SEC Hack Happened Because Of Problems With Multi-Factor Authentication

Key Points:

• SEC hack identified by SIM swap, posting false Bitcoin ETF approval.
• Bitcoin prices surged and fell; an investigation revealed no MFA since July 2023.

The Securities and Exchange Commission (SEC) provided an update on a recent hacking incident that occurred earlier this month, impacting its X account and causing disruption in the cryptocurrency industry.

SEC Hack by SIM Swap Attack

The SEC revealed that an “unauthorized party” executed a SIM swap attack, gaining control of an SEC cell phone number associated with the account. This allowed the attacker to display a false post on Jan. 9, claiming the approval of spot Bitcoin exchange-traded funds (ETFs).

The fraudulent announcement led to a surge in Bitcoin prices, reaching almost $48,000, before plummeting below $46,000 when the SEC clarified that the ETF approval had not been granted.

Investigations determined that the SEC hack was facilitated by a SIM swap, wherein the perpetrator illicitly transferred the victim’s phone number to another device, enabling them to intercept messages and calls. Notably, the SEC lacked two-factor authentication (MFA), a crucial security feature that had been disabled since July 2023.

Elon Musk, owner of X and a vocal SEC critic, responded to the SEC hack with mockery, while X denied any involvement in a system breach. The SEC, however, confirmed no evidence of compromise in other systems, data, or devices beyond the telecom carrier.

Following the incident, the SEC has reactivated MFA for all its social media accounts, highlighting the importance of robust security measures in protecting sensitive information for influential government agencies. The SEC hack prompted a comprehensive investigation involving multiple law enforcement and federal agencies to address the incident and enhance digital security awareness.