In a recent revelation, Ethereum co-founder Vitalik Buterin confirmed that the hack of his X (Twitter) account, which occurred on September 9th, was the result of a SIM-swap attack. Buterin made this announcement on the decentralized social media network Farcaster on September 12th, shedding light on the security vulnerability that allowed scammers to take control of his X (Twitter) account and orchestrate a fake NFT giveaway, causing victims to collectively lose over $691,000.
Buterin explained that the hack was made possible when the attacker socially engineered T-Mobile, gaining control of his phone number. He emphasized the critical role a phone number can play in compromising online accounts, even when not used for two-factor authentication (2FA). This incident served as a wake-up call for Buterin, who admitted he had underestimated the insecurity of phone numbers in online security.
Reacting to the incident, Ethereum developer Tim Beiko strongly recommended the removal of phone numbers from Twitter accounts and the activation of 2FA. Beiko suggested that defaulting to 2FA for accounts with a substantial following, such as those with over 10,000 followers, should be considered as an added layer of security.
The SIM-swap attack technique utilized in this incident involves hackers taking control of a victim’s mobile phone number, enabling them to exploit 2FA to gain access to social media, bank, and cryptocurrency accounts. Unfortunately, this is not the first time T-Mobile has been implicated in such attacks. In 2020, the telecom giant faced legal action for allegedly facilitating the theft of $8.7 million in cryptocurrency through a series of SIM-swap attacks. Subsequently, in February 2021, T-Mobile was once again sued when a customer lost $450,000 in Bitcoin due to another SIM-swap attack.
The Buterin incident underscores the urgency of addressing the vulnerability of phone numbers in online security, especially for high-profile individuals and accounts. The cryptocurrency community and social media platforms are now reevaluating their security measures to prevent similar attacks in the future. As the digital landscape evolves, it becomes increasingly important to stay vigilant against these types of cyber threats and implement robust security protocols.
