Friend.Tech Users Targeted by SIM Swap Attack, Several Ether Drained

Users tie Friend.Tech accounts to real-world X profiles and phone numbers - which increases security risks.

AccessTimeIconOct 3, 2023 at 11:41 a.m. UTC
Updated Oct 5, 2023 at 6:31 a.m. UTC

Some Friend.Tech users reported that they were the victim of SIM swap attacks over the weekend with the attackers successfully draining thousands of dollars worth of tokens.

The Friend.Tech code itself was not exploited. No users are at immediate risk. The application lets holders buy "shares" of people who hold an account on X which grants buyers certain privileges.

SIM Swap attacks are a common occurrence and happen when criminals take over control of a mobile phone by tricking service providers to connect that phone number to a SIM card in the hacker’s possession. Swapped phones can then be used for fraudulent activity.

At least two users claimed that were targeted in a SIM swap attack which allowed exploiters to drain over 42 ether (ETH), worth nearly $70,000 at current prices, over separate attacks.

“If your Twitter account is doxxed to your real name, your phone number can be found, and this could happen to you,” posted @darengb, a user who got impacted. Their phone carrier is Verizon.

Social application Friend.Tech has become one of the most popular crypto platforms this year, despite the bear market, generating steady revenues and profits for its creators. The application amassed over 100,000 users in under two weeks after going live, as previously reported.

However, security risks remain a large cause of concern for any crypto platform. Hackers may employ techniques from smart contract manipulation or flash loan attacks, to using a traditional method to exploit wealthy users.

Some Friend.Tech users have suggested added security features, such as 2FA, a common SMS or code-based authentication service, that may prevent a repeat of such attacks in the future.

"The SIM swap attack on FriendTech users is a great reminder of the importance of strong security measures, especially for accounts containing valuable digital assets," said Eran Karpen, Co-Founder and CTO at Unplugged, in a message to CoinDesk. "SMS, a technology developed in the 1980s, is relatively simple and vulnerable to attack. In the FriendTech case, the cell carriers were the attack vectors and were tricked into redirecting your phone number to a SIM card they controlled. Two-factor authentication (2FA) with an authenticator app, rather than SMS, authenticates on the device, not the cell carrier, and can mitigate the attack."

"An alternative solution will be to use a secondary "secret" SIM for 2FA via a phone that supports dual SIM or e-SIM. That way, you refrain from using your main SIM attached to your publicly known phone number," Karpen added.

Edited by Parikshit Mishra.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Read more about