Cryptocurrency users on the Friend.tech platform have been put on high alert after a recent surge in SIM-swap attacks. These incidents have led to the loss of nearly 109 Ether, equivalent to approximately $178,000, from four users in less than a week.
Cryptocurrency enthusiasts are growing increasingly concerned as reports of SIM-swap attacks on Friend.tech users continue to surface. The modus operandi of these attacks involves malicious actors gaining control of a user’s mobile number, allowing them to intercept two-factor authentication codes, ultimately compromising the victim’s accounts. In a short span, four users have fallen victim to these attacks, resulting in substantial financial losses.
On September 30th, a Twitter user known as “froggie.eth” raised an alarm about his Friend.tech account being compromised through a SIM-swap attack. This unfortunate incident resulted in the theft of over 20 Ether from his account, equivalent to around $32,600 at the time.
Just a few days later, on October 3rd, musician Daren Broxmeyer reported a similar attack on his Friend.tech account. He stated that he had been SIM-swapped and lost 22 Ether, amounting to approximately $36,000. Broxmeyer also revealed that his phone had been bombarded with numerous phone calls, which he suspects was an attempt to prevent him from receiving a warning message from his service provider regarding the unauthorized access to his account.
On the same day, another Friend.tech user going by the username “dipper” came forward with a similar story. They claimed that their account had been compromised and expressed confusion about how the attackers had managed to breach their account, as they had been using strong passwords.
Friend.tech phishing scam
The fourth victim, “digging4doge,” fell prey to a phishing scam that tricked them into sharing a login code. As a result, they lost approximately 60 Ether, equivalent to $98,400 at the time. This incident underscores the diverse tactics employed by cybercriminals to exploit cryptocurrency users.
Friendtech user @digging4doge just got drained to the tune of ~60 eth worth of keys.About an hour ago, he received a text informing him that a number change had been requested for his account.He had two hours to respond or the request would be auto approved. This was, of… pic.twitter.com/L21Hr041kP
— quit (👀,🦄) (@0xQuit) October 4, 2023
Manifold trading’s assessment and warning
Crypto investment firm Manifold Trading weighed in on the situation, warning that any hacker gaining access to a Friend.tech account could potentially “rug” the entire account. They estimated that around $20 million could be at risk if a third of Friend.tech accounts are linked to phone numbers. Manifold emphasized that the security issues plaguing the platform should be a top priority for the company.
If any hacker gains access to a FriendTech account via simswap/email hack, they can rug the whole accountIf you assume 1/3 of FriendTech accounts are connected to phone numbers, that's $20M at risk from sim-swapsFriendTech's current setup also technically allows a rogue dev… https://t.co/XgodMNSh2l
— Manifold (@ManifoldTrading) October 2, 2023
Call for enhanced security measures
In light of these alarming developments, Manifold Trading proposed several security enhancements that could help safeguard Friend.tech users. These include the implementation of two-factor authentication (2FA) for logins, enhanced key encryption protocols, and more secure transaction processes. They also suggested giving users the option to switch from phone number-based logins to email-based logins and allowing the use of third-party wallets.
This recent wave of SIM-swap attacks on Friend.tech users follows a broader trend of cryptocurrency-related hacks and breaches. High-profile figures, such as Ethereum co-founder Vitalik Buterin, have previously fallen victim to SIM-swap attacks, with their compromised accounts subsequently used for phishing attacks.