Some Friend.Tech users reported that they were the victim of SIM swap attacks over the weekend with the attackers successfully draining thousands of dollars worth of tokens.
The Friend.Tech code itself was not exploited. No users are at immediate risk. The application lets holders buy "shares" of people who hold an account on X which grants buyers certain privileges.
SIM Swap attacks are a common occurrence and happen when criminals take over control of a mobile phone by tricking service providers to connect that phone number to a SIM card in the hacker’s possession. Swapped phones can then be used for fraudulent activity.
At least two users claimed that were targeted in a SIM swap attack which allowed exploiters to drain over 42 ether (ETH), worth nearly $70,000 at current prices, over separate attacks.
“If your Twitter account is doxxed to your real name, your phone number can be found, and this could happen to you,” posted @darengb, a user who got impacted. Their phone carrier is Verizon.
However, security risks remain a large cause of concern for any crypto platform. Hackers may employ techniques from smart contract manipulation or flash loan attacks, to using a traditional method to exploit wealthy users.
Some Friend.Tech users have suggested added security features, such as 2FA, a common SMS or code-based authentication service, that may prevent a repeat of such attacks in the future.
"The SIM swap attack on FriendTech users is a great reminder of the importance of strong security measures, especially for accounts containing valuable digital assets," said Eran Karpen, Co-Founder and CTO at Unplugged, in a message to CoinDesk. "SMS, a technology developed in the 1980s, is relatively simple and vulnerable to attack. In the FriendTech case, the cell carriers were the attack vectors and were tricked into redirecting your phone number to a SIM card they controlled. Two-factor authentication (2FA) with an authenticator app, rather than SMS, authenticates on the device, not the cell carrier, and can mitigate the attack."
"An alternative solution will be to use a secondary "secret" SIM for 2FA via a phone that supports dual SIM or e-SIM. That way, you refrain from using your main SIM attached to your publicly known phone number," Karpen added.
CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk offers all employees above a certain salary threshold, including journalists, stock options in the Bullish group as part of their compensation.