SEC Chair Addresses Lawmakers Regarding Misleading Tweet About Bitcoin ETF

SEC Chair Responds to Lawmakers and Addresses Sim Swap Attack

Gary Gensler, Chair of the Securities and Exchange Commission (SEC), has issued a response to lawmakers in the House of Representatives regarding an unauthorized tweet about the spot Bitcoin ETF. In his letter, Gensler confirms that a hacker gained access to the SEC’s official Twitter account using a SIM swap attack. This attack allowed the hacker to falsely post that the SEC had approved spot Bitcoin ETFs, causing a spike in the crypto markets.

Details of the Attack

Gensler explains that the hacker made two separate posts and “liked” two other posts before the SEC regained control of the account. The SEC’s staff believes that the unauthorized access was terminated by 5:30 pm, and law enforcement is currently investigating how the hacker was able to change the SIM card and determine the associated phone number.

Multi-Factor Authentication Enabled

Since the incident, the SEC has implemented multi-factor authentication on all its social media accounts. Gensler himself confirmed the compromise from his official account and clarified that the SEC had not approved the listing and trading of spot Bitcoin exchange-traded products.

Ongoing Investigation and Cybersecurity Measures

The SEC is collaborating with various law enforcement agencies, including the Office of Inspector General, the FBI, and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, to investigate the attack. Gensler emphasizes that the SEC takes cybersecurity seriously and is in contact with the Justice Department. At present, there is no evidence that the unauthorized party accessed SEC systems, data, devices, or other social media accounts.

Two-Factor Authentication Oversight

Following the attack, the SEC approved the spot Bitcoin ETFs, but it was later discovered that two-factor authentication had not been enabled for the SEC’s Twitter account. The lack of this security measure contributed to the breach. The SEC’s security team confirmed this finding, and the SEC acknowledged the oversight in a statement.