Why the SEC’s hijacked account was most valuable the day before a decision

The week

On January 9, 2024, the account of the Securities and Exchange Commission, the federal regulator of U.S. securities markets, on X, the social media platform formerly known as Twitter, posted a false message saying the agency had approved spot bitcoin exchange-traded products. These are funds that hold bitcoin itself and trade on a stock exchange like an ordinary share, letting investors gain exposure to bitcoin through a regular brokerage account.

Investors had been waiting weeks for exactly that decision, and traders were watching the SEC’s every word. The price of bitcoin moved sharply.

The expectation had a clear origin. In August 2023 the U.S. Court of Appeals for the D.C. Circuit had found that the SEC had not adequately explained its rejection of Grayscale’s proposal to convert its bitcoin trust into an exchange-traded product, and sent the matter back to the agency. Several large asset managers had applications pending, and the statutory deadline on one of them fell on January 10. Market participants could read that date from public filings as easily as SEC staff could.

The market had already shown how it reacted to false news on the subject. In October 2023 a crypto news outlet posted on X that the SEC had approved a spot bitcoin fund from one of the largest asset managers. The report was wrong, and bitcoin’s price jumped and then fell back once it was corrected.

Within minutes, the SEC chair posted from his own account that the agency’s account had been compromised and that no approval had been granted. X said the account had not had multi-factor authentication enabled at the time. Multi-factor authentication, or MFA, means that logging in requires something beyond a password, such as a code sent to a phone or a physical security key, so a stolen password alone is not enough.

The SEC was not the only prominent account taken over in those days. On January 3, the X account of Mandiant, the Google-owned incident response firm, had been hijacked and used to promote a cryptocurrency scam. Security professionals took note that even a firm whose business is investigating breaches could lose control of its own social account.

The next day, January 10, the SEC did approve the listing and trading of spot bitcoin exchange-traded products. The false post had been, in effect, a day early.

The chair’s statement on the approval was careful about its scope. He said the agency had approved listing and trading of a number of spot bitcoin exchange-traded products, and that the court decision on Grayscale had shaped that outcome. He added that the approval was not an endorsement of bitcoin. Trading in the new products began the following day.

Later in January, the SEC explained how it happened. It said the attacker had taken control of the phone number associated with the account through a SIM swap. A SIM swap is a trick in which a criminal persuades a mobile carrier to move someone’s phone number to a new SIM card the criminal controls, often by impersonating the customer. Once the number moves, any text messages or calls meant for the victim, including password reset codes, go to the attacker instead.

The agency announced its findings on January 22. It said the unauthorized party had obtained control of the phone number associated with the account through the agency’s telecommunications carrier, then used it to reset the account’s password. The SEC’s inspector general, the FBI, CISA, the Commodity Futures Trading Commission, the Justice Department and the SEC’s own enforcement division were involved in the inquiry.

The SEC also said multi-factor authentication had been disabled in July 2023, at the agency’s request, after staff had trouble accessing the account. A protection switched off for convenience months earlier left one of the most market-sensitive accounts in government guarded by a phone number. The timing of the attack, the day before a decision the market was primed to believe, turned an embarrassing breach into a market event.

The SEC said that X support had disabled the protection at its staff’s request, and that multi-factor authentication was now enabled for all of its social media accounts that offered it. Restoring it was quick once it was a priority. The gap had lasted about six months.

Regulators had been working on the attack method too. In November 2023 the Federal Communications Commission had adopted rules requiring wireless carriers to use secure methods of authenticating customers before moving a phone number to a new device or carrier. Those rules were not yet in effect when the SEC’s number was taken.

Agencies use social media because the public is there. Emergency managers post evacuation orders, health departments post outbreak guidance, and financial regulators post decisions that markets trade on within seconds. Each account is an official channel of government running on a platform the agency does not control.

The SEC incident had a feature that makes it more instructive than a typical account takeover: the false post anticipated an actual decision the market was expecting, which made it maximally believable and maximally profitable for anyone positioned to trade on it. The value of an official account to an attacker is not constant. It depends on what the agency is about to say.

The problem has three parts: the account as a privileged credential, the calendar that sets its value, and the audience that must be able to check it. The defenses make sense only once the attack is clear, so the place to start is how accounts like this are taken over.

How official accounts get hijacked

A social media account is, at bottom, a username, a password and a set of ways to prove you are the owner if you forget the password. Those recovery methods are usually an email address and a phone number. An attacker who wants the account does not have to defeat the platform’s security. They only have to find the weakest of those routes.

The common routes are well known. Phishing tricks a staff member into typing the password into a fake login page. Password reuse lets an attacker try a password stolen from some other website. And recovery attacks, like the SIM swap in the SEC case, go after the email or phone number that can reset the password. If the phone number receives the reset code, whoever controls the phone number controls the account.

A useful comparison is a building with a strong front door and a side entrance protected by a receptionist who can be talked into handing over a spare key. A good lock on the front door does little if the side entrance is easy. In the SEC case, the front door lacked its second lock because MFA had been turned off, and the side entrance, the phone number, was opened by persuading a carrier.

Not all MFA is equal. A code sent by text message (SMS) is better than nothing, but it travels to a phone number, and phone numbers can be stolen. Phishing-resistant methods, such as physical security keys or passkeys built on the FIDO standard, prove identity using a cryptographic secret stored on a device the person holds. They cannot be intercepted by moving a phone number, and they will not work on a fake website, which is why security agencies favor them.

Why weak methods stay in use

Phone-based methods persist because they are easy. Nearly everyone has a phone, text-message codes need no extra hardware, and platforms use phone numbers to recover accounts when everything else fails. Platform policies also shift. In March 2023, Twitter, as X was then called, restricted text-message two-factor authentication to paying subscribers, leaving other accounts to move to authenticator apps or security keys or to lose the protection.

Changes like that put pressure on teams that manage accounts with little support. An account set up years earlier by a communications officer may depend on settings nobody has reviewed since. When a platform changes the rules, the account owner has to notice and respond, and many do not.

Routes that bypass MFA entirely

Strong authentication is necessary but does not close every route. Malware that steals browser session tokens can let an attacker use an already authenticated session without seeing a password or a code. Third-party scheduling and analytics tools connected to an account may hold their own access tokens, and a breach at the tool can reach the account. Platform support staff can, as in the SEC case, change security settings on request.

Each of these routes calls for a specific control. Posting should happen from managed devices with current endpoint protection. Connected applications should be reviewed and pruned on a schedule. And any request to a platform’s support team to change an account’s security should go through the same approval as a change to an internal system.

The account as a privileged credential

The immediate failures were basic. Multi-factor authentication had been switched off to fix an access problem, and control of the account came down to a phone number that could be taken over by persuading a carrier. Disabling a control because staff cannot log in is common and understandable. Most organizations have done something similar under deadline pressure. On an account whose posts can move markets, it is a decision that should require security approval, an owner and an expiry date, so that a temporary workaround cannot drift into permanence.

In security language, a privileged credential is a login that can do serious damage if misused: the administrator account on a payroll system, for example, or the keys to a bank’s payment network. Organizations protect those more heavily than ordinary logins. An official account deserves the treatment given to administrator accounts on agency systems.

That starts with phishing-resistant authentication where the platform supports it, and access through the platform’s business or government management tools so staff do not share a password. Shared passwords are a particular weakness: when five people know the password, nobody knows who used it, and changing it when someone leaves is easily forgotten. It also needs an inventory listing every official account, who can post, and how it is secured. Many agencies, asked how many official accounts they have, discover old accounts from past campaigns or regional offices that nobody is watching.

What the inventory should record

A useful inventory goes beyond a list of handles. For each account it records the platform, the purpose, the business owner and the named people who can post. It also records the authentication method, the recovery email and phone number, any connected third-party tools, and the date of the last review. Those fields turn a list into something the security team can test.

Dormant accounts need a decision. Deleting an old account can free its handle for someone else to claim and use for impersonation. Often the safer course is to keep the account, secure it like the others, and post a pinned notice pointing to the active official account. The inventory records which accounts are dormant and who checks them.

What privileged access looks like for a social account

Privileged access management for internal systems has familiar elements, and most translate. Each person has a named login rather than a shared one. Access is granted for a role and reviewed on a schedule. Every login and every security change is logged and visible to the security team. Emergency access, sometimes called break-glass access, exists for when the normal route fails, and its use triggers an alert and a review.

For a social account, those elements map onto platform features and agency processes. The platform’s business or government management tools supply named access. The access list goes into the agency’s periodic access review alongside its other privileged systems. Login alerts go to a shared security mailbox as well as to the communications team. Break-glass credentials, if the platform requires a primary owner login, are held in a sealed vault with two-person retrieval.

Federal policy already sets the standard for agency systems. The Office of Management and Budget’s 2022 zero trust strategy directed agencies to require phishing-resistant multi-factor authentication for their staff. An official account on an outside platform is not an agency system in the same sense. Holding it to the same standard is still a defensible choice, and the gap between the two is hard to explain after an incident.

Exceptions that expire

The July 2023 decision shows why exceptions need structure. A request to switch off MFA because staff cannot log in is a reasonable short-term fix. It becomes dangerous when it has no owner, no compensating control and no end date. A workable exception process records who asked, who approved, why, what extra monitoring applies while the exception lasts, and when it expires. At expiry the control returns automatically unless someone renews the exception with a fresh justification.

Compensating controls matter while an exception runs. If MFA must be off for a week, phone-based recovery can be removed for the same week and login alerts watched more closely. The password can be changed to a long random one held by a single named person. None of those is as good as MFA. Together they make an exception survivable.

The recovery path

It also means mapping the recovery path, because recovery is where controls are bypassed. Which email addresses and phone numbers can reset the account, who controls them, and how are they protected? Recovery email should be agency-managed with strong authentication, not a personal address or one belonging to a former employee. Phone numbers should sit on carrier accounts with port-out protection and PINs. Port-out protection is a setting that stops a number being moved to another carrier or SIM without extra verification. And phone-based recovery should be removed wherever the platform allows a stronger method.

The SEC’s number was the agency’s own, held on its account with its carrier. That makes the carrier relationship part of the security perimeter. Agencies and companies with business wireless accounts can usually restrict who may authorize SIM changes and ports, require an account PIN, and set up alerts for changes. The telecom manager who administers the wireless contract rarely thinks of it as a security role. For numbers tied to privileged accounts, it is one.

Recovery email carries risks of its own. An address on a domain the agency later lets lapse can be registered by someone else, who can then receive reset messages. Mailboxes used for recovery should be on domains the organization intends to keep, protected by phishing-resistant authentication and monitored for reset messages nobody requested.

The calendar that sets its value

Regulators, central banks, statistical agencies and emergency managers often know when their most consequential announcements will come: a statutory deadline on an application, a scheduled data release, a rate decision, a forecast landfall. Attackers can often read the same calendar from public sources. An account takeover timed for the day before an expected decision is worth far more, because a false post will be believed and acted on before anyone checks.

Precedents for timed falsehoods

Markets had seen this pattern before. In April 2013 the Associated Press’s Twitter account was hijacked and used to post a false report of explosions at the White House, and U.S. stock prices dropped briefly before recovering once the report was denied. In October 2023, the false report of a spot bitcoin fund approval showed the same sensitivity in crypto markets. Each case paired a credible source with a moment when the audience was primed to act.

Bitcoin was especially exposed. It trades around the clock on venues without the trading pauses that stock exchanges apply during extreme moves. A false post late on a Tuesday afternoon met a market that was open and liquid, with no mechanism to slow trading while the truth caught up.

The SEC’s account was always sensitive. On January 9, with the market waiting for a decision, it was at its most valuable.

That suggests a heightened posture around known decision points. In the days before a market-moving or safety-critical announcement, the agency can freeze changes to account security settings and access lists. It can confirm that authentication and recovery protections are in place and increase monitoring for login alerts and setting changes. And it can assign a named person to watch the account as the decision approaches. It can pre-draft the correction message and agree who will issue it, through which channels, within how many minutes. It costs little, and it concentrates effort when the account is most valuable to an attacker.

Attackers who wait

A freeze has a limit. An attacker who gains access weeks before a decision can sit dormant and post at the chosen moment, and freezing settings does nothing against access already obtained. The heightened posture should therefore begin with a check of current access: review active sessions and connected applications, sign out every session, and require each authorized person to sign in again with a security key. Recovery details should be confirmed as unchanged. Anything unexpected is treated as an incident before the announcement, not after it.

The posture should be written into the communications plan for each major decision, alongside the press release and briefing schedule, so that it happens because the plan says so rather than because someone remembers. A short checklist signed by the communications director and the CISO, the chief information security officer, the day before is enough. Afterward, a brief review can confirm whether any alerts fired and whether the correction process would have worked.

The same calendar thinking applies to staff. Communications teams often change around major announcements, with temporary access granted to colleagues or contractors. Those grants should expire automatically, and nobody should receive new posting rights in the final days before a sensitive release.

The posture should end deliberately as well. Once the decision is out and the correction window has passed, the freeze lifts, temporary monitoring stands down, and a short note records what was checked and whether anything unusual appeared. That record is what lets the next team repeat the exercise without starting from scratch.

Organizations differ in how predictable their calendar is. A central bank or statistical agency publishes release dates months ahead; the Bureau of Labor Statistics, for example, publishes its schedule for the monthly employment report in advance. A securities regulator’s decision dates may follow from statutory deadlines on filings. An emergency manager’s calendar follows the weather and is known only days ahead. A public health agency’s may follow a vaccine advisory meeting. Each can identify its high-value days, even if some appear at short notice, and the posture can be triggered by a forecast as well as a schedule.

The audience that must be able to check

The SEC corrected the false post quickly through another official account, and the agency’s website never carried it. Prices still moved, because people act on social posts before checking primary sources. Agencies cannot prevent that, but they can shorten the time it takes a careful reader to verify. For an agency whose words move prices, every minute between a false post and a credible correction is a minute in which someone else profits.

Three practices help. Publish consequential decisions on the agency’s own website first or at the same moment. Say in every social post where the authoritative version lives, so that a post without a matching web page looks suspicious. Keep a list of official accounts on the agency’s website, since platform verification badges have changed meaning more than once. A blue check mark is a feature of a private company’s product, and its rules can change; the agency’s own website is under the agency’s control.

For announcements that move markets, coordinate in advance with the exchanges, self-regulatory organizations or partner agencies that will be asked whether a post is genuine. Self-regulatory organizations are industry bodies, such as stock exchanges, that oversee market participants under the SEC’s supervision. They should know where to check and whom to call. The aim is that a trader, a journalist or a compliance officer who sees a surprising post can confirm or dismiss it in moments, by looking in one predictable place.

The correction itself

A correction works when it is fast, specific and everywhere at once. It names the false post, states the facts, and points to the official web page. It goes out through every channel the agency controls: other social accounts, the website, email lists and direct calls to the partners who field questions. Wording drafted in advance saves the minutes that matter.

The readers who act fastest can also build their own checks. Newsrooms, trading desks and compliance teams that monitor regulators can adopt a simple rule: a market-moving post is not acted on until it appears on the agency’s website or is confirmed through a known contact. Agencies can encourage that rule by being consistent. Every time a real decision appears on the website at the same moment as the post, the rule becomes easier to follow and a post without a matching page stands out.

The agency also needs a route to the platform. Large platforms offer support channels for government and enterprise customers, and a named contact reached through one of them can lock or restore an account far faster than a general help form. That contact has to be established before an incident, and recorded where the duty officer can find it at night.

Teaching the audience where to look

Securities law offers a useful parallel. In 2013 the SEC said that public companies could use social media to announce key information, provided investors had been told in advance which channels the company would use. The principle carries over to agencies. An audience that has been told where official statements appear can judge a post against that rule.

The audience differs by agency. A market regulator’s critical readers are traders, journalists and compliance staff who can be reached through exchanges and industry bodies. An emergency manager’s readers are residents, many of whom will see a post secondhand. For them the authoritative channel for the most urgent messages is often the federal alerting system that sends wireless emergency alerts to phones, with social media as a secondary route. A health department’s readers include clinicians, who can be reached through professional channels, and the wider public, who rely on local media.

Banks face the same problem in a different form. A false post from a bank’s account announcing an outage or directing customers to a website is a ready-made phishing campaign. Banks have long told customers they will never ask for passwords by message; the same discipline applies to telling customers which accounts and web addresses are genuine.

Three days before landfall

The lessons reach beyond financial regulators. Take a state emergency management agency during hurricane season. Its account posts evacuation orders that hundreds of thousands of people act on. A forecast landfall is three days away.

Under a well-designed plan, the agency’s communications director pulls out a one-page checklist. Every person with posting rights is confirmed; two contractors whose access was granted for a summer campaign are removed. The CISO’s team confirms that the account uses security keys, that the recovery email is an agency-managed address with its own strong protection, and that the recovery phone number has port-out protection. Settings are frozen until the storm passes. A named duty officer watches login alerts around the clock. Two correction messages are pre-drafted: one for a false evacuation order, one for a false all-clear. The agency confirms with county emergency managers and local broadcasters that the official orders will always appear on the agency’s website at the same moment as the post.

Run the same three days without the plan. The account still has a shared password known to former staff. A false all-clear posted by an attacker could keep people in harm’s way. The damage would be measured not in market prices but in safety and in public trust in the next real warning.

After the storm, the prepared agency holds a short review. It confirms that no unexpected logins occurred, removes any temporary access, restores normal settings and notes what it would change next season. The checklist improves each time it is used, and the next storm starts from a better version.

The contrast is in cost as well as outcome. The prepared agency spent perhaps an afternoon of staff time on the checklist and already owned the security keys. The unprepared one would spend days on correction, investigation and explanation, while residents decided whether to believe its next post.

How official accounts are run in practice

Part of the reason official accounts end up weakly protected is the way they are managed day to day. In most agencies, and in most companies, social media sits with the communications or public affairs team. That team is judged on reach, speed and tone, not on security. It often works to tight deadlines, sometimes late at night, sometimes from personal phones. When a login fails at the moment a statement needs to go out, the instinct is to remove whatever is in the way.

The security team, meanwhile, protects the agency’s own networks and systems. A social media account sits on someone else’s platform, outside the network, and is easy to overlook. It may not appear in the inventory of systems the security team monitors. Its logins may not flow into the same alerting tools. Nobody may have asked who owns the phone number attached to it.

The result is an ownership gap. Communications owns the content; security owns the risk; and the account itself falls between them. Closing the gap does not require a reorganization. It requires a short written agreement: communications decides what is posted and who may post; security sets the authentication and recovery standards and must approve any exception; both sign the checklist before major announcements; and the account appears on the security team’s list of privileged credentials.

Say a regional bank discovers, during an audit, that its main social account is registered to a mobile number that belonged to a marketing manager who left two years earlier. The number has since been reassigned by the carrier to a stranger. Nobody did anything wrong in a dramatic sense; the arrangement simply drifted. Under the ownership agreement described above, the annual review of privileged credentials would have caught it.

How the rules differ by organization

Financial firms have explicit guidance on social media, though most of it concerns content and records rather than account security. The federal banking agencies and the National Credit Union Administration, through their joint examination council, issued social media guidance in 2013 that treated social media as a channel carrying compliance, reputation and operational risk. FINRA has issued guidance to broker-dealers on supervising and retaining social media communications since 2010. Those frameworks give banks, credit unions and broker-dealers an existing place to record who owns each account and how it is protected.

Federal agencies have the OMB authentication mandate and CISA guidance, but small teams and outside platforms make enforcement uneven. State and local agencies often have neither a dedicated security team for communications tools nor central oversight of their accounts. A county with a dozen department accounts may have no single list of them. Health systems add a privacy dimension: an attacker with access to a hospital’s account may also see private messages from patients.

There is also a practical tension to manage honestly. Strong authentication can be inconvenient, especially for a team that shares posting duties across shifts. The answer is not to weaken it but to use the platform’s business or government management tools. These let several named people post under the agency’s account, each with their own login and security key, without anyone sharing a password. When someone leaves, their access is removed without disturbing anyone else.

Cost is modest. Security keys are inexpensive, platform management tools are often free or included in business tiers, and the main effort is a few hours to enroll staff and document the setup. The real expense is attention: someone in security must own the accounts on the list, and someone in communications must accept that convenience gives way on the days that matter.

What a hijacking costs

For a board member, an agency head or a general counsel, a hijacked official account is more than an IT incident. It can move markets, mislead the public, invite investigations and leave lasting damage to an institution’s credibility. The same logic applies to companies: a listed company’s account announcing a false merger or a bank’s account announcing a false outage can do real harm in minutes.

The costs also fall unevenly in time. Securing an account properly takes a few hours of work and a few security keys. Responding to a hijacking takes the attention of the communications director, the CISO, legal counsel and senior leadership for days. The questions that follow, about why a protection was switched off and who approved it, are the kind that boards and oversight bodies ask long after the false post has been deleted. Spending a little before the moments that matter is far cheaper than explaining afterward why nobody did.

The first hour after a hijacking

A short playbook keeps the first hour orderly. Someone confirms the post is false and declares an incident. The correction goes out through the agency’s other channels while a second person contacts the platform to lock the account. Partners who will be asked about the post, such as exchanges or county emergency managers, are called directly.

Once the account is back, every session is signed out, recovery details are checked and replaced, and connected applications are reviewed. Evidence is preserved before anything is deleted: screenshots of the post, login records the platform will provide, and carrier records for any phone number involved. Investigators need those records, and in a market-moving case regulators may want to know who traded in the minutes around the post.

The playbook should name roles rather than people, so that it works on a holiday or at night. It should be tested once a year in a short exercise, ideally timed before a major scheduled decision when the cost of getting it wrong is highest.

The case for accepting more risk

A reasonable objection runs as follows. Social media is a secondary channel. Corrections are fast, and the SEC’s took minutes. Strong authentication sometimes locks teams out when they most need to post, and a regulator unable to post during a crisis has its own problem. On that view, the right investment is fast correction, not heavy protection.

Fast correction is indeed essential, and this article argues for it. It is not sufficient for accounts whose posts move money or behavior in minutes. The bitcoin price moved before the correction landed, and someone positioned in advance could profit in that window. A false evacuation order cannot be fully recalled once people are on the road. The lockout risk is real, and the answer is several named users with their own keys and a tested break-glass route, which removes the single point of failure without removing the protection.

Second-order effects

The controls have side effects worth planning for. Stricter access can push staff to post from personal accounts in a hurry, which creates a new set of unofficial channels. Freezes before major decisions can collide with legitimate staffing changes. Publishing on the website first requires the web team to be on duty at the same moment as communications. Each of these is manageable when it is anticipated in the plan.

The failures are familiar:

• Treating social accounts as a marketing tool, not an official channel. They are often managed outside the security team’s view.
• Turning off protections to fix a login problem and never turning them back on.
• Relying on text-message codes tied to phone numbers that can be stolen.
• Ignoring the recovery path, including old phone numbers and personal email addresses.
• Applying the same security every day, rather than raising it before the moments that matter most.
• Posting decisions on social media before the official website, leaving no authoritative place to check.

Where communications and security have to agree

1. How many official social media accounts do we have, including old or regional ones, and who can post on each?
2. Has any security protection on an official account been switched off, and if so, who approved it and when does that end?
3. Which email addresses and phone numbers can reset each account, who controls them, and do the numbers have port-out protection and PINs with the carrier?
4. Which of our upcoming announcements could move markets or change public behavior, and does the plan for each include an account security checklist?
5. If a false post went out today, who would issue the correction, through which channels, and how many minutes would it take?

Behind those sit three further checks. The first is whether each account uses phishing-resistant authentication rather than text-message codes or passwords alone. The second is whether important decisions go on the agency’s own website first or at the same time, with every post pointing to it. The third is whether exchanges, partner agencies and other key verifiers know how to confirm that a post is genuine.

The answers belong in writing, signed by both the communications lead and the CISO, and reviewed at least once a year and before every decision the agency expects to move markets or behavior.

With hindsight

The SEC said it found no evidence that the attacker had accessed its systems, data or other social media accounts. The damage came entirely from a single post on a platform the agency did not run, which is exactly why the account deserved the protection of a privileged credential.

The agency’s January 22 statement also set out the remediation that followed: multi-factor authentication enabled on all its social media accounts that offered it, and an investigation involving its inspector general, the FBI and other agencies. Restoring the protection took little effort. What the incident exposed was the months in which nobody had restored it.

In October 2024 an Alabama man was arrested and charged with carrying out the SIM swap that gave access to the account; he pleaded guilty in February 2025 and was sentenced in May 2025 to 14 months in prison. The case confirmed how ordinary the technique was: no sophisticated hacking of the SEC, just control of a phone number.

The details reported at sentencing showed how little was needed. Prosecutors said he used an identification card printer to produce a fake ID. With it he impersonated the user of the government phone number linked to the account at an AT&T store in Huntsville, Alabama, and obtained a replacement SIM. He activated it in a new iPhone and passed the account’s password reset code to co-conspirators, one of whom posted the false announcement. He was reported to have been paid $50,000 for the swap, was sentenced in Washington, D.C., and faced three years of supervised release after prison.

The case record also gave a sense of the market effect. According to reports of the prosecution, bitcoin rose by more than $1,000 after the false post and fell by more than $2,000 once the SEC regained control. The swing came from one post on one account, held for minutes.

The attack depended on a carrier store employee accepting a fake document. The FCC’s rules on SIM changes and number ports, adopted two months before the incident, were aimed at exactly that step. Carrier controls help, but they rely on staff in thousands of stores. Removing phone-based recovery from privileged accounts takes that dependency out of the chain.

Takeovers of government and corporate social media accounts continued, many used to promote cryptocurrency scams, and platform verification features for government accounts kept changing. That second point reinforces the advice to keep a list of official accounts on the agency’s own website. A badge controlled by a platform cannot be the foundation of public trust in an agency’s voice.

Federal guidance continued to steer organizations away from SMS-based authentication. CISA’s mobile communications guidance, for example, says not to use SMS as a second factor and to enroll accounts, including social media, in phishing-resistant FIDO authentication. CISA, the Cybersecurity and Infrastructure Security Agency, is the federal government’s lead civilian cybersecurity agency, so its guidance is a reasonable benchmark.

The case for treating recovery as part of the attack surface also held up. The attacker never needed the account’s password, a platform vulnerability or access to SEC systems. A phone number, a fake ID and a carrier counter were enough, which is why removing phone-based recovery from privileged accounts remains the most direct fix.

The spot bitcoin products launched the day after approval and drew substantial investor money in the months that followed. Decisions about crypto products stayed market-moving, and so did the official accounts that announced them. The incident did not change the agency’s mission; it changed how carefully its voice needed guarding.

The calendar point holds for any agency whose announcements are anticipated: the days before a scheduled decision are when an official account is worth most to someone who wants to impersonate it. Agencies should treat official accounts the way they treat the keys to their most sensitive systems. They should raise their guard on the days when a false word would do most harm, and make sure that anyone who doubts a post knows exactly where to look for the truth.