I work in fraud prevention. While it's not yet a typical attack, it is does happen regularly. Usually the attack is done against an individual who is known to

I work in fraud prevention. While it's not yet a typical attack, it is does happen regularly. Usually the attack is done against an individual who is known to have significant crypto assets and is using Gmail. By default if you enable 2fa on your Gmail account, sms based 2fa is activated as backup. The attacker social engineers the phone provider to port the victims number, then resets the victims Gmail account, uses Android device manager to wipe their devices, and using the details found in Gmail they proceed to gain access to other accounts owned by the victim. The main goal being to social engineer access to services where they store crypto or to find unencrypted wallet backups in the cloud.