The SEC said that a SIM swap was used to take control of its X account in a hack that led to an early post announcing bitcoin ETFs that Chair Gary Gensler clarified was unauthorized earlier this month. File Photo by Evelyn Hockstein/UPI |
License Photo
Jan. 23 (UPI) -- The U.S. Securities and Exchange Commission said the hack that led its X account to prematurely post about the approval of bitcoin ETFs earlier this month was the result of a "SIM swap."
The SEC said Monday it determined that hackers gained access to the cellphone associated with the account by transferring the phone number to another device without their authorization, which allowed them to receive calls and texts associated with the number and then changed the password to the SEC's X account.
"Among other things, law enforcement is currently investigating how the unauthorized party got the carrier to change the SIM for the account and how the party knew the phone number was associated with the account," the SEC said.
The SEC said the phone was breached through the telecom carrier and the investigation did not turn up any evidence that the SIM swap allowed the unauthorized person to get access to any SEC systems, data, devices or other social media accounts, the commission said.
Following the incident, X said the hack was not a result of a breach of its systems and noted that the account lacked multi-factor authentication protection, which requires a second form of identity authentication, usually a code provided through a text message.
On Monday, the SEC said the account's multi-factor authentication was disabled by X support in July after a request by SEC staff who experienced difficulty logging into the account and it was not enabled again until after the account was recovered from the Jan. 9 hack.
"MFA currently is enabled for all SEC social media accounts that offer it," the SEC said.
The SEC added it is still working on the case with its Division of Enforcement and Office of Inspector General as well as the FBI, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, the Commodity Futures Trading Commission, the Department of Justice.
The hack allowed a third party to post an unauthorized message on SEC's social media account saying that it approved the listing and trading of spot bitcoin exchange-trading fund, of ETFs, and was removed about an hour later.
The post caused bitcoin prices to spike to $48,000 before falling back to $45,958 after SEC Chair Gary Gensler clarified the post was unauthorized.
The SEC ultimately did approve the bitcoin ETFs, the following day, allowing 11 investment companies to offer "spot bitcoin" ETFs. The actual approval came a day after the X hacking incident.
