On Monday, the Securities and Exchange Commission (SEC) disclosed that multi-factor authentication (MFA) on its X account was disabled leading up to a false post earlier this month, just before the formal approval of spot Bitcoin ETFs.

The incident occurred on Tuesday, January 9, 2024, when the SEC’s @SECGov X account was compromised, and unauthorized posts regarding the approval of spot Bitcoin exchange-traded funds emerged.

SIM Swap Attack

According to a statement released by an SEC spokesperson on January 22, It was revealed that the unauthorized party gained control of the agency cell phone number associated with the account through a “SIM swap” attack.

This technique allows transferring a person’s phone number to another device without authorization. While the SEC has confirmed that the access to the phone number occurred via the telecom carrier and not its systems, the method and motivation behind the attack are still under investigation.

We can confirm that the account @SECGov was compromised and we have completed a preliminary investigation. Based on our investigation, the compromise was not due to any breach of X’s systems, but rather due to an unidentified individual obtaining control over a phone number…

— Safety (@Safety) January 10, 2024

Notably, multi-factor authentication had been disabled on the @SECGov X account in July 2023 at the staff’s request due to issues accessing the account. It remained disabled until staff reenabled it after the account was compromised. Currently, MFA is enabled for all SEC social media accounts that offer it.

This allowed the unauthorized party to post on the compromised account, falsely announcing the Commission’s approval of spot Bitcoin exchange-traded funds and liking two posts by non-SEC accounts.

SEC Reassures Public Amid Cybersecurity Breach

In its statement, the SEC has