Ethereum co-founder Vitalik Buterin has recently attributed the security breach on his Twitter account to a SIM-swap attack.

Coinlive previously reported on how Vitalik's X account was hacked and used to promote phishing links.

What is a SIM Swap Attack?

A SIM swap attack, also known as sim jacking, is a technique hackers use to gain control of a victim's mobile phone number.

Once they have control of the phone number, these malicious actors can exploit two-factor authentication (2FA) to access social media, financial, and crypto accounts unlawfully.

Buterin shared the details of the attack while speaking on the decentralised social media platform Farcaster on September 12.

Explaining the SIM swap, Buterin detailed how the attacker manipulated T-Mobile, a major mobile service provider, to take over his phone number.

Buterin only managed to regain control of his T-Mobile account after the hacker had already exploited his Twitter account.

The Ethereum founder stated his preference for the new platform Farcaster:

Anyway, glad to be on farcaster, where my account recovery can be controlled by a good wholesome ethereum address :)

Hackers Managed to Steal $691,000 in Cryptocurrencies

The breach of Buterin's X account occurred on September 9.

Scammers gained access and posted a malicious phishing link.

Clicking this link and signing the signature provided them access to individuals' wallets, resulting in significant financial losses for them.

Blockchain analyst ZachXBT, after investigating the incident, revealed that a sum of $691,000 had been drained from victims' wallets following the security breach.

Approximately 73% of this amount consisted of non-fungible tokens (NFTs).

Not the First SIM-Swap Attack Involving T-Mobile

While this incident has exposed the vulnerabilities associated with phone numbers in the authentication process, it has also highlighted the broader issue of mobile service providers' susceptibility to SIM swap attacks.

While conceptually a reliable form of security, SIM verification heavily depends on a centralised security framework.

The chink in its armour is that access to account data was reliant on the provider itself; making them an easy target to be hacked and manipulated.