By using a simple email verification trick, it is possible to check if someone has an account on a crypto exchange without knowing their password. However, even if a thief has a valid email and password to a crypto account, there are still security measures in place to protect against unauthorized access.
Security flaw in Coinbase allowed anyone to check the balance of any valid password and username for a month. Sim swap hackers are known to use this flaw to identify how much is in an account before stealing the phone number.
A hacker can use geolocation techniques and people searches to find a phone number and carrier, as well as the corresponding username, password, and account balance for a potential hack.