Vitalik Says X Account Hacked Via SIM-Swap

Ethereum co-founder Vitalik Buterin has regained access to his T-Mobile account after confirming that the phishing scam on Saturday was a result of SIM swap attack, Buterin said via Farcaster on 12 September.

In hi thread on the decentralized social media network, Buterin said that “someone socially-engineered T-mobile itself” to take over his mobile number, which was later used to gain access to his X (formerly Twitter) account. This method of attack is called a SIM-swap, or sim-jacking attack, and it allows a hacker to gain control over a victim’s mobile phone number, which is later used tp access their social media, bank, and other accounts.

The Etherem co-founder noted that the lesson he learned was that a phone number was sufficient enough for malicious actors to reset his X account, even when its not used for two-factor authentication (2FA). While he did not remember when he “added the number”, Buterin believes it was required by X when he was signing up for Twitter Blue.

Buterin’s X account was compromised by a scammer on 9 September, and used to promote a fake commemorative NFT giveaway that included a malicious link. Once users clicked on the link, they were transported to a malicious website designed to siphon funds from their wallets by interacting with the popular Drainer software. Close to $700,000 in user crypto assets were lost using this phishing scam.

This is not the first time T-Mobile was involved in this type of an attack, with the telecoms giant becoming a target of a lawsuit for enabling the theft of $8.7 million worth of crypto in 2020. The company was sued once again in 2021, when a customer lost $450,000 in Bitcoin in another SIM-swap attack.