A highly anticipated decision by the U.S. Securities and Exchange Commission on whether to approve a spot-Bitcoin exchange-traded fund quickly morphed into a major cybersecurity incident on Tuesday.
The SEC's X account was compromised and a fake post claiming that the agency had green lit plans for the products fueled a brief surge in the price of the world's biggest cryptocurrency.
It also has sparked an investigation by U.S. authorities into how a social media account at Wall Street's main regulator was compromised.
"It really shows the breadth and frequency of cyberattacks," said Kurt Gottschall, a partner at law firm Haynes Boone and former SEC regional director. "The irony here is that the SEC has not shown much sympathy to public companies and asset managers that have experienced cybersecurity incidents."
The breach gave fodder to crypto faithful who have long viewed the commission's chair, Gary Gensler, as an enemy due to his zeal to rein in the industry.
The irony of a cybersecurity incident befalling a regulator that's repeatedly warned of crypto's online vulnerabilities was not lost on critics who have spent years waiting for the SEC to approve a Bitcoin ETF.
Traders have been speculating for weeks that the agency could approve several of the products as soon as Wednesday.
Investigation
In statements late Tuesday, the regulator said that it would work with law enforcement to investigate the incident, the unauthorized access had been terminated, and that the post wasn't made by the SEC or its staff.
In a separate statement, Gensler clarified that no decision on ETFs had been made.
"The @SECGov twitter account was compromised, and an unauthorized tweet was posted. The SEC has not approved the listing and trading of spot bitcoin exchange-traded products." — Gary Gensler (@GaryGensler) January 9, 2024
The SEC said that there was unapproved activity on the @SECGov X account "by an unknown party for a brief period of time shortly after 4 pm ET" on Tuesday.
After the fake post was removed, Joe Benarroch, head of business operations at X, said in a statement that the "account is secure and we are investigating the root cause."
The social media service said in a post that "an unidentified individual" compromised the SEC's account by acquiring control of an associated phone number. It added that the account didn't have two-factor authentication enabled at the time of the incident.
Such authentication adds an extra layer of security that's become increasingly common as cyberattacks proliferate.
