Why the SEC’s hijacked account was most valuable the day before a decision
The false bitcoin ETF post from the SEC’s X account came one day before the actual approval, when markets were primed to believe it. Agencies whose announcements move markets or behavior should secure official accounts as privileged credentials, by the calendar, and for the audience.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On January 9, 2024, the Securities and Exchange Commission’s account on X posted a false message saying the agency had approved spot bitcoin exchange-traded products. Markets were waiting for exactly that decision, and the price of bitcoin moved sharply. Within minutes, the SEC chair posted from his own account that the agency’s account had been compromised and that no approval had been granted. X said the account had not had multi-factor authentication enabled at the time. The next day, January 10, the SEC did approve the listing and trading of spot bitcoin exchange-traded products. Later in January, the SEC said the attacker had taken control of the phone number associated with the account through a SIM swap. It also said multi-factor authentication had been disabled in July 2023, at the agency’s request, after staff had trouble accessing the account.
Agencies use social media because the public is there. Emergency managers post evacuation orders, health departments post outbreak guidance, and financial regulators post decisions that markets trade on within seconds. Each account is an official channel of government running on a platform the agency does not control. The SEC incident had a feature that makes it more instructive than a typical account takeover: the false post anticipated an actual decision the market was expecting, which made it maximally believable and maximally profitable for anyone positioned to trade on it. The value of an official account to an attacker is not constant. It depends on what the agency is about to say. We look at the problem in three parts that together cover it: the account as a privileged credential, the calendar that sets its value, and the audience that must be able to check it.
The account as a privileged credential
The immediate failures were basic. Multi-factor authentication had been switched off to fix an access problem, and control of the account came down to a phone number that could be taken over by persuading a carrier. Disabling a control because staff cannot log in is common and understandable. On an account whose posts can move markets, it is a decision that should require security approval, an owner and an expiry date.
An official account deserves the treatment given to administrator accounts on agency systems. That starts with phishing-resistant authentication where the platform supports it, and access through the platform’s business or government management tools so staff do not share a password. It also needs an inventory listing every official account, who can post, and how it is secured. It also means mapping the recovery path, because recovery is where controls are bypassed. Which email addresses and phone numbers can reset the account, who controls them, and how are they protected? Recovery email should be agency-managed with strong authentication. Phone numbers should sit on carrier accounts with port-out protection and PINs, and phone-based recovery should be removed wherever the platform allows a stronger method.
The calendar that sets its value
Regulators, central banks, statistical agencies and emergency managers often know when their most consequential announcements will come: a statutory deadline on an application, a scheduled data release, a rate decision, a forecast landfall. Attackers can often read the same calendar from public sources. An account takeover timed for the day before an expected decision is worth far more, because a false post will be believed and acted on before anyone checks.
That suggests a heightened posture around known decision points. In the days before a market-moving or safety-critical announcement, the agency can freeze changes to account security settings and access lists. It can confirm that authentication and recovery protections are in place and increase monitoring for login alerts and setting changes. And it can assign a named person to watch the account as the decision approaches. It can pre-draft the correction message and agree who will issue it, through which channels, within how many minutes. None of this is expensive. It concentrates effort when the account is most valuable to an attacker.
The posture should be written into the communications plan for each major decision, alongside the press release and briefing schedule, so that it happens because the plan says so rather than because someone remembers. A short checklist signed by the communications director and the CISO the day before is enough. Afterward, a brief review can confirm whether any alerts fired and whether the correction process would have worked.
The same calendar thinking applies to staff. Communications teams often change around major announcements, with temporary access granted to colleagues or contractors. Those grants should expire automatically, and nobody should receive new posting rights in the final days before a sensitive release.
The audience that must be able to check
The SEC corrected the false post quickly through another official account, and the agency’s website never carried it. Prices still moved, because people act on social posts before checking primary sources. Agencies cannot prevent that, but they can shorten the time it takes a careful reader to verify. For an agency whose words move prices, every minute between a false post and a credible correction is a minute in which someone else profits.
Three practices help. Publish consequential decisions on the agency’s own website first or at the same moment. Say in every social post where the authoritative version lives, so that a post without a matching web page looks suspicious. Keep a list of official accounts on the agency’s website, since platform verification badges have changed meaning more than once. For announcements that move markets, coordinate in advance with the exchanges, self-regulatory organizations or partner agencies that will be asked whether a post is genuine. They should know where to check and whom to call.
With hindsight
The SEC said it found no evidence that the attacker had accessed its systems, data or other social media accounts. In October 2024 the Justice Department announced the arrest of a man charged with carrying out the SIM swap that gave access to the account, and he pleaded guilty and was sentenced in 2025. Members of Congress pressed the agency over the lapse in multi-factor authentication. Takeovers of government and corporate social media accounts continued, many used to promote cryptocurrency scams, and platform verification features for government accounts kept changing. Federal guidance continued to steer agencies away from SMS-based authentication toward phishing-resistant methods. The calendar point holds for any agency whose announcements are anticipated: the days before a scheduled decision are when an official account is worth most to someone who wants to impersonate it.