolen Device Protection. When it’s on and the iPhone is away from familiar places such as home or work, using saved passwords and passkeys, erasing the phone or moving its eSIM needs Face ID or Touch ID, with no passcode fallback. Changing your Apple Account password or your passcode, or adding a recovery key or a recovery contact, also means waiting an hour and scanning again, and Find My can’t be turned off. On Android, Theft Detection Lock locks the screen when it senses the phone being snatched, Offline Device Lock locks it when it goes offline, and Remote Lock locks it from android.com/lock with your phone number. All of them have to be turned on before the phone is gone.

Your number on someone else’s SIM card

A thief doesn’t need your phone to get your number. In a SIM swap, someone talks your carrier into moving your number to a SIM card they hold, and from then on your calls and texts, login codes included, go to them. The FBI received 1,611 complaints about SIM swaps in 2021, with more than 68 million dollars lost. By 2025 they were down to 971, with 17.4 million dollars lost; 121 of them involved crypto.

One swap can cost far more. In 2018, a group moved a crypto investor’s number to a SIM card they controlled, used it to get into his accounts and took more than 20 million dollars in crypto. One of them, a man from Florida, pleaded guilty to conspiracy to commit wire fraud. In December 2022, a federal judge in New York sentenced him to 18 months and ordered him to repay more than 20 million dollars within 60 days. In July 2025, finding that he hadn’t paid, the judge resentenced him to 12 years.

In November 2023, the US Federal Communications Commission adopted rules requiring carriers to confirm, by secure methods, that it’s really the customer before moving a number to a new SIM, to tell the customer at once, and to offer a free lock against such moves. In July 2024, after industry groups asked for more time, it suspended the deadline for carriers to comply until a later notice. Wherever you live, the protection that doesn’t depend on your carrier is to keep text messages out of anything that holds money.

Recovery words kept on the phone

Recovery words stored on the phone can be stolen without the phone. In February 2025, Kaspersky found apps in Google Play and in Apple’s App Store that searched the phone’s photos for pictures of recovery phrases and sent them to the attackers. The ones on Google Play had been downloaded more than 242,000 times, and according to Kaspersky, it was the first time an app built to steal data had been found in Apple’s store.

Side by side

Where the key was	To get back in	What a thief needs
On an exchange	Your password and your second step, or its backup codes	The same, or the email and the number that reset them
In a wallet with a seed phrase	The words	The words, or the phone unlocked and the wallet’s PIN
In your Apple or Google account	The account, and the passcode of a phone you used before	The phone and its passcode, to take over the account
On a hardware wallet	The device and its PIN	The device and its PIN, or the words
In a multisig wallet	Your other keys	More keys than the phone holds

What to do before it happens

Set things up so that no single phone, account or phone number is a single point of failure: losing one should never lose the money.

• Keep only spending money on the phone. A wallet on your phone is for what you’d carry in cash. Keep its recovery words on paper, never in a photo, a note or an email, or, if it’s backed up to your Apple or Google account, guard that account as you would the money. Then restore it once on another device, with a small amount, to check that it works.
• Keep savings where one lost key can’t lose them, in collaborative custody that passes the test in the guide on hardware wallets, multisig and collaborative custody. Then a lost phone costs you one key, not your savings.
• Turn on your phone’s theft protection today. Stolen Device Protection on an iPhone; Theft Detection Lock, Offline Device Lock and Remote Lock on Android. In public, unlock with your face or your finger, not your passcode.
• Take your phone number out of the chain. For anything that holds money, use an authenticator app that backs up its codes, a passkey or a security key instead of text messages, and keep the backup codes on paper. Ask your carrier for a PIN or a lock on moving your number.
• Set up your account’s recovery while you still can. Add recovery contacts to your Apple or Google account. If you turn on Apple’s recovery key, keep it on paper, in two places.
• Write down where every key and every backup is, without the secrets themselves, so someone you trust could follow it if you can’t. The guide on inheritance goes through that case.