The X account of the Securities and Exchange Commission was compromised by hackers on Tuesday, the regulator has confirmed.
After breaking into the account, the hackers falsely wrote on the SEC’s official account that the regulator had approved spot Bitcoin ETFs, which are exchange-traded funds that let investors dabble in Bitcoin without actually buying any cryptocurrency. The approval—or potential rejection—of these ETFs has been the main focus of the crypto industry for months, spurring a price rally that pushed the value of one Bitcoin over $40,000.
Videos by VICE
“Today the SEC grants approval for #Bitcoin ETFs for listing on all registered national securities exchanges,” the hackers wrote. “The approved Bitcoin ETFs will be subject to ongoing surveillance and compliance measures to ensure continued investor protection.”
In reality, no approval had been given. The immediate elation followed by the realization that the tweet was fake caused a slight wobble in the price of Bitcoin, leading to about $90 million in liquidations, the cryptocurrency news outlet CoinDesk reported.
To quell any confusion, SEC Chair Gary Gensler confirmed that the SEC’s account was hacked in a subsequent X post on Tuesday afternoon. “The @SECGov twitter account was compromised, and an unauthorized tweet was posted,” he posted. “The SEC has not approved the listing and trading of spot bitcoin exchange-traded products.”
X’s Safety account posted its own explanation for the high-profile hack on Tuesday night, and laid the blame squarely on the SEC, which it said had not implemented two-factor authentication, a basic security feature. The account was broken into after hackers obtained the phone number associated with the account from a third party, the X Safety account said.
“We can confirm that the account @SECGov was compromised and we have completed a preliminary investigation,” the X Safety account tweeted. “Based on our investigation, the compromise was not due to any breach of X’s systems, but rather due to an unidentified individual obtaining control over a phone number associated with the @SECGov account through a third party. We can also confirm that the account did not have two-factor authentication enabled at the time the account was compromised. We encourage all users to enable this extra layer of security.”
X allows for SMS-based password recovery using a mobile phone number associated with an account. Using SMS-based two-factor authentication may not have helped in a situation where the hacker gained control of the associated phone number, but using an authenticator app or security key may well have. Motherboard reached out to the SEC for comment and received an emailed statement that did not address questions around the agency’s security practices.
“The SEC continues to investigate the matter and is coordinating with appropriate law enforcement entities, including the SEC’s Office of the Inspector General and the FBI,” the SEC spokesperson wrote.
The SEC hack marks the second time that fake news around ETFs has caused investors pain. In October, a popular crypto news outlet posted a tweet saying that an ETF had been approved by regulators. In a period of about 20 minutes, before it was widely recognized as fake news, a price spike caused about $84 million in liquidations.
Regulators are anticipated to make a decision on Bitcoin spot ETFs this week.
Update: This article was updated with comment from an SEC spokesperson.
