(Photo Illustration by Jonathan Raa/NurPhoto via Getty Images)
UPDATE 1/10: In a late Tuesday post, X says the hack was carried out via a SIM-swapping attack.
Original Story:A hacker caused some financial turmoil on Tuesday after hijacking the Twitter account belonging to the Securities and Exchange Commission (SEC), the US federal financial regulator.
The hacker exploited access to @SECGov to pump up the value of Bitcoin by tweeting that the agency had cleared the listing of Bitcoin ETFs (Exchange-Traded funds) for all national securities exchanges. The tweet looked legit, and triggered Bitcoin’s value to soar from around $46,000 to nearly $48,000.
Minutes later, SEC Chair Gary Gensler used his own Twitter account to say the SEC account "was compromised," adding that the "SEC has not approved the listing and trading of spot bitcoin exchange-traded products.”
It looks like the SEC has also regained access to its Twitter account, and repeated Gensler’s alert about the hijacking. The hacker’s original tweet was also deleted. The news sent Bitcoin’s value down to around $45,000.
In a statement, the SEC would only say that the hacking incident is under investigation. But it's still unclear how the hijacking occurred and if the SEC’s own email systems were compromised.
"The SEC has determined that there was unauthorized access to and activity on the @SECGov x.com account by an unknown party for a brief period of time shortly after 4 pm ET. That unauthorized access has been terminated," the regulator said. "The SEC will work with law enforcement and our partners across government to investigate the matter and determine appropriate next steps relating to both the unauthorized access and any related misconduct."
In the meantime, the incident echoes a stunt back in 2020 when the Twitter accounts of several celebrities, including Elon Musk, Kim Kardashian, and Barack Obama were all taken over to promote a Bitcoin scam.
Investigators later traced the hack to three individuals, including a 17-year-old from Florida, who sold access to coveted Twitter accounts. To pull off the hijacking, the culprits used social engineering techniques to dupe Twitter employees into giving up access to internal admin tools.