Friend.Tech Users Targeted by SIM Swap Attack, Several Ether Drained

Some Friend.Tech users reported that they were the victim of SIM swap attacks over the weekend with the attackers successfully draining thousands of dollars worth of tokens.

The Friend.Tech code itself was not exploited. No users are at immediate risk. The application lets holders buy "shares" of people who hold an account on X which grants buyers certain privileges.

SIM Swap attacks are a common occurrence and happen when criminals take over control of a mobile phone by tricking service providers to connect that phone number to a SIM card in the hacker’s possession. Swapped phones can then be used for fraudulent activity.

At least two users claimed that were targeted in a SIM swap attack which allowed exploiters to drain over 42 ether ETH$2,961.90, worth nearly $70,000 at current prices, over separate attacks.

“If your Twitter account is doxxed to your real name, your phone number can be found, and this could happen to you,” posted @darengb, a user who got impacted. Their phone carrier is Verizon.

Social application Friend.Tech has become one of the most popular crypto platforms this year, despite the bear market, generating steady revenues and profits for its creators. The application amassed over 100,000 users in under two weeks after going live, as previously reported.

However, security risks remain a large cause of concern for any crypto platform. Hackers may employ techniques from smart contract manipulation or flash loan attacks, to using a traditional method to exploit wealthy users.

Some Friend.Tech users have suggested added security features, such as 2FA, a common SMS or code-based authentication service, that may prevent a repeat of such attacks in the future.

"The SIM swap attack on FriendTech users is a great reminder of the importance of strong security measures, especially for accounts containing valuable digital assets," said Eran Karpen, Co-Founder and CTO at Unplugged, in a message to CoinDesk. "SMS, a technology developed in the 1980s, is relatively simple and vulnerable to attack. In the FriendTech case, the cell carriers were the attack vectors and were tricked into redirecting your phone number to a SIM card they controlled. Two-factor authentication (2FA) with an authenticator app, rather than SMS, authenticates on the device, not the cell carrier, and can mitigate the attack."

"An alternative solution will be to use a secondary "secret" SIM for 2FA via a phone that supports dual SIM or e-SIM. That way, you refrain from using your main SIM attached to your publicly known phone number," Karpen added.