In a swift succession of events, four individuals using the Friend(dot)tech platform found themselves victims of compromised accounts, which subsequently led to the theft of nearly 109 Ether, valued at approximately $178,000, in less than a week. These incidents have raised concerns among Friend(dot)tech users regarding potential SIM-swap attacks, a malicious tactic where hackers gain control of a user’s mobile number to intercept two-factor authentication (2FA) codes, enabling unauthorized access to accounts.
The first incident occurred on September 30 when a Twitter user, going by the handle “froggie.eth,” alerted the community that their Friend(dot)tech account had fallen victim to a SIM-swap attack. This led to the unauthorized withdrawal of more than 20 ETH from their account.
Subsequently, on October 3, several other Friend(dot)tech users reported similar breaches. Musician Daren Broxmeyer revealed that he had been SIM-swapped and lost 22 ETH. He suspected that his phone had been inundated with spam calls as part of a strategy to distract him from receiving a critical text from his service provider, warning of the unauthorized access attempts on his account.
On the same day, another user known as “dipper” also reported a compromised account. They expressed bewilderment as to how hackers gained access since they employed strong passwords.
The fourth victim, “digging4doge,” suffered a loss of approximately 60 ETH after falling prey to a phishing scam that duped them into divulging a login code.
Manifold Trading, a cryptocurrency investment firm, highlighted the severe consequences of a hacker gaining access to a Friend(dot)tech account. They explained that such an intrusion enables the attacker to “rug the whole account,” potentially compromising significant sums of money.
The Manifold estimated that if one-third of Friend(dot)tech accounts are linked to phone numbers, as much as $20 million could be at risk of exploitation through Friend(dot)tech-focused exploits. Moreover, they expressed concern about the platform’s overall security setup, emphasizing that addressing these vulnerabilities should be the top priority.
To enhance security, Manifold recommended that Friend(dot)tech implement two-factor authentication (2FA) for logins, key decryptions, and transactions. Additionally, they suggested offering users the option to switch from phone number-based logins to email-based logins and enabling the use of third-party wallets.
Notably, high-profile figures in the cryptocurrency industry have previously fallen victim to SIM-swap attacks, with attackers using compromised accounts for phishing attacks. This includes incidents such as the compromise of Ethereum co-founder Vitalik Buterin’s X account in September.
