incident · 1704758400000

SEC X Account Takeover

The official X (formerly Twitter) account of the U.S. Securities and Exchange Commission (SEC) was compromised to post a fake announcement approving Bitcoin ETFs, causing temporary market manipulation.

What happened

An unauthorized individual gained control of the SEC's official @SECGov X account and posted a false message stating that the SEC had approved the listing and trading of spot Bitcoin exchange-traded products (ETPs).

Technical mechanism

The takeover was achieved through a SIM swapping attack. The attacker gained control of the phone number associated with the account and used it to reset the password. The SEC had previously disabled multi-factor authentication (MFA) on the account.

Why it matters

The incident demonstrated the severe financial market impact that can result from the compromise of a single official social media account, highlighting the necessity of strong authentication for high-profile government communications.

Impact

The false announcement caused the price of Bitcoin to spike briefly before falling when the SEC quickly clarified that the account was compromised and no such approval had been granted. It undermined trust in official communications.

Response

The SEC quickly regained control of the account, deleted the unauthorized post, and issued a correction. They engaged law enforcement, including the FBI and the SEC's Office of the Inspector General, to investigate the incident.

Defensive lessons

  • Mandate Multi-Factor Authentication (MFA), preferably using hardware security keys or authenticator apps rather than SMS, for all official social media accounts.
  • Implement strict controls and monitoring for SIM swapping risks.
  • Establish rapid response protocols for communicating account compromises to the public.

Evidence register

  1. U.S. Securities and Exchange Commission — SECGov X Account (verified)